IT Administrators

GNS3CISCO Help you pass your CCNA CCNP EXAM

2011-05-14T11:05:00.001-07:00

GNS3CISCO.BLOGSPOT.COM
FACEBOOK.COM/GNS3CISCO

Installing RSAT: Remote Server Administration Tools for Windows Vista

2011-05-14T07:54:00.000-07:00

Remote Server Administration Tools was released by Microsoft for Windows Vista SP1 users to be able to manage both Windows 2003 and Windows 2008 Servers.

If you had upgraded to Vista in the past and wanted to manage Windows servers with your Vista client, you were able to with some hacks. But all in all it was a very painful process and a lot of administrators had to run a Windows XP machine virtually or have a second box to do server administrative tasks.

Now that the RSAT is released for general consumption what can it do?

Remote Server Administration Tools for Roles

Active Directory Certificate Services Tools – includes the Certification Authority snap-in, the Certificate Templates snap-in, the Enterprise PKI snap-in, and the Online Responder Management snap-in.

Active Directory Certification Authority Tools includes the Certification Authority, Certificate Templates, and Enterprise PKI snap-ins.
Online Responder Tools includes the Online Responder Management snap-in.

Active Directory Domain Services (AD DS) Tools – includes snap-ins and command-line tools for remotely managing Active Directory Domain Services.

Active Directory Domain Controller Tools includes Active Directory Users and Computers, Active Directory Domains and Trusts, Active Directory Sites and Services, and other snap-ins and command-line tools for remotely managing AD DS.
Server for Network Information Service (NIS) Tools includes an extension to the Active Directory Users and Computers snap-in, and the ypclear.exe command-line tool.

Active Directory Lightweight Directory Services (AD LDS) Tools – includes Active Directory Sites and Services, Active Directory Service Interfaces (ADSI) Edit, Schema Manager, and other snap-ins and command-line tools for managing AD LDS.

DHCP Server Tools – includes the DHCP snap-in.

DNS Server Tools – includes the DNS Manager snap-in and dnscmd.exe command-line tool.

File Services Tools – includes the following, along with the storagemgmt.msc snap-in:

Distributed File System Tools includes the DFS Management snap-in, and the dfsradmin.exe, dfscmd.exe, dfsdiag.exe, and dfsutil.exe command-line tools.
File Server Resource Manager Tools includes the File Server Resource Manager snap-in, and the filescrn.exe and storrept.exe command-line tools.
Share and Storage Management Tools includes the Share and Storage Management snap-in.

Terminal Services Tools – includes the Remote Desktops and Terminal Services Manager snap-ins.

Universal Description, Discovery, and Integration (UDDI) Services Tools - includes the UDDI Services snap-in.

Microsoft Remote Server Administration Tools for Features

BitLocker Drive Encryption Tools – includes the manage-bde.wsf script.

Failover Clustering Tools – includes the Failover Cluster Manager snap-in and the cluster.exe command-line tool.

Group Policy Management Tools – includes Group Policy Management Console, Group Policy Management Editor, and Group Policy Starter GPO Editor.

Network Load Balancing Tools – includes the Network Load Balancing Manager snap-in, the nlb.exe and wlbs.exe command-line tools, and wlbsctrl.dll.

SMTP Server Tools – includes the Simple Mail Transfer Protocol (SMTP) snap-in.

Storage Manager for SANs Tools – Tools includes the Storage Manager for SANs snap-in, and the provisionstorage.exe command-line tool.

Windows System Resource Manager Tools – includes the Windows System Resource Manager snap-in and the wsrmc.exe command-line tool.

How to Install Remote Server Administration Tools for Vista

There are two versions of the RSAT tool, one for 32-bit machines and one for 64-bit machines. You can download the version you need at their respective download locations:

Download: Remote Server Administration Tools (x86)
Download: Remote Server Administration Tools (x64)

Once you download the file go ahead and give it a left click … c’mon … you know you want to! After clicking the file you will see it preparing the installation and doing a search to make sure your copy of Vista is prepared for the remote server admin tools.

After a bit you will get a prompt to install Update for Windows (KB941314)

After clicking Ok, you will now get prompted to read the license terms, in this case it is a simple paragraph that I actually read, that said if you are using an illegal copy you can’t use this software.

Since I am lucky enough to be using a legal copy I let off a sigh of relief and plunged ahead by clicking I Accept

Now it will begin Initializing installation and applying updates

After it is done installing you will see the Installation Complete screen:

Now when you go to Start->Administrative Tools you will see the following help file: Remote Server Administration Tool

When you click on it you will be able to read all about using Remote Server Administration Tool goodness. But instead of wasting your time reading that, I went through some of it above and will show some examples below here so you don’t have to!

The one thing you don’t see is any of the additional tools for administrating your Windows Servers, but that’s because you still have to enable them.

Now let’s go in and enable Remote Server Administration Tools in the control panel so you can use them: Start->Control Panel

Next you will see the control panel, go ahead and click on Programs

Click on Program & Features

On the left pane click on Turn Windows features on or off

Note: If you are prompted by UAC go ahead and click Ok

In the Windows Features window you can scroll down until you see Remote Server Administration Tool.

At this point you can install all the features, by checking the box, or you can expand out both the Feature Administration Tools & Role Administration Tools and only install the tools you wish to use. For our example I am going install them all!

Once you hit OK, you will see a window that shows it is configuring Vista with the features selected.

Now that it is enabled lets go back in to the Administrative Tools to see if anything is different?

Seems like everything was loaded correctly! Let’s take this baby for a test drive …

RSAT Terminal Services Manager in Vista

This section of the article will walk you through starting Terminal Services Manager and connecting to a remote Windows 2008 Server.

Go to your Administrative tools and go Terminal Services->Terminal Services Manager

You will see the following MMC open.

Note: You may be prompted by UAC, go ahead and click Ok

When you run Terminal Services Manager the first time (and every time if you don’t disable it) you get prompted by a warning that certain features are disabled when run from the console session.

If you wish to disable this, go ahead and check In the future, do not show this message and click Ok

As you can see this MMC is in the new Server 2008 layout. Let’s go ahead and click Connect to Computer in the right Actions pane

In the next window you can either connect to the local computer, or another computer. In this case I am going to enter an IP address to the test Windows Server 2008 I am running and click Ok

It connects successfully as you can see and I can tell that I already have a session on the test server through RDP.

There is a lot more to see in the MMC but I just wanted to demonstrate the functionality of administrating from Vista, and will have to cover actual usage in a future article.

As you can see RSAT brings a much overdue set of tools for System Administrators that will cut down on having to keep separate machines running just to do simple administrator tasks.

Configuring DNS on Cisco IOS routers

2011-04-19T10:07:00.000-07:00

Configuration

Client R1#
----------

ip name-server 2.2.2.2
! ip domain-lookup is enabled by default
ip domain-lookup

Server R2#
----------

ip dns server
! ip domain-lookup is enabled by default
ip domain-lookup

ip host R2 2.2.2.2
ip host R1 1.1.1.1
! We can point to another DNS server
ip name-server 61.8.8.8

! but DO NOT point name-server to itself
! NO ip name-server 2.2.2.2

Verification

R1#ping R2

Translating “R2″…domain server (2.2.2.2) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 155.1.0.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/58/60 ms
R1#
*Apr 7 11:35:07.163: Domain: query for R2 type 1 to 2.2.2.2
*Apr 7 11:35:07.195: DOM: dom2cache: hostname is R2, RR type=1, class=1, ttl=1, n=4Reply received ok

R2#debug domain
Domain Name System debugging is on
R2#
*Apr 7 02:18:27.683: DNS: Incoming UDP query (id#2)
*Apr 7 02:18:27.683: DNS: Type 1 DNS query (id#2) for host ‘R2′ from 12.0.0.1(58198)
*Apr 7 02:18:27.683: DNS: Query for my own hostname: R2
*Apr 7 02:18:27.683: DNS: Spoofing reply to query (id#2)
*Apr 7 02:18:27.683: DNS: Finished processing query (id#2) in 0.004 secs

REPRODUCE ROUTER CRASH

Router may crash if we configure it as a DNS server, and also point “ip name-server” to itself.

R2#c
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#ip name-server 2.2.2.2
R2(config)#
R2#
R2#
R2#

!
! The R2 successfully serves the DNS queuries
! for valid hostnames (When “ping R2″ is issued on R1 router)

R1#ping R2

Translating “R2″…domain server (2.2.2.2) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 155.1.0.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/58/60 ms

*Apr 7 11:35:58.539: Domain: query for R2 type 1 to 2.2.2.2
*Apr 7 11:35:58.571: DOM: dom2cache: hostname is R2, RR type=1, class=1, ttl=1, n=4Reply received ok

R2#
*Apr 7 02:19:19.059: DNS: Incoming UDP query (id#3)
*Apr 7 02:19:19.059: DNS: Type 1 DNS query (id#3) for host ‘R2′ from 12.0.0.1(54174)
*Apr 7 02:19:19.059: DNS: Query for my own hostname: R2
*Apr 7 02:19:19.059: DNS: Spoofing reply to query (id#3)
*Apr 7 02:19:19.059: DNS: Finished processing query (id#3) in 0.000 secs
R2#
R2#

! The R2 crashes when “ping R3″ is issued on R1 router

R1#ping R3

Translating “R3″…domain server (2.2.2.2)
*Apr 7 11:36:22.991: Domain: query for R3 type 1 to 2.2.2.2
% Unrecognized host or address, or protocol not running.

timed out

*Apr 7 11:36:55.459: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1, changed state to down
*Apr 7 11:36:55.459: %OSPF-5-ADJCHG: Process 1, Nbr 12.0.0.2 on Serial0/1 from FULL to DOWN, Neighbor Down: Interface down or detached

! As R2 cannot resolve IP for hostname R3, it tries to forward the queury to
! the next DNS server with IP address of itself. And the request keeps

! looping within R2.
!
!

R2#

DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
DNS: Type 1 DNS query (id#4) for host ‘R3′ from 2.2.2.2(53)
DNS: Re-sending DNS query (type 1, id#4) to 2.2.2.2
DNS: Incoming UDP query (id#4)
Doc CD Navigation

How to configure 802.1Q trunking between Cisco Catalyst switches

2011-04-18T19:42:00.000-07:00

How to configure 802.1Q trunking between Cisco Catalyst 4000 - 4500 - 5000 - 5500 - 6000 - 6500 Switches that run CatOS and Cisco IOS System Software.

In 802.1Q trunking, all VLAN packets are tagged on the trunk link, except the native VLAN.

The native VLAN packets are sent untagged on the trunk link.

Therefore, the native VLAN must be the same on both switches configured for trunking.

This makes it easy to deduce to which VLAN a frame belongs when a frame is received with no tag.

By default, VLAN 1 is the native VLAN on all switches.

In Catalyst OS (CatOS), the native VLAN can be changed when the set vlan vlan-id mod/port command is issued, where mod/port is the trunk port.

In Cisco IOS Software, the native VLAN can be changed when the switchport trunk native vlan vlan-id interface command is issued, which is configured on the trunk port.

To enable the 802.1Q trunking on a CatOS and integrated Cisco IOS Software (native mode) switch, issue these commands:

In the CatOS switch:

cat6000>set trunk mod/port [on , desirable , auto , nonegotiate] dot1q

In the integrated Cisco IOS (native mode) switch:

cat6500(config-if)#switchport trunk {encapsulation dot1q}

For more information visit:

802.1Q Trunking Between Catalyst Switches Running CatOS and Cisco IOS System Software

Benefits of Obtaining a CCIE Routing and Switching (RS) Certification from Cisco

2011-04-18T19:01:00.000-07:00

Quick Overview

What are the benefits of obtaining a CCIE routing and switching certification from Cisco? Read on to learn all about it! It’s an amazing opportunity and one you should definitely take advantage of if this field interests you.

Product Description

Have you ever wanted to show a possible employer that you are knowledgeable in your job or occupation? Did you have a desire to let your customers and clients see that you are serious in your work and strive to achieve perfection as a Cisco certified internetwork expert? Well if so perhaps the idea of obtaining a CCIE Routing and switching certification would benefit you. Cisco has such a course that can bring you more towards achieving these goals in your life.

When you are preparing to sign up for one of the Cisco CCIE certification courses you will notice that there are no formal prerequisites required. Most of the other professional certifications are no longer required by the Cisco training course administrators. The students selected are expected to have an understanding of the various subtleties and the challenges that the networking systems would involve. It is strongly recommended that you have at least three to five productive years on the job in that field prior to attempting to become certified. In order to obtain your CCIE Routing and switching certification you will be required to pass a written qualification exam as well as hands on lab evaluation. This assures that you are qualified and capable of performing the job at hand.

To those who may not be completely knowledgeable of what CCIE stands for. It successfully identifies those verified experts who have the necessary skills and the experience to enable them to handle just about any assignment in the networking field. The CCIE exams receive constant evaluations and are continually updated in order to assure top quality graduates who are favored within the industry. During these revisions the exams are centered upon the most current technology in the industry making Cisco graduates some of the more popular and most desired on the market today.

CCIE is recognized as the most high-level certification one can obtain in the industry today. When applying for a position dealing with networking most industry leaders look favorably upon CCIE Routing and switching certification. Value to the company generally translates of increasing salary in ones paycheck as well. What this boils down to is a great way to increase job security for you and your family’s future.

Often times when it comes down to a selection of possible candidates for a position the difference remains with the Cisco graduates. Various corporations and business tie up a considerable amount of money in their computer network systems and as such they want to ensure that anyone who may be handling this equipment is highly qualified to maintain it. Maintenance of the company’s networks is basic towards protecting their assets and ensuring continual operations. As the various computer environments become more and more complex the need for these qualified professionals is quickly becoming greater than ever before. Certified CCIEs are in high demand in the industry today.

Passing a CCIE exam is not as easy as one may think. Earning the honored CCIE certification requires passing the lab test successfully and there is only one way to prepare for this exam and that is by hands on experience.

Cost wise you will find that the average CCIE student has spent thousands of dollars and a minimum of eighteen months in their efforts to obtain their certification. In fact obtaining this certification is so difficult that the candidates are likely to attempt the lab more than once before they finally achieve their certification but it can be done and the rewards are well worth it.

Additional Information

Certification Level	Expert
Certification Track	CCIE Routing & Switching

GNS3-Topology: CCNA & CCNP Full Mesh Topology Template

2011-04-18T18:20:00.000-07:00

Chris sent me a lab which he says has helped him to work on about 95% of his CCNA and CCNP lab requirements. I think this is a clear sign that using Dynamips or GNS3 can be effective in a big way with exam preperation. That 5% left over can be achieved in a few ways - rack space, friends with labs or purchasing switches on ebay and link them into the virtual topology using real interfaces. Nevertheless Its great to see how much we can do without cash, space or budget (electricity bill) to prepare ourselves for these exams.

This lab is just a template lab and has no configs, routing protocols or scenarios to it. I’ll let Chris explain

I created one simple topology that seems to handle 95% of my CCNA & CCNP lab requirements. It isn’t fancy, but it should save people an hour+ of labor (that is how long it took me to create this topology).

I was getting tired of making one lab per exercise in the Cisco Lab Portfolios and the Certification Zone lab exercises. So I whipped up a 6 router setup that could handle the majority of the router scenarios I am using for practice.

It consists of 6 7206 routers in a full mesh topology. Each router has 2 ethernet connections to a dynamips ’switch’, one each in VLAN1 and VLAN2.

Each router has at least 4 frame connections to the other routers in the topology.

Each router also has 1 frame connection to a frame relay switch, with full mesh DLCI between all routers.

I use dynagen, not GNS3. I created a diagram of the topology using the freeware tool called Network Notepad (http://www.networknotepad.com/) so I can keep track of all the different connections.

Some of the CCNA & CCNP stuff calls for using the Cisco SDM. I created one generic_startup.txt config file. It sets the password to cisco for the router, and enables the http server. It also sets the exec-timeout on con0 to infinite, and disables domain lookup (your pings will work quickly now). All you have to do is bridge GNS3 or Dynagen to your physical network card, and you can use the Cisco SDM to interface with the routers. Or SecureACS, the VPN client, VMWare images, etc….

Warning: this topo uses a lot of RAM. When I have all 6 routers running, my memory utilization jumps from 900mb to 3.5GB. When all 6 routers are idle, I am seeing 10-15% CPU utilization - I have an Intel Core2 Quad processor.

Routers Used: 7206

IOS: c7200-advipservicesk9-mz.124-2.T

Image:

Feature of Topology: Full Mesh Ethernet, Frame Relay

Download: GNS3-Labs:: CCNA-CCNP-Full.Mesh.Topology

Useful iPhone Apps

2011-04-17T13:10:00.000-07:00

OpenTable
http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=296581815&mt=8

ShopShop
http://itunes.apple.com/us/app/shopshop-shopping-list/id288350249?mt=8

Pandora
http://www.pandora.com/on-the-iphone

Traffic!
http://www.inrixtraffic.com/

WebEx
http://www.webex.com/iphone/

Koredoko
http://itunes.apple.com/us/app/koredoko/id286765236?mt=8

Zenbe Lists
http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=284448147&mt=8

Top iPhone applications for sys-admins

2011-04-17T13:04:00.000-07:00

In the business of running web servers, the iPhone is not perceived as a professional tool for system administration. It does lack tethering, the battery is limited, you can’t run multiple apps at the same time, etc. but the most important caveat is there’s no keyboard, which means you can’t type commands with it. A real sys admin tool should also have real-time notification in the background, which is not possible on the iPhone.

Nevertheless, the iPhone or the iPod touch is a compelling mobile device. The 3G access is speedy enough for casual access, there’s a wide array of applications available, with Apple pushing with enterprise features such as IPSec VPN, and after all, it has more features and more power than any other mobile phone available in the market. As such I’ve made a list of applications that sys-admins should find interesting to add to their workflow, from the most obvious to the exotic but useful applications

1. Mail.app

Why: Mail.app allows you to receive alerts and notifications, from third-party monitoring services, and also keep in touch with your team. Mail.app doesn’t have push email, but you can set it up to pull new emails regularly from your email server

Price: $0, included with the iPhone

2. Safari.

Why: Safari will allow you to “visually” check the responsiveness and availability of websites and servers.

Price: $0, included with the iPhone

3. NetNewsWire

Why: This will allow to check status of software or hardware which publish a RSS feed, such as the Status section on the iWeb blog.

Price: Free

iTMS Link: NetNewsWire

4. TouchTerm Pro

Why: TouchTerm Pro allows you to ssh to Solaris and Linux servers, and do remote server administration. TouchTerm Pro is the most complete ssh client for the iPhone.
Price: $14.99
iTMS Link: TouchTerm Pro

5. Jaadu remote desktop

Why: Jaadu remote desktop can connect to your server, windows server 2003 or windows server 2008
Price: $24.99
Link: Jaadu Remote Desktop

6. 1Password

Why: 1Password allows you to store passwords for your servers and different services.

Price: Free

Link: 1Password

7. Network Ping

Why: Network ping has tools for traceroutes, a telnet console, and as the name suggests, a ping tool.

Price: $3.99

Link: Network Ping

8. Network utility

Why: Network Utility allows you to do lookups and scans. Less features than Network Ping, but still potentially useful

Price: $0.99

Link: Network Utility

9. aSubnet

Why: aSubNet is an IPv4 subnet calculator to set up a network

Price: $0.99

Link: aSubnet

10. Inco

Why: Inco is a remote system monitor and administration tool for Mac OS X

Price: Free

Link: Inco

11. iNagios

Why: iNagios is not an iPhone application per se, it’s a web application with pages optimized for the device’s Safari. It’s also read-only, which means you can’t solve any system incident. Still, sys-admins should add it to their bookmark

Price: Free

Link: inagios

12. netshare

Why: NetShare allows you to tether your iPhone’s 3G connection, and work from your laptop, for those times where there is no open wifi access.

Link & Price: This was taken down by Apple shortly after it was put on iTMS. If you did download it… well lucky you!

13. Air Sharing

Why: Air Sharing allows you to store documents on the iPhone. For sys-admins, you can for instance put PDFs of your servers setup and architecture, manuals or reference networking books.

Price: $4.99

Link: Air Sharing

If you have any other applications you use for System administration, do share with us in the comments!

Five security secrets your IT administrators don't want you to know

2011-04-17T12:59:00.000-07:00

As valued members of your organization, IT administrators work every day to keep your infrastructure up and available. But in today’s rush to contain operational costs, your IT administrators could be taking more shortcuts than you’d expect. And perhaps no aspect of IT suffers more from cutting corners than does security. Here are five facts about IT security that your administrators probably don't want you to know.

Most passwords never change

Certainly, regulations may call for frequent password changes on all accounts in your infrastructure. But though your IT administrators may be tasked to change passwords on a regular basis, your organization probably lacks the automation to reliably change what could be thousands of the passwords that matter most.

Sensitive accounts like administrator logins, embedded application-to-application passwords, and privileged service accounts often keep the same passwords for years because IT staff may not have the tools to track and change them. And, because systems and applications often crash when IT personnel attempt to change interdependent credentials, many of your organization’s most privileged logins can go unchanged for extended periods of time.

Ad-hoc change processes and handwritten scripts might succeed in updating the passwords of some types of privileged accounts, but unless your organization has invested in privileged identity management software you can be sure that many of the passwords that grant access to your organization’s most sensitive information are never changed. This means that access to this data – whether by IT staff, programmers, subcontractors and others who ever had access – will continue to spread over time.

Too many individuals have too much access

Regardless of your written policies, highly-privileged account passwords are almost certainly known to large numbers of IT staff. And chances are, for the sake of convenience these logins have been shared with individuals outside of IT.

As a result contractors, service providers, application programmers, and even end-users are likely to have the ability to gain privileged access using credentials that may never change। Unless you’ve got technology in place to track privileged logins, delegate access, and change these powerful credentials after each time they’re used you’ll never know who now has access.

Your CEO's data isn't private

With all the recent headlines about corporate and government data leaks, you might still be surprised to know how many individuals have access to the files on your executive’s computers, and to the data resident in the applications that senior managers use every day. Anyone with knowledge of the right credentials can gain anonymous access to read, copy and alter data – including the communications and application data belonging to your executive staff. In many cases these credentials are known not only to senior IT managers, but also to IT rank and file, application programming teams, contractors and others. More than likely your low paid help desk workers have access to more sensitive data than your CFO. And those subcontractors in India? It’s likely that they can access the CEO's account, too.

IT auditors can be misled

If your administrators know about security gaps or failed policies that your IT auditors haven’t discovered they will most likely try to take the knowledge to their graves. IT staff have limited time to complete higher-visibility projects that influence performance ratings and paychecks, so in most cases you can forget about them fixing any security holes that your auditors fail to notice.

Security often takes a back seat

Is your IT administrators’ pay structure tied to security? No? Then they’re probably not as proactive as you might expect when it comes to securing your network. Most IT administrators won’t tell you about the security vulnerabilities they discover in the course of their jobs because they’re not paid to fight losing battles to gain resources necessary to close each discovered security gap.

Because pay packages are rarely tied to safeguarding your network, your IT administrator is also probably not taking the initiative to update her technical skills when it comes to security. As a result, even when budgets allow for purchases of new security technologies, your staff may have no clue how to actually use these new tools effectively.

Fundamentally, the security of each organization hinges on how well IT balances convenience with controls and accountability. All too often IT is given free reign to operate under its own rules when it comes to security and resists working under the same types of controls that apply to others in the organization.

Those organizations that work to bring IT into balance – introducing accountability through segregation of duties and adequate auditing controls while providing sufficient resources and incentives to provide proactive security – often come out ahead.

How to configure logging in Cisco IOS

2011-04-16T23:28:00.000-07:00

Cisco IOS System Message Logging is enabled by default in order to send logging messages to the console.

These messages can be directed to logging buffers, terminal lines or a UNIX syslog server, depending on the configuration.

Issue the logging on command in order to enable logging.

Logging is enabled by default on Cisco routers.

Issue the no logging on command in order to disable logging.

In order to log messages on internal buffers, issue the logging buffered command.

In order to display buffered log messages, issue the show logging command.

In order to log messages on a syslog server, issue the logging command.

In order to log messages on a non-console terminal, issue the terminal monitor command.

For information on how to synchronize unsolicited messages refer to:

Cisco Configuring Synchronization of Logging Messages

For detailed information about system logging message severity levels refer to:

Cisco Limiting the Error Message Severity Level and Facilities

How to configure GLBP

2011-04-16T23:27:00.002-07:00

The Gateway Load Balancing Protocol (GLBP) feature was integrated into Cisco IOS Software Release 12.2(15)T.

Highly recommend that you use the Cisco Feature Navigator to find the latest information about platform support and Cisco IOS Software image support.

Before configuring the GLBP feature, ensure that your Cisco routers can support multiple MAC addresses on the physical interfaces.

Several Ethernet (LANCE and QUICC) controllers in low-end Cisco products can only have a single unicast MAC address in their address filter.

To verify this, issue the show interfaces command, and ensure that the displayed hardware is neither LANCE nor QUICC.

These controllers do not support association of multiple MAC addresses with the interface.

Configuring basic GLBP is simple.

The basic configuration closely resembles the Hot Standby Router Protocol (HSRP) configuration.

The following sample configuration sets up two routers R1 and R2 as GLBP gateways serving the 10.1.1.0 network with 10.1.1.1 as the virtual gateway address.

This is the default gateway that would be configured on all the hosts in the 10.1.1.0 network, as shown:

R1# show running interface e0/0

ip address 10.1.1.2 255.255.255.0
glbp 1 ip 10.1.1.1

R2# show running interface e0/0
ip address 10.1.1.3 255.255.255.0
glbp 1 ip 10.1.1.1

The default mode for loadbalancing is round-robin.

This can be changed issuing the glbp 1 load-balancing host-dependent interface command.

When this command is configured, the Active Virtual gateway (AVG) ensures that a specific host gets its Address Resolution Protocol (ARP) mapping with the MAC address of the same AVF all the time.

To perform unequal load balancing, issue the glbp 1 load-balancing weighted command.

For more information on configuration, debug and verification of GLBP refer to:

Gateway Load Balancing Protocol

How to configure RIP v1 and RIP v2

2011-04-16T23:27:00.001-07:00

The Routing Information Protocol (RIP) is a distance-vector interior gateway protocol that uses hop count as its metric.

RIP version 1 (v1) is a classfull routing protocol.

RIP version 2 (v2) is classless.

To enable RIP routing on a Cisco router, issue the router rip command in global configuration mode.

To specify a list of networks for the RIP routing process, issue the network command in router configuration mode.

By default, RIP enabled routers run RIP v1.

To specify a Routing Information Protocol (RIP) version used globally by the router, issue the version command in router configuration mode.

A RIP router might need to be able to exchange updates with both v1 and v2 routers.

To specify a Routing RIP version to send on an interface basis, issue the ip rip send version command in interface configuration mode.

To specify a Routing Information Protocol (RIP) version to receive on an interface basis, issue the ip rip receive version command in interface configuration mode.

For more information refer to:

Configuring RIP

How to configure default routing so different default routes are used based on the source of the packet (Policy Based Routing)

2011-04-16T23:19:00.000-07:00

How to configure default routing so different default routes are used based on the source of the packet, such as based on which devices or users are originating the packets.

The default route is already configured on the router, and you want to policy route certain users to different Internet Service Providers (ISPs).

Issue the set ip default next-hop command in the route-map command configuration mode.

Configure Policy Based Routing (PBR) specifying a different default IP next hop for interested traffic by issuing a route-map command.

This is a sample configuration for the traffic sourced from 10.1.1.0/24, coming in on interface Ethernet0, policy routed to next-hop x.x.x.x:

int Ethernet0
ip address 10.1.1.1 255.255.255.0
ip policy-map new-gateway

route-map new-gateway permit 10
match ip address 10
set ip default next-hop x.x.x.x

access-list 10 permit 10.1.1.0 0.0.0.255

Note: The traffic that does not match the policy uses the default route configured in the router.

For more information on PBR refer to:

Configuring IP Routing Protocol-Independent Features

Policy-Based Routing

For more information on default routes refer to:

Configuring a Gateway of Last Resort Using IP Commands

How to configure static routes

2011-04-16T23:17:00.000-07:00

Routers send packets to various networks based on the information available in the routing table.

They learn about the networks that are directly connected, based on the IP addresses configured on their interfaces.

These networks are automatically included in the routing table, which is then used for sending packets to destinations belonging to them.

For routers to send or forward packets to networks that are not directly connected, they must know the path to reach the destination network.

One way for the router to know the path to such networks is to configure a static route, which adds this particular route to the routing table.

To configure a static route, issue the ip route prefix mask {ip-address | interface-type interface-number [ip-address]} [distance] [name] [permanent] [tag tag] command in global configuration mode.

For example, issue the command ip route 192.168.20.0 255.255.255.0 192.168.17.254 to configure a static route for the network 192.168.20.0/24 pointing to the next-hop IP address 192.168.17.254.

The next-hop IP address should either be directly connected or should be reachable by recursive routing table lookup if not connected directly.

For more information on specifying next-hop IP addresses for static routes refer to:

Specifying a Next Hop IP Address for Static Routes

How does load balancing work?

2011-04-16T23:16:00.000-07:00

To address the need for high availability and scalability, networks often use multiple parallel links.

To provide aggregate bandwidth greater than that available with a single link, parallel links are used.

Load balancing occurs when traffic destined to a network is forwarded over multiple parallel paths.

Routers prefer routes learned through protocols with lower administrative distance.

For load balancing to work, the parallel routes are learned through a single routing protocol.

This protocol should have the least administrative distance among all the routing protocols running on the router.

These multiple routes to a destination are compared by their metrics, and the shortest path is installed in the routing table.

If there is more than one path with the same least metric value, all least-metric routes are installed in the routing table.

Some protocols, such as Enhanced Interior Gateway Routing Protocol (EIGRP), can be configured to install multiple paths.

This may occur even if the paths are not of equal metric.

To determine the number of routes that be installed based on the value configured for the protocol, issue the maximum-paths command.

The maximum number of parallel paths installed is Cisco IOS Software and protocol dependent.

Once multiple paths are installed, routers will load balance on the paths on a per-packet or per-destination basis.

A router load balancing on a per-packet basis uses the parallel paths in a round-robin fashion, only forwarding a single packet on a path before moving on to the next one.

A router load balancing on a per-destination basis uses the parallel routes in a round-robin fashion, but forwards an entire destination-based flow in each pass.

Per-packet or per-destination load balancing is dependent on the switching mechanism configured on the interface.

Interfaces configured for process switching load balance on a per-packet basis.

Interfaces configured for fast or optimum switching load balance on a per-destination basis.

Meanwhile, interfaces configured for Cisco Express Forwarding (CEF) can load balance on a per-packet basis or per-source-destination basis.

For more information refer to these documents:

How Does Load Balancing Work?

Load Balancing with CEF

How to configure OSPF

2011-04-16T23:13:00.000-07:00

Open Shortest Path First (OSPF) is an interior gateway, link-state routing protocol.

OSPF routers exchange information about the state of the links in the network, and this information is entered into the topology database.

The Shortest Path First (SPF) algorithm is then run on the contents of the topology or link state database to build the routing table.

Basic OSPF configuration involves enabling an OSPF routing process on a router and specifying a range of IP addresses associated with the routing process along with the corresponding area ID.

To configure an OSPF routing process, issue the router ospf command in global configuration mode.

To define the interfaces on which OSPF runs and to define the area ID for those interfaces, issue the network area command in router configuration mode.

Depending on the topology, additional configuration, such as explicitly defining neighbors and controlling Designated Router (DR) and Backup Designated Router (BDR), might be necessary.

For additional information on basic OSPF configuration and other OSPF configuration options refer to:

Configuring OSPF

For information on how to design and deploy OSPF in large networks refer to the:

OSPF Design Guide

How to configure NAT

2011-04-16T23:11:00.000-07:00

NAT is very useful in these instances:

	Conserving IP address space.
	Implementing TCP load distribution.
	Connecting networks with overlapping addresses.
	During network migration, which involves the renumbering of nodes.
	Connecting a private network using an unregistered address to a public network like the Internet.
	Distributing other Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) based services.

A router configured for NAT maintains a translation table that has the mapping between the addresses used in the translation.

Configuring NAT involves identifying the NAT inside and NAT outside interfaces, then configuring the way the addresses are to be translated, depending on the requirement.

A router configured with NAT translates only traffic that is forwarded between the inside and outside interfaces, and the flow that matches the criteria specified for translation.

Traffic that does not meet these conditions is forwarded without any translation.

To configure the inside and outside interfaces, issue the ip nat inside and ip nat outside commands under the respective interfaces.

A static NAT configuration creates a one-to-one mapping and translates a specific address to another address.

This type of configuration creates a permanent entry in the NAT table, as long as the configuration is present and is useful when users on both inside and outside networks need to initiate a connection.

To configure static NAT, issue the ip nat inside source static or ip nat outside source static commands in global configuration mode, depending on where the host is located.

Static NAT can also be used to redirect traffic using a particular port to a different port on a host.

This is helpful when the users belonging to the inside network use a particular port number to access a particular application (like a web server) available on the inside or outside network.

The same application is accessed by users from the outside network using a different port number.

To redirect traffic to a different port, issue the ip nat inside source {static {tcp|udp local-ip local-port global-ip global-port} [extendable] or ip nat outside source {static tcp|udp global-ip global-port local-ip local-port} [extendable] commands in global configuration mode, depending on whether the inside or outside network is available.

Another type of configuration is dynamic NAT, which is useful when a limited number of addresses is available instead of the actual number of hosts to be translated.

The addresses used for translation are configured by issuing the ip nat pool command in global configuration mode.

The hosts to be translated are specified by issuing the access-list command or match statements in the route-map command.

The pool and the list of hosts to be translated are linked together by issuing the ip nat inside source list name pool name command or the ip nat inside source route-map name pool name command in global configuration mode.

The command can be issued for an outside network by replacing the keyword "inside" with "outside".

Dynamic NAT creates an entry in the NAT table, when the host initiates a connection and establishes a one-to-one mapping between the addresses.

But the mapping could vary depending on the address available in the pool at the time of communication.

Dynamic NAT allows sessions to be initiated from inside or outside networks for which it is configured.

Dynamic NAT entries are removed from the translation table if the host does not communicate for a specific period of time, which is configurable, and the address is returned to the pool for use by another host.

Another form of dynamic translation is overloading or Port Address Translation (PAT), which allows many hosts to be mapped to a single address at the same time.

When PAT is configured, the router makes use of the source port numbers to distinguish the sessions from different hosts.

PAT creates an extended translation entry in the NAT table by including the protocol as well as the port information.

PAT is configured by adding the overload option to the dynamic NAT configuration command, which binds the hosts and the pool.

Static and dynamic NAT can be configured simultaneously when it is required.

This occurs in cases where many addresses are not available for translation, and certain devices must be statically configured for NAT at the same time.

For more information on configuring NAT refer to these documents:

NAT: Local and Global Definitions

Configuring Static and Dynamic NAT Simultaneously

Configuring Network Address Translation: Getting Started

How to configure IP addressing

2011-04-16T23:02:00.000-07:00

A basic required task for configuring IP is to assign IP addresses to network interfaces, further explanation:

Configuring IP addressing

Doing so enables the interfaces and allows communication with hosts on those interfaces using IP, further explanation:

Host and subnet quantities

Associated with this task are decisions about subnetting and masking the IP addresses, further explanation:

IP addressing and subnetting for new users

Cisco Tools

2011-04-16T23:01:00.000-07:00

3Com IP Addressing Tutorial
ACL Wildcard Mask Calculator
AirSnort WLAN Tool
Alfresco Community Network - Free ECM
All Net Tools - Tool Box
APC Product Selectors
Attacking DHCP, Mitigating With Cisco Switch
Bandwidth Calculator
Bandwidth Speed Test Tool
Belkin Wizards
Bits/Bytes Conversion Calculator
Black Box Custom Cable and Adapter Wizards
Boson Free Utilities, Cisco Config Register Calculator
Broadband Tools
Cain - Windows Based Hacking Tool
CertSearch Tool - rates Cisco practice test providers
CIDR Report
CIDR / VLSM Supernet Calculator
Cisco 827/827H/SOHO97/837 ADSL Firewall IPSec Config
Cisco 827/827H/SOHO97/837 ADSL IPSec Config
Cisco 827/827H/SOHO97/837 Basic Config
Cisco 827/827H/837 Business Config
Cisco 827, 827H, 837, SOHO97 Config Wizard
Cisco 851/851W/857/857W/871/871W/877/877W Wizard
Cisco 827/827H/SOHO97/837 Firewall Config
Cisco 827/827H/837 Firewall PPTP Config
Cisco 827H/SOHO97/837 GUI Config
Cisco 837, SOHO97 IPv6 Config Wizard
Cisco 827/827H/837/850/870/SOHO97 Software Picks
Cisco 1700 Series Solution Design Tool
Cisco 2600/3600/3700 Memory Calculator
Cisco 3620/3640/3660/7200 Simulator
Cisco Account Support
Cisco ACL Editor and Simulator
Cisco Administration Tools - The Ultimate List
Cisco Aironet 1500 Path Loss Calculator
Cisco Aironet Outdoor Bridge Range Calculation Utility
Cisco ASR 1000 Cost of Ownership Calculator
Cisco ASR 1000 Environmental Impact Calculator
Cisco AutoQoS ROI Calculator
Cisco BitSwapping Tool
Cisco Blog Roll
Cisco BPX/IGX Firmware Compatibility Tool
Cisco Bug Toolkit
Cisco Business Ready Teleworker ROI Calculator
Cisco Case Study Tool
Cisco Catalyst 2950 Config Wizard
Cisco Catalyst 2950 Slow Down Viruses
Cisco Catalyst Switch Solution Finder
Cisco CatOS to IOS Config Converter
Cisco-centric Open Source Initiative
Cisco CCIE Verification Tool
Cisco Certification Online Support
Cisco Certification Tracking System
Cisco Certification Validation
Cisco Certification Verification
Cisco Command Lookup Tool
Cisco ConfigMaker Software
Cisco CPQRGs Last 9 Years
Cisco Customer Contact Software Bandwidth Calculators
Cisco Customer Profile Database
Cisco Customer Training Tools - Free
Cisco Data Center Design Best Practices Tool
Cisco Download Free CTIServer For Basic Caller ID
Cisco DSP Calculator
Cisco Dynamic Configuration Tool
Cisco EDI CatOS to IOS Configuration Conversion Tool
Cisco EEM Scripts to Customize IOS
Cisco End-of-Sale and End-of-Life Products
Cisco Error Message Decoder
Cisco Feature Navigator
Cisco Gathering Basic Cisco CallManager Traces
Cisco Global Learning Partner Locator
Cisco Global Pre-Sales Support
Cisco Global Web Site and Language Selector
Cisco How Setup Cisco AP To WPA With Microsoft SBS 2003
Cisco How To Load Config File Onto Cisco Router
Cisco How To Do Port Forwarding Cisco NAT
Cisco How-To Tutorials
Cisco ICS 7750 Configuration Tool
Cisco IDE RAID
Cisco IOS MIB Tools
Cisco IOS Reference Guide
Cisco IOS Software Modularity Patch Navigator
Cisco IOS Software Selector
Cisco IOS XR Software Selector
Cisco IPC Cost Savings Calculator
Cisco IP Communications: Return on Investment Calculator
Cisco IPSec VPN and DSL Performance
Cisco IP Subnet Calculator
Cisco IP Telephony Readiness Assessment Tool
Cisco IPv6 Installation
Cisco Jobs
Cisco Microsoft SBS 2003 IPv6 Readiness
Cisco Network Academy Locator
Cisco Network Academy PLAN-IT Toolkits
Cisco Old Technical Documentation
Cisco Output Interpreter
Cisco Partner Access Online
Cisco Partner Authorized Distributor Locator
Cisco Partner Business Central - DPRG
Cisco Partner Business Planning
Cisco Partner Campaign Builder
Cisco Partner Capital Resource Library
Cisco Partner CARE
Cisco Partner Certification and Specialization Application
Cisco Partner Channel Account Manager Locator
Cisco Partner Channel Marketing Fund Builder Tool
Cisco Partner CLEI
Cisco Partner Counterfeit Reporting
Cisco Partner Cross Reference Tool
Cisco Partner Customer Service Case Management Tool
Cisco Partner Customer Success Story Submittal
Cisco Partner E-Learning Connection
Cisco Partner Finance Solutions
Cisco Partner Help Online
Cisco Partner Initiated Customer Access Tool
Cisco Partner Locator
Cisco Partner Marketing Funds
Cisco Partner Marketing Library
Cisco Partner Ordering Lead Times Tool
Cisco Partner Ordering Status Tool
Cisco Partner Ordering Tool
Cisco Partner Order Service Contacts
Cisco Partner PDI Help Desk
Cisco Partner Performance Metrics Central
Cisco Partner Pricing Tool
Cisco Partner Quote Builder
Cisco Partner Registration
Cisco Partner Self Service
Cisco Partner Service Contract Center
Cisco Partner Solution Catalog
Cisco Partner SONA Network Multiplier Benefits Simulator
Cisco Partner Standardized BOM Templates
Cisco Partner Steps to Success
Cisco Partner Trade-In Accelerator Program Tool
Cisco Partner Trade-In Tools
Cisco Partner Value Incentive Program Tool
Cisco Partner Value Selling Tool Suite
Cisco Partner View
Cisco Password Cracker
Cisco PIX 501 Firewall Config Template
Cisco PIX VPN GUI Config
Cisco Power Calculator
Cisco Product Advisor

Cisco Product Alert Tool
Cisco Product Approved Status
Cisco Product Documentation New and Revised
Cisco Product Field Notices
Cisco Product Identification Tool
Cisco Product Release Notes
Cisco Product Security Incident Response
Cisco Product Upgrade Tool
Cisco Profile Manager
Cisco Recommended Service Providers Locator
Cisco Refurbished Configurations Report
Cisco Refurbished Inventory Availability and List Pricing
Cisco Repair and Hardware Troubleshooting
Cisco Report Product Security Incidents
Cisco Retail Collaboration Benefits Calculator
Cisco RIF Decoder Tool
Cisco RMA Service Order Tools
Cisco RMA U.S. and Canada Service Order Returns
Cisco Router Configure QoS Template
Cisco Routers that Support NetFlow
Cisco Sales Office Locator
Cisco Secure Business Advisor
Cisco Security Agent ROI Calculator
Cisco Security Center
Cisco Security Conversion Tool
Cisco Security Policy Builder
Cisco Service Finder
Cisco Small Business Network Designer
Cisco Smart Business Roadmap Assessment Tool
Cisco SMARTnet Service Availability Matrix Search
Cisco SNMP Object Navigator
Cisco Software Advisor
Cisco Software Downloads
Cisco Software License Registration
Cisco Software Registration
Cisco Software Search
Cisco Solution Designer
Cisco Solution Finder for Modular Routers
Cisco Special File Access
Cisco Subnetting Game
Cisco TAC Open Case
Cisco TAC Update Case
Cisco Technical Forums
Cisco Technology Developer Partner Locator
Cisco Unity Tools
Cisco Visio Stencils
Cisco Voice Codec Bandwidth Calculator
Cisco Voice Technology Group Subscription Tool
Cisco VPN Client GUI Error Lookup Tool
Cisco VPN Savings Calculator
Cisco vs. Competitor Lab Tests
Cisco WAFS Online Support Tool
Cisco WAN Performance Testing
Cisco Warranties
Cisco WLAN Productivity Savings Payback Calculator
CiscoWorks LMS/RWAN ROI Calculator
Commonly Open Ports
Currency Converter Tool
dBm/dBW Calculator
DNS Advisor
Domain Name/IP Address Lookup - Domain Dossier
Domain Name/Whois Go Daddy
Domain Name/Whois/WhoisIP/SPAM Database/Traceroute/Ping
Domain Name/Whois Network Solutions
Domain Tools
Download.com
Dynamips Cisco Router Hardware Emulator
Ethereal - Free Protocol Analyzer/Packet Sniffer
Firewall Test and Port Scan Tools
Flowalyzer Free NetFlow & sFlow Tester
Foundstone Free Tools
FTP File Search
H.264 High Profile Quick Savings Tool
How to Activate Cisco NetFlow, sFlow, IPFIX and NetStream
How to Determine the Serial Number of Catalyst Switch Components
How to Find/Display Your MAC Address
How to solve Windows system crashes in minutes
How to Structured Wiring
How to Subnet a Network
HP Printing Supplies Finder
Intellishield PSIRT Search Tool
International Dialing Codes
International Dialing Codes Alphabetical
Internet Country Codes
IP Addressing and Subnetting for New Users
IP Address Locator Tool
IP Address Subnetting Tutorial
IP Subnet Calculator
IP Subnet Calculator for Windows
IP Subnetting Made Easy
IRRToolSet
Lancope NetFlow Bandwidth Calculator
Learn to Subnet
Linksys Knowledge Base
Lokbox Blacklist Converter Applet
Looking Glass Level 3 Tools
ManageEngine DeviceExpert Configuration Management
MIBs Supported By Cisco Product
Michael Morris Cisco Tech Links
Microsoft Knowledge Base
Netcordia Network Software Tools
Netcraftsmen iPhone Subnet Calculator Toolkit
NetQoS Network Latency Calculator
NetQoS Subnet Calculator
NetSetMan Network Settings Manager Tool
Network Calculators/Subnet Mask/Inverter/Network Node
Network Monitoring Tools
Network Tools
NWTools
OUI and Company_id Assignments
Paris Traceroute Tool
Pearson VUE Cisco Testing
Port Forward Router/Firewall Config Wizard
RMX H.264 High Profile Quick Savings Tool
RWIN/BDP Calculator
Samplicator - UDP datagrams
Scrutinizer Free NetFlow and sFlow Analyzer
Security Scan
Shrubbery Networks Tools
SolarWinds TFTP Server, NetFlow Configurator, VM Monitor Tools
Spam Cost Calculator
Speed Test
TCP/IP Analyzer
TCP Optimizer
Terminal Emulators
Theoretical Maximum TCP Throughput
Traceroute.org
Trend Micro Submission Wizard
TTCP TCP and UDP Throughput Test Tool
U.S. Telephone Area Codes
Vendor/Ethernet MAC Address Lookup and Search Tool
VE Network Catcher Shunra Network Monitoring Tool
Voice over IP Calculators
VoIP Test Tool
Vunerable Ports
Wi-Fi Certified Products Tool
Wi-Fi HotSpot Directory Tool
Wi-Fi HotSpot Zone Finder Tool
wikiHow - Networking
Wireless Bridge ROI Calculator
Wireless Home Network Guide
Wireless Solution ROI Calculator
WLAN Key Generator
World Clock

Cisco Repair and Hardware Troubleshooting

2011-04-16T22:56:00.000-07:00

Before requesting a quote on our board level expert Cisco repair, you may wish to first investigate:

Cisco Hardware Troubleshooting Links

AS5200 Gateway
AS5300 Gateway
AS5350 Gateway
AS5400 Gateway
AS5800 Gateway
800 Series Router
1600 Series Router
1700 Series Router
1800 Series Router
2500 Series Router
2600 Series Router
2800 Series Router
3600 Series Router
3700 Series Router
3800 Series Router
4000 Series Router
SN 5420 Storage Router
6400 Series Router
7100 Series Router

7200 Series Router
uBR72xx Router
uBR7246 VXR Router
7300 Series Router
7400 Series Router
7500 Series Router
7500 Series RSP
7500 Series VIP
10000 ESR Router
12000 Line Card
12000 Series Router
High CPU Utilization
How-To Tutorials
Memory Problems
Password Recovery Procedures
Router Crashes
Technical Forums
1010 ATM Switch
2900XL Switch

2926 Switch
2926G Switch
2948G Switch
2948G-L3 Switch
2980G Switch
3500XL Switch
4000 Switch
4000 Supervisor III/IV
4500 Supervisor III/IV
4908G-L3 Switch
4912G Switch
5000 Switch
5500 Switch
6000 Crashes
6000 CatOS WS-X6348
6000 Cisco IOS WS-X6348
6000 MSFC, MSFC2, MSFC2a
6000 Switch
6500 Crashes

6500 CatOS WS-X6348
6500 Cisco IOS WS-X6348
6500 MSFC, MSFC2, MSFC2a
6500 Switch
8510 MSR Switch
8540 MSR Switch
8600 BPX Switches
CVA120 Cable Voice Adapter
MC3810 Concentrators
MICA Modem
ONS 15327
PIX Firewall
ROMmon Recovery
Support Wiki
uBR900 Cable Modem

The ultimate list of Cisco administration tools

2011-04-16T22:52:00.000-07:00

Here is what we have so far:

Arpwatch-ng
Big Brother
Cacti
Cisco Adaptive Security Device Manager (ASDM)
Cisco-centric Open Source Community (COSI).
Cisco Monitor Director
Cisco Monitor Manager
Cisco Network Assistant
Cisco's Security Device Manager (SDM)
CiscoWorks
HP OpenView
Hyperterminal
Kiwi CatTools
Kiwi Syslog Daemon
MRTG
Nagios
Nessus
Netdisco
NetMRI
Paessler Router Traffic Grapher (PRTG)
Putty
RANCID with CVSweb
SecureCRT
SNMP
SolarWinds Engineer's Toolkits
ssh client eg TeraTerm
Syslog-ng with phpsyslog-ng
tftpd32
tftp server eg Solarwinds
TraffStats
WhatsUp
WinAgents IOS Config Editor
Wireshark/Ethereal

Windows 8 early build leaks

2011-04-13T19:13:00.000-07:00

Microsoft deciding to release early code to trusted partners is always going to be a double-edged sword. On the one hand, it allows for valuable feedback and bug identification on software before it gets released to consumers and business users alike, on the other, it’s an opportunity for the less scrupulous among us to share that early code with everyone.

Windows 8 is no exception to this rule. A day after screenshots of the Windows App Store leaked, it seems a complete early build of the operating has now been released.

The version that has appeared for download is an ISO carrying the name 6.1.7850.0.winmain_win8m1.100922-1508_x86fre_client-enterprise_en-us. It’s a 2.45GB download suggesting this is a full OS release, although we suspect much of the code will be Windows 7 with features from 8 being used on top of that base. The screenshots that have appeared backup that suspicion with the system information identifying it as Windows 7 Enterprise.

This is a leaked operating system that is already getting a lot of attention on file-sharing networks, but really isn’t something you want to install to work with. It’s Windows 7+, with Windows 8 not expected until early next year, meaning there’s still a lot of Microsoft to add.

How To Set Up Linux DNS Services

2011-04-13T01:53:00.000-07:00

How To Set Up Linux DNS Services

The material on this page was prepared using Sarge or Etch
configured using our Installation and Packages pages.
If you did not use our pages to set up your system, what you
encounter on your system may be different than what is given here.

As mentioned on the Networking page, every system on the Internet must have a unique IP address. (This does not include systems that are behind a NAT firewall because they are not directly on the Internet.) DNS acts as a directory service for all of these systems, allowing you to specify each one by its hostname. A telephone book allows you to look up an individual person by name and get their telephone number, their unique identifier on the telephone system's network. DNS allows you to look up individual server by name and get its IP address, its unique identifer on the Internet.

There are other hostname-to-IP directory services in use, mainly for LANs. Windows LANs can use WINS. UNIX LANs can use NIS. But because DNS is the directory service for the Internet (and can also be used for LANs) it is the most widely used. UNIX LANs could always use DNS instead of NIS, and starting with Windows 2000 Server, Windows LANs could use DNS instead of, or in addition to, WINS. And on small LANs where there are only a few machines you could just use HOSTS files on each system instead of setting up a server running DNS, NIS, or WINS.

As a service, DNS is critical to the operation of the Internet. When you enter www.some-domain.com in a Web browser, it's DNS that takes the www host name and translates it to an IP address. Without DNS, you could be connected to the Internet just fine, but you ain't goin' no where. Not unless you keep a record of the IP addresses of all of the resources you access on the Internet and use those instead of host/domain names.

So when you visit a Web site, you are actually doing so using the site's IP address even though you specified a host and domain name in the URL. In the background your computer quickly queried a DNS server to get the IP address that corresponds to the Web site's server and domain names. Now you know why you have to specify one or two DNS server IP addresses in the TCP/IP configuration on your desktop PC (in the resolv.conf file on a Linux system and the TCP/IP properties in the Network Control Panel on Windows systems).

A "cannot connect" error doesn't necessarily indicate there isn't a connection to the destination server. There may very well be. The error may indicate a failure in "resolving" the domain name to an IP address. I use the open source Firefox Web browser on Windows systems because the status bar gives more informational messages like "Resolving host", "Connecting to", and "Transferring data" rather than just the generic "Opening page" with IE. (It also seems to render pages faster than IE.)

In short, always check for correct DNS operation when troubleshooting a problem involving the inability to access an Internet resource. The ability to resolve names is critical, and later in this page we'll show you some tools you can use to investigate and verify this ability.

When you are surfing the Web viewing Web pages or sending an e-mail your workstation is sending queries to a DNS server to resolve server/domain names. (Back on the Modems page we showed you how to set up your resolv.conf file to do this.) When you have you own Web site that other people visit you need a DNS server to respond to the queries from their workstations.

When you visit Web sites, the DNS server your workstation queries for name resolution is typically run by your ISP, but you could have one of your own. When you have your own Web site the DNS servers which respond to visitors queries are typically run by your Web hosting provider, but you could likewise have your own one of these too. Actually, if you set up your own DNS server it could be used to respond to both "internal" (from your workstation) and "external" (from your Web site's visitors) queries.

Even if you don't have your own domain name, or even your own LAN, you can still benefit from using a DNS server to allow others to access your Debian system. If you have a single system connected to the Interent via a cable or DSL connection, you can have it act as a Web/e-mail/FTP server using a neat service called "dynamic DNS" which we'll cover later. Dynamic DNS will even work with a modem if you want to play around with it.

DNS Server Functions

You can set up a DNS server for several different reasons:

Internet Domain Support: If you have a domain name and you're operating Web, e-mail, FTP, or other Internet servers, you'll use a DNS server ro respond to resolution queries so others can find and access your server(s). This is a serious undertaking and you'd have to set up a minimum of two of them. On this page we'll refer to these types of DNS servers as authoritative DNS servers for reasons you'll see later. However, there are alternatives to having your own authoritative DNS server if you have (or want to have) your own domain name. You can have someone else host your DNS records for you. Even if someone else is taking care of your domain's DNS records you could still set up one of the following types of DNS servers.

Local Name Resolution: Similar to the above scenario, this type of DNS server would resolve the hostnames of systems on your LAN. Typically in this scenario there is one DNS server and it does both jobs. The first being that it receives queries from workstations and the second being that it serves as the authoritative source for the responses (this will be more clear as we progress). Having this type of DNS server would eliminate the need to have (and manually update) a HOSTS file on each system on your LAN. On this page we'll refer to these as LAN DNS servers.

During the Debian installation you are asked to supply a domain name. This is an internal (private) domain name which is not visible to the outside world so, like the private IP address ranges you use on a LAN, it doesn't have to be registered with anyone. A LAN DNS server would be authoritative for this internal, private domain. For security reasons, the name for this internal domain should not be the same as any public domain name you have registered. Private domain names are not restricted to using one of the established public TLD (Top Level Domain) names such as .com or .net. You could use .corp or .inc or anything else for your TLD. Since a single DNS server can be authoritative for multiple domains, you could use the same DNS server for both your public and private domains. However, the server would need to be accessible from both the Internet and the LAN so you'd need to locate it in a DMZ. Though you want to use different public and private domain names, you can use the same name for the second-level domain. For example, my-domain.com for the public name and my-domain.inc for the private name.

Internet Name Resolution: LAN workstations and other desktop PCs need to send Internet domain name resolution queries to a DNS server. The DNS server most often used for this is the ISP's DNS servers. These are often the DNS servers you specify in your TCP/IP configuration. You can have your own DNS server respond to these resolution queries instead of using your ISP's DNS servers. My ISP recently had a problem where they would intermittently lose connectivity to the network segment that their DNS servers were connected to so they couldn't be contacted. It took me about 30 seconds to turn one of my Debian systems into this type of DNS server and I was surfing with no problems. On this page we'll refer to these as simple DNS servers. If a simple DNS server fails, you could just switch back to using your ISP's DNS servers. As a matter of fact, given that you typically specify two DNS servers in the TCP/IP configuration of most desktop PCs, you could have one of your ISP's DNS servers listed as the second (fallback) entry and you'd never miss a beat if your simple DNS server did go down. Turning your Debian system into a simple DNS server is simply a matter of entering a single command.

Don't take from this that you need three different types of DNS servers. If you were to set up a couple authoritative DNS servers they could also provide the functionality of LAN and simple DNS servers. And a LAN DNS server can simultaneously provide the functionality of a simple DNS server. It's a progressive type of thing.

If you were going to set up authoritative DNS servers or a simple DNS server you'd have to have a 24/7 broadband connection to the Internet. Naturally, a LAN DNS server that didn't resolve Internet host/domain names wouldn't need this.

A DNS server is just a Debian system running a DNS application. The most widely used DNS application is BIND (Berkeley Internet Name Domain) and it runs a daemon called named that, among other things, responds to resolution queries. We'll see how to install it after we cover some basics.

DNS Basics

Finding a single server out of all of the servers on the Internet is like trying to find a single file on drive with thousands of files. In both cases it helps to have some hierarchy built into the directory to logically group things. The DNS "namespace" is hierarchical in the same type of upside-down tree structure seen with file systems. Just as you have the root of a partition or drive, the DNS namespace has a root which is signified by a period.

When specifying the absolute path to a file in a file system you start at the root and go to the file:
/etc/bind/named.conf
When specifying the absolute path to a server in the DNS namespace you start at the server and go to the root:
www.aboutdebian.com.
Note that period after the 'com' as it's important. It's how you specify the root of the namespace. An absolute path in the DNS namespace is called a FQDN (Fully Qualified Domain Name). The use of FQDNs are prevalent in DNS configuration files and it's important that you always use that trailing period.

Internet resources are usually specified by a domain name and a server hostname. The www part of a URL is often the hostname of the Web server (or it could be an alias to a server with a different host name). DNS is basically just a database with records for these hostnames. The directory for the entire telephone system is not stored in one huge phone book. Rather, it is broken up into many pieces with each city having, and maintaining, its piece of the entire directory in its phone book. By the same token, pieces of the DNS directory database (the "zones") are stored, and maintained, on many different DNS servers located around the Internet. If you want to find the telephone number for a person in Poughkeepsie, you'd have to look in the Poughkeepsie telephone book. If you want to find the IP address of the www server in the some-domain.com domain, you'd have to query the DNS server that stores the DNS records for that domain.

The entries in the database map a host/domain name to an IP address. Here is a simplistic logical view of the type of information that is stored (we'll get to the A, CNAME, and MX designations in a bit).

A	www.their-domain.com	172.29.183.103
MX	mail.their-domain.com	172.29.183.217
A	debian.your-domain.com	10.177.8.3
CNAME	www.your-domain.com	10.177.8.3
MX	debian.your-domain.com	10.177.8.3

This is why a real Internet server needs a static (unchanging) IP address. The IP address of the server's NIC connected to the Internet has to match whatever address is in the DNS database. Dynamic DNS does provide a way around this for home servers however, which we'll see later.

When you want to browse to www.their-domain.com your DNS server (the one you specify in the TCP/IP configuration on your desktop computer) most likely won't have a DNS record for the their-domain.com domain so it has to contact the DNS server that does. When your DNS server contacts the DNS server that has the DNS records (referred to as "resource records" or "zone records") for their-domain.com your DNS server gets the IP address of the www server and relays that address back to your desktop computer. So which DNS server has the DNS records for a particular domain?

When you register a domain name with someone like Network Solutions, one of the things they ask you for are the server names and addresses of two or three "name servers" (DNS servers). These are the servers where the DNS records for your domain will be stored (and queried by the DNS servers of those browsing to your site). So where do you get the "name servers" information for your domain? Typically, when you host your Web site using a Web hosting service they not only provide a Web server for your domain's Web site files but they will also provide a DNS server to store your domain's DNS records. In other words, you'll want to know who your Web hosting provider is going to be before you register a domain name (so you can enter the provider's DNS server information in the name servers section of the domain name registration application).

You'll see the term "zone" used in DNS references. Most of the time a zone just equates to a domain. The only times this wouldn't be true is if you set up subdomains and set up separate DNS servers to handle just those subdomains. For example, a company would set up the subdomains us.their-domain.com and europe.their-domain.com and would "delegate" a separate DNS server to each one of them. In the case of these two DNS servers their zone would be just the subdomains. The zone of the DNS server for the parent their-domain.com (which would contain the servers www.their-domain.com and mail.their-domain.com) would only contain records for those few machines in the parent domain.

Note that in the above example "us" and "europe" are subdomains while "www" and "mail" are host names of servers in the parent domain.

Once you've got your Web site up and running on your Web hosting provider's servers and someone surf's to your site, the DNS server they specified in their local TCP/IP configuration will query your hosting provider's DNS servers to get the IP address for your Web site. The DNS servers that host the DNS records for your domain, i.e. the DNS servers you specify in your domain name registration application, are the authoritative DNS servers for your domain. The surfer's DNS server queries one of your site's authoritative DNS servers to get an address and gets an authoritative response. When the surfer's DNS server relays the address information back to the surfer's local PC it is a "non-authoritaive" response because the surfer's DNS server is not an authoritative DNS server for your domain.

Example: If you surf to MIT's Web site the DNS server you have specified in your TCP/IP configuration queries one of MIT's authoritative DNS servers and gets an authoritative response with the IP address for the 'www' server. Your DNS server then sends a non-authoritative response back to your PC. You can easily see this for yourself. At a shell prompt, or a DOS window on a newer Windows system, type in:
nslookup www.mit.edu
First you'll see the name and IP address of your locally-specified DNS server. Then you'll see the non-authoritative response your DNS server sent back containing the name and IP address of the MIT Web server.

If you're on a Linux system you can also see which name server(s) your DNS server contacted to get the IP address. At a shell prompt type in:
whois mit.edu
and you'll see three authoritative name servers listed with the hostnames STRAWB, W20NS, and BITSY. The 'whois' command simply returns the contents of a site's domain record.

Records and Records
Don't confuse DNS zone records with domain records. Your domain record is created when you fill out a domain name registration application and is maintained by the domain registration service (like Network Solutions) you used to register the domain name. A domain only has one domain record and it contains administrative and technical contact information as well as entries for the authoritative DNS servers (aka "name servers") that are hosting the DNS records for the domain. You have to enter the hostnames and addresses for multiple DNS servers in your domain record for redundancy (fail-over) purposes.

DNS records (aka zone records) for a domain are stored in the domain's zone file on the authoritative DNS servers. Typically, it is stored on the DNS servers of whatever Web hosting service is hosting your domain's Web site. However, if you have your own Web server (rather than using a Web hosting service) the DNS records could be hosted by you using your own authoritative DNS servers (as in MIT's case), or by a third party like EasyDNS.

In short, the name servers you specified in your domain record host the domain's zone file containing the zone records. The name servers, whether they be your Web hosting provider's, those of a third party like EasyDNS, or your own, which host the domain's zone file are auhoritative DNS servers for the domain.

Because DNS is so important to the operation of the Internet, when you register a domain name you must specify a minimum of two name servers. If you set up your own authoritative DNS servers for your domain you must set up a minimum of two of them (for redundency) and these would be the servers you specify in your domain record. While the multiple servers you specify in your domain record are authoritative for your domain, only one DNS server can be the primary DNS server for a domain. Any others are "secondary" servers. The zone file on the primary DNS server is "replicated" (transferred) to all secondary servers. As a result, any changes made to DNS records must be made on the primary DNS server. The zone files on secondary servers are read-only. If you made changes to the records in a zone file on a secondary DNS server they would simply be overwritten at the next replication. As you will see below, the primary server for a domain and the replication frequency are specified in a special type of zone record.

Early on in this page we said that the DNS zone records are stored in a DNS database which we now know is called a zone file. The term "database" is used quite loosely. The zone file is actually just a text file which you can edit with any text editor. A zone file is domain-specific. That is, each domain has its own zone file. Actually, there are two zone files for each domain but we're only concerned with one right now. The DNS servers for a Web hosting provider will have many zone files, two for each domain it's hosting zone records for. A zone "record" is, in most cases, nothing more than a single line in the text zone file.

There are different types of DNS zone records. These numerous record types give you flexibility in setting up the servers in your domain. The most common types of zone records are:

An A (Address) record is a "host record" and it is the most common type. It is simply a static mapping of a hostname to an IP address. A common hostname for a Web server is 'www' so the A record for this server gives the IP address for this server in the domain.

An MX (Mail eXchanger) record is specifically for mail servers. It's a special type of service-specifier record. It identifies a mail server for the domain. That's why you don't have to enter a hostname like 'www' in an e-mail address. If you're running Sendmail (mail server) and Apache (Web server) on the same system (i.e. the same system is acting as both your Web server and e-mail server), both the A record for the system and the MX record would refer to the same server.

To offer some fail-over protection for e-mail, MX records also have a Priority field (numeric). You can enter two or three MX records each pointing to a different mail server, but the server specified in the record with the highest priority (lowest number) will be chosen first. A mail server with a priority of 10 in the MX record will receive e-mail before a server with a priority of 20 in its MX record. Note that we are only talking about receiving mail from other Internet mail servers here. When a mail server is sending mail, it acts like a desktop PC when it comes to DNS. The mail server looks at the domain name in the recipient's e-mail address and the mail server then contacts its local DNS server (specified in the resolv.conf file) to get the IP address for the mail server in the recipient's domain. When an authoriative DNS server for the recipient's domain receives the query from the sender's DNS server it sends back the IP addresses from the MX records it has in that domain's zone file.

A CNAME (Canonical Name) record is an alias record. It's a way to have the same physical server respond to two different hostnames. Let's say you're not only running Sendmail and Apache on your server, but you're also running WU-FTPD so it also acts as an FTP server. You could create a CNAME record with the alias name 'ftp' so people would use ftp.your-domain.com and www.your-domain.com to access different services on the same server.

Another use for a CNAME record was illustrated in the example near the top of the page. Suppose you name your Web server 'debian' instead of 'www'. You could simply create a CNAME record with the alias name 'www' but with the hostname 'debian' and debian's IP address.

NS (Name Server) records specify the authoritative DNS servers for a domain.

There can multiples of all of the above record types. There is one special record type of which there is only one record in the zone file. That's the SOA (Start Of Authority) record and it's the first record in the zone file. An SOA record is only present in a zone file located on authoritative DNS servers (non-authoritative DNS servers can cache zone records). It specifies such things as:

The primary authoritative DNS server for the zone (domain).
The e-mail address of the zone's (domain's) administrator. In zone files, the '@' has a specific meaning so the e-mail address is written as me.my-domain.com.
Timing information as to when secondary DNS servers should refresh or expire a zone file and a serial number to indicate the version of the zone file for the sake of comparison.

The SOA record is the one that takes up several lines.

Several important points to note about the records in a zone file:

Records can specify servers in other domains. This is most commonly used with MX and NS records when backup servers are located in a different domain but receive mail or resolve queries for your domain.

There must be an A record for systems specified in all MX, NS, and CNAME records.

A and CNAME records can specify workstations as well as servers (which you'll see when we set up a LAN DNS server).

Now lets look at a typical zone file. When a Debian system is set up as a DNS server the zone files are stored in the /etc/bind directory. In a zone file the two parantheses around the timer values act as line-continuation characters as does the '\' character at the end of second line. The ';' is the comment character. The 'IN' indicates an INternet-class record.

$TTL 86400
my-name.com.          IN     SOA    debns1.my-name.com. \
                                   joe.my-name.com. {      
                  2004011522     ; Serial no., based on date
                       21600     ; Refresh after 6 hours
                        3600     ; Retry after 1 hour
                      604800     ; Expire after 7 days
                        3600     ; Minimum TTL of 1 hour
)
;Name servers
debns1                IN     A       192.168.1.41
debns2.joescuz.com.   IN     A       192.168.1.42

@                     IN     NS      debns1
my-name.com.          IN     NS      debns2.my-name.com.


;Mail servers
debmail1              IN     A       192.168.1.51
debmail2.my-name.com. IN     A       192.168.1.52

@                     IN     MX      10 debmail1
my-name.com.          IN     MX      20 debmail2.my-name.com.


;Aliased servers
debhp                 IN     A       192.168.1.61
debdell.my-name.com.  IN     A       192.168.1.62

www                   IN     CNAME   debhp
ftp.my-name.com.      IN     CNAME   debdell.my-name.com.

Several things to take note of when evaluating this example zone file:

Records are grouped in fours and then subgrouped in twos. The lines are spaced apart only to aid in the readability of this example. You don't want any blank lines in a zone file.

The first two records in the group of four use A records to specify the servers, and then the second two records are types which specify what those servers are used for. Optionally, you could list all A records together, all NS records together, all CNAME records together, etc.

The first record in the subgroup of two is a shorthand way of entering the information (without the FQDN). The second record is the longhand way. The '@' is a shorthand way of specifying "this zone" (domain).

Whenever you specify a domain in a zone file it must have a trailing period to make it a FQDN.

The $TTL 86400 line at the very top of the file specifies the Time To Live value for the record (used by secondary DNS servers).

Notice that this zone file specifies the required two DNS servers (with the primary specified in the SOA record) and two mail servers (also for redundancy).

Also notice the priority numbers before the hostnames in the MX records.

If you had a simpler setup with only one server with the hostname 'debian' that operated as a Web, e-mail, and FTP server and you had your DNS records hosted by someone like EasyDNS, your zone file would look a lot simpler:

$TTL 86400
my-name.com.          IN     SOA    ns1.easydns.com. \
                                   me.my-name.com. (
                  2004011522     ; Serial no., based on date
                       21600     ; Refresh after 6 hours
                        3600     ; Retry after 1 hour
                      604800     ; Expire after 7 days
                        3600     ; Minimum TTL of 1 hour
                     )
debian                IN     A       192.168.1.51
ns1.easydns.com.      IN     A       216.220.40.243
ns2.easydns.com.      IN     A       205.210.42.20
@                     IN     NS      ns1.easydns.com.
@                     IN     NS      ns2.easydns.com.
@                     IN     MX      10 debian
www                   IN     CNAME   debian
ftp                   IN     CNAME   debian
debian                IN     CNAME   @

Naturally, the 192.168.1.51 private address in this example would have to be an ISP-assigned public address for an Internet-accessible server. We just used a private address as an example.

Notice that the last CNAME record is a little different from the others. It specifies which server should handle requests when no hostname is specified, i.e. requests going to simply my-name.com in a URL, etc. Notice also that you can specify other domains in your zone file which is where the long-hand way of specifying a FQDN is useful.

Dynamic DNS

If you set up a Debian system to act as a combination firewall, NAT, and home Web server you (and others if you wish) can access the Web pages on it (such as your Web cam images) from a remote location by entering the system's IP address in the URL. The IP address would be whatever is assigned to you by your ISP. The problem is that, unless you pay extra to have a static IP address, the IP address assigned by your ISP will change from time to time and trying keeping up with these changes can be a pain. You can get around this by using a host and domain name to access your system instead of an IP address. Being able to access your system using a consistent name in the URL even though the IP address changes is a major benefit of dynamic DNS.

Dynamic DNS (DDNS) is the ability for a host (your Debian server) to update its own DNS A record. A host's IP address (or what appears to be its IP address) can change when you use a home broadband service such as cable or DSL, or when you dial into an ISP (PPP connection) using a modem. If you have a broadband connection, DDNS allows you to have a full-time Internet server even though you don't have a static IP address.

You run a small DDNS client on your server that sends DNS record update requests to the DDNS server. If you have your own domain name, the DDNS server is the one that's listed as the primary name server in your domain record. Most DNS servers do not support dynamic updates by default. They have to be configured to listen for dynamic updates. When your server is booted up (or you run the client software manually) it sends a request to the DDNS server to check/update the IP address in the A record for your server. If you've pulled a different IP address from your ISP since the last time a request was sent, the A record is updated with this new IP address.

When you use a firewall router, what appears to be your server's IP address is actually the IP address on the "external" router interface. As mentioned on the Networking page, the router does NAT and this address translation can cause difficulties for dynamic DNS. ddclient is a DDNS client that works with firewalls, is compatible with a number of DDNS services, and is available as a Debian package.

Dynamic DNS with Your Own Domain

You can use dynamic DNS if you already have, or want to have, your own registered domain name. You may want your own domain name for several reasons:

You want to set up production Internet servers for an organization or business with static IP addresses.

You want to use your own domain name with your home server(s).

You want to (as in my case) set up a "non-production" domain just for playing around with. A non-production domain would allow you to investigate how DNS works by playing around with the zone record values. Being that there's no production servers in the domain, there's no problem if you screw something up. (A non-production domain is a real domain with whatever name you choose but you just use it with test servers. Naturally, you can make it a production domain at any time just by setting up "real" servers.)

For this I use the Domain Name+DNS Only Service bundle from EasyDNS.com because it kills two birds with one stone (and because they have toll-free telephone tech support). EasyDNS will not only host your zone files on their DNS server, but register your domain name (and annually renew the domain name registration) all for $35/year. That's a pretty good deal as well as being convenient. You don't have to go to one place to register/renew your domain name, and then go to another place to host your DNS records. When you register a domain name with EasyDNS they'll set up some preliminary zone records for you and you just go in and add/modify/delete records.

EasyDNS provides a Web interface for DNS management so you can play around with the settings, change server names, create alias records, etc.

The best part is support for dynamic DNS is included in their DNS offerings so you can use them for home and test servers that don't have static IP addresses (and ddclient will work with them too).

As a side note, what if you already have a domain name with servers that have static IP addresses? Most places that will host your DNS records (like your ISP or Web hosting provider) won't let you even see them much less work with them. Having EasyDNS host your DNS records will allow you to have some control in the management of your DNS. Their straight DNS records hosting service (without the domain registration/renewal piece) costs $20/year. Just be sure to update your domain record with the EasyDNS name servers information once you sign up for the service and get your DNS records set up. (You also have the option of transferring your domain to them, i.e. making them the domain name registrar, if you want to take advantage of the single-payment convenience thing.)

Having your own non-production domain will not only let you play around with zone records, but you can experiment with having your own authoritative DNS server. One of EasyDNS's servers would be the primary authoritative name server and you could set up your Debian server as a secondary. Then you'd just use the 'nameservers' link in the Web interface to enter your server's hostname and IP address as a secondary server entry. This way you could play with the "zone transfers" that take place between authoritative servers.

But the benefits of having your own non-production domain go beyond just DNS. It also comes in handy for testing Sendmail e-mail server and Apache Web server configurations, etc. For instance, you can see if your Debian system properly sends and receives e-mail for your non-production domain. Or you could install a test cerfificate (available for free from most certifying authorities like Thawte or Verisign) on your Debian system acting as a Web server so you can investigate SSL functionality. Just about any type of Internet server you want to play with will have more functionality when you can give it a registered domain name that has DNS resolution capabilities. And if you don't have any plans to eventually use it as a production domain, just let it expire after the first year is up and the knowledge gained will be well worth the 35 bucks.

ddclient Configuration File for EasyDNS

We'll install ddclient in a bit. It'll prompt you for the necessary configuration information during the install. When it's finished it'll create the /etc/ddclient.conf file and it should look something like this (the information you enter during the client install is in blue):

# Configuration file for ddclient generated by debconf
#
# /etc/ddclient.conf

pid=/var/run/ddclient.pid
protocol=easydns
use=if, if=eth0
server=members.easydns.com
login=bgates
password=luvlinux
my-last-name.net

If your server is behind a cable/DSL router (such as a Linksys, DLink, or Netgear) or some other type of firewall or proxy server, replace the line:
use=if, if=eth0
with the line:
use=web, web=support.easydns.com/utils/get_ip.php
This simply uses a page on EasyDNS's Web site to display your 'outside' IP address. The ddclient software will read the IP address off the returned HTML code and send it to EasyDNS. It'll do this periodically which is necessary with the changing IP addresses you get with cable and DSL services.

Support for dynamic DNS is disabled by default which is fine if you do have static IP address(es) on your server(s). Enabling dynamic DNS using the EasyDNS Web interface is simply a matter of clicking on the "disabled" link as illustrated below and acknowledging the change on the subsequent confirmation page.

Once you've got your configuration file set up and you've set your domain for dynamic DNS, you can test your ddclient configuration to make sure it's working with the command:
ddclient -daemon=0 -noquiet -debug -verbose
If you use Apache's virtual hosts feature to host multiple Web sites on your server and you have multiple domain names registered with EasyDNS you can update the dynamic DNS for all the domains simultaneously by separating each of the domains with a comma (,) like so:

The EasyDNS Web interface allows you to add/modify A records, MX records and priorities, aliases (CNAME records), and even the time intervals in the SOA record, all by clicking on the "dns" link shown in the figure above. The "nameservers" link takes you to a page which lists the authoritative DNS server information (EasyDNS's name servers) for your domain.

Your Own DNS Server ?

If you have your own domain name and you also want to try running your own DNS server, EasyDNS.com has a Secondary DNS Service for $15/year which takes some of the risk out of running your own DNS. You set their servers up to transfer zone information from your DNS server. You would then enter your DNS server address as the primary in your domain record, and the EasyDNS DNS server addresses as the secondary DNS servers in your domain record. Then, should your DNS server ever fail, name resolution queries will go to the EasyDNS servers.

Your Own Domain Without Your Own Servers
Would you like your own domain name and receive e-mail and Web traffic to your domain without all the work of setting up your own e-mail and Web servers? Piece of cake!

Just get the Domain Name+DNS Plus Service bundle from EasyDNS.com for $55/year. This service includes the domain name registration (and renewals) and you'll be able to:

have your domain name annually renewed automatically when you renew the service.

have e-mails sent to a you@yourdomain.com e-mail address automatically forwarded to whatever existing e-mail address you want (such as your e-mail address provided by your ISP) without having to pay for additional e-mail services.

use their EasySMTP service (included with the Plus bundle) to send e-mail messages using your you@yourdomain.com e-mail address.

have Web requests to http://www.yourdomain.com automatically forwarded to any URL you want (like your personal Web space you get from your ISP).

Your own domain name is nice to have for several reasons. You may want to use your last name for your domain name (if it's available). Some of the benefits of having your own domain name include:

You can set up lastname.com e-mail addresses for every member of your family (called "mailmaps") and simply forward their e-mail to their existing e-mail account even if everyone uses a different ISP or Web-mail service.

With your own domain name, your e-mail address and Web URL will always remain the same no matter how often you switch ISPs or Web-mail services.

Because so many sites use your e-mail address as a login ID it's a real pain to change your e-mail address. Not to mention notifying everyone that your e-mail address is different. With e-mail forwarding using your own domain name, if you switch ISPs you simply change the forwarding address. The ability to have a consistent e-mail address is valuable for students as their e-mail providers change while they go from high school to college to their first job (and having a lastname.com e-mail address looks good on a resume too). It allows you to have the same e-mail address if you're forced to change ISPs because you move to a different city. It also protects you from ISP mergers, failures, and name changes. And having a consistent Web URL via Web forwarding means you won't lose all the search engine traffic to your Web pages if the URL to your personal Web space changes.

One valuable thing about the EasyDNS.com service is that it supports SPF TXT records. This allows your to set up Sender Policy Framework for your mail server which prevents spammers from sending e-mails using your domain name. SPF is fast becoming the standard for spam prevention. You use it to specify the IP addresses of servers which are allowed to send e-mails on behalf of your domain (usually only one or two). When a spammer sends an e-mail using your domain name, and the receiving e-mail (SMTP) server is configured to use SPF, the receiving e-mail server checks the source address of the e-mail against the allowed addresses listed in your SPF TXT record in your DNS. If there's no match the mail is discarded.

Domain-less DNS For Free

If you have a broadband Internet connection without a static IP and have no desire to have your own domain name, you can use a free service offered by dyndns.org to set up a home Web/e-mail/ftp server. It offers a dynamic DNS service which will redirect traffic to your server using their domain name.

With this free service you use your server's hostname but dyndns.org's domain name. You're basically just adding/modifying an A record for your server in their zone file. Your Web server would have a URL like:
http://your-hostname.dyndns.org
E-mail addressed to your server would have to have an address like:
you@your-hostname.dyndns.org
Because you'll be using your hostname with dyndns.org's domain name, you have to make sure your hostname isn't the same as that of anyone else using their service. As a result, you'll want to come up with a hostname for your server that's really unique. Recall that you set the hostname during the installation. You can always change it by editing the /etc/hosts file. However, you'll also need to check for the current hostname in the configuration files of any server applications that may use it, such as Sendmail and Apache, and edit those files as well.

If you connect your Linux server to the Internet using a modem (we show you how on the Modems page), you'll need to a way to keep your connection up long enough for any dynamic DNS changes to take effect and this could take up to 45 minutes. Most ISPs will drop an inactive connection before that. You can use the ping command to keep your PPP connection up. The trick is to run it in the background and set it so it only sends a ping once every five minutes. Pick a Web site and enter:
ping -i 300 www.chosen-site.com > /dev/null &
Just don't forget to bring it to the foreground and stop it once you've disconnected your modem connection. To bring it to the foreground simply type:
fg ping
and then press Ctrl-C to exit the ping program.

ddclient Configuration File for dyndns.org

If you selected the dyndns.org service when you installed ddclient your /etc/ddclient.conf file should look something like this:

# Configuration file for ddclient generated by debconf
#
# /etc/ddclient.conf

pid=/var/run/ddclient.pid
protocol=dyndns2
use=if, if=ppp0
server=members.dyndns.org
login=bgates
password=luvlinux
your-debian-box-hostname.dyndns.org

Note that this file indicates the ppp0 (dialup modem) interface was entered during the installation rather than the 'eth0' that you would use for a network card.

If your server is behind a cable/DSL router (such as a Linksys, DLink, or Netgear) or some other type of firewall or proxy server, replace the line:
use=if, if=ppp0
with the line:
use=web, web=checkip.dyndns.com/, web-skip='Current IP Address:'
This simply uses a page on dyndns.org's Web site to display your 'outside' IP address. The ddclient software will read the IP address off the returned HTML code.

Security Note: Even home Web/e-mail servers need to be set up securely. Spammers have a talent for quickly locating improperly secured e-mail servers and using them as spam relay points. This not only puts your server at risk but gobbles up all your bandwidth. If you are going to set up a home Web/e-mail server, be sure to do it securely. That not only involves setting up the server in a secure fashion during the initial install, but also includes configuring Apache and Sendmail in a secure manner. The procedures on these pages do not result in secure servers. If you are going to set up your own Web/e-mail server you'll need to buy some books and do some research to learn how to do it securely. More information is given on the Securing Servers page. You'll also want to take a look at the Firewall page for information on how to use IPTABLES entries to help protect your server and your home network. (Remember that if you only have one server Apache and Sendmail are going to be running on the same system that is acting as your NAT/firewall system.) In addition, the Packages page shows you how to use the cron scheduler and a shell script to automatically keep your system up to date with the latest security patches.

Dynamic DNS is OK for home servers, but it's not really appropriate for businesses. Static IP addresses and having your ISP or a third party like EasyDNS host your DNS records would be more appropriate for Internet server implementations by businesses.

Installing ddclient

Before installing this package be sure to sign up for an account with EasyDNS or dyndns.org. You'll need your account username and password when you install the package. With your account set up you install the package by typing in
apt-get install ddclient
at the shell prompt. You'll then be prompted for the following:

Select the service you want to use.

The next screen may seem confusing if you selected EasyDNS in Step 1 because it prompts you for "your DynDNS fully qualified domain names" and then gives examples for dyndns.org. What they mean by the "DynDNS" is "Dynamic DNS", not "DynDNS.org". The "fully qualified" is also a bit misleading. You don't need to enter a trailing period after the TLD (.com, .net, or .org Top Level Domain). All you need to do is enter your server's hostname followed by your, or dyndns.org's, domain name. Examples:
debian.gates.com or very-unique-hostname.dyndns.org
Enter the username you chose when you signed up with your service.

Enter the password you chose when you signed up with your service.

Enter the interface that will be connecting to the service. This will most likely be 'eth0' for an ethernet card (even if it is connected to a LAN which has a firewall router) or 'ppp0' for modem use (note that that's a zero on the end, not the letter O).

If you entered 'ppp0' you'll be asked if you want ddcleint to run automatically every time you connect. You may want to select No here so you have the option of running it or not.

You'll then be asked if you want to run ddclient as a daemon. If this server is going to be a full-time Web or e-mail server with a broadband connection you should answer Yes to this.

The client will now be installed and the appropriate configuration file like the ones shown above will be created. Even though the file was created for you, we showed you the typical files for both dyndns.org and EasyDNS services in case you need to edit them at a later point. If you want to examine your config file you can do so using the nano text editor with the command:
nano /etc/ddclient.conf
If you're using a modem connection you'll want to first connect to your ISP with the pon command. If you didn't set ddclient to run as a daemon then just type in:
ddclient
at the shell prompt once you're connected. The resulting message will tell you what IP address your external interface has (and what the DNS record will be updated with.

As mentioned earlier, it will take awhile for this update to take affect. To see if it has taken affect yet, try pinging using your domain name and see if the returned IP address matches what was indicated in the message when you started ddclient. Note that even if you used the above ping command in the background to keep your connection up you can still issue a second ping command in the foreground to check the returned IP address.

Other DNS Server Files

Given that a DNS server can host the zone files for many different domains, each having two zone files, it needs a way to tell which zone files are for which domains. It does this in the named.conf file which, like the zone files themselves, is located in the /etc/bind directory (which you'll see when we install Bind shortly).

Of the two zone files for each domain the one we've been talking about all along has been for forward lookups (resolving names to IP addresses). This zone file is typically named db.my-last-name.net.

DNS also offers a "reverse lookup" function that allows you to translate IP addresses to host/domain names. The information that allows this to happen is stored in the second zone file. Here's a reverse-lookup zone file that corresponds to the simpler zone file we showed earlier:

$TTL 86400
1.168.192.in-addr.arpa. IN     SOA    ns1.easydns.com. \
                                     me.my-name.com. (
                  2004011522     ; Serial no., based on date
                       21600     ; Refresh after 6 hours
                        3600     ; Retry after 1 hour
                      604800     ; Expire after 7 days
                        3600     ; Minimum TTL of 1 hour
                     )
51                    IN     PTR     debian
@                     IN     NS      ns1.easydns.com.
@                     IN     NS      ns2.easydns.com.

Note that the NS records are the same but there's no A records. And since we only have one system handling all three Web, e-mail, and FTP server functions we only need one PTR record. A PTR (Pointer) record is the opposite of an A record. It has the host part of the IP address and gives the corresponding hostname. Typically you want a PTR record for every A record in the forward-lookup file provided the server is in the domain. We don't have PTR records for the name servers above because they're in a different domain (and thus in a different address space).

Why is only the host part of the IP address needed in this file? Because the network portion of the IP address is used when naming the reverse-lookup zone file, and it's reversed. Because 192.168.1.x is a Class C network, the first three octets make up the network portion of the IP address so it's used in the zone file name. Only the last octet specifies the individual host so it's used to specify the host in PTR records. With the above example IP address, the zone file would be named:
db.1.168.192
The reverse-lookup zone file is also located in the /etc/bind directory. There's another place this naming convention is used. Take a look at the start of the SOA record. The domain is specified as
1.168.192.in-addr.arpa
in-addr.arpa is the default domain for all reverse lookups. As you'll see below, the shorthand method of specifying this with the '@' is normally used.

DNS Tools, Testing, and Troubleshooting

When you're testing changes to your DNS records things may not act the way you expect them to. What you need is some patience. Most DNS servers cache lookups. If you make a change to a zone record on EasyDNS or dyndns.org, or the IP address you pulled from your ISP changes and ddclient sends the update, it'll take the DNS servers at EasyDNS or dyndns.org up to 15 minutes to update. Then the DNS server that your desktop system is using to resolve names may cache the old information for another 20 to 30 minutes.

If you're using a Windows system to test DNS changes don't forget that it also has a DNS cache. You can clear it manually in a DOS window with the command:
ipconfig /flushdns
As a result, if you make a change to your zone records give it at least 45 minutes before you try to see if the changes had the desired effect. Web browsers also cache name-to-address information. If you're using a Web browser to test your changes, you may want to go and delete all the files in the browser's cache directory as well.

The above makes playing around with dynamic DNS when using a modem kind of a pain. You have to keep the connection up for for at least 45 minutes because if you disconnect, you'll pull a different IP address when you reconnect and your DNS records will have invalid IP addresses. That's why I showed you how to run the ping command in the background to keep the dial-up connection alive.

A DNS problem will likely be in one of three places:

The DNS server addresses specified in the TCP/IP configuration on the PC you are using to do the pinging are not correct.

The registrar's domain record does not contain the correct name server hostnames and/or addresses.

The authoritative DNS servers for the domain do not have the domain's zone records configured correctly.

The most basic tool for testing DNS is the ping command. If you can ping a Web server using its IP address but not it's domain name, you have a DNS problem. If you can ping a server using its domain name you'll notice that the server's IP address is also displayed. Verifying that this is the correct IP address will verify that DNS is working properly. Another thing ping can tell you is if you're pinging an actual server or an alias. Using the MIT example again, you may type in
ping www.mit.edu
but the response will be something like
Pinging DANDELION-PATCH.mit.edu
Another common tool for testing DNS is nslookup (name server lookup) and it's available on Linux systems and NT-class Windows systems (NT-WS, 2000 Pro). As you saw earlier in this page this command will show you what name server your PC is using to resolve names, as well as return hostname and address information on the server that's specified as the target of the command. However, it also has an interactive mode that increase its usefulness. If you simply type in:
nslookup
and you'll get a > prompt. There are several statements that you can enter at his prompt. One helpful one is when you want your system to send queries to a different, other than the default, name server. At the prompt type in the 'server' command followed by the IP address of the DNS server to use:
server 192.168.10.10
Then you just type in the domain name you want information on at the prompt. You'll see in the response that the name server being queried has changed to the one you specified. Type 'exit' at the prompt when you're done. Another similar tool on Linux systems is the dig command. You can specify the alternate DNS server to use on the command line:
dig 192.168.10.10 mit.edu any
The any parameter tells it to return information on all record types. Check the man pages for dig and nslookup for more information.

If you want to make sure that BIND isn't having a problem with your zone files, you can check the syslog after you boot the system (which is when BIND starts up and reads the zone files). At a shell prompt just type in:
nano /var/log/syslog
and look near the bottom of the file. You'll see messages when BIND was started. Check to see if any of them refer to any errors that were encountered. If it didn't have a problem with the zone file you'll see it referenced along with:
loaded serial 1
indicating that it has set the serial number (version) to 1.

Your Own DNS Server

Don't set up your Debian system as a DNS server if it doesn't have access to the Internet. It will try and use external DNS servers (called "root hints" which we explain later) to resolve names and they won't be accessible. This will cause problems trying to FTP or telnet to your Debian server even over a local LAN using only IP addresses.

DNS is simply another server application. You can use your Linux system as an authoritative, LAN, or simple DNS server. Simple DNS servers and LAN servers which also provide simple DNS services (resolving Internet host/domain names) need to be connected to the Internet but being behind a firewall should not present a problem as long as you have UDP port 53 is open on the firewall. If you're going to set up and test a secondary authoritative DNS server you'll also need to have TCP port 53 open on the firewall as well for zone transfers.

We'll show you how to set up simple and LAN DNS servers in this section. Setting up production ("real") authoritative DNS servers (remember that you need at least two) is beyond the scope of this page because you'll need to do quite a bit more reading to learn about zone transfers (insecure and secure) between primary and secondary servers and you'll need to know a lot more about the named.conf file. The issue of server security also becomes more important. However, seeing how to set up DNS server files for a LAN DNS server will be a good start.

Where to learn more - The best of our bookshelves:
More info...		DNS and BIND is another case where an O'Reilly book is considered the bible in the industry. I doubt there's a DNS server admin out there that doesn't have a copy. The 4th Edition covers BIND 9 with its security enhancements. The first three chapters provide a detailed foundation in the basics of DNS operation from zone files to root name servers. From there it's all about server configuration. Setting up multiple servers, incremental zone transfers, and round-robin load distribution are just a few of the things covered. It also covers how to set up a server to respond to DDNS requests from clients and DHCP servers as well as how to control which systems have this ability through ACLs (Access Control Lists). How to use BIND's debugging levels and debugger output to solve problems is also covered.

A Simple DNS Server

As mentioned earlier, the most widely used DNS application is called BIND and installing it is simply a matter of entering the command:
apt-get install bind9
Congratulations! You now have a simple DNS server. Now just change the DNS server settings in the TCP/IP configuration files on the workstations on your LAN so that they start using this server as their preferred DNS server. You can use your ISP's DNS server(s) as alternate servers as this will provide some redundancy if your server ever goes down. You'll also want to modify the /etc/resolv.conf file on the DNS server itself so that it points to itself. Do that by opening the file in a text editor with the command:
nano /etc/resolv.conf
and making sure the first nameserver line is:
nameserver 127.0.0.1
Why is setting up a simple DNS server so easy? Because of things called "root hints". The root hints are a list of root-level DNS servers in the /etc/bind/db.root file. Your simple DNS server will query a root server to get the addresses of authoritative DNS servers for each given domain (so it can contact those authoritative DNS servers to get the IP addresses of the desired hosts).

Just remember that your simple DNS server needs a 24/7 connection to the Internet. Or it at least needs to be connected to the Internet any time any system on your LAN needs to access anything on the Internet.

A LAN DNS Server

We'll cover setting up a LAN DNS server for a small LAN where the workstation addresses are statically assigned. If you have a larger LAN that uses DHCP, you'll need to set up the server to respond to DDNS update requests because a system's A record will need to be updated when DHCP assigns the system a different address.

In setting up a LAN DNS server we need to:

Create the forward and reverse zone files.

Update the named.conf configuration file with things called "forwarders"

Update the named.conf configuration file so that the server knows it's authoritative for the LAN domain.

The zone files are just like the zone files we have above. You can even copy/paste the following zone files into a text editor and edit them accordingly if you want. If you're viewing this page on a Windows system, you can copy/paste them into Notepad and FTP them to your Debian system (remember to use ASCII mode when you FTP). Because the zone file names aren't Windows-friendly just save them in Notepad using names like forward.txt and reverse.txt. You can rename them when we copy them from your home directory to the /etc/bind directory. Remember that FTP won't work with the root account (it's a security thing) so use the user account you created when you installed Debian. When you FTP the files to your Debian system they'll go into this account's home directory. We'll copy them over to the right place in a bit.

Here's the forward-lookup zone file for a LAN with the domain name kplan.net. Note that the A records are grouped together, as are the other record types, and that there are no blank lines. However, when trying to get my DNS server to work I did see an error in the syslog file about the reverse-lookup zone file not ending in a "new line" so make sure there's a blank line at the bottom of the file.

$TTL 86400
kplan.net.            IN     SOA    woody.kplan.net. \
                                   keith.kplan.net. (
                  2004011522     ; Serial no., based on date
                       21600     ; Refresh after 6 hours
                        3600     ; Retry after 1 hour
                      604800     ; Expire after 7 days
                        3600     ; Minimum TTL of 1 hour
                     )
potato-gw             IN     A       192.168.10.1
w2kpro                IN     A       192.168.10.10
ntserver              IN     A       192.168.10.20
solarisintel          IN     A       192.168.10.30
solarissparc          IN     A       192.168.10.40
woody                 IN     A       192.168.10.50
@                     IN     NS      woody
@                     IN     MX      10 woody
www                   IN     CNAME   woody
ftp                   IN     CNAME   woody
woody                 IN     CNAME   @

And here's the reverse-lookup zone file for the same domain:

$TTL 86400
@                     IN     SOA    woody.kplan.net. \
                                   keith.kplan.net. (
                  2004011522     ; Serial no., based on date
                       21600     ; Refresh after 6 hours
                        3600     ; Retry after 1 hour
                      604800     ; Expire after 7 days
                        3600     ; Minimum TTL of 1 hour
                     )
1                     IN     PTR     potato-gw
10                    IN     PTR     w2kpro
20                    IN     PTR     ntserver
30                    IN     PTR     solarisintel
40                    IN     PTR     solarissparc
50                    IN     PTR     woody
@                     IN     NS      woody

Notice that instead of using 10.168.192.in-addr.arpa at the start of the SOA record I just used the shortcut. Now when I add a new system to my network I can just add entries to these two files rather than editing the HOSTS files on all of the servers and workstations.

If you created these files on a Windows system using Notepad and FTPed them to your Debian server, go into the directory you FTPed them into and move/rename them like so:
mv forward.txt /etc/bind/db.kplan.net and mv reverse.txt /etc/bind/db.10.168.192
While the zone file naming convention that BIND uses by default is db. followed by the domain name, and the reverse-lookup zone file is similar except that the domain name is replaced by the reversed network address, you can actually name them whatever you want. You tell the server what zone files to use in the named.conf file.

named.conf

The named.conf file is the main configuration file for a DNS server. In it you tell the server what, if any, forwarders to use, what domains it's authoritative for, and which zone files it should use for each domain.

Forwarders let you specify other DNS servers to use when your DNS server receives a query for a domain it isn't authoritative for. Your LAN DNS server will be authoritative for your LAN's domain name, but it won't know about domains on the Internet. When it gets a query for an Internet domain it will forward the request out to a DNS server specified in the forwarders section of the named.conf file.

Open the /etc/bind/named.conf file using the ee text editor. In the options section you'll see an indented block of text like this:

// forwarders {
//  0.0.0.0;
// };

You typically want to put your ISP's DNS servers here. The '//' are comment characters in this file so you'll need to remove those also. You should end up with a block of text that looks like this:

forwarders {
192.168.243.9;
192.168.253.9;
};

We used private addresses in the above example but naturally these would be publically-accessible DNS servers (your ISP's). Now we have to add the content to the file so the server knows it knows it's authoritative for the kplan.net domain. At the bottom of the file you'll see the line:
// add entries for other zones below here
Below this line we'll enter the following for the forward and reverse zone files:

zone "kplan.net" {
   type master;
 file "/etc/bind/db.kplan.net";
};

zone "10.168.192.in-addr.arpa" {
   type master;
 file "/etc/bind/db.10.168.192";
};

Save the file and we're in business from a server perspective. The named daemon is running, we already have a root hints database, our zone files our set up, and our forwarders are set up in the configuration file. Now just change the /etc/resolv.conf file on any Debian and UNIX systems so it looks like this:

search kplan.net
nameserver 192.168.10.50

On Windows systems you'd have to change the "Preferred DNS server" in the TCP/IP properties to the 192.168.10.50 address.

Now that you've got a feel for what DNS does for you, and possibly have your own domain name with name resolution capabilities, it's time to start setting up some servers.

SECURITY WARNING
Do NOT plan to use the system you will create using these guide pages as a "production" (real) server. It will NOT be secure!

There are many steps involved in creating a secure Internet or LAN server. While we do refer to some things you can do to make your system more secure, there are many other measures related to system security that also need to be taken into consideration and they are not covered on these pages.

These guide pages are meant as a learning tool only. The knowledge gained on these pages will help you understand the material covered in security-related publications when you are ready to consider setting up a production server.

Run Your Own Web Server Using Linux & Apache

2011-03-24T07:55:00.000-07:00

Run Your Own Web Server Using Linux & Apache

“ Setup, optimize and secure your own Web Server ”

Learn to install Linux (Fedora), Apache, PHP and MySQL
Master common server administration tasks
Secure your server easily with a firewall and an intrusion detection system
No prior Linux experience required

try this torrent download

Overview

This is the HOWTO book I wish I had when I started with Apache on Linux. This book will take the novice from zero to Web site with a deeper understanding of the system as a whole, and the tools available to make things run smoothly.

Stephen Pierzchala
NewestIndustry Blog

SitePoint’s “Run Your Own Web Server Using Linux & Apache” is the ultimate guide to setting up, optimizing and securing the Apache Web server on a Linux system.

Whether you’re planning on running Linux at home, or on a leased Web Server, this book will walk you step-by-step through all of the common administration tasks, from managing traffic reporting to log-file rotation. This guide even includes step-by-step instructions on installing Linux (Fedora 4), Apache 2.0, PHP 5 and MySQL 4.1 on a home or office development server, so you can test all of your applications before rolling them out.

Why Run a Development Server?

Why Apache?

56 Million Webmasters Can’t be Wrong!

Apache’s world renown reputation for secure, lightning fast and reliable operation has seen it carve out a position as the most used web server on the planet — currently outnumbering all other web servers combined by 3 to 1.

Netcraft Web Server Survey

Using a spare PC as a Linux development server means you can develop applications faster, while minimizing your Website’s downtime.

With a development server, you can avoid executing untested code on a “live” server -- a practice that can endanger your site’s security and performance. By writing PHP code and database scripts locally, you can identify and fix problems before they’re published online. Test code revisions, performance optimizations, and partially complete scripts safely on your Linux development server.

You can also avoid making hefty file transfers between your local PC and remote server every time you need to test a minor change.

And if you work with a development team, a development server will allow you to collaborate on projects without having to give all team members access to your live Web server.

Why Manage Your Own Server?

Managing your own Web server offers several benefits.

1. Saving money. You can lease an unmanaged dedicated server for well under $50/month — hundreds of dollars less than a fully managed solution — as long as you’re willing to perform basic tasks yourself.

2. Use better tools and have more flexibility. There are some major disadvantages to having someone else administer a Web server for you. You’ll have a very limited toolset, and your ability to change and optimize configurations will be severely restricted, hindering performance and uptime.

For example, by managing your own server, you can install must-have tools such as Tripwire (for spotting server intruders), SSH, and VNC (so you can securely log in to your server over an encrypted connection). In other words, by running your own server, you’ll enjoy a level of flexibility, plus options and features that are simply unavailable in most managed server offerings.

What will you learn?

Setup

Learn to install Linux (Fedora), Apache 2.0, PHP 5 & MySQL 4.1

Day-to-Day Usage

Using the GNOME Desktop Graphical User Interface
Surf the Linux file system and handle file permissions like a pro
Working with the command line and shell
Automate routine tasks using cron and anacron

Administration

Setting up new users & groups
Install and use Webmin for admin tasks
Configuring Apache 2.0 using the HTTP Config Tool

Optimize server settings for maximum performance

Securely manage your server remotely via SSH and VNC
Manage backups, log file rotation, and traffic reporting

Security

Configure your machine’s firewall using Firestarter
Use Tripwire and snort to ensure that your server is not compromised
Disable unnecessary services to improve security

This is simply the most practical hands-on guide to web server management.

Who Should Read This Book?

Whether you want to set up a development server at home or in the office, or if you want to save thousands of dollars annually by managing your own leased server, this book is for you. No prior Linux experience is required to use this book.

Run your own unix webserver part3

2011-03-24T07:45:00.000-07:00

I imagine thousands, if not millions, of inquisitive geeks out there with their FreeBSD servers ready to go. Apache, PHP, and MySQL are installed, and they're just waiting , wondering..."Now What?"

Well the wait is over, my furry little geek friends. Cancel your World of Warcraft membership and do what real men do - run a UNIX web server.

In this lesson, we configure Apache and serve up a PHP page.

This document assumes:

FreeBSD is installed, and you followed the instructions from part 1 of this series
Apache 2.x and PHP 5.x are installed, and you followed the instructions from part 2 of this series.

This document also assumes that:

at least one domain name points to your server
The one I'm using is example.com. Replace that with your domain in the references below.
your server has at least one static IP address
The one I'm using is 10.20.111.2. Again, replace my example IP with your real IP below.

Let's go...I promise this will be quick.

Make a home for your website

SSH to your server as the user 'web' and create the website root directory:

mkdir ~/www/example.com

Make a homepage for your site

You can later go back and upload a better site, but for now, we'll just make a quick PHP-driven index page in the website root directory.

Use vi to create and open the index file:

vi ~/www/example.com/index.php

Add the following content:

Save and quit vi. Good. We have a web directory and a home page.

Edit Apache's configuration file

We need to tell Apache where the new site is. I prefer using name-based Virtual Hosts

Use vi to create and open Apache's config file, called httpd.conf:

vi ~/apache/conf/httpd.conf

Scroll to the bottom and add the following. (Remember, replace my example domain and IP with your real ones)

NameVirtualHost 10.20.111.2:80 # ------------------------------------------------------------------- # # example.com # ------------------------------------------------------------------- # DocumentRoot /home/www/example.com ServerName www.example.com CustomLog "|/usr/local/apache/bin/rotatelogs /usr/local/apache/logs/example.com.log 604800" combined DirectoryIndex index.php index.html index.htm ServerName example.com Redirect / http://www.example.com/

Start Apache

Starting and stopping apache requires SuperUser (root) privileges, so type su, and enter root's password.

In case the web server was already running, we'll try and stop it first. If you get an error about apache not running, don't worry...

apachectl stop

Before starting or restarting Apache, I test any configuration edit's I've made.

apachectl configtest

You should get, Syntax OK.

Finally, start the server:

apachectl start

In the future, after making Apache configuration changes, restart the server like this:

apachectl configtest apachectl graceful

That gracefully stops the server, re-reads the configuration, and starts up again.

Launch Party

Open up your favorite browser and go to the site!

If it worked, submit your site to Google, jump out of the nest, and flap your wings. You're on your own now!

IT Administrators

GNS3CISCO Help you pass your CCNA CCNP EXAM

Installing RSAT: Remote Server Administration Tools for Windows Vista

Remote Server Administration Tools for Roles

Microsoft Remote Server Administration Tools for Features

How to Install Remote Server Administration Tools for Vista

RSAT Terminal Services Manager in Vista

Configuring DNS on Cisco IOS routers

How to configure 802.1Q trunking between Cisco Catalyst switches

Benefits of Obtaining a CCIE Routing and Switching (RS) Certification from Cisco

Quick Overview

Product Description

Additional Information

GNS3-Topology: CCNA & CCNP Full Mesh Topology Template

Useful iPhone Apps

Top iPhone applications for sys-admins

1. Mail.app

2. Safari.

3. NetNewsWire

4. TouchTerm Pro

5. Jaadu remote desktop

6. 1Password

7. Network Ping

8. Network utility

9. aSubnet

10. Inco

11. iNagios

12. netshare

13. Air Sharing

Five security secrets your IT administrators don't want you to know

How to configure logging in Cisco IOS

How to configure GLBP

How to configure RIP v1 and RIP v2

How to configure default routing so different default routes are used based on the source of the packet (Policy Based Routing)

How to configure static routes

How does load balancing work?

How to configure OSPF

How to configure NAT

How to configure IP addressing

Cisco Tools

Cisco Repair and Hardware Troubleshooting

The ultimate list of Cisco administration tools

Windows 8 early build leaks

How To Set Up Linux DNS Services

Run Your Own Web Server Using Linux & Apache

Run Your Own Web Server Using Linux & Apache

“ Setup, optimize and secure your own Web Server ”

Overview

Stephen Pierzchala NewestIndustry Blog

Why Run a Development Server?

Why Apache?

56 Million Webmasters Can’t be Wrong!

Netcraft Web Server Survey

Why Manage Your Own Server?

What will you learn?

Who Should Read This Book?

Run your own unix webserver part3

Make a home for your website

Make a homepage for your site

Edit Apache's configuration file

Start Apache

Launch Party

Stephen Pierzchala
NewestIndustry Blog