IT HELP (CCNA,CCNP,MCSE,LINUX,VMWARE,CLOUD MGN)

PIX: Dynamic Site-to-Site IPSEC Configuration

2014-05-23T19:00:00.003+05:30

PIX: Dynamic Site-to-Site IPSEC Configuration

SCENARIO:

Configure a tunnel between 10.2.2.0/24 to 10.1.1.0/24, between one static and one dynamic VPN peers.

This is a typical scenario when one device has a dynamic "outside" IP address (such as DHCP).

Notes:
The configuration can be expanded to include remote access VPN on either peer;
The configuration can be expanded to include more than one dynamic peer;
In case of multiple VPN devices, there should always be at least one static peer.

TOPOLOGY:

10.2.2.0 --- STATIC ==== (( INTERNET )) ===== DYNAMIC ---- 10.1.1.0

STATIC.inside = 10.2.2.1/24
STATIC.outside = 203.1.1.1/24
DYNAMIC.outside = DHCP
DYNAMIC.inside = 10.1.1.1/24

CONFIGURATIONS:
- several possible simple configurations, depending on the PIX OS running on either device.

PHASE 1 / ISAKMP PARAMETERS:
- authentication = pre-shared key (MY_ISAKMP_KEY)
- encryption = 3DES
- hash = MD5
- group = 2

PHASE 2 / IPSEC PARAMETERS:
- ESP-3DES, ESP-MD5

STATIC PIX 6.X:

access-list NONAT permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity address
isakmp nat-traversal

isakmp key MY_ISAKMP_KEY address 0.0.0.0 netmask 0.0.0.0 no-xauth

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-DES-MD5
crypto map MY_STATIC_MAP 20 ipsec-isakmp dynamic DYN_MAP

crypto map MY_STATIC_MAP interface outside
isakmp enable outside

STATIC PIX 7.0/7.1:

access-list NONAT extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity address
isakmp nat-traversal

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map MY_STATIC_MAP 20 ipsec-isakmp dynamic DYN_MAP

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map MY_STATIC_MAP interface outside
isakmp enable outside

STATIC PIX 7.2:

access-list NONAT extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-vpn

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map MY_STATIC_MAP 20 ipsec-isakmp dynamic DYN_MAP

crypto isakmp nat-traversal
crypto isakmp identity address

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map MY_STATIC_MAP interface outside
crypto isakmp enable outside

DYNAMIC PIX 6.X:

access-list NONAT permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list VPN permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity hostname
isakmp nat-traversal

isakmp key MY_ISAKMP_KEY address 203.1.1.1 netmask 255.255.255.255

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 1000

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map DYNAMIC_MAP 10 ipsec-isakmp
crypto map DYNAMIC_MAP 10 match address VPN
crypto map DYNAMIC_MAP 10 set peer 203.1.1.1
crypto map DYNAMIC_MAP 10 set transform-set ESP-3DES-MD5

crypto map DYNAMIC_MAP interface outside
isakmp enable outside

DYNAMIC PIX 7.0/7.1:

access-list NONAT permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list VPN permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity hostname
isakmp nat-traversal

isakmp key MY_ISAKMP_KEY address 203.1.1.1 netmask 255.255.255.255

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 1000

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map DYNAMIC_MAP 10 ipsec-isakmp dynamic DYN_MAP
crypto map DYNAMIC_MAP 10 match address VPN
crypto map DYNAMIC_MAP 10 set peer 203.1.1.1

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map DYNAMIC_MAP interface outside
isakmp enable outside

DYNAMIC PIX 7.2:

access-list NONAT permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list VPN permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

crypto isakmp identity hostname
crypto isakmp nat-traversal

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map DYNAMIC_MAP 10 ipsec-isakmp dynamic DYN_MAP
crypto map DYNAMIC_MAP 10 match address VPN
crypto map DYNAMIC_MAP 10 set peer 203.1.1.1

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map DYNAMIC_MAP interface outside
isakmp enable outside

REFERENCE

PIX 6: http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a0080094680.shtml
PIX 7: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

Wednesday, March 12, 2008

IPSEC Checklist and Best Practices

Basic Checklist for VPN Configuration:
- IP address of the static VPN peers

- IP addresses/networks that will be tunneled
--> networks behind each VPN peer (site-to-site)
--> network behind VPN and pool (remote access)

- PHASE I / ISAKMP parameters
--> authentication (pre-shared key/certificate)
--> encryption (DES, 3DES, AES)
--> hash (SHA, MD5)
--> group (2, 5)

- PHASE II / IPSEC Parameters
--> transform set

- VPN Group (remote access only)
--> VPN Group Name
--> VPN Group Password

VLAN

2014-05-23T18:58:00.002+05:30

PIX 6.X - Configuring Logical / VLAN interfaces

Scenario:
The inside/ethernet1 interface of the PIX will be mapped to two VLANs, VLAN1 with IP address 192.168.1.2/24 and VLAN2 with IP address 192.168.2.2. The outside interface has IP address 10.199.248.225/24

Topology:

[Thanks to former colleague Dan for the image.]

PIX 6 Configuration:

interface ethernet1 auto
nameif ethernet1 inside security100
address inside 192.168.1.2 255.255.255.0

interface ethernet1 vlan2 logical
nameif vlan2 inside2 security50
address vlan2 192.168.2.2 255.255.255.0

Notes:
Your Physical Interface is (by default), your VLAN1.

PIX 7 Configuration:

interface Ethernet1
nameif inside
security-level 100
ip address 192.168.1.2 255.255.255.0
no shut

interface Ethernet1.2
vlan 2
nameif inside2
security-level 50
ip address 192.168.2.2 255.255.255.0
no shut

VTP

2014-05-23T18:57:00.004+05:30

Trunking vs Etherchannel

Your Ad Here

Noticed several colleagues of mine are still confused with "trunking" and "etherchannel". These two -- some would argue grammatically similar -- have very different functions and implications.

Trunking refers to (multiple) VLANs that are going through an interface. That is, for example, if you say that "a Cat6500 with GigabitEthernet1/1 trunks VLANs 1, 50, and 100", it means that these VLANs (and only these VLANs) are permitted to go through Gi1/1. The implication is that this forms a basic security feature, by permitting only specific VLANs; other traffic belonging to other VLANs will be permitted on this trunk interface.

Etherchannel -- aka channel-group, port-channel, or port group -- on the otherhand, refers to multiple (physical) interfaces bundled together into a single (logical) interface. That is, for example, if you say that "Cat6500 Port-channel100 includes GigabitEthernet2/1-4", these means that Gi2/1 to Gi2/4 are configured together as a single logical interface. The implication is that the bandwidth of these interfaces are combined and shared -- hence, in this example, Port-channel has a total bandwidth of 4Gbps (1Gbps per interface x 4 interfaces ).

So to state the basic difference between the two:

Trunking "bundles" VLANs together that are permitted on any single interface.
Etherchannel "bundles" (physical) interfaces together into a single logical interface.

Question: Can you combine an interface to have both trunking and etherchannel?

Answer: This is question is a little vague. In a way, yes. Here's a typical scenario actually being used in many companies:

Topology:
DeviceA. GigabitEthernet1/1 <=====> DeviceB.GigabitEthernet1/1
DeviceA. GigabitEthernet1/2 <=====> DeviceB.GigabitEthernet1/2

Requirement:Permit only VLANs 100 and 200 through the link between DeviceA and DeviceB. Also, increase the link bandwidth between these two devices to 2Gbps. To summarize:

DeviceA.GigabitEthernet1/1 - trunking for vlans 100 and 200, share bandwidth with Gi1/2;
DeviceA.GigabitEthernet1/2 - trunking for vlans 100 and 200, share bandwidth with Gi1/1;

DeviceB.GigabitEthernet1/1 - trunking for vlans 100 and 200, share bandwidth with Gi1/2; DeviceB.GigabitEthernet1/2 - trunking for vlans 100 and 200, share bandwidth with Gi1/1;

To achieve this, we arbitrarily assign a channel group number IDs. For this example, we select 300 for DeviceA, so we have Port-Channel300 which will group Gi1/1 and Gi1/2. The basic configuration for DeviceA, then, would look like the following:

interface GigabitEthernet1/1
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200
channel-group 300 mode desirable
!
interface GigabitEthernet1/2
switchport switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200
channel-group 300 mode desirable
!
interface Port-Channel300
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200
!

The device on the remote end, DeviceB, should be configured similarly as well.

Similarly, we select Port-Channel500 for DeviceB.

interface GigabitEthernet1/1
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200
channel-group 500 mode desirable
!
interface GigabitEthernet1/2
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200
channel-group 500 mode desirable
!
interface Port-Channel500
switchport
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 100,200
!

With that, you're done!

Here are some points you should take note of:

Important Note #1: The channel-group ID only has local significance. In this example, DeviceA assigns Port-channel300 while DeviceB uses Port-channel500.

Important Note #2: The VLANs trunked on the port-channel interface and the member interfaces should match. If there is a mismatch, the status of the interfaces will be down.

Important Note #3: The actual syntax would vary, depending on the IOS image currently being used. Here's a general hint: IOS 12.0 uses the "port group" interface command, while IOS 12.1 onwards uses the "channel-group" interface command.

MPLS

2014-05-23T18:57:00.000+05:30

MPLS Label Distribution Parameters

MPLS Label Distribution Parameter Options:

Label Space Options	Per-Interface	Per-Plaform
Label Distribution	Unsolicited downstream	Downstream-on-Demand
Label Allocation	Independent Control Mode	Ordered Control Mode
Label Retention	Liberal Label Retention	Conservative Label Retention

Label Space Options

Per-Platform Labels

LFIB: [Label | Action | Next Hop ]
one label assigned to a destination network and announced to all neighbors
locally unique, valid on all incoming interfaces
smaller LFIB, FIB; faster label exchange
less secure than per-interface labels; label-spoofing
default in Frame-Mode MPLS

Per-Interface Labels

LFIB:[IN intf | IN Label | NH intf | NH Label]
one label for each destination, each device, each interface
secure; prevents label-spoofing; labeled packets/ATM cells only accepted from interface where label is assigned
default in Cell-Mode MPLS

Label Distribution

Unsolicited Downstream

label advertised to all neighbor LSRs, regardless of whether upstream or downstream
Frame-Mode

Downstream-On-Demand

label advertised only upon request of upstream LSR
cell-mode

Label Allocation

Independent Control

LSR can assign a label for a prefix w/o outgoing/downstream label
for edge LSRs only (requires L3 capabilities)
faster label propagation
for unsolicited downstream / frame-mode

Ordered Control

local label allocated and propagated only
if exist(nexthop label) propagae/allocate label, else request label from nexthop
for downstream-on-demand/cell-mode

Label Retention

Liberal Label Retention

all received label stored in LIB, even if not from next-hop LSR
improves convergence speed; allows easy failover for link failures
frame-mode

Conservative Label Retention

only received labels from nexthop LSRs are stored; others are ignored
downstream-on-demand/cell-mode

Standard Parameter Sets for Cisco Platforms

Parameter	Routers, frame interfaces	Routers, ATM interfaces	ATM switches
Label Space	per-platform	per-interface	per-interface
Label Distribution	unsolicited downstream	downstream-on-demand	downstream-on-demand
Label Allocation	independent control	independent control	ordered control
Label Retention	liberal label retention	conservative OR liberal	conservative

BGP

2014-05-23T18:55:00.003+05:30

BGP Route Dampening

At a Glance:

designed to reduce router processing load caused by unstable routes;
prevents sustained routing oscillations without affecting well-behaved routes;
RFC 2439: BGP Route Flap Dampening;
minimizes BGP updates by suppressing unstable routes.

Route-Dampening Operation:

EBGP route flaps = 1000 penalty points

IBGP route flaps not dampened;
penalty not user-configurable;

penalty decays via exponential decay algorithm

if penalty > suppress limit, route is dampened

if penalty < reuse limit, dampened route is propagated

if penalty < 1/2 reuse limit, flap history forgotten

route is never dampened more than the maximum suppress time limit
unreachable route with flap history is in history state (still in BGP table to retain flap history)
penalty is applied to an individual path, not the prefix

Configuring Route Dampening:

router(config-router)# bgp dampening [half-life reuse suppress max-suppress-time] [route-map route-map-name]
half-life	time for penalty to halve (default 15 minutes)
reuse	penalty points when dampened route is reused (default 750)
suppress	penalty points when route is suppressed (default 2000)
max-suppress-time	maximum time a route is suppressed (default 1hour; maximum 255 minutes)

router(config-route-map)#
set dampening half-life reuse suppress max-suppress-time

- used for less aggressive dampening of routes towards root DNS servers
- dampening of smaller prefixes more aggressively
- selective dampening based on BGP neighbors and route-map match criteria

Other Commands:

clear ip bgp ip_addr flap-statistics [{regexp regexp} | {filter-list listname} | {ipaddr mask} ]

clear ip bgp dampening [ipaddr mask]

show ip bgp dampened-paths

show ip bgp flap-statistics [{regexp regexp}|{filter-list listname}|{ipaddr mask [longer-prefix]}]

debug ip bgp dampening

Monday, May 23, 2011

BGP: Regular Expressions for AS-PATH Filtering

Symbol	Description
\|	logical OR
.	match any
[x..y]	match one in range
^	match beginning of string
$	match end of string
_	match any delimiter/white space
( )	group as a single atom
*	match 0 or more instances of previous atom
?	match 0 or 1 instance of previous atom
+	match 1 or more instances of previous atom
\	escape character; if followed by a number n, points to the nth atom

Example 1: Advertise routes with empty AS-PATH (internal routes)

router bgp 123
neighbor 5.6.7.8 remote-as 387
neighbor 5.6.7.8 filter-list 1 out
!
ip as-path access-list 1 permit ^$
!match "blank" atom at the "start" and "end" of string
!

Example 2: Accept only default routes, preferring primary route based on AS PATH:

	AS387 (primary ISP)
	/
AS123
	\
	AS462 (backup ISP)

router bgp 123
neighbor 1.2.3.4 remote-as 462
neighbor 1.2.3.4 route-map FILTER in
neighbor 5.6.7.8 remote-as 387
neighbor 5.6.7.8 route-map FILTER in
!
route-map FILTER permit 10
! default routes from primary ISP (AS 387) accepted are preferred (larger weight)
match ip prefix-list DEFAULT_ONLY
match as-path 10
set weight 150
!
route-map FILTER permit 20
! default routes from backup ISP are accepted, with lower preference than primary ISP routes
match ip prefix-list DEFAULT_ONLY
set weight 100
!
ip as-path access-list 10 permit _387$
ip prefix-list DEFAULT_ONLY seq 10 permit 0.0.0.0/0
!

Example 3: AS PATH Filtering with AS Path Prepending:

- customer in AS123 is performing AS-PATH pre-pending

AS123
10.0.0.1	\
	\
	AS462

router bgp 387
neighbor 10.0.0.1 remote-as 213
neighbor 10.0.0.1 filter-list 10 in
!
ip as-path access-list 10 permit ^123(_123)*$
! accepts "123", "123 123", or "123 123 123"

Example 4: AS PATH Filtering with AS Path Prepending, multiple customers:

- multiple customers performing AS PATH Prepending

Customer 1
	\
Customer 2 -	AS387
	/
Customer 3

router bgp 387
neighbor 10.0.0.1 remote-as 123
neighbor 10.0.0.1 filter-list 10 in

neighbor 20.0.0.1 remote-as 456

neighbor 20.0.0.1 filter-list 10 in

neighbor 30.0.0.1 remote-as 789

neighbor 30.0.0.1 filter-list 10 in

!
ip as-path access-list 10 permit ^([0..9]+)(_\1)*$
! accepts repeating instances of "123", "456", and "789"
! does not accept strings non-repeating strings (e.g. "123 123 100")
!

Notes:
atom 1 = at least one instance of a number at the beginning of the string;
atom 2 = 0 or more instances of a whitespace and atom 1 until the end of the string.

Wednesday, May 4, 2011

BGP Path Attributes and Route Selection

BGP Path Attributes

Mandatory Well-Known
Origin (i, e, ?)
AS-Path (sequence of AS-Numbers to access network/IP)
Next-Hop (ip address)

Discretionary Well-Known
Local Preference (for routing policy)
Atomic Aggregate (flags route if aggregated)

Optional Non-Transitive
Multi-Exit Discriminator (MED) - multiple entry pts to one AS
Originator-ID - for route reflector environment
Cluster-List - for route reflector environment

Optional Transitive
Aggregator - IP address & AS of routers that aggregated routes
Community - for route tagging

BGP Route Selection Order:

Prefer highest weight (local to router)
Prefer highest local preference (global within AS)
Prefer routes that the router originated
Prefer shorter AS paths
Prefer lowest origin code (IGP < EGP < Incomplete)
Prefer lowest MED
Prefer external (EBGP) paths over internal (IBGP)

For IBGP paths, prefer nonreflected routes (no originator-ID) over reflected routes
For reflected routes, prefer shorter cluster-list

For IBGP paths, prefer path through closest IGP neighbor
For EBGP paths, prefer oldest (most stable) path
Prefer paths from router with the lower BGP router-ID

BGP: Multihomed Customer to Single ISP in Load-Sharing Setup with Static Routes

Outbound Traffic (CE to PE):
- each customer router uses closest CE as exit point;
- CE routers must be collocated to have load-sharing;

Inbound/Return Traffic (PE to CE) (pre-IOS 12.2):
- true load-sharing is impossible to achieve with multiple PEs;
- per BGP route selection, only one route will be the best route (to the customer network)
- can be optimized by dividing the customer address space

Customer Network: 11.2.3.0 /24
Customer Network "division" assigned to PE1: 11.2.3.0/25
Customer Network "division" assigned to PE2: 11.2.3.128/25

BGP: Multihomed Customer to Single ISP in Primary-Backup Setup with Static Routes

Scenario:
Multihomed customer connected to a single service provider on multiple permanent links;
Customer network using OSPF; provider network using BGP; CE-PE via static routing;
Floating static routes configured as backup on both CE and PE;

Floating Static Routes in BGP:
Once active, the floating static routes will be permanently installed in BGP; static routes are locally sourced which is preferred;

admin distance cannot be used in route-maps; hence, use communities
tag floating static routes; tags mapped to specific communities;
use route maps to modify the weight and/or local preference;
default weight: 32768

IOS: %BGP_MPLS-3-GEN_ERROR

Mar 18 20:41:38.892 EDT: %BGP_MPLS-3-GEN_ERROR: BGP: MPLS outlabel changed, MPLS forw not updated, prefix not in routing table -Traceback= 10D36950 10D3709C 10B10388 10B10718 10AEEFD0 10AEF030 10B53A50 10B53DC0 10AF588C 10AFD610 10AFE8E0 10A44524 10A3B6D4
Mar 18 20:41:38.892 EDT: %BGP_MPLS-3-GEN_ERROR: BGP: MPLS outlabel changed, MPLS forw not updated, prefix not in routing table -Traceback= 10D36950 10D3709C 10B10388 10B10718 10AEEFD0 10AEF030 10B53A50 10B53DC0 10AF588C 10AFD610 10AFE8E0 10A44524 10A3B6D4
Mar 18 20:41:38.892 EDT: %BGP_MPLS-3-GEN_ERROR: BGP: MPLS outlabel changed, MPLS forw not updated, prefix not in routing table -Traceback= 10D36950 10D3709C 10B10388 10B10718 10AEEFD0 10AEF030 10B53A50 10B53DC0 10AF588C 10AFD610 10AFE8E0 10A44524 10A3B6D4

Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500e-ENTSERVICES-M), Version
12.2(50)SG1, RELEASE SOFTWARE (fc2)
Technical Support:
http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Tue 10-Feb-09 00:17 by prod_rel_team
Image text-base: 0x10000000, data-base: 0x124FED8C

ROM: 12.2(44r)SG
Darkside Revision 0, Jawa Revision 11, Tatooine Revision 140, Forerunner Revision 1.74

MyRouter uptime is 5 days, 3 hours, 12 minutes
System returned to ROM by power-on
System restarted at 19:50:40 EDT Fri Mar 13 2009
System image file is "bootflash:/cat4500e-entservices-mz.122-50.SG1.bin"

cisco WS-C4900M (MPC8548) processor (revision 2) with 524288K bytes of memory.
Processor board ID JAE130628BD
MPC8548 CPU at 1.33GHz, Cisco Catalyst 4900M
Last reset from PowerUp
1 Virtual Ethernet interface
36 Gigabit Ethernet interfaces
16 Ten Gigabit Ethernet interfaces
511K bytes of non-volatile configuration memory.

Configuration register is 0x2102

CSCse15707: Trace back seen at bgp_ipv4_mpls_label_change.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCse15707

Basic PIX Configuration

2014-05-23T18:53:00.001+05:30

Basic PIX Configuration

This should be your most basic configuration if you want your PIX to have internet access, assuming there are no other blocking/filtering device that exists between the PIX and the internet:

Topology:
PIX inside: 192.168.102.254 /24
PIX outside: 10.199.248.50 /24
ISP/default gateway: 10.199.248.254 /24

PIX 6.X Configuration:
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
ip address outside 10.199.248.50 255.255.255.0
ip address inside 192.168.102.254 255.255.255.0
global (outside) 1 interface
nat (inside) 1 0 0
route outside 0 0 10.199.248.3 1

PIX 7.X Configuration
interface Ethernet0
no shutdown
nameif outside
ip address 10.199.248.50 255.255.255.0
interface Ethernet1
no shutdown
nameif inside
ip address 192.168.102.254 255.255.255.0
global (outside) 1 interface
nat (inside) 1 0 0
route outside 0 0 10.199.248.3

Notes:
Slight difference when dealing with different PIX OS, but principle is the same. First, configure the interfaces. Next, configure translation (shown here is the simplest NAT). Lastly, configure default route.

MYSQL Database Create

2014-01-24T15:00:00.002+05:30

Create a MySQL Database, Tables and Insert Data

How do I create a MySQL database, tables, and insert (store) data into newly created tables?

MySQL is a free and open source database management system. You need to use sql commands to create database. You also need to login as mysql root user account. To create a database and set up tables for the same use the following sql commands:

Tutorial details
Difficulty	Easy (rss)
Root privileges	No
Requirements	mysql
Estimated completion time	10m

1. CREATE DATABASE - create the database. To use this statement, you need the CREATE privilege for the database.

2. CREATE TABLE - create the table. You must have the CREATE privilege for the table.

3. INSERT - To add/insert data to table i.e. inserts new rows into an existing table.

Procedure for creating a database and a sample table

mysql>

Add a database called books, enter:
mysql> CREATE DATABASE books;

Now, database is created. Use a database with use command, type:
mysql> USE books;

Next, create a table called authors with name, email and id as fields:
mysql> CREATE TABLE authors (id INT, name VARCHAR(20), email VARCHAR(20));

To display your tables in books database, enter:
mysql> SHOW TABLES;
Sample outputs:

+-----------------+

| Tables_in_books |

+-----------------+

| authors |

+-----------------+

1 row in set (0.00 sec)

Finally, add a data i.e. row to table books using INSERT statement, run:
mysql> INSERT INTO authors (id,name,email) VALUES(1,"Vivek","xuz@abc.com");
Sample outputs:

Query OK, 1 row affected (0.00 sec)

Try to add few more rows to your table:
mysql> INSERT INTO authors (id,name,email) VALUES(2,"Priya","p@gmail.com");
mysql> INSERT INTO authors (id,name,email) VALUES(3,"Tom","tom@yahoo.com");

To display all rows i.e. data stored in authors table, enter:
mysql> SELECT * FROM authors;
Sample outputs:

+------+-------+---------------+

| id | name | email |

+------+-------+---------------+

| 1 | Vivek | xuz@abc.com |

| 2 | Priya | p@gmail.com |

| 3 | Tom | tom@yahoo.com |

+------+-------+---------------+

3 rows in set (0.00 sec)

Share Folder Linux

2014-01-24T14:58:00.005+05:30

How to install Samba server on CentOS 6

Part 1: Configuring anonymous share with samba server

To install the samba package,enter the following command:

sudo yum install samba samba-client samba-common

Check the version of installed samba software by using this command:

smbd --version

Configure the samba service, so that, it will start automatically at boot time:

sudo chkconfig smb on

sudo chkconfig nmb on

Disable the SELinux:

sudo nano /etc/selinux/config

Change SELinux from enforcing to disabled:

SELINUX=disabled

Add these Iptables rules, so that samba will work perfectly:

sudo iptables -I INPUT 4 -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT

sudo iptables -I INPUT 5 -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT

sudo iptables -I INPUT 6 -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT

sudo service iptables save

Restart the Server!!!

Go to your Windows machine and use this command in order to check the WORKGROUP name:

net config workstation

It will show the output, something like this:

Backup the smb.conf file, then delete it and create the new one:

sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

sudo rm /etc/samba/smb.conf

sudo touch /etc/samba/smb.conf

sudo nano /etc/samba/smb.conf

Add these lines, in your smb.conf file (or change it according to your requirement):

#======================= Global Settings =====================================

[global]

workgroup = WORKGROUP

security = share

map to guest = bad user

#============================ Share Definitions ==============================

[MyShare]

path = /samba/share

browsable =yes

writable = yes

guest ok = yes

read only = no

Save the smb.conf file and restart the service:

sudo service smb restart

sudo service nmb restart

Access the samba share from windows (where centos is the name of my samba server):

wao, we are able to access the samba share successfully

Let’s try to create something, inside the share folder:

Error, we cannot create anything inside the share folder

Check the current permission on the samba share:

cd /samba/

ls -l

Change it, in such a way that everyone can read and write it(Check it, that it is allowed in your environment or not):

sudo chmod -R 0777 share

ls -l

Try to create something again, inside the share folder:

Verify the newly created file on samba server:

cd share/

ls -l

Part 2: Add and manage users and groups

Add a group in your CentOS server (in my case smbgrp):

sudo groupadd smbgrp

Create a new share, set the permission on the share:

cd /samba/

sudo mkdir secure

sudo chown -R arbab:smbgrp secure/

ls -l

sudo chmod -R 0770 secure/

ls -l

Add the user to the samba group and create samba password:

sudo usermod -a -G smbgrp arbab

sudo smbpasswd -a arbab

Edit the smb.conf file:

sudo nano /etc/samba/smb.conf

Add the newly created samba share in smb.conf file:

[Secure]

path = /samba/secure

valid users = @smbgrp

guest ok = no

writable = yes

browsable = yes

Restart the samba service:

sudo service smb restart

sudo service nmb restart

Check the syntax error with testparm:

sudo testparm

Testing from Windows Machine:

Verification from CentOS server:

cd /samba/secure/

ls -l

XAMPP installation Linux

2014-01-24T14:58:00.001+05:30

Welcome to the Linux version of XAMPP
(on x86-compatible processors)

By the way: In the past this software was called LAMPP but to avoid misconceptions we renamed it to »XAMPP for Linux«. So if you are seeking for LAMPP you're on the right track. ;)

If you encounter any problems with XAMPP please feel free to get in touch with us. This will help us to improve XAMPP and make it more useful for everybody.

Jump-off point

Pictures of XAMPP for Linux

Installation in 4 Steps

Step 1: Download
Step 2: Installation
Step 3: Start
Step 4: Test

READ ME

A matter of security (A MUST READ!)
Advanced start and stop parameters
What is where?
Stopping XAMPP
Uninstall

Pictures of XAMPP for Linux

As the old saying goes, a picture is worth a thousand words. Here you can take a look at some screen shots of a XAMPP installation.

Step 1: Download

Simply click on one of the links below. It's a good idea to get the latest version. :)

A complete list of downloads (older versions) is available at SourceForge.

A detailed overview over the changes and contents of all XAMPP releases is available in the RELEASE NOTES.

XAMPP for Linux 1.8.1, 2012/9/30
Version	Size	Notice
XAMPP Linux 1.8.1	81 MB	Apache 2.4.3, MySQL 5.5.27, PHP 5.4.7 & PEAR + SQLite 2.8.17/3.6.16 + multibyte (mbstring) support, Perl 5.14.2, ProFTPD 1.3.4a, phpMyAdmin 3.5.2.2, OpenSSL 1.0.1c, GD 2.0.1, Freetype2 2.1.7, libjpeg 6b, libpng 1.2.12, gdbm 1.8.0, zlib 1.2.3, expat 1.2, Sablotron 1.0, libxml 2.7.6, Ming 0.4.2, Webalizer 2.21-02, pdf class 009e, ncurses 5.3, mod_perl 2.0.5, FreeTDS 0.63, gettext 0.17, IMAP C-Client 2007e, OpenLDAP (client) 2.3.11, mcrypt 2.5.7, mhash 0.8.18, eAccelerator 0.9.5.3, cURL 7.19.6, libxslt 1.1.26, libapreq 2.12, FPDF 1.6, XAMPP Control Panel 0.8, bzip 1.0.5, PBXT 1.0.09-rc, PBMS 0.5.08-alpha, ICU4C Library 4.2.1, APR (1.4.6), APR-utils (1.4.1) MD5 checsum: e7092eafff81ad363de45d192774b4d6
Upgrade 1.8.0 to 1.8.1	32 MB	Upgrade package. How to upgrade? MD5 checksum: 990a56b93ba5a909a63b67ba4f0ac503
Development package	38 MB	The development package contains all files you need if you want to compile other software packages for XAMPP by yourself and the Unix manual pages. Install this package like the normal XAMPP distribution: tar xvfz xampp-linux-devel-1.8.1.tar.gz -C /opt MD5 checksum: 1377159c73d9a5bfc0e930b122861ee6

Attention: If you download these files on a Windows system and you're running McAfee virus scanner you may get a false positive virus warning. This is a problem with McAfee and gzip-compressed files, it should be ignored.

Step 2: Installation

After downloading simply type in the following commands:

Go to a Linux shell and login as the system administrator root:

Extract the downloaded archive file to /opt:

tar xvfz xampp-linux-1.8.1.tar.gz -C /opt

Warning: Please use only this command to install XAMPP. DON'T use any Microsoft Windows tools to extract the archive, it won't work.

Warning 2: already installed XAMPP versions get overwritten by this command.

That's all. XAMPP is now installed below the /opt/lampp directory.

Step 3: Start

To start XAMPP simply call this command:

/opt/lampp/lampp start

You should now see something like this on your screen:

Starting XAMPP 1.8.1...
LAMPP: Starting Apache...
LAMPP: Starting MySQL...
LAMPP started.

Ready. Apache and MySQL are running.

If you get any error messages please take a look at the Linux FAQ.

Step 4: Test

OK, that was easy but how can you check that everything really works? Just type in the following URL at your favourite web browser:

http://localhost

Now you should see the start page of XAMPP containing some links to check the status of the installed software and some small programming examples.

The Instant Art example: A small PHP/GD program (since 0.9.6pre1 also a flashy PHP/Ming example, see screenshot). Thanks to Anke Arnold for her font »AnkeCalligraph«.

A matter of security (A MUST READ!)

As mentioned before, XAMPP is not meant for production use but only for developers in a development environment. The way XAMPP is configured is to be open as possible and allowing the developer anything he/she wants. For development environments this is great but in a production environment it could be fatal.

Here a list of missing security in XAMPP:

The MySQL administrator (root) has no password.
The MySQL daemon is accessible via network.
ProFTPD uses the password "lampp" for user "nobody".
PhpMyAdmin is accessible via network.
Examples are accessible via network.
MySQL and Apache running under the same user (nobody).

To fix most of the security weaknesses simply call the following command:

/opt/lampp/lampp security

It starts a small security check and makes your XAMPP installation quite secure. For example this protects the XAMPP demo pages by a username ('lampp') and password combination.

Set Bridge Ethernet in linux

2014-01-24T14:56:00.002+05:30

brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 192.168.7.119 netmask 255.255.255.0 up
route add default gw 192.168.7.2 dev br0
ifconfig eth0 0.0.0.0 promisc up
ifconfig eth1 0.0.0.0 promisc up
brctl stp br0 off

Ubuntu to Windows Domain via Active Directory

2014-01-24T14:55:00.004+05:30

Attach Ubuntu to Windows Domain via Active Directory (+ sudo)

Posted by Jagdish Goswami

There may not be too many advantages to adding your Ubuntu machines to your Windows domain, but if you think of them this will allow you to work toward them. It’s actually pretty easy to add a Linux box to Active Directory. This is true because AD started out life as an LDAP server and it still retains its LDAP genes somewhere deep inside its withered exterior.

First thing you will want to do is add this utility to your Ubuntu machine:

sudo apt-get install likewise-open

It will allow you to authenticate against AD using Kerberos. If you don’t know what that means it’s not important at this stage; it’s enough to understand that it’s a secure method for assuring identity between your client machine and your AD server.

I then added the machine to the domain. Again this is a simple operation. Before you do anything on the Ubuntu machine, hop into Active Directory and create a machine account in the name of the Ubuntu machine. Then back on the Ubuntu machine it’s one line of code:

sudo domainjoin-cli join [domain.name] [username]

Easy enough.

Further I added a domain group to the local sudo group by adding these lines to the/etc/sudoers file:

# Active Directory group [groupname] given sudo privs
%[domain.name]\\[groupname] ALL=(ALL) ALL

If you don’t know how to edit a protected file like /etc/sudoers I recommend using Gedit:

gksudo gedit /etc/sudoers

Just add those two lines to the end of the file. The first line is just a comment line and could say something different. Replace those items in the square brackets with the appropriate information to your network.

For the group I created in Active Directory to grant these sudo privileges I included Domain Administrators and a couple of individuals who would likely be using the Ubuntu box and need sudo rights. If you’d rather you could substitute a username for thegroupname in the edit above, but I think it’s better to use a security group in AD since you’re now attached to it.

Anyway, that’s about it. Not too exciting but sure it’s useful for something. Have fun with it.

(The same can be done with Macs or probably any Unix-like system as long as it can authenticate against an LDAP. Of course for other systems the details will be, you know, different.)

CCNP Basics | IT HELP (CCNA,CCNP,MCSE,LINUX,VMWARE,CLOUD MGN)

2014-01-08T10:35:00.001+05:30

CCNP Basics | IT HELP (CCNA,CCNP,MCSE,LINUX,VMWARE,CLOUD MGN)

How to launch VMware Player VMs without GUI

2013-07-18T15:19:00.004+05:30

How to launch VMware Player VMs without GUI

I assume that you have already created a VM using VMware Player, and so have *.vmx files ready somewhere. Now you want to start/stop the VM using vmrun. You don’t need root permission to use vmrun command.

First, download VMware VIX for Linux, and then install it on the VMware host as follows.

$ chmod 755 ./VMware-VIX-1.11.0-471780.x86_64
$ sudo ./VMware-VIX-1.11.0-471780.x86_64

To start VM:

$ vmrun -T player start /path/to/vm/my.vmx nogui

To reboot VM:

$ vmrun -T player reset /path/to/vm/my.vmx soft

To power off VM:

$ vmrun -T player stop /path/to/vm/my.vmx soft

VMware Player does not support VM snapshot operations. So you cannot take a snapshot of VMware Player VMs using vmrun. But if your VM was created using VMware Workstation or VMware Fusion, you can take a snapshot of a running VM as follows.

$ vmrun -T ws (or fusion) snapshot /path/to/vm/my.vmx my_snapshot

How do I backup MySQL in Linux?

2013-07-03T14:22:00.002+05:30

How do I backup MySQL in Linux?

1. Copying from the mysql directory
By default, MySQL databases on servers that use Linux are stored in the following directory:
/var/lib/mysql/
If you shut down the mysqld service first, you can copy your databases to an example /backup directory using the following command:
cp –Rp /var/lib/mysql/*.* /backup

The –R switch for the cp command means recursive, which you want to use because each database is in a separate directory. The –p switch is for permissions, which will maintain the permissions of what is copied.
You generally want to shutdown the mysqld service before using the above method because if a database is copied while it is actively being used, the resulting backup will be corrupt and therefore worthless. If you are certain none of the databases are not being used at the time, you can use the above command.

2. The mysqldump command
The mysqldump command lets you back up both individual databases and all databases on a server without having to shutdown the mysqld service. Because of this ability to make backups while still keeping databases online, this method is preferred.

Individual databases
An example command that would let you back up a database named example to the directory /backup while logged in as root is as follows:
mysqldump example > /backup/example_backup.sql

Unless it is a small database, it is recommended that you then compress the resulting database backup in order to reduce the amount of time necessary to transfer the backup. The following command would compress the backup of the example database:
tar czvf /backup/example_backup.tar.gz /backup./example_backup.sql

All database
If you have numerous databases and backing all of them up individually would be too time consuming, the following command will backup all MySQL databases on your server to the /backup directory:
mysqldump -A > /backup/databases.sql(or --all-databases)
The –A switch (“-all-databases” performs the same function) will dump any and all databases on the server.

How to Reset CentOS root Password

2013-07-03T14:21:00.004+05:30

How to Reset CentOS root Password

For those who are forgot their CentOS root password, please do not panic. There was the easy way to reset the root password for CentOS. Please follow this steps and you will be able to access your CentOS.

1. Reboot the CentOS machine
2. When booting up, press any key to go into the select menu.
3. The press ‘e’ to navigate to second grub.conf line (kernel)
4. Once again press ‘e’ to edit the line and you can select one step from these option :

option 1 : 1 (’1′) at the end of the line. OR
option 2: S (‘S’) a the end of the line OR
option 3: add ‘single’ to “ro root=LABEL=/ single”

5. After edit, hit “ENTER”
6. Press ‘b’ to reboot
7. After reboot it will stop at ‘#’ command line.
8. At ‘#’ command line, type ‘passwd’ to create new password.
9. Reboot machine as usual
10 Finish

How to Enable CentOS Desktop

2013-07-03T14:21:00.001+05:30

CentOS: Enable CentOS GNOME Desktop

Mostly the CentOS servers that I am using is run on CLI (Command-Line Interface) mode. But in some cases, I need to have a desktop to install some applications with GUI (Grapich User Interface) mode. In this case, I will use GNOME, the most popular user-friendly desktop for any UNIX based system.

Variable that I used as below:

OS: CentOS 6.2 64bit
Desktop environment: GNOME

1. Using yum, we will need to install X Windows System as the based for GUI and rich input device capability:

$ yum groupinstall -y 'X Window System'

2. Only then we can install GNOME desktop environment on top of it:

$ yum groupinstall -y 'Desktop'

3. Since previously the server is running on CLI mode, we need to change some value to tell CentOS to boot up in the GUI mode. Open /etc/inittab via text editor and change following line:

id:3:initdefault:

To:

id:5:initdefault:

4. Reboot:

$ init 6

Note: You can switch from GUI to CLI mode manually by using following method:

GUI to CLI: Ctrl + Alt + F6
CLI to GUI: Ctrl + Alt + F1

If you want to start the desktop from CLI console (not SSH session), use following command:

$ startx

In some cases, when you login into the system via GUI, you will see some kind of weird boxes replacing the fonts. You can overcome this problem by installing fonts group via yum:

$ yum groupinstall -y fonts

How to Install Subversion (SVN) Server

2013-07-03T14:20:00.000+05:30

Install Subversion (SVN) Server

Since programmers are already familiar with SVN instead of WebDAV, so I will need to setup a Subversion server for them. By using PHP Designer 7 on Windows 7, they can connect SVN server viaTortoiseSVN plugin which available at http://tortoisesvn.tigris.org/.

Subversion is a full-featured version control system originally designed to be a better CVS. In layman term is it control the versioning of files being shared between users.In this case, I will use Subversion package which available in yum repo. Variables as below:

OS: CentOS 6.0 64bit
Server IP: 192.168.0.170
SVN directory for webproject1: /home/user1/webproject1
SVN user for webproject1: project1
SVN password for webproject1: mypasswording1
SVN directory for webproject2: /home/user1/webproject2
SVN user for webproject2: project2
SVN password for webproject2: mypasswording2

1. Firstly, we need to install SVN or subversion package via yum:

$ yum install subversion -y

2. Create both project local directories:

$ mkdir -p /home/user1/webproject1

$ mkdir -p /home/user1/webproject2

3. Create both project SVN directories:

$ svnadmin create /home/user1/webproject1

$ svnadmin create /home/user1/webproject2

4. You should see following files and folders has been created under webproject1 directory (same goes towebproject2):

$ ls -1 /home/user1/webproject1/

conf

format

hooks

locks

README.txt

5. We need to configure the SVN service before we can use. Open the configuration file at /home/user1/webproject1/conf/svnserve.conf via text editor (repeat this step again for webproject2):

[general]

### These options control access to the repository for unauthenticated

### and authenticated users. Valid values are "write", "read",

### and "none". The sample settings below are the defaults.

anon-access = read

auth-access = write

### The password-db option controls the location of the password

### database file. Unless you specify a path starting with a /,

### the file's location is relative to the directory containing

### this configuration file.

### If SASL is enabled (see below), this file will NOT be used.

### Uncomment the line below to use the default password file.

password-db = passwd

### The authz-db option controls the location of the authorization

### rules for path-based access control. Unless you specify a path

### starting with a /, the file's location is relative to the the

### directory containing this file. If you don't specify an

### authz-db, no path-based access control is done.

### Uncomment the line below to use the default authorization file.

# authz-db = authz

### This option specifies the authentication realm of the repository.

### If two repositories have the same authentication realm, they should

### have the same password database, and vice versa. The default realm

### is repository's uuid.

realm = My First Repository

6. Then we create the user database to authorize which user we want to have read and write privileges for the repository. Using text editor, open the /home/user1/webproject1/conf/passwd and create the user:

project1:mypasswording1

7. SVN repository for webproject1 is completed. We need to do the same thing for webproject2. Open the /home/user1/webproject2/conf/passwd and create the user:

project2:mypasswording2

8. Lets start the SVN service as daemon:

$ svnserve -d

9. Lets check whether the SVN is running fine on default port 3690 (make sure your firewall has allowing this incoming port):

$ netstat -tulpn | grep svn

tcp 0 0 0.0.0.0:3690 0.0.0.0:* LISTEN 20412/svnserve

10. Lets say we already have web files for both projects located under /tmp directory in same server, so we might need to import the web files from local server to the SVN directory so SVN can start host the files. Before we start importing, we need to specify the default text editor that will be use by SVN:

$ export SVN_EDITOR=vim

$ cd /tmp/webproject1

$ svn import svn://project1@192.168.0.170/home/user1/webproject1

$ cd /tmp/webproject2

$ svn import svn://project2@192.168.0.170/home/user1/webproject2

Linux Shell Commands

2013-07-03T14:19:00.000+05:30

Linux Shell Commands

Navigating in UNIX

pwd	Shows the full path of the current directory
ls	Lists all the files in the current directory
ls -al	Lists all files and information
ls –alR	Lists all files and information in all subdirectories
ls -alR \| more	Same as ls –alR, pausing when screen becomes full
ls -alR > filename.txt	Same as ls –alR, outputs the results to a file
*ls .html**	Lists all files ending with .html
cd [directory name]	Changes to a new directory
cd ..	Changes to directory above current one
clear	Clears the screen
vdir	Gives a more detailed listing than the "ls" command
exit	Log off your shell

Moving, Copying and Deleting Files

mv [old filename] [new filename]	Move/rename a file
cp [filename] [new filename]	Copies a file
rm [filename]	Deletes a file
rm *	Deletes all files in current directory
*rm .html**	Deletes all files ending in .html

Creating, Moving, Copying and Deleting Directories

mkdir [directory name]	Creates a new directory
*ls -d /**	Lists all directories within current directory
cp -r [directory] [new directory]	Copies a directory and all files/directories in it

Searching Files and Directories

find . -name [filename] -print	Searches for a file starting with current directory
grep [text] [filename]	Searches for text within a file

File and Directory Permissions

There are three levels of file permissions: read, write and execute. In addition, there are three groups to which you can assign permissions: file owner, user group and everyone. The command chmod followed by three numbers is used to change permissions. The first number is the permission for the owner, the second for the group and the third for everyone. Here are how the levels of permission translate:

0 = ---	No permission
1 = --X	Execute only
2 = -W-	Write only
3 = -WX	Write and execute
4 = R--	Read only
5 = R-X	Read and execute
6 = RW-	Read and write
7 = RWX	Read, write and execute

It is preferred that the group always have permission of 0. This prevents other users on the server from browsing files via Telnet and FTP. Here are the most common file permissions used:

chmod 604 [filename]	Minimum permissions for HTML file
chmod 705 [directory name]	Minimum permissions for directories
chmod 755 [filename]	Minimum permissions for scripts & programs
chmod 606 [filename]	Permissions for data files used by scripts
chmod 703 [directory name]	Write-only permissions for public FTP uploading

How do I unzip a file with telnet?

All of the below commands assume that you are within the same directory that the compressed file is in. To be sure type:
ls {enter}
If the file is there, you're ready to go. If not type:
cd /big/dom/xdomain/www/directory/ {enter}
replacing the path with the correct path to your file.

If a file ends in .zip (for example, file.zip) type:
unzip file.zip

If a file ends in .tar (e.g., file.tar) type:
tar -xvf file.tar

If a file ends in .gz (for example, file.gz) type:
gzip -d file.gz

If a file ends in .tar.gz (e.g. file.tar.gz) type:
gzip -d file.tar.gz
and then
tar -xvf file.tar

If a file ends in .tgz (e.g. file.tgz)

How to upload running VM in Openstack

2013-06-24T12:33:00.001+05:30

1. To check image info in openstack compute node
#qemu-img info <<image-name>>

2. Glance Add image in openstack
# glance add is_public=true container_format=raw disk_format=qcow2 < <<Image-Path>>>

Openstack Notes:

1. Install openstack on any hardware with scripts
Converting VM running instances that can run on openstack

1. Download and install VMWARE VCenter Converter for Windows & Install it.
2. Open Vcenter Converter Standalone client

3. Click on Convert Machine
4. Select Source type = VMware Workstation or other VMware virtual machine
5. Browse source virtual machine or image
6. Click Next
7. Destination Type Window

- Select destination type = VMware Workstation or other VMware virtual machine
- Select VMware product – Vmware Workstation 6.5x

8. Click Next and you will see Options window
9. Click on Data to copy edit
10. Under Edit select Pre-allocated in drop down of Disk type
11. Click Next & Finish
Uploading VMware based images on Glance - openstack

1. Upload image using glance command
# glance image-create --name <your-image-name> --disk-format=vmdk --is-public=True --container-format=bare < <path-to-vmdk-flat-image-file>

How to create Customise CENTOS Image for Openstack

2013-06-24T12:31:00.000+05:30

Creating qcow2 CentOS Image for OpenStack

Updated March 9, 2012 by Karve |Tags: None

Page Actions

Creating a CentOS 6 image
Same instructions can be used for Redhat 6 and Fedora

These instructons were run on Ubuntu 11.10 Server x86_64. Run the following in a VNC Session on the hypervisor, you will need to install the vnc4server, vncviewer.

# Install the kvm-pxe to avoid the "pci_add_option_rom: failed to find romfile "pxe-rtl8139.bin"" message
sudo apt-get install kvm-pxe

# Download the CentOS DVD iso, alternatively check the mirrors at http://isoredirect.centos.org/centos/6/isos/x86_64/ for downloading relevant iso.
wget http://mirrors.usc.edu/pub/linux/distributions/centos/6.2/isos/x86_64/CentOS-6.2-x86_64-LiveDVD.iso

# Create a qcow2 image that represents the main HDD of the virtual machine and swap space. (Note: 5GB is not sufficient)
kvm-img create -f qcow2 centos.qcow2 10G

# Boot the Virtual Machine from DVD iso, select an unused vnc
sudo kvm -m 1024 -cdrom CentOS-6.2-x86_64-LiveDVD.iso -drive file=centos.qcow2,if=virtio,index=0 -boot d -net nic -net user -nographic -vnc :2
# This command will block

# Connect to VM using vncviewer from another window
vncviewer :2
# This will show you the desktop that was booted form the DVD iso file. Now we install the CentOS on the attached image file.

# Double Click on the "Install to Hard Drive" icon on the desktop and click Next
# Select the US English and click Next
# Select the default Storage and click Next, Click "Yes, Discard any data" on the popup
# Leave the default hostname and Click Next
# Default TimeZone and click Next
# Type the root password (at least 6 characters long) and confirm and click Next
# Select "Create custom layout", the "Review and modify partitioning layout" will automatically be checked and click Next
# Select the Free and Click on Create, Standard Partition, Create
# Select / as the Mount Point with ext4 as the File System Type and 9120 as the Size (MB), Fixed Size and click OK
# Select the Free and Click on Create, Standard Partition, Create
# Don't select the "Mount Point", instead Select swap for the "File System Type", the Mount Point will be grayed out, select the "Fill to maximum allowable size" and click OK
# Now you show see the vda1 with ext4 and vda2 as swap, Click Next, Format and Click on "Write Changes to Disk"
# Leave the defaults for the Boot loader and click Next
# It will copy the live image to hard drive, complete the post-installation. After completion, it will show the "Congratulations" message. Click Close.
# Select System and "Shut Down" the VM

# Now back to the bash prompt on the hypervisor, start the VM from the qcow2 image without the DVD iso
sudo kvm -m 1024 -drive file=centos.qcow2,if=virtio,index=0,boot=on -boot c -net nic -net user -nographic -vnc :2

# Reconnect to VM using vncviewer from the second window
vncviewer :2
# This will show you the Welcome page. Click Forward, Accept license, Forward
# Do not create any user (you may create if you want to, but not necessary if you only want root), click Forward

# Select Date time and click Forward# Select Date and click forward
# Ignore the "Insufficient memory to configure kdump!" message, click OK and Finish.
# Click on "Other", type root and hit Enter and your password and hit Enter and login to the VM.
# Close the root superuser warning message.
# Rightclick on the desktop and Open Terminal
# Install the latest updates
sudo yum -y update
# Enable ssh daemon to autostart
sudo chkconfig --level 345 sshd on
# Check that the levels for 345 are on
sudo chkconfig --list | grep sshd
# The firewall is set by default to allow ssh on port 22, you can check it by going to System, Administration, Firewall to verify
# Shutdown the VM (Careful - Don't shutdown the hypervisor, run this in VM's Terminal)
shutdown -h now

# Now back to the bash prompt on the hypervisor

The centos.qcow2 is ready to be added to glance

Adding the image to glance

# Run the following command to get the Access token Id. Note set the hostname to the glance hostname if it is different from current hostname
myhostname=`hostname`
accesstokenid=`curl -d '{"auth":{"passwordCredentials":{"username": "adminUser","password": "password"}}}' -H "Content-type: application/json" http://$myhostname:35357/v2.0/tokens | python -mjson.tool | grep -A3 access | grep id | sed "s/.*:.*\"$.*$\"/\\1/"`
echo $accesstokenid

# or
curl -d '{"auth":{"passwordCredentials":{"username": "adminUser","password": "password"}}}' -H "Content-type: application/json" http://`hostname`:35357/v2.0/tokens | python -mjson.tool
# Note the access token id above and set the accesstokenid manually

sudo glance -A $accesstokenid -v add name="centos-qcow2" is_public=True disk_format="qcow2" < centos6.qcow2

Convert disk format to raw

Instead of qcow2, you can convert the image to raw and add it to glance as follows. Note: set the accesstokenid as above before adding to glance.

qemu-img convert -O raw centos.qcow2 centos.raw
sudo glance -A $accesstokenid -v add name="centos-raw" is_public=True < centos.raw

List the images

nova --username=adminUser --apikey=password --projectid=adminTenant --url=http://`hostname`:5000/v2.0/ image-list

Openstack Folsom Guide --Nimulla

2013-06-24T12:29:00.000+05:30

Basic OpenStack Folsom Install Guide

Version:	1.0
Source:	https://github.com/nimbula/OpenStack-Folsom-Install-Guide
Keywords:	Multi-node OpenStack, Folsom, Nova, Keystone, Glance, Horizon, Cinder, KVM, Ubuntu Server 12.10 (64-bit release).

Overview

This guide focuses on providing step-by-step instruction to users who are interested in taking a bare-metal server installation to a fully functioning OpenStack cloud. We will avoid using scripts like TryStack and DevStack and will attempt to configure a “vanilla” OpenStack environment. The only scripts used in this tutorial are slight modifications of the existing keystone scripts available on the official OpenStack GitHub repo. (https://github.com/openstack/keystone/blob/master/tools/sample_data.sh)

Who should read this guide

This guide is for the system administrator who is installing, configuring and managing the OpenStack “Folsom” cluster infrastructure. A reasonable level of familiarity with the following is assumed:

The Unix command line
Installing packages
Basic networking concepts

Special thanks to

Emilien Macchi at eNovance for assistance in merging some portions of this text into the official OpenStack repository.

Bilel Msekni from TELECOM SudParis for allowing me to fork sections of his OpenStack install guide and for the valuable suggestions and input.

Author

Zachary VanDuyn, Technical Marketing Intern at Nimbula

Getting Started

This guide intentionally uses the nova-network package instead of the newly released quantum. This decision was made in order to reduce the setup time for a basic network configuration. Although the next release plans to freeze nova-network development, the team responsible for overseeing OpenStack networking (Thierry, Vish, Dan) have decided that they will ”...continue to support nova-network as it currently exists in Folsom”.

You can read more about their decision here.

Hardware Requirements

The following are recommended hardware requirements for both the controller and compute nodes.

Controller Node

(runs network, volume, API, scheduler and image services)

Processor: 64-bit x86
Memory: 12GB of RAM
Disk Space: 30GB (SATA, SAS, SSD)
Volume Storage: two disks with 2TB (SATA) for volumes attached to the compute nodes
Network: one 1GB NIC

Compute Node(s)

(runs virtual instances)

Processor: 64-bit x86
Memory: 32GB of RAM
Disk Space: 30GB (SATA, SAS, SSD)
Network: one 1GB NIC

Basic Configuration

OpenStack Install

Control Node Install

Updating your system

After you complete the Ubuntu 12.10 installation, go into superuser mode and stay there until this tutorial concludes:

sudo su

Update your system:

· apt-get update

· apt-get upgrade

apt-get dist-upgrade

Install and configure the MySQL & RabbitMQ

Install MySQL:

apt-get install mysql-server python-mysqldb

Configure MySQL to accept all incoming requests:

· sed -i 's/127.0.0.1/0.0.0.0/g' /etc/mysql/my.cnf

service mysql restart

Install RabbitMQ:

apt-get install rabbitmq-server

Install and configure the NTP service

Install the NTP service:

apt-get install ntp

Configure the NTP server to synchronize between your compute node(s) and the controller node:

· sed -i 's/server ntp.ubuntu.com/server ntp.ubuntu.com\nserver 127.127.1.0\nfudge 127.127.1.0 stratum 10/g' /etc/ntp.conf

service ntp restart

Install VLAN, Bridge-Utils, and setup IP Forwarding

Install the VLAN and Bridge-Utils services:

apt-get install vlan bridge-utils

Enable IP_Forwarding

o by uncommenting net.ipv4.ip_forward=1 in /etc/sysctl.conf:

o vi /etc/sysctl.conf

o or alternatively, to avoid editing any files:

o echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-openstack-ipv4-forwarding.conf

service procps start

Now, run systcl with the updated configuration:

· sysctl -p

Install and configure Keystone

Install the Keystone identity service:

apt-get install keystone

Create a new MySQL database for Keystone:

· mysql -u root -p

· CREATE DATABASE keystone;

· GRANT ALL ON keystone.* TO 'keystoneUser'@'%' IDENTIFIED BY 'keystonePass';

quit;

Adapt the connection attribute in the /etc/keystone/keystone.conf to our newly created database.:

· vi /etc/keystone/keystone.conf

· #and edit the connection field to show

connection = mysql://keystoneUser:keystonePass@10.32.14.232/keystone

Restart the identity service then synchronize the database:

· service keystone restart

keystone-manage db_sync

Use mseknibilel’s scripts

o With Quantum:

o wget https://raw.github.com/nimbula/OpenStack-Folsom-Install-guide/master/Keystone_Scripts/With%20Quantum/keystone_basic.sh

wget https://raw.github.com/nimbula/OpenStack-Folsom-Install-guide/master/Keystone_Scripts/With%20Quantum/keystone_endpoints_basic.sh

o Without Quantum:

o wget https://raw.github.com/nimbula/OpenStack-Folsom-Install-guide/master/Keystone_Scripts/Without%20Quantum/keystone_basic.sh

wget https://raw.github.com/nimbula/OpenStack-Folsom-Install-guide/master/Keystone_Scripts/Without%20Quantum/keystone_endpoints_basic.sh

Change the mode for both files:

· chmod +x keystone_basic.sh

chmod +x keystone_endpoints_basic.sh

In the keystone_basic.sh script, change the $HOST_IP variable to your X.X.X.232 address
In the keystone_endpoints_basic.sh script, change the $HOST_IP, $EXT_HOST_IP, & $MYSQL_HOST variables to your X.X.X.232 address and then execute the scripts.
Note: Double check your work here, screwing up keystone can be a pain to recover from:

· vi keystone_basic.sh

· vi keystone_endpoints_basic.sh

· ./keystone_basic.sh

./keystone_endpoints_basic.sh

The keystone_basic.sh script has no output, but keystone_endpoints_basic.sh should kick out something similar to this:

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | description | OpenStack Compute Service |

· | id | 2801693507a44570a7439245b20ea0cd |

· | name | nova |

· | type | compute |

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | description | OpenStack Volume Service |

· | id | b80f524c06464c0c8af80942a1c94f78 |

· | name | cinder |

· | type | volume |

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | description | OpenStack Image Service |

· | id | 9326c1e4d4bc4e748bd8387fa5279bd0 |

· | name | glance |

· | type | image |

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | description | OpenStack Identity |

· | id | 7fd27d54ac7c476cb36ef7d0002b9fda |

· | name | keystone |

· | type | identity |

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | description | OpenStack EC2 service |

· | id | 7ce8ae8b16774c3f82e0eeecea60520a |

· | name | ec2 |

· | type | ec2 |

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | description | OpenStack Networking service |

· | id | 8777783c2f9f4ae3a3a6a501833ab021 |

· | name | quantum |

· | type | network |

· +-------------+----------------------------------+

· +-------------+-------------------------------------------+

· | Property | Value |

· +-------------+-------------------------------------------+

· | adminurl | http://10.32.14.232:8774/v2/$(tenant_id)s |

· | id | ecfcff81220c45ce9f13ca000f1c4fa7 |

· | internalurl | http://10.32.14.232:8774/v2/$(tenant_id)s |

· | publicurl | http://10.32.14.232:8774/v2/$(tenant_id)s |

· | region | RegionOne |

· | service_id | 2801693507a44570a7439245b20ea0cd |

· +-------------+-------------------------------------------+

· | Property | Value |

· +-------------+-------------------------------------------+

· | adminurl | http://10.32.14.232:8776/v1/$(tenant_id)s |

· | id | 420959377cde408a865445b0ea743a19 |

· | internalurl | http://10.32.14.232:8776/v1/$(tenant_id)s |

· | publicurl | http://10.32.14.232:8776/v1/$(tenant_id)s |

· | region | RegionOne |

· | service_id | b80f524c06464c0c8af80942a1c94f78 |

· +-------------+-------------------------------------------+

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | adminurl | http://10.32.14.232:9292/v2 |

· | id | f2c0b4ea7bed4a8aa2d44b140df73a0d |

· | internalurl | http://10.32.14.232:9292/v2 |

· | publicurl | http://10.32.14.232:9292/v2 |

· | region | RegionOne |

· | service_id | 9326c1e4d4bc4e748bd8387fa5279bd0 |

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | adminurl | http://10.32.14.232:35357/v2.0 |

· | id | ef0fb3dfa5f74f70a2059dd015e7743d |

· | internalurl | http://10.32.14.232:5000/v2.0 |

· | publicurl | http://10.32.14.232:5000/v2.0 |

· | region | RegionOne |

· | service_id | 7fd27d54ac7c476cb36ef7d0002b9fda |

· +-------------+----------------------------------+

· +-------------+-----------------------------------------+

· | Property | Value |

· +-------------+-----------------------------------------+

· | adminurl | http://10.32.14.232:8773/services/Admin |

· | id | e5a40371df6e47e79dc78bb61591fc87 |

· | internalurl | http://10.32.14.232:8773/services/Cloud |

· | publicurl | http://10.32.14.232:8773/services/Cloud |

· | region | RegionOne |

· | service_id | 7ce8ae8b16774c3f82e0eeecea60520a |

· +-------------+-----------------------------------------+

· +-------------+----------------------------------+

· | Property | Value |

· +-------------+----------------------------------+

· | adminurl | http://10.32.14.232:9696/ |

· | id | 8396e30ecbf14f3d9bd97d489f7407ea |

· | internalurl | http://10.32.14.232:9696/ |

· | publicurl | http://10.32.14.232:9696/ |

· | region | RegionOne |

· | service_id | 8777783c2f9f4ae3a3a6a501833ab021 |

+-------------+----------------------------------+

Let’s create our OpenStack credential file and load it so we won’t be bothered later:

vi creds

Paste the following text:

· export OS_NO_CACHE=1

· export OS_TENANT_NAME=admin

· export OS_USERNAME=admin

· export OS_PASSWORD=admin_pass

export OS_AUTH_URL="http://10.32.14.232:5000/v2.0/"

Load the file:

source creds

Let’s just do a quick test to see if Keystone is up:

· apt-get install curl openssl

curl http://10.32.14.232:35357/v2.0/endpoints -H 'x-auth-token: ADMIN' | python -m json.tool

It should kick out something like this:

· {

· "endpoints": [

· {

· "adminurl": "http://10.32.14.232:8776/v1/$(tenant_id)s",

· "id": "0fe6ddf16ce344989adb22a644befa48",

· "internalurl": "http://10.32.14.232:8776/v1/$(tenant_id)s",

· "publicurl": "http://10.32.14.232:8776/v1/$(tenant_id)s",

· "region": "RegionOne",

· "service_id": "d0a8dbeac60845aaa1fa043c23177d5e"

· },

· {

· "adminurl": "http://10.32.14.232:35357/v2.0",

· "id": "7811cbbf4c3042f1a6b97d19a9ceace5",

· "internalurl": "http://10.32.14.232:5000/v2.0",

· "publicurl": "http://10.32.14.232:5000/v2.0",

· "region": "RegionOne",

· "service_id": "00685df9e085427a97837892622ca4b2"

· },

· {

· "adminurl": "http://10.32.14.232:8774/v2/$(tenant_id)s",

· "id": "826a7b77f108414ea4be8eb06d3b0c96",

· "internalurl": "http://10.32.14.232:8774/v2/$(tenant_id)s",

· "publicurl": "http://10.32.14.232:8774/v2/$(tenant_id)s",

· "region": "RegionOne",

· "service_id": "1a7bd347252049d9921703d45c1182dc"

· },

· {

· "adminurl": "http://10.32.14.232:9696/",

· "id": "b0974d6c9bbb4f2cab281f3ff5bcd412",

· "internalurl": "http://10.32.14.232:9696/",

· "publicurl": "http://10.32.14.232:9696/",

· "region": "RegionOne",

· "service_id": "fc2b6886fd8241448d4f3b0c9a960bf0"

· },

· {

· "adminurl": "http://10.32.14.232:9292/v2",

· "id": "c49d46bc5a62445ea60dc568abc954bb",

· "internalurl": "http://10.32.14.232:9292/v2",

· "publicurl": "http://10.32.14.232:9292/v2",

· "region": "RegionOne",

· "service_id": "574f359c07fc449ab6b0b4fad42b2df9"

· },

· {

· "adminurl": "http://10.32.14.232:8773/services/Admin",

· "id": "d50733db9848451596c84b782906cba1",

· "internalurl": "http://10.32.14.232:8773/services/Cloud",

· "publicurl": "http://10.32.14.232:8773/services/Cloud",

· "region": "RegionOne",

· "service_id": "a0fdb3cd3a234cada512ba0a75a6df56"

· }

· ]

· }

Install and configure Glance

Now, let’s continue by installing the image storage service (Glance):

apt-get install glance

Let’s create a new MySQL database for Glance:

· mysql -u root -p

· CREATE DATABASE glance;

· GRANT ALL ON glance.* TO 'glanceUser'@'%' IDENTIFIED BY 'glancePass';

quit;

Next, replace the existing filter:authtoken section in /etc/glance/glance-api-paste.ini with:

· vi /etc/glance/glance-api-paste.ini

· [filter:authtoken]

· paste.filter_factory = keystone.middleware.auth_token:filter_factory

· auth_host = 10.32.14.232

· auth_port = 35357

· auth_protocol = http

· admin_tenant_name = service

· admin_user = glance

admin_password = service_pass

Then, update /etc/glance/glance-registry-paste.ini with:

· vi /etc/glance/glance-registry-paste.ini

· [filter:authtoken]

· paste.filter_factory = keystone.middleware.auth_token:filter_factory

· auth_host = 10.32.14.232

· auth_port = 35357

· auth_protocol = http

· admin_tenant_name = service

· admin_user = glance

admin_password = service_pass

Open /etc/glance/glance-api.conf and update with the following:

· vi /etc/glance/glance-api.conf

· sql_connection = mysql://glanceUser:glancePass@10.32.14.232/glance

· [paste_deploy]

flavor = keystone

Update the /etc/glance/glance-registry.conf:

· vi /etc/glance/glance-registry.conf

· sql_connection = mysql://glanceUser:glancePass@10.32.14.232/glance

· [paste_deploy]

flavor = keystone

Restart the glance-api and glance-registry services:

service glance-api restart; service glance-registry restart

Sync databases:

glance-manage db_sync

Note: You’ll probably get a warning, reminding you that ‘useexisting’ is deprecated. That’s normal, don’t worry about it.
Restart the services again to take into account the new modifications

service glance-registry restart; service glance-api restart

Now, let’s test the Glance installation by installing the cirros cloud image from the Launchpad mirror:

· mkdir images

· cd images

· wget https://launchpad.net/cirros/trunk/0.3.0/+download/cirros-0.3.0-x86_64-disk.img

glance image-create --name NimbulaTest --is-public true --container-format bare --disk-format qcow2 < cirros-0.3.0-x86_64-disk.img

That last command should produce output similar to:

· +-----------------+------------------------------------+

· | Property | Value |

· +----------------+------------------------------------+

· | checksum | 50bdc35edb03a38d91b1b071afb20a3c |

· | container_format | bare |

· | created_at | 2012-12-04T21:52:49 |

· | deleted | False |

· | deleted_at | None |

· | disk_format | qcow2 |

· | id | 9f045abf-3aa4-40d9-a9e1-7ab7bfa3e1ef |

· | is_public | True |

· | min_disk | 0 |

· | min_ram | 0 |

· | name | NimbulaTest |

· | owner | b302c28c0f0e4d2f8f4d99553fc3971f |

· | protected | False |

· | size | 9761280 |

· | status | active |

· | updated_at | 2012-12-04T21:52:50 |

+----------------+------------------------------------+

Now let’s make sure it uploaded, by using glance’s image list:

glance image-list

It should return something like this:

· +--------------------------------------+-------------+-------------+------------------+---------+--------+

· +--------------------------------------+-------------+-------------+------------------+---------+--------+

+--------------------------------------+-------------+-------------+------------------+---------+--------+

Setup networking

Now, time to install bridge-utils:

apt-get install -y bridge-utils

Reconfigure /etc/network/interfaces:

· vi /etc/network/interfaces

· # This file describes the network interfaces available on your system

· # and how to activate them. For more information, see interfaces(5).

· # The loopback network interface

· auto lo

· iface lo inet loopback

· # The primary network interface

· auto br100

· iface br100 inet static

· address 10.32.14.232

· netmask 255.255.255.0

· network 10.32.14.0

· broadcast 10.32.14.255

· gateway 10.32.14.1

· # dns-* options are implemented by the resolvconf package, if installed

· dns-nameservers 172.16.0.16

· dns-search mtv.nimbula.org

· bridge_ports eth0

· bridge_stp off

· bridge_maxwait 0

bridge_fd 0

Ensure that you setup the bridge and then restart networking:

sudo brctl addbr br100; sudo /etc/init.d/networking restart

Install and configure Nova

Time to install Nova (and some other packages):

apt-get install -y nova-api nova-cert novnc nova-consoleauth nova-scheduler nova-novncproxy nova-network

We are also going to remove the Quantum endpoint and service, the script we ran earlier assumes that we will use Quantum instead of nova-networks, and having both endpoints on the same installation can cause some serious conflicts:
First, get the endpoint ID:

keystone endpoint-list | grep 9696

It will return output similar to this:

Grab the ID from the output and then remove that endpoint:

keystone endpoint-delete b0974d6c9bbb4f2cab281f3ff5bcd412

Next, find the Quantum service ID:

keystone service-list | grep quantum

It will return output similar to this:

Grab the ID from the output and then remove that service:

keystone service-delete 9e3b400f6531414c93262644f20cfda1

Prepare a MySQL database for Nova:

· mysql -u root -p

· CREATE DATABASE nova;

· GRANT ALL ON nova.* TO 'novaUser'@'%' IDENTIFIED BY 'novaPass';

quit;

Now, let’s modify the authtoken section in the /etc/nova/api-paste.ini file:

· [filter:authtoken]

· paste.filter_factory = keystone.middleware.auth_token:filter_factory

· auth_host = 10.32.14.232

· auth_port = 35357

· auth_protocol = http

· admin_tenant_name = service

· admin_user = nova

· admin_password = service_pass

signing_dirname = /tmp/keystone-signing-nova

Next up is the /etc/nova/nova.conf file:

· [DEFAULT]

· logdir=/var/log/nova

· state_path=/var/lib/nova

· lock_path=/run/lock/nova

· verbose=True

· api_paste_config=/etc/nova/api-paste.ini

· scheduler_driver=nova.scheduler.simple.SimpleScheduler

· s3_host=10.32.14.232

· ec2_host=10.32.14.232

· ec2_dmz_host=10.32.14.232

· rabbit_host=10.32.14.232

· cc_host=10.32.14.232

· metadata_host=10.32.14.232

· metadata_listen=0.0.0.0

· nova_url=http://10.32.14.232:8774/v1.1/

· sql_connection=mysql://novaUser:novaPass@10.32.14.232/nova

· ec2_url=http://10.32.14.232:8773/services/Cloud

· root_helper=sudo nova-rootwrap /etc/nova/rootwrap.conf

· # Auth

· use_deprecated_auth=false

· auth_strategy=keystone

· keystone_ec2_url=http://10.32.14.232:5000/v2.0/ec2tokens

· # Imaging service

· glance_api_servers=10.32.14.232:9292

· image_service=nova.image.glance.GlanceImageService

· # Vnc configuration

· novnc_enabled=true

· novncproxy_base_url=http://10.32.14.232:6080/vnc_auto.html

· novncproxy_port=6080

· vncserver_proxyclient_address=10.32.14.232

· vncserver_listen=0.0.0.0

· # NETWORK

· network_manager=nova.network.manager.FlatDHCPManager

· force_dhcp_release=True

· dhcpbridge_flagfile=/etc/nova/nova.conf

· firewall_driver=nova.virt.libvirt.firewall.IptablesFirewallDriver

· # Change my_ip to match each host

· my_ip=10.32.14.232

· public_interface=br100

· vlan_interface=eth0

· flat_network_bridge=br100

· flat_interface=eth0

· #Note the different pool, this will be used for instance range

· fixed_range=10.33.14.0/24

· # Compute #

· compute_driver=libvirt.LibvirtDriver

· # Cinder #

· volume_api_class=nova.volume.cinder.API

osapi_volume_listen_port=5900

Now, sync your database:

nova-manage db sync

Note: You may get some debug output mentioning ‘nova.db.sqlalchemy.migration’. That’s normal, don’t worry about it.
Restart all of your nova-* services:

cd /etc/init.d/; for i in $(ls nova-*); do sudo service $i restart; done

Make sure all of your services are up and happy:

nova-manage service list

You should get something like this:

· Binary Host Zone Status State Updated_At

· nova-cert folsom-1 nova enabled :-) 2012-11-06 18:30:58

· nova-consoleauth folsom-1 nova enabled :-) 2012-11-06 18:30:57

· nova-scheduler folsom-1 nova enabled :-) 2012-11-06 18:31:05

nova-network folsom-1 nova enabled :-) 2012-11-06 18:31:09

Note: You may get some debug output mentioning ‘nova.db.sqlalchemy.migration’. That’s normal, don’t worry about it.

Install and configure Cinder

Now, it’s time to install Cinder, this new OpenStack project aims at managing the volumes for VM’s. It replaces nova-volumes:

apt-get install cinder-api cinder-scheduler cinder-volume iscsitarget iscsitarget-dkms

Prepare a MySQL database for Cinder:

· mysql -u root -p

· CREATE DATABASE cinder;

· GRANT ALL ON cinder.* TO 'cinderUser'@'%' IDENTIFIED BY 'cinderPass';

quit;

Configure api-paste.ini by following this template:

· vi /etc/cinder/api-paste.ini

· [filter:authtoken]

· paste.filter_factory = keystone.middleware.auth_token:filter_factory

· service_protocol = http

· service_host = 10.32.14.232

· service_port = 5000

· auth_host = 10.32.14.232

· auth_port = 35357

· auth_protocol = http

· admin_tenant_name = service

· admin_user = cinder

admin_password = service_pass

Open cinder.conf and change it to the following:

· vi /etc/cinder/cinder.conf

· [DEFAULT]

· rootwrap_config=/etc/cinder/rootwrap.conf

· sql_connection = mysql://cinderUser:cinderPass@10.32.14.232/cinder

· api_paste_confg = /etc/cinder/api-paste.ini

· iscsi_helper=ietadm

· volume_name_template = volume-%s

· volume_group = cinder-volumes

· verbose = True

· auth_strategy = keystone

#osapi_volume_listen_port=5900

Time to synchronize the database, yet again:

cinder-manage db sync

Now, let’s create a volume group, name it cinder-volumes, and make sure that it persists after a reboot:

· dd if=/dev/zero of=cinder-volumes bs=1 count=0 seek=2G

· losetup /dev/loop2 cinder-volumes

fdisk /dev/loop2

And at the fdisk prompt, enter the following commands:

· n

· p

· 1

· ENTER

· t

· 8e

Proceed to create the physical volume and then the volume group itself:

· pvcreate /dev/loop2

vgcreate cinder-volumes /dev/loop2

Now, let’s add this to the rc.local to make sure that we don’t lose this volume on a server reboot
Add the following to the file before the exit 0 line:

· #the path is wherever you ran the previous two steps + "cinder-volumes"

losetup /dev/loop2 <PATH_TO_VG>

Install and configure Horizon

Finally, we are almost done. On to the Horizon interface:

apt-get install openstack-dashboard memcached

Some users (including myself) have encountered a few bugs when using the default Ubuntu theme. Disable it by doing the following:

· vi /etc/openstack-dashboard/local_settings.py

· #Comment these lines

· #Enable the Ubuntu theme if it is present.

· #try:

· # from ubuntu_theme import *

· #except ImportError:

· # pass

Horizon now requires a reboot to authenticate properly. Reboot and when the machine is ready, start all of your nova services:

· reboot

cd /etc/init.d/; for i in $(ls nova-*); do sudo service $i start; done

Compute Node

Updating your system

Now, all we have to do is add a compute node. Log onto the next available node on your cluster. (repeat for as many nodes as you’d like)
Start by updating your system as root:

· sudo su

· apt-get update

· apt-get upgrade

apt-get dist-upgrade

Install and configure the NTP service

Install the NTP service:

apt-get install ntp

Configure the NTP server to follow the controller node:

· sed -i 's/server ntp.ubuntu.com/server 10.32.14.232/' /etc/ntp.conf

service ntp restart

Setup vlan, bridge-utils, and KVM

Install other miscellaneous services:

apt-get install vlan bridge-utils

Enable IP_Forwarding

o by uncommenting net.ipv4.ip_forward=1 in /etc/sysctl.conf:

o vi /etc/sysctl.conf

o or alternatively, to avoid editing any files:

o echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/99-openstack-ipv4-forwarding.conf

service procps start

Now, run systcl with the updated configuration:

· sysctl -p

Next, check if you can install KVM on your machine:

apt-get install cpu-checker

Then run:

· kvm-ok

You should get a response similar to:

KVM acceleration can be used

Now that we are all clear, let’s install kvm and configure it:

apt-get install -y kvm libvirt-bin pm-utils

Edit the cgroup_device_acl array in the qemu.conf file to:

· vi /etc/libvirt/qemu.conf

· cgroup_device_acl = [

· "/dev/null", "/dev/full", "/dev/zero",

· "/dev/random", "/dev/urandom",

· "/dev/ptmx", "/dev/kvm", "/dev/kqemu",

· "/dev/rtc", "/dev/hpet", "/dev/net/tun"

· ]

Delete the default virtual bridge:

· virsh net-destroy default

virsh net-undefine default

Setup live migration

Enable live migration by uncommenting the listen_tls = 0, listen_tcp = 1, and auth_tcp = “none” fields in the libvirtd.conf file. Don’t touch any of the other existing settings:

· vi /etc/libvirt/libvirtd.conf

· listen_tls = 0

· listen_tcp = 1

· auth_tcp = "none"

Edit libvirtd_opts variable in the libvirt-bin.conf file:

· vi /etc/init/libvirt-bin.conf

Find env libvirtd_opts and set it to:

env libvirtd_opts="-d -l"

Edit the same field in /etc/default/libvirt-bin and again, set it to:

· libvirtd_opts="-d -l"

Restart the libvirt service to apply the changes:

service libvirt-bin restart

Install and configure nova-network

Now, time to install nova-network and bridge-utils:

apt-get install nova-network bridge-utils

Now, let’s configure our interfaces file similar to our first node. (this time we will just use a different IP):

· vi /etc/network/interfaces

· # This file describes the network interfaces available on your system

· # and how to activate them. For more information, see interfaces(5).

· # The loopback network interface

· auto lo

· iface lo inet loopback

· # The primary network interface

· auto br100

· iface br100 inet static

· address 10.32.14.234

· netmask 255.255.255.0

· network 10.32.14.0

· broadcast 10.32.14.255

· gateway 10.32.14.1

· # dns-* options are implemented by the resolvconf package, if installed

· dns-nameservers 172.16.0.16

· dns-search mtv.nimbula.org

· bridge_ports eth0

· bridge_stp off

· bridge_maxwait 0

bridge_fd 0

Now, make sure the br100 is added and restart the networking services:

brctl addbr br100; /etc/init.d/networking restart

Install and configure nova-api and nova-compute

Now, let’s install the compute packages:

apt-get install nova-api-metadata nova-compute-kvm

Now, modify the authtoken section in api-paste.ini:

· vi /etc/nova/api-paste.ini

· [filter:authtoken]

· paste.filter_factory = keystone.middleware.auth_token:filter_factory

· auth_host = 10.32.14.232

· auth_port = 35357

· auth_protocol = http

· admin_tenant_name = service

· admin_user = nova

· admin_password = service_pass

signing_dirname = /tmp/keystone-signing-nova

Next up, edit the nova-compute.conf:

· vi /etc/nova/nova-compute.conf

· [DEFAULT]

· libvirt_type=kvm

Now, time for the good ol’ nova.conf again:

· vi /etc/nova/nova.conf

· [DEFAULT]

· logdir=/var/log/nova

· state_path=/var/lib/nova

· lock_path=/run/lock/nova

· verbose=True

· api_paste_config=/etc/nova/api-paste.ini

· scheduler_driver=nova.scheduler.simple.SimpleScheduler

· s3_host=10.32.14.232

· ec2_host=10.32.14.232

· ec2_dmz_host=10.32.14.232

· rabbit_host=10.32.14.232

· cc_host=10.32.14.232

· metadata_host=10.32.14.234

· metadata_listen=0.0.0.0

· nova_url=http://10.32.14.232:8774/v1.1/

· sql_connection=mysql://novaUser:novaPass@10.32.14.232/nova

· ec2_url=http://10.32.14.232:8773/services/Cloud

· root_helper=sudo nova-rootwrap /etc/nova/rootwrap.conf

· # Auth

· use_deprecated_auth=false

· auth_strategy=keystone

· keystone_ec2_url=http://10.32.14.232:5000/v2.0/ec2tokens

· # Imaging service

· glance_api_servers=10.32.14.232:9292

· image_service=nova.image.glance.GlanceImageService

· # Vnc configuration

· novnc_enabled=true

· novncproxy_base_url=http://10.32.14.232:6080/vnc_auto.html

· novncproxy_port=6080

· vncserver_proxyclient_address=10.32.14.234

· vncserver_listen=0.0.0.0

· # NETWORK

· network_manager=nova.network.manager.FlatDHCPManager

· force_dhcp_release=True

· dhcpbridge=/usr/bin/nova-dhcpbridge

· dhcpbridge_flagfile=/etc/nova/nova.conf

· firewall_driver=nova.virt.libvirt.firewall.IptablesFirewallDriver

· # Change my_ip to match each host

· my_ip=10.32.14.234

· public_interface=br100

· vlan_interface=eth0

· flat_network_bridge=br100

· flat_interface=eth0

· #Note the different pool, this will be used for instance range

· fixed_range=10.33.14.0/24

· # Compute #

· compute_driver=libvirt.LibvirtDriver

· # Cinder #

· volume_api_class=nova.volume.cinder.API

osapi_volume_listen_port=5900

Resync your databases:

nova-manage db sync

Restart services to update changes:

cd /etc/init.d/; for i in $(ls nova-*); do sudo service $i restart; done

Check to make sure your services are in a good mood:

nova-manage service list

You should now see a mix of services running on multiple nodes:

· Binary Host Zone Status State Updated_At

· nova-cert folsom-1 nova enabled :-) 2012-11-08 00:26:03

· nova-consoleauth folsom-1 nova enabled :-) 2012-11-08 00:26:03

· nova-scheduler folsom-1 nova enabled :-) 2012-11-08 00:26:04

· nova-network folsom-1 nova enabled :-) 2012-11-08 00:26:04

· nova-compute folsom-2 nova enabled :-) 2012-11-08 00:26:00

nova-network folsom-2 nova enabled :-) 2012-11-08 00:26:00

Note: You may get some debug output mentioning ‘nova.db.sqlalchemy.api’. That’s normal, don’t worry about it.

Setting up projects using Horizon

Now, log onto OpenStack horizon by visiting the URL: http://10.32.14.232/horizon and logging in with the credentials:

· username: admin

password: admin_pass

Next, navigate to the “Projects” tab on the bottom left of the landing screen:

Now, in the new pane go ahead and click the “Create Project” button in the top right. You will be greeted with a modal dialog like so:

Fill in the fields presented, and don’t forget the tabs on top. Make sure you add yourself as a project member:
Now, your new project should be behind the modal grid. Find your new project and the corresponding row. Copy the “Project ID” to your clipboard, we’ll use it in the next step:

Creating a network

We are almost finished. Now it’s time to create a network and bind it to that project:
Note: Remember to use the instance network:

nova-manage network create --label=NimbulaNetwork --fixed_range_v4=10.33.14.0/24 --bridge=br100 --project_id=<InsertProjectIDHere> --num_networks=1 --multi_host=T

Now, you are done. No seriously. Go to http://10.32.14.232/horizon (or whatever your IP is) and then select your project, find an image, and launch and instance.

Tips & Tricks

Removing ‘error’ state instances

So, it’s entirely possible that you screw up your network the first time, maybe you give it the wrong IP Pool, or maybe you assign it to the wrong project. Now, all of your instances are in the error state and you can’t delete them. Luckily, I’ve already found two very simple and undocumented processes of removing them.

Jump on your first node, open up the terminal as root, and plugin the following commands:

· service nova-network stop

· nova-manage project scrub <ProjectName>

nova-manage network list

It should return something like this:

· id IPv4 IPv6 start address DNS1 DNS2 VlanID project uuid

3 10.33.14.0/24 None 10.33.14.2 8.8.4.4 None None Nimbula 8ccdef11-7070-4852-a212-31c3ddedccd3

Find the network you want to remove and copy the IPv4 section:

nova-manage network delete 10.33.14.0/24

Now, we’ve got to get rid of those error state instances:

nova list | grep ERROR

That command should return a list of all ERROR state instances:

· +------+------------+--------+--------------------------------+

· +------+------------+--------+--------------------------------+

+------+------------+--------+--------------------------------+

To delete, plug in their names to the following command(s):

nova reset-state –active <name> nova delete <name>

If those two commands don’t work, we can take more drastic measures:

vi DeleteInstances.sh

Paste the following in:

· #!/bin/bash

· mysql -uroot -ppassword << EOF

· use nova;

· DELETE a FROM nova.security_group_instance_association AS a INNER JOIN nova.instances AS b ON a.instance_id=b.id where b.uuid='$1';

· DELETE FROM nova.instance_info_caches WHERE instance_id='$1';

· DELETE FROM nova.instances WHERE uuid='$1';

EOF

Save it by hitting ESC, then ”:”, then x, and hitting Enter - Then make sure it’s executable by using the following:

chmod +x DeleteInstances.sh

And run it:

./DeleteInstances.sh

Floating IP setup

First create a dedicated pool:

sudo nova-mange floating create --pool pool_auto_assign --ip_range X.X.X.X/X

Then modify the nova.conf with these flags:

· vi /etc/nova/nova.conf

· default_floating_pool = pool_auto_assign

· floating_range = X.X.X.X/X

· auto_assign_floating_ip = True

You may also want to increase the floating IP’s quota (this is also in the /etc/nova/nova.conf):

· quota_floating_ips = 50

Then, we need to restart nova-network:

sudo service nova-network restart

Cisco SSG 200 Switch Configuration

2013-06-24T12:16:00.000+05:30

How to install Openstack Grizzly Installation

2013-06-21T16:05:00.000+05:30

How to Use VMWARE Player

2013-06-21T16:03:00.001+05:30

How to Use Virtual BOX

2013-06-21T16:00:00.000+05:30

IT HELP (CCNA,CCNP,MCSE,LINUX,VMWARE,CLOUD MGN)

PIX: Dynamic Site-to-Site IPSEC Configuration

Wednesday, March 12, 2008

VLAN

VTP

MPLS

BGP

Monday, May 23, 2011

Wednesday, May 4, 2011

Wednesday, April 15, 2009

Basic PIX Configuration

Basic PIX Configuration

MYSQL Database Create

Share Folder Linux

XAMPP installation Linux

Set Bridge Ethernet in linux

Ubuntu to Windows Domain via Active Directory

CCNP Basics | IT HELP (CCNA,CCNP,MCSE,LINUX,VMWARE,CLOUD MGN)

How to launch VMware Player VMs without GUI

How to launch VMware Player VMs without GUI

How do I backup MySQL in Linux?

How to Reset CentOS root Password

How to Enable CentOS Desktop

How to Install Subversion (SVN) Server

Linux Shell Commands

How to upload running VM in Openstack

How to create Customise CENTOS Image for Openstack

Openstack Folsom Guide --Nimulla

Cisco SSG 200 Switch Configuration

How to install Openstack Grizzly Installation

How to Use VMWARE Player

How to Use Virtual BOX