The Diary of a Networker

Shutdown Date of Powered Off VMs using VMware PowerCLI

2022-12-12T11:39:00.002+05:30

So you have got a list of Powered OFF VMs in vCenter and would like to perform a cleanup however you don't have any idea when this was powered OFF. Well there are three ways to find the powered OFF date.

1. Event Timestamp - highly reliable method

2. NVRAM Timestamp - average reliable method

3. Storage Timestamp - least reliable method

Prerequisites

Create a txt file named VMList.txt and paste the name of VMs one by one.

Step by Step Procedure

1. Save the VMList.txt in C:\Temp of your windows machine

2. Open PowerShell ISE and connect your vCenter

Connect-VIServer my-vcenter.xyz.intra

3. Input credentials and wait for the connection to establish.

4. Now paste the below script in the PowerShell ISE.

get-content "C:\Temp\VMList.txt" |

foreach {Get-VM -Name $_|

Select Name,PowerState,

@{N='Event Timestamp';E={

(Get-VIevent -Entity $_ -MaxSamples ([int]::MaxValue) |

where{$_ -is [VMware.Vim.VmPoweredOffEvent]} |

Sort-Object -Property CreatedTime)[-1].CreatedTime

}},

@{N='Storage Timestamp';E={$_.ExtensionData.Storage.Timestamp.ToLocalTime()}},

@{N='NVRAM Timestap';E={

$dsName = ($_.ExtensionData.LayoutEx.File | where {$_.Type -eq 'nvram'}).Name.Split(' ')[0].Trim('[]')

$ds = Get-Datastore -Name $dsName

New-PSDrive -Location $ds -Name DS -PSProvider VimDatastore -Root "\" | Out-Null

$file = Get-ChildItem -Path "DS:\$($_.Name)\$($_.Name).nvram"

Remove-PSDrive -Name DS -Confirm:$false

$file.LastWriteTime

}}

} |Export-csv "c:\Temp\output.csv"

5. Select this Script in your PowerShell ISE and run this.

6. You will get the output in C:\Temp\output.csv in the below format.

Any questions, ask in comments.

Cheers!

Licensing Mode for Remote Desktop Session Host is not Configured

2020-02-12T16:14:00.000+05:30

Issue

You run into the below issue (fig. 1) even after configuring RDS Licensing Server (fig. 2)

Licensing Mode for Remote Desktop Session Host is not Configured

The Remote Desktop Session Host server is within its grace period, but the RD Session Host server has not been configured with any license server.

fig.1

fig. 2

Troubleshooting

You can check whether the license server is set using the following PowerShell commands:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.GetSpecifiedLicenseServerList()

No value returned in our case in 'SpecifiedLSList' - meaning license server is not set though we set this on fig. 2.

Fix

Set the RDS license server parameters using GPO (a local or a domain policy).

We use Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Licensing.

Required settings are :

1. Use the specified Remote Desktop license servers (fig. 3) - enable the policy and specify the RDS license server address.

2. Set the Remote Desktop licensing mode (fig. 4) - select the licensing mode. In our case, it is Per User.

fig. 3

fig. 4

In my case the issue got fixed without a restart (I used local GPO), you may try a reboot as well.

You can also run the previous command to see the license servers.

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.GetSpecifiedLicenseServerList()

Cheers!!

Disk lock error in VMware

2019-10-11T10:37:00.003+05:30

Issue :

You encounter below error while consolidating VM or powering ON a VM :

An error occurred while consolidating disks: msg.snapshot.error-DISKLOCKED

An error occurred while consolidating disks: msg.fileio.lock.

Consolidation failed for disk node 'scsi0:0': msg.fileio.lock

Unable to access a file filename since it is locked

Unable to access virtual machine configuration

A general system error occurred: vim.fault.G-enericVmC-onfigFault

Cause :

The common reason would be a powered on virtual machine contains locks on all files in use by the owning ESXi host to facilitate read and write access.

Other locks may be created by hot-adding disks to snapshot based backup appliances during the backup process.

Failure to create a lock / start a virtual machine can occur if an unsupported disk format is used or if a lock is already present.

Solutions

Solution 1 : vMotion the virtual machine

vMotion the virtual machine to a different host and try to consolidate/power on.

If the above is not successful storage vMotion the virtual machine to a different datastore.

Solution 2 : Restart the management agents on the particular host the VM is running on.

SSH into the ESXi host and run the command services.sh restart

Solution 3 : Restart the ESXi host.

Shutdown the affected VM. vMotion all other working VMs to a different host and restart the ESXi host.

Solution 4 : Unregister the virtual machine from the host & re-register the virtual machine on the host holding the lock.

Solution 5 : Clone the VMDK files to a different datastore using PowerCLI, create new Virtual Machine, attach the cloned VMDKs’.

Further reading : https://kb.vmware.com/s/article/2107795

Get Cluster Resources using PowerCLI : VMware

2019-09-19T15:30:00.003+05:30

Requirement : You need to extract CPU, Memory and Datastore size from a vCenter cluster.

Procedure:

Open PowerCLI

Enter the command Connect-VIServer <yourvcenterserver>

Now enter the below script after connecting your vCenter in PowerCLI:

Get-Cluster -Name | get-vmhost | select Name, NumCpu, CpuUsageMhz, CPUTotalMhz, MemoryUsageGB, MemoryTotalGB | Export-Csv -NoTypeInformation -UseCulture -Path c:\temp\cluster.csv

You will get result similar to below

This will extract the CPU, Memory total allocated and usage details.

Now to get a high level capacity details of all clusters in a vCenter please follow the below.

1. Create a PowerCLI profile and add the below code.

a. To create a profile use the below code in PowerCLI

if (!(test-path $profile)) 

           {new-item -type file -path $profile -force}

notepad $profile

Now paste the below code in the notepad which has just opened, save and close it.

function Get-ClusterCapacityCheck {

[CmdletBinding()]
param(
[Parameter(Position=0,Mandatory=$true,HelpMessage="Name of the cluster to test",
ValueFromPipeline=$True,ValueFromPipelineByPropertyName=$true)]
[System.String]
$ClusterName
)

begin {
$Finish = (Get-Date -Hour 0 -Minute 0 -Second 0)
$Start = $Finish.AddDays(-1).AddSeconds(1)

New-VIProperty -Name FreeSpaceGB -ObjectType Datastore -Value {
param($ds)
[Math]::Round($ds.FreeSpaceMb/1KB,0)
} -Force

}

process {

$Cluster = Get-Cluster $ClusterName

$ClusterCPUCores = $Cluster.ExtensionData.Summary.NumCpuCores
$ClusterEffectiveMemoryGB = [math]::round(($Cluster.ExtensionData.Summary.EffectiveMemory / 1KB),0)

$ClusterVMs = $Cluster | Get-VM

$ClusterAllocatedvCPUs = ($ClusterVMs | Measure-Object -Property NumCPu -Sum).Sum
$ClusterAllocatedMemoryGB = [math]::round(($ClusterVMs | Measure-Object -Property MemoryMB -Sum).Sum / 1KB)

$ClustervCPUpCPURatio = [math]::round($ClusterAllocatedvCPUs / $ClusterCPUCores,2)
$ClusterActiveMemoryPercentage = [math]::round(($Cluster | Get-Stat -Stat mem.usage.average -Start $Start -Finish $Finish | Measure-Object -Property Value -Average).Average,0)

$VMHost = $Cluster | Get-VMHost | Select-Object -Last 1
$ClusterFreeDiskspaceGB = ($VMHost | Get-Datastore | Where-Object {$_.Extensiondata.Summary.MultipleHostAccess -eq $True} | Measure-Object -Property FreeSpaceGB -Sum).Sum

New-Object -TypeName PSObject -Property @{
Cluster = $Cluster.Name
ClusterCPUCores = $ClusterCPUCores
ClusterAllocatedvCPUs = $ClusterAllocatedvCPUs
ClustervCPUpCPURatio = $ClustervCPUpCPURatio
ClusterEffectiveMemoryGB = $ClusterEffectiveMemoryGB
ClusterAllocatedMemoryGB = $ClusterAllocatedMemoryGB
ClusterActiveMemoryPercentage = $ClusterActiveMemoryPercentage
ClusterFreeDiskspaceGB = $ClusterFreeDiskspaceGB
}
}
}

b. Close and re-open PowerCLI to get the above change effective.

2. Run the below script to extract the details.

Get-Cluster | Get-ClusterCapacityCheck | Select-Object Cluster,ClusterCPUCores,ClusterAllocatedvCPUs,ClustervCPUpCPURatio,ClusterEffectiveMemoryGB,ClusterAllocatedMemoryGB,ClusterActiveMemoryPercentage,ClusterFreeDiskspaceGB

You will get result similar to below

Java Update tab missing

2019-03-27T16:04:00.000+05:30

Issue : You could not find Update tab in Java Control Panel

Solution :

For 32 bit OS: Go to HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy and change the value of EnableJavaUpdate to 1

For 64 bit OS : Go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy and change the value of EnableJavaUpdate to 1

Cheers!

Migrate option grayed out while trying to vMotion a VM

2019-03-27T16:00:00.001+05:30

You may face the below issue on a vSphere environment:

Fix:

(Caution: Before performing these steps, make a note of the datastore where the virtual machine resides.)

1. In the vSphere Client, right-click the powered-off virtual machine and click Remove from Inventory.
2. Click Yes when prompted to confirm the removal.
3. Click Home > Storage
4. Open the Datastore and folder where the VM’s vmx file is stored
5. Right-click the .vmx file and click “Add to Inventory” (or “Register VM” in some verisons).
6. Follow the steps in the wizard to add the virtual machine back to the Inventory.
7. Click Home > Hosts and Clusters.
8. Right-click the virtual machine. The migrate option is now available.

Cheers!

An error occurred while taking a snapshot: msg.snapshot.error-QUIESCINGERROR

2019-03-27T15:33:00.000+05:30

We are using Veritas NetBackup solution and encounter the above error frequently on our network.

There are multiple causes for this issue and you need to apply separate fix for each issue.

Solution 1

The first and foremost thing we do is to search the VMware KB. So let's first work through the following article and see if it resolve the issue: https://kb.vmware.com/s/article/2069952

Solution 2

Root cause : Though VMware snapshot provider service was disabled it was causing backup failure.

Fix : Upgrade VMware tools and remove Volume Shadow Copy Service Support during the upgrade (reboot is not required). This will remove the VMware snapshot provider service from server.

Solution 3

Root cause : Symantec Backup Exec Remote Agent is stopping the Virtual Disk Service

Fix : Un-install Symantec Backup Exec Remote Agent for Windows Systems from Programs and Features.

Cheers!

Remote Registry Query for Multiple Computers in a Domain

2019-03-27T15:12:00.003+05:30

You may use this method to query any registry information from a batch of servers/computers in your network.

In this example I have queried the Symantec Endpoint Protection version currently installed on the servers and it's reporting servers.

Basically I need to query the value of the below registry keys in the remote server.

Location : HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\Public-Opstate

Reg Key : LastServerIP

Location : HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion

Reg Key : PRODUCTVERSION

Basic Requirement

a. Make sure that you have admin privilege on the machine you are running the query.

b. Make sure that Remote Registry Service is started on the target machines.

Method

1. Create a .bat file and paste the below script

@echo off
set file=c:\serverlist.txt
for /f "Tokens=*" %%g in (%file%) do (
echo %%g>> c:\regquery.txt
reg query "\\%%g\HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\Public-Opstate" /v LastServerIP>> c:\regquery.txt
reg query "\\%%g\HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion" /v PRODUCTVERSION>> c:\regquery.txt
echo.>> c:\regquery.txt
echo.>> c:\regquery.txt
)

{Note : The one I marked in red is what you need to modify in your case
Also if you have multiple reg queries please add them one by one on the script}

2. Create a text file c:\serverlist.txt and paste the name of server you need to check.

3. Run the script in cmd with admin access.

4. Results will be present in c:\regquery.txt and is similar to below :

Cheers !

Meru WLAN Basic Configuration Guide

2019-03-27T14:36:00.002+05:30

Meru

Meru Networks is a supplier of wireless local area networks (WLANs) to various industries. Meru Networks was founded in 2002 and headquartered in Sunnyvale, California, United States. Meru formulated many innovative approaches to wireless networking. It has used virtualization technology to create an intelligent and self-monitoring wireless network to allow enterprises to become all wireless, while smoothly migrating their business-critical applications from wired to wireless networks.

Major Products of Meru

Hardware

Controllers - For small enterprise to large enterprise use various models of controllers are available. Eg: MC1550, MC6000 etc.

Access Points - Different models of Access Points are available for various deployment scenarios.

Software

Meru System Director Operating System - The operating system which runs on all Meru controllers and access points

Meru E(z)RF Network Manager - Manages multiple controllers and thousands of access points providing real-time location tracking and location firewall.

Meru Spectrum Manager - A spectrum analysis solution.

Meru Identity Manager - Allows businesses to provide access to thousands of Wi-Fi devices in the “bring your own device” (BYOD) workplace.

Meru Virtual Controller - Provides the same functionality as that of the hardware controller. It can be downloaded as OVF template and can be loaded to Esxi server.

To know more about the products visit http://www.merunetworks.com/products/index.html

Wireless LAN - The Meru Difference

Some of Meru’s key technology innovations include:

- Single Channel Architecture (SCA) for pervasive Wi-Fi coverage without the hassle of costly site surveys

- Channel layering to maximize client density without sacrificing pervasive coverage

- Intelligent network control traffic management

- Robust on-boarding and monitoring solution for BYOD

Basic Meru WLAN setup

This setup includes the following components:

1.) Meru MC3200v Virtual LAN Controller

2.) Meru 320i access points.

3.) Windows domain.

4.) RADIUS server for AAA (Windows NPS).

Network Diagram

In this example I have used Meru Virtual LAN controller instead of a hardware controller. When it comes to the configuration part there will not be any difference between a hardware controller and virtual controller, except the system director is loaded to a hardware box in the former and to a virtual machine in latter.

Step by step configuration

This configuration includes the following:

A.) Deploying the controller, Access Point to an existing wired network consist of a Windows Domain

B.) Basic Controller and Access Point Configuration

C.) Basic Wireless Profile setup for domain users with RADIUS authentication

D.) Basic Wireless Profile for guest users

E.) Configuring TACACS+ Authentication for Administrators (Optional)

A.) Deploying the controller, Access Point to an existing wired network consist of a Windows Domain.

1.) Meru Controller Installation. Download the Controller Installation guide and follow the steps outlined to deploy either a hardware controller or virtual controller.

2.) The next step is to perform the basic configuration of the controller which you have deployed earlier.

3.) Access the Controller console (if it is a hardware controller, connect it using a console cable and virtual controller - connect through vSphere client console )

3.) Login to the controller with user name as admin and password admin. Type setup to launch the initial configuration script.

4.) Perform the rest of the configuration using the guide which is available for download from the following link Make sure that you followed the steps under the topic 'Setup Via CLI' only. We will configure the rest of the Controller setup via CLI latter in this blog.

5.) Once the initial setup is done via CLI. It's time to check whether the Meru WebUI is working. Connect the web interface of your controller via the IP address you configured during the setup i.e https://ipaddress Also check whether you are able to connect your controller using an SSH connection. Below screenshot shows the WebUI.

6.) Install Meru Access Point using the Installation guide which is available for download from the below link.

B.) Basic Meru Controller and Access Point Configuration

All the configurations are done using CLI. Meru CLI is very similar to Cisco and many of the Cisco commands will work here. If you are comfortable with Cisco routers I would recommend you use CLI for configuration. Also some CLI commands does not have a WebUI alternative. So in some point of time you will have to use CLI.

Like Cisco CLI, Meru have got different command modes - User EXEC Mode, Privileged EXEC Mode, Global Configuration mode.

Setting the command history buffer size

Just in case you need to recall the commands you have typed previously, the default size is 10.

I am just setting it as 20. Use the command terminal history size 20 in Privileged EXEC Mode.

Meru Controller File System (CFS)

Using CFS you can manage the controller OS and its configuration files.

Below are the local directories present in a controller:

Images - Directory where the current image resides

Backup - Contain backup configuration

ATS/scripts - Contain AP bootup scripts

Capture - Contain the packet capture files

Some useful commands

Show current directory - pwd

List files inside directory - dir

Change to another directory - cd ATS/scripts

Configuration Files

Similar to Cisco router, Controller have got startup configuration and running configuration.

The command copy running-config startup-config (to save running config to startup config) is also applicable here.

Copy files to and from the Controller

In some situations you might need to transfer files to the controller or backup files from the controller. You can use the following protocols to do the same: FTP, SFTP, TFTP, SCP

If the server from/to which you perform the file transfer is using a password then you can globally set the username and passwod using the below command:

ip ftp user-name myusername

Ip ftp password mypassword

Replace ftp with sftp, scp according to the server you are using.

Copy files from Controller to FTP, TFTP, SFTP and SCP server

For example, to copy a file script.log from the local directory of the controller to a remote FTP server. The server IP is 192.168.1.100 and its remote directory is backup. The username of the server is administrator. (If you have set the credentials earlier using the ip ftp username/password command, use the second command to copy)

1. Copy script.log ftp://administrator@192.168.1.100/backup/

2. Copy script.log ftp://192.168.1.100

Here replace ftp with scp, sftp, tftp etc.

Copy files to Controller from a remote server

Copy ftp://192.168.1.100/script.log .

Summary of the File System Commands

Show flash - Displays the version of the image files contained in the controller's flash memory.

More running-config - Same as that of running-config. But there is a difference. Try to figure out the difference ;-)

Reload ap [id] | all | controller | default - To reload ap, controller or all.

[CAUTION :- The keyword default will reboot all Aps' and Controllers at the factory default startup configuration.]

Licensing

The following commands will display information about the license :

show license

show controller

show license-file active

To import a license file from ftp/sftp/tftp use the following command in global configuration mode:

License ftp://192.168.1.100/license3411.lic active

Configuring DHCP server in Controller

You can configure DHCP server in Controller itself so that you might not want to rely on external DHCP servers to server the client devices. This is basically done in small environments. Deploying Controller based DHCP server in large environment may increase the Controller load.

In a controller you can configure multiple DHCP servers for different VLANs' in your network. You can map each VLAN with DHCP server.

Important : DHCP Relay Pass-through MUST be enabled for a Controller based DHCP to work. To enable DHCP Relay Passthrough globally, use the below command in global configuration mode:

ip dhcp-passthrough

To enable DHCP pass-through for a VLAN:

(config)# vlan TestVLAN tag 200

(config-vlan)# no ip dhcp-passthrough

Use the below code to configure DHCP server. Here I have tagged the DHCP server to vlan 'TestVLAN':

(config)# dhcp-server DHCP1

(config-dhcp-server)# enable

(config-dhcp-server)# vlan name TestVLAN

(config-dhcp-server)# lease-time 3600

(config-dhcp-server)# ip-pool 192.168.1.10 192.168.1.100

(config-dhcp-server)# domain-name tony.com

(config-dhcp-server)# dns-server-primary 192.168.1.5

(config-dhcp-server)# dns-server-secondary 192.168.1.4

(config-dhcp-server)# enable

More options can be configured like below:

Republishing with a notification : Product discontinued hence this post is not relevant anymore..

How to reboot multiple Virtual Machines on an ESXi host

2016-06-02T19:22:00.000+05:30

Recently I got a request to schedule the reboot of multiple VMs on an ESXi host on every weekend.

Let me explain the scenario first.

1. We need to schedule the reboot of all 50 VMs on every Saturday at 10.00PM (all those machines are Windows servers)

2. Both ESXi and vCenter are version 5.5

3. PowerCLI is installed on vCenter server.

Step-by-step Instructions

1. RDP to your vCenter server (if you are using vCenter server appliance you need to make changes on the below steps accordingly)

2. Make sure that you have enabled access for your domain user (domain administrator)\local server administrator so that they can access vCenter. If you haven't done this please follow https://virtuallylg.wordpress.com/2013/09/29/vsphere-5-5-how-to-add-domain-users-to-sso/

3. Open a notepad and copy paste the below script, save the file as 'VMReboot.ps1'

param(

[parameter(Mandatory = $true)]

[string[]]$vCenter,

[parameter(Mandatory = $true)]

[string[]]$vmName

)

$VIServer = Connect-VIServer $vCenter

If ($VIServer.IsConnected -ne $true){

Write-Host "error connecting to $vCenter" -ForegroundColor Red

exit

}

foreach($vm in $vmName){

Write-Host "Going to restart $vm"

Restart-VMGuest -VM (Get-VM $vm) -Confirm:$false

}

Disconnect-VIServer -Confirm:$false

4. Open PowerShell and test the script first (see below screenshot).

You need to mention your vCenter server and name of VMs you need to reboot. If you have multiple VMs separate the names with comma or if all VMs start with a common prefix use wild card (eg. "TestVM*")

See the VMs you have mentioned are getting rebooted. If the script works then schedule this job using Windows Task Scheduler

5. Open Task Scheduler and Create a basic task

6. Mention your schedule and on Actions > Start a Program

Program/script : C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Add arguments : -PSConsoleFile "C:\Program Files (x86)\VMware\Infrastructure\vSphere PowerCLI\vim.psc1" " & "C:\VMReboot.ps1" -vCenter VCENTER-SRV -vmName "TestVM*"

Verify if the scheduled task is working by running it.

Enable Task History to make sure that the scheduled task is working properly

All the best!

Reviewing Google Apps for Education: How good is Google Apps for your School ?

2016-04-06T13:34:00.000+05:30

I recently got a chance to implement and review Google Apps for Education in a school environment. So I just thought of sharing few information I acquired during my encounter with Google Apps. Hope this helps..!

"Cloud is changing the game"

What is cloud computing?

A solution allows companies to access IT-based services via the internet.

Cloud computing services operate at several levels:

Infrastructure as a service (IaaS)
Software as a service (SaaS)
Platform as a service (PaaS)

How Cloud Computing Can Help in Education?

Potential Cost-savings : Moving to the cloud usually means moving away from a CAPEX model (physical assets that depreciate) to an OPEX model (pay per use).

Collaboration : It includes a wide range of communication and collaboration tools, ideal for conducting online classes or for providing peer to peer support or tutoring.

Backup : An important function of the Cloud is that it automatically saves content, making it impossible to lose or delete any valuable material.

Accessibility : Any data stored in the Cloud can easily be accessed from almost any device including mobile devices such as phones or tablets.

Storage : The Cloud allows its users to store almost all types of content and data including music, documents, eBooks, applications, photos, and much more.

Flexibility : Offers the flexibility to meet rapidly changing software requirements for today’s and tomorrow’s teachers and students

No need for in-house expertise. Network managers can save a significant amount of time by reducing routine, operational tasks such as applying updates.

Google

No introduction is required for this name!

Just have a look at the verity of products they have :

Google for Education Products

45 million users among 190 countries are using Google for Education products.

Devices

Chromebooks, Chromeboxes and Tablets

Productivity Tools

Google Apps for Education Suite

This includes Classroom, Gmail, Drive, Calendar, Docs, Sheets ,Slides, Sites

Class Content

Apps, Books and Videos (YouTube For Schools)

More Products

Google Cloud Platform, Chrome Browser, Google Search for Education, Google Maps for Education

Google Apps for Education & Office365 – A comparison

Both offer a similar feature set:

Online storage : Google offers unlimited storage for education whereas Office365 provides only 15 GB of free storage

Both have app marketplaces

Both are free for education market.

Both services provide apps for mobile devices, and both offer options for accessing files when offline.

For most schools the real ‘value’ of a platform lies in how well that platform can support learning programs.

Google Apps – The counterpart of AD ?

Google Apps is a cloud directory service (Hmm, not a straight forward statement!)

No need to spend money for buying expensive directory services like Microsoft Active Directory or maintain complex management software.

Google Apps is simple : to configure, manage and troubleshoot.

It's free and a perfect solution for schools.

Almost all the applications required for a school environment are available in Google Apps for Education.

Can You Use Google Apps as Your Directory Service/ Can we replace AD with Google Apps?

Well, it depends on three factors:

What “directory services” means to your organization ?

Which specific IT resources you need to run your organization?

Whether your organization is new (a startup, or launched in the past 7-10 years) or has been around for a while (anything longer than 10 years)?

What “directory services” means to your organization ?

Are you looking to centrally manage your users? Google Apps may do this well enough if all you want to control is access to Google Apps and some web applications. If you have more needs, Google’s directory won’t suffice.

Are you looking to control device and application access for your employees? If so, you may find Google Apps is limited.

Do you have a BYOD culture?

Does your organization have a high bar when it comes to security due to regulations or the fact that you store sensitive information?

Which specific IT resources you need to run your organization?

Complete an ‘IT Audit”

Audit your Hardware, Application and Server Infrastructure

Ask questions like :

1. Are we using one type of device, or are we using a mix? (i.e. Windows, Mac OSX, etc.)

2. Which teams are using Windows, which teams are using Macs, which teams are using Linux devices and why?

3. Do we provide our users with mobile phones and tablets or do we subscribe to a BYOD (Bring Your Own Device) model?

4. Are most of your apps Web-based solutions or hardwired? And how do we expect that to change to web-based within the next 5 years? 10 years?

5.Do you have any on-premise, legacy apps?

Whether your organization is new (a startup, or launched in the past 7-10 years) or has been around for a while (anything longer than 10 years)?

If you are a “born in the cloud” company mainly leveraging Google Apps and some Web-based services, Google Apps Directory could work for you in your early stages.

If your organization has been around for a while, is more diverse with your IT infrastructure, or is growing rapidly, Google Apps Directory will not give you the control you desire.

Well, now it's your turn to decide Google Apps for Education is good for your school or not?

A short note about Bitcoin

2015-08-03T21:20:00.002+05:30

Have you heard about a currency which you can mine? If not this is a new form of currency which you cannot touch but will get you everything which money can buy! This is called Bitcoin, the first example of a growing category of money known as cryptocurrency.

What is Bitcoin?

Bitcoin is a form of digital currency, created and held electronically. No one controls it. Transactions are made without any bank's involvement. There are no transaction fees and no need to provide your real name. It is not backed by gold or credibility of any government. Bitcoins aren't printed, like rupees or euros but they are produced by lots of people running computers all around the world, using software that solves mathematical problems.

How to acquire bitcoin?

There are different ways to acquire bitcoins. Here I am listing out a few:

Buy Bitcoins

Simple as it says. You can buy bitcoins from somebody who have it or from a Bitcoin exchange by exchanging any fiat currency (USD, INR etc). While writing this article the price was 1BTC = $284.85 Surprised!?!

Earn by accepting Bitcoin as a payment for your product/services.

The best and easiest way to earn Bitcoins. However, there is a risk factor. You have to believe Bitcoins. In fact the Bitcoin value is based on faith. Sounds crazy huh!? You will get a clue from the below question and answer:

Qn: What really backs the U.S. Dollar?

Ans: U.S. Dollar is backed by the "full faith and credit" of the US Government, it means the labor, wealth and property of "The American People"!

Mine Bitcoin

Mining is the process by which new coins are created - tell your computer to solve a set of difficult mathematical problems and success is rewarded with bitcoin.

Sounds simple?

No, it is not that simple! There are so many hurdles - mining hardware, software, complexity of the mathematical problem, processing power, electricity charges etc. And the fact that only a finite number of bitcoins can ever be created (21 million, to be exact) :-(

The other side of Bitcoin is something different. Nobel Prize winning economist Paul Krugman has even written an article 'Bitcoin Is Evil'- the topic explains the content. Either it is good or evil. Let's learn something new - just keep in mind "Ignorance is an evil weed".

Curious about Bitcoins?! Here are some good starts https://bitcoin.org , http://www.bitcoinmining.com and ask Google uncle ;-)

Wireless Networking Basics

2014-10-22T20:30:00.000+05:30

It's been a while since my last post. So this time I have come up with a new topic, Wireless Networking! Wireless networking have been around for many years and is being used widely in many industries. I have prepared an FAQ about basic wireless networking which might help the WiFi beginners. As usual, if you have any comments or queries then do get in touch.

1.) What is a Wireless Network (WLAN)?

A wireless local area network (WLAN) is an interconnection of two or more devices using a wireless media. Wireless networks are made up of network adapters that transmit high frequency radio signals, instead of using wires or cables, to send information to other computers or devices on a network.

This gives users the ability to move around within a local coverage area and still be connected to the network. Most modern WLANs are based on IEEE 802.11 standards, marketed under the Wi-Fi brand name.

2.) What is a Wired Network?

A wired network connects devices to the Internet or other networks using cables. In the past, wired networks were sometimes thought to be faster than wireless ones. However, today’s WLANs have minimized that difference.

3.) What are the differences between a Wired and Wireless Network?

Wired Network	Wireless Network
Use Ethernet switches to interconnect endpoints.	Access points and Controllers interconnect endpoints.
Less mobility	Greater Mobility
Inexpensive	Expensive
Difficult to configure and manage	Easy to set up and manage.
Data travels through dedicated wires.	Data travels through Air. Radio waves are the media.
Single path for data to travel (wires).	Multiple path for data (channels).
Speed doesn't change with distance.	Speed varies with distance – Follows the inverse square law.
Signal physically secure.	Accessible to anyone. Security must be implemented.

Wired network Wireless network

4.) What are the major similarities of a wired and wireless network?

On both wired and wireless network packets are send from one MAC address to another.
Both are prone to bandwidth issues : Congestion and over utilization.
Both are reliant upon the major protocols like DHCP, DNS, RADIUS etc.
Both subject to problems in the backbone network like network failure, looping etc.

5.) What are the major devices used to build a WLAN?

Below are some important devices need to build a WLAN:

a.) WLAN controller -> It is a device (either hardware or software) that directs or regulates traffic on the wireless network. The main purposes of a WLAN Controller are:

• Centralized Control : Management of Wireless Access Points from a centralized location (like a Domain Controller)

• Simplified Operations : It simplifies network deployment, operations, and management.

b.) Wireless Access Points (WAP): A wireless access point (AP) allows wireless devices to communicate and are commonly connected to cabled networks to allow wireless users access to the network. This also helps us to extend the Wireless network over a wide range.

c.) WLAN Network Interface card : Used in Laptops to connect with the WLAN.

d.) RADIUS or (TACACS+): To provide Authentication, Authorization and Accounting (AAA), a security mechanism.

e.) End devices such as Laptops, Tablet PCs', Mobile phone, Printer, VOIP etc.

f.) Power over Ethernet (PoE) : To provide power to APs', VOIP phones etc

Along with this there are many management/security software available in the market which are vendor specific. eg. RingMaster software of Juniper.

6.) What are the types of Wireless Network?

WLAN operates in two basic modes:

a.) Ad hoc mode -> Mobile units transmit directly (peer-to-peer)

b.) Infrastructure mode -> Mobile units communicate through an access point that serves as a bridge to other networks (such as Internet or LAN).

7.) What is the major protocol used in Wireless Network?

IEEE 802.11. Mainly operating at 2.4 and 5 GHz.

[Ref: http://en.wikipedia.org/wiki/IEEE_802.11]

8.) How to Secure WLANs?

To increase security, WLANs require:

• User authentication, to prevent unauthorized access to network resources, authenticate users to be sure you know who is using the WLAN. Open Authentication, Shared Key Authentication , EAP Authentication (802.1x), MAC Address Authentication , Combination of MAC-Based, EAP, and Open Authentication, WPA Key Management (802.1x), Captive portal are the examples of wireless authentication solution.

More info about authentication @ http://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SecurityAuthenticationTypes.html#wp1059546

• Data encryption/privacy, to protect the integrity and privacy of transmitted data, encrypt data that travels on the network. WEP and WPA/WPA2 are the two important encryption mechanisms available. Wired Equivalent Privacy (WEP) encryption is not adequate nowadays, but WPA and WPA2 give you stronger options.

• Physically hide or secure access points to prevent tampering.

Basically while designing a wireless network we need choose the security protocol needs to be used in it. It can either be WEP or WPA/WPA2.

For example WPA2 is a security scheme that specifies two main aspects of your wireless security:

Authentication: Your choice of PSK ("Personal") or 802.1X ("Enterprise").
Encryption: Always AES-CCMP.

If you're using WPA2 security on your network, you have two authentication choices: You either have to use a single password for the whole network that everyone knows (this is called a Pre-Shared Key or PSK), or you use 802.1X to force each user to use his own unique login credentials (e.g. username and password).

Regardless of which authentication type you've set up your network to use, WPA2 always uses a scheme called AES-CCMP to encrypt your data over the air for the sake of confidentiality, and to thwart various other kinds of attacks.

802.1X is based on EAP, the Extensible Authentication Protocol that was originally developed for PPP, and is still used extensively in VPN solutions that use PPP inside the encrypted tunnel (LT2P-over-IPSec, PPTP, etc.). In fact, 802.1X is generally referred to as "EAP over LANs" or "EAPoL".

To know more about various 802.1X mechanisms check http://securityuncorked.com/2009/12/four-options-for-secure-wireless-authentication-with-8021x/ and http://technet.microsoft.com/en-in/library/cc759077(v=ws.10).aspx

9.) What is the difference between WEP and WPA ?

WEP	WPA
Wired Equivalent Privacy	Wi-Fi Protected Access
A security protocol for wireless networks introduced in 1999 to provide data confidentiality comparable to a traditional wired network	A security protocol developed by the Wi-Fi Alliance in 2003 for use in securing wireless networks; designed to replace the WEP protocol.
Through the use of a security algorithm for IEEE 802.11 wireless networks it works to create a wireless network that is as secure as a wired network.	As a temporary solution to WEP's problems, WPA still uses WEP's insecure RC4 stream cipher but provides extra security through TKIP, AES, CCMP.
Wireless security through the use of an encryption key and uses CRC for Integrity check.	Wireless security through the use of a password. Uses Integrity check.
Open system authentication or shared key authentication. Mainly using MAC address for authentication.	Authentication through the use of a 64 digit hexadecimal key or an 8 to 63 character passcode. User Authentication is possible.

More details @ http://www.howtogeek.com/167783/htg-explains-the-difference-between-wep-wpa-and-wpa2-wireless-encryption-and-why-it-matters/

10.) Which are all the major vendors in WLAN market?

Cisco, Aruba, HP, Ruckus, Motorola, Meru, Juniper etc.

11.) What does WiFi mean?

WiFi is the popular term for a high-frequency wireless local area network (WLAN). It is also is a set of standards for wireless local area networks (WLAN) currently based on the IEEE 802.11 specifications to ensure interoperability of wireless networking products.

12.) Which are the standards bodies primarily responsible for implementing WLANs?

IEEE : Defines the mechanical process of how WLANs are implemented in the 802.11 standards so that vendors can create compatible products.

The Wi-Fi Alliance : Basically certifies companies by ensuring that their products follow the 802.11 standards, thus allowing customers to buy WLAN products from different vendors without having to be concerned about any compatibility issues.

Frequencies bands.

13.) Some Basic Wireless Terminologies

Radio Frequency (RF)

Before we look into the radio frequency let's have a look into the electromagnetic spectrum as RF is a part of the electromagnetic spectrum.

The electromagnetic radiation spectrum is the complete range of the wavelengths of electromagnetic radiation, beginning with the longest radio waves and extending through visible light all the way to the extremely short gamma rays that are a product of radioactive atoms.

Now what is this electromagnetic radiation? Electromagnetic radiation (EM radiation, EMR, or light) is a form of energy released by electromagnetic processes. Electromagnetic radiation is made when an atom absorbs energy. The absorbed energy causes one or more electrons to change their locale within the atom. When the electron returns to its original position, an electromagnetic wave is produced. Depending on the kind of atom and the amount of energy, this electromagnetic radiation can take the form of heat, light, ultraviolet, or other electromagnetic waves.

Electromagnetic radiation travels in waves, just like waves in an ocean. The energy of the radiation depends on the distance between the crests (the highest points) of the waves, or the wavelength. In general the smaller the wavelength, the higher the energy of the radiation. Gamma rays have wavelengths less than ten trillionths of a meter which is about the size of the nucleus of an atom. This means that gamma rays have very high-energy. Radio waves, on the other hand, have wavelengths that range from less than one centimeter to greater than 100 meters (this is bigger than the size of a football field)! The energy of radio waves is much lower than the energy of other types of electromagnetic radiation. The only type of light detectable by the human eye is visible light. It has wavelengths about the size of a bacteria cell, and its energies fall between those of radio waves and gamma rays.

The types of electromagnetic radiation are broadly classified into the following classes:

Gamma radiation

X-ray radiation

Ultraviolet radiation

Visible radiation

Infrared radiation

Terahertz radiation

Microwave radiation

Radio waves

This classification goes in the increasing order of wavelength, which is characteristic of the type of radiation.

The below diagram explain electromagnetic spectrum more clearly.

Now let's look into RF in more detail.

Short for radio frequency, RF is any frequency within the electromagnetic spectrum associated with radio wave propagation. When an RF current is supplied to an antenna, an electromagnetic field is created that then is able to propagate through space. The current actually excites electrons within the antenna and the energy moves outward in the form of an electromagnetic wave.

Many wireless technologies are based on RF field propagation. Radio frequency is also abbreviated as rf or r.f.

RF basically range between a frequency range of 3 kHz and 300 GHz.

Here is an excellent video which describes RF in simple words https://www.youtube.com/watch?v=FVmTooGICNc

Also a great guide about RF and Antenna Fundamentals can be found at http://faculty.ccri.edu/jbernardini/JB-Website/ETEK1500/1500Notes/CWNA-ed4-Chapter-2.pdf

Service Set

A service set is a set consisting of all the devices associated with a consumer or enterprise IEEE 802.11 WLAN. It can also be called as a wireless cell or wireless workgroup.

SSID : To identify a service set we use Service Set Identifier (SSID). On an AP SSID is the combination of its MAC address and network name.

BSS : BSS(Basic service set) is an area where an AP service or It is a single wireless area for an infrastructure mode wireless LAN.

BSSID : To identify BSS we use BSSID.

ESS : If the AP connects to a Wireless Controller over a wired connection (multiple APs' will be there in such a situation), then all together we call it as ESS.

Active and Passive Scanning

Passive Scanning : Beacon frames are being sent out from the AP (typically every 100 milli second) to announce the presence of a wireless LAN. This frame contain many information like SSID, Capability information, Supported rates etc. [More about becon @ http://www.wi-fiplanet.com/tutorials/print.php/1492071] Laptops listens to these becon frames and connect to the desired WLAN. The process of listening to beacon is called Passive Scanning.

Whereas in Active Scanning clients will search for APs' through probe request. Active scanning is required when enabled the "SSID Hide" in AP. APs' respond with a probe response frame, containing capability information, supported data rates, etc., when after it receives a probe request frame.

Authentication, Association and Re-association

Authentication

Authentication frame: 802.11 authentication is a process whereby the access point either accepts or rejects the identity of a radio NIC. The NIC begins the process by sending an authentication frame containing its identity to the access point. With open system authentication (the default), the radio NIC sends only one authentication frame, and the access point responds with an authentication frame as a response indicating acceptance (or rejection). With the optional shared key authentication, the radio NIC sends an initial authentication frame, and the access point responds with an authentication frame containing challenge text. The radio NIC must send an encrypted version of the challenge text (using its WEP key) in an authentication frame back to the access point. The access point ensures that the radio NIC has the correct WEP key (which is the basis for authentication) by seeing whether the challenge text recovered after decryption is the same that was sent previously. Based on the results of this comparison, the access point replies to the radio NIC with an authentication frame signifying the result of authentication.

Deauthentication frame: A station sends a deauthentication frame to another station if it wishes to terminate secure communications.

Association

Association request frame: 802.11 association enables the access point to allocate resources for and synchronize with a radio NIC. A NIC begins the association process by sending an association request to an access point. This frame carries information about the NIC (e.g., supported data rates) and the SSID of the network it wishes to associate with. After receiving the association request, the access point considers associating with the NIC, and (if accepted) reserves memory space and establishes an association ID for the NIC.

Association response frame: An access point sends an association response frame containing an acceptance or rejection notice to the radio NIC requesting association. If the access point accepts the radio NIC, the frame includes information regarding the association, such as association ID and supported data rates. If the outcome of the association is positive, the radio NIC can utilize the access point to communicate with other NICs on the network and systems on the distribution (i.e., Ethernet) side of the access point.

Reassociation

Reassociation request frame: If a radio NIC roams away from the currently associated access point and finds another access point having a stronger beacon signal, the radio NIC will send a reassociation frame to the new access point. The new access point then coordinates the forwarding of data frames that may still be in the buffer of the previous access point waiting for transmission to the radio NIC.

Reassociation response frame: An access point sends a reassociation response frame containing an acceptance or rejection notice to the radio NIC requesting reassociation. Similar to the association process, the frame includes information regarding the association, such as association ID and supported data rates.

Beacon and Probe

Beacon frame: The access point periodically sends a beacon frame to announce its presence and relay information, such as timestamp, SSID, and other parameters regarding the access point to radio NICs that are within range. Radio NICs continually scan all 802.11 radio channels and listen to beacons as the basis for choosing which access point is best to associate with.

Probe request frame: A station sends a probe request frame when it needs to obtain information from another station. For example, a radio NIC would send a probe request to determine which access points are within range.

Probe response frame: A station will respond with a probe response frame, containing capability information, supported data rates, etc., when after it receives a probe request frame.

Interference

Interference is anything which modifies, or disrupts a signal as it travels along a channel between a source and a receiver. The term typically refers to the addition of unwanted signals to a useful signal.

Effects of Interference

> A decrease in the wireless range between devices

> A decrease in data throughput over Wi-Fi

> Intermittent or complete loss of the wireless connection

Causes of Interference

The five main interference factors are :

1.) Absorption

2.) Reflection

3.) Multipath

4.) Scattering

5.) Refraction

Some common causes of interference can be found @ http://packetworks.net/blog/common-causes-of-wifi-interference

How to avoid common Interference

An interesting article can be found @ http://www.networkworld.com/article/2215287/tech-primers/coping-with-wi-fi-s-biggest-problem--interference.html

Yet another interesting article http://www.cisco.com/c/en/us/products/collateral/wireless/spectrum-expert-wi-fi/prod_white_paper0900aecd807395a9.html

Frequencies and Channels

What is a channel?

In a communication network a channel refers to a physical transmission medium such as a wire, or to a logical connection over a multiplexed medium such as a radio channel. A channel is used to convey an information signal, for example a digital bit stream, from one or several senders (or transmitters) to one or several receivers. A channel has a certain capacity for transmitting information, often measured by its bandwidth in Hz or its data rate in bits per second.

In a Wireless network each wireless radio operates on a configured radio frequency (RF) channel identified by numbers. A radio assigned to a particular channel both transmits and receives all traffic on that channel.

Depending upon the network configuration, some channels might have less interference than others. Choosing the right channel lets you optimize performance.

There are 14 channels designated for wireless networks in the 2.4-GHz frequency band and 42 channels in the 5-GHz frequency band.

The 14 channels in the 2.4-GHz band are spaced 5 MHz apart. The protocol requires 25 MHz of channel separation, meaning that it is possible for adjacent channels to overlap and then interfere with each other. For this reason, only channels 1, 6, 11 are typically used in the US to avoid interference. In the rest of the world, the four channels 1, 5, 9, 13 are typically recommended. The 2.4-GHz frequency band is heavily used because most devices can operate on that band.

The 5-GHz band is actually four frequency bands: 5.1 GHz, 5.3 GHz, 5.4 GHz, and 5.8 GHz. The 5-GHz band has a total of 24 channels with 20- MHz bandwidth available. Unlike the 2.4-GHz band, the channels are non-overlapping, therefore all channels have the potential to be used in a single wireless system. Because only 802.11a devices formerly used this band (occasionally 802.11n uses it also) this band is less crowded and targeted for increased use for new 802.11 technologies under development.

For best performance, choose a channel at least 5 channels apart from your neighbors' networks. Determine this by completing a site survey—a site survey includes a test for RF interference.

Try to use non-overlapping channels (eg. 1, 6, 11), or minimize overlap of signals by using channels as far apart as possible from other networks in range.

List of WLAN channels can be found at http://en.wikipedia.org/wiki/List_of_WLAN_channels

What is Frequency?

Frequency is the number of occurrences of a repeating event per unit time. Radio Frequency, which range around 3KHz to 300GHz is used for communication (basically a wifi network works at 2.4 GHz to 5GHz).

The 802.11 workgroup currently documents use in five distinct frequency ranges: 2.4 GHz, 3.6 GHz, 4.9 GHz, 5 GHz, and 5.9 GHz bands.

Site Surveying

A radio frequency (RF) site survey is the first step in the deployment of a Wireless network and the most important step to ensure desired operation. A site survey is a task-by-task process by which the surveyor studies the facility to understand the RF behavior, discovers RF coverage areas, checks for RF interference and determines the appropriate placement of Wireless devices.

A couple of useful links about Site survey : http://www.wi-fiplanet.com/tutorials/article.php/3761356 and http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/68666-wireless-site-survey-faq.html#qa1

Useful Links

http://www.wi-fi.org/

http://en.wikipedia.org/wiki/IEEE_802.11

Emulating Cisco ASA 8.4.2 on GNS3 [ Included GNS3 1.3 - Updated on 07/04/2015]

2014-02-16T18:08:00.002+05:30

This post will take you through a step-by-step guide to emulate Cisco ASA 8.4.2 on GNS3. In GNS3 QEMU is an emulator which emulates the hardware environment for a Cisco ASA device. Please make sure that your computer have got at least 4GB of RAM before you begin.

The below steps are pretty simple and straight forward. So let's begin.

Edit on 28/10/2014: On the latest version of GNS3 i.e GNS3 1.0, adding ASA from Qemu is a little different. Just follow the steps mentioned under the topic 'In GNS3 1.0' below.

1.) Download and install GNS3. You can get the software from http://www.gns3.com . You may need to register/login to get the software.

2.) Get a copy of ASA 8.4.2 code. You can get it from your live ASA device by copying the image to a TFTP server.

3.) Unpack the image and you will get two files, asa842-initrd.gz and asa842-vmlinuz.

[For GNS3 1.0 (latest) follow the steps under the topic 'In GNS3 1.0']

4.) Now Open GNS3 and go to Edit -> Preferences -> Qemu -> ASA.

5.) Configure the 'ASA Settings' and 'ASA Specific Settings' like below:

Identifier name: Cisco-ASA

RAM : 1024 MiB

Number of NICs : 6

Qemu Options: -vnc none -vga none -m 1024 -icount auto -hdachs 980,16,32

Initrd: Browse and select the 'asa842-initrd.gz' file from the unpack process

Kernel: Browse and select the 'asa842-vmlinuz' file from the unpack process

Kernel cmd line: -append ide_generic.probe_mask=0x01 ide_core.chs=0.0:980,16,32 auto nousb console=ttyS0,9600 bigphysarea=65536

Finally click Save and click OK. Also refer the below screenshot for more info regarding the above configuration.

Now drag and drop ASA Firewall to the project area and start configuring your ASA device!

In GNS3 1.0 [Edit on 28/10/2014]

Follow up to step 4 above.

1.) Expand QEMU > QEMU VMs

2.) Click New and type a name of your ASA device

3.) Select the type as ASA 8.4(2) and click Next

4.) Leave the Qemu binary and RAM as it is and click Next

5.) Now browse the initrd and Kernal image which you have extracted before and click Finish

That's it! You are done with ASA configuration in GNS3. No need to give Qemu Options or Kernel cmd line, everything is already set in GNS3. Below you can find a screenshot of the configuration.

Now go to your GNS3 > Security devices and drag your ASA to work-space, enjoy!

Add ASDM and connect your ASA

You can connect ASA from the computer from which you are running GNS3. Follow the steps below to do this:

1.) Add a Microsoft Loop-back to your computer (refer http://www.groovypost.com/howto/install-loopback-adapter-windows-8-server-2012/) and provide an IP address as below (use any IP) :

2.) Drag and drop 'Cloud' to the GNS3 work-space and connect it with an Ethernet Switch. Refer below screenshot :

3.) Configure 'Cloud' and add the Loop-back adapter which you have added instep 1 as mentioned in below figure:

4.) Take a console session to your ASA from GNS3 and configure one of its interface like below:

interface GigabitEthernet1
nameif inside
security-level 100
ip address 192.168.1.10 255.255.255.0

5.) Now try to ping your computer's Loopback IP from ASA and vice-verse (Make sure that you disable firewall/antivirus etc on your local PC which is installed with GNS3.)

6.) Download ASDM ( asdm-649.bin)

7.) Install a TFTP server in your local PC and keep the above file in its root directory.

8.) Now upload the asdm-649.bin to the ASAs' flash using the below commands: (If the upload fails , then try disabling any other network adapter other than the Loop-back adapter temporarily and try)

ciscoasa# copy tftp: flash:
Address or name of remote host? 192.168.1.100
Source filename? asdm-649.bin
Destination filename [asdm-649.bin]?

Accessing tftp://192.168.1.100/asdm-649.bin...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
18927088 bytes copied in 143.10 secs (132357 bytes/sec)

9.) Initiate the below commands to load ASDM on the ASA and enable http server:

ciscoasa(config)# asdm image flash:asdm-649.bin
ciscoasa(config)# http server enable
ciscoasa(config)# http 192.168.1.10 255.255.255.0 inside
ciscoasa(config)# username admin password 1234 privilege 15

ciscoasa(config)# write memory

10.) Now get to your local PC, open a browser and type https://192.168.1.10 and you will get a page open like below:

11.) Click on 'Run ASDM' and enter with the username and password which you have created on step 9. You will be presented with the ASA dashboard.

I hope this helps. You can expect ASA configuration examples and tech notes soon in my blog.

Zone Based Firewall Advanced Configuration

2013-08-18T11:22:00.000+05:30

This post will take you through some advanced configuration scenarios of Cisco IOS Zone Based Firewall. This is a continuation of my previous blog entry Cisco IOS Zone-Based Firewall Step-by-step Configuration Guide.

Following are the features and scenarios we are going to see in this post.

1.) Zone Based Firewall Layer 7 Application Inspection and Control

2.) Traffic Policing in Zone-Based Policy Firewall

3.) Session Control in Zone Based Firewall

4.) Out-of-Order Packet Processing Support in the Zone-Based Firewall Application

5.) Tuning Zone-Based Policy Firewall Denial-of-Service Protection

6.) Content Filtering with IOS Zone Based Firewall

7.) Self-Zone Configuration in Zone Based Firewall

8.) Allow SSL WebVPN through Zone Based Firewall

9.) Allow Cisco Configuration Professional through Zone Based Firewall

10.) Using IPSec VPN with Zone-Based Policy Firewall

1. Zone Based Firewall Layer 7 Application Inspection and Control

ZBFW is capable of doing a layer 7 application inspection for the below protocols:

HTTP
SMTP
POP3
IMAP
Sun RPC
P2P Applications (Refer How to block P2P Traffic on a Cisco Router)
IM Applications

Here we are going to discuss about the IM layer 7 inspection capability of a Zone Based Firewall.

IM application inspection and control

This feature is currently applicable for the following IM Services:

AOL Instant Messenger
MSN Messenger
Yahoo! Messenger

IM inspection and control offers both Layer 4 Stateful Inspection and Layer 7 Application Control.

Layer 4 inspection is configured similarly to other application services:

class-map type inspect match-any IM-CLASS
   match protocol [aol | msnmsgr | ymsgr ]

policy-map type inspect IN-TO-OUT-POLICY
   class type inspect IM-CLASS
      [drop | inspect | pass]

IM application have got the port hopping capability and it contact their servers on multiple port. In order to allow an IM service we need to simply apply a layer 4 inspect action but if you want to deny a particular IM service you need to define server list so that ZBFW can identify the traffic associated with IM application.

First configure the server-list parameter-map:

    parameter-map type protocol-info
      server name
      server ip a.b.c.d
      server ip range a.b.c.d a.b.c.d

Parameter Map

For example, the AOL and Yahoo! IM server list is defined as such:

    parameter-map type protocol-info AOL-SERVERS
     server name login.oscar.aol.com
     server name toc.oscar.aol.com
     server name oam-d09a.blue.aol.com
     server ip x.x.x.x
     server ip range x.x.x.x y.y.y.y

parameter-map type protocol-info YAHOO-SERVERS
    server name scs.msg.yahoo.com
    server name scsa.msg.yahoo.com
    server name scsb.msg.yahoo.com

Class Map

You need to apply the server-list to the protocol definition:

    class-map type inspect match-any AOL-BLOCK-CLASS
     match protocol aol AOL-SERVERS
match protocol ymsgr YAHOO-SERVERS
     exit

class-map type inspect match-all IM-PROTOCOL-CLASS
      match class-map IM-BLOCK-CLASS
exit

Policy Map

   policy-map type inspect IN-TO-OUT-POLICY
class type inspect IM-PROTOCOL-CLASS
drop log
exit

You must configure the 'ip domain lookup' and 'ip name-server x.x.x.x' commands in order to enable name resolution.

IM server names are fairly dynamic. You will need to periodically check that your configured IM server lists are complete and correct. IM Application Inspection also offers the capability to differentiate between text-chat activity and all other application services such as selectively blocking or allowing text-chat capabilities, while denying other service capabilities.

2. Traffic Policing in Zone-Based Policy Firewall

Using a ZBFW we can limit the transmission rate of specific traffic. This will help us to limit lower priority traffic over business-essential traffic. ZBFW policing can only specify bandwidth use in bytes/second, packet/second and bandwidth percentage policing are not offered.

Configuring ZBFW Policing

ZBFW policing limits traffic in a policy-map’s class-map to a user-defined rate value between 8,000 and 2,000,000,000 bits per second, with a configurable burst value in the range of 1,000 to 512,000,000 bytes.

In this example I am policing HTTP traffic. The rate policing part is highlighted in bold text.ZFW policing is configured in the policy-map,which is applied after the policy action:

class-map type inspect match-all HTTP-TRAFFIC
   match protocol http

    policy-map type inspect IN-TO-OUT-POLICY
     class type inspect http-class
      inspect
      police rate [bps rate value {8000-2000000000}] burst [value in bytes {1000-512000000}]

3. Session Control in Zone Based Firewall

ZBFW adds the functionality to limit the session where it allows granular control on the number of sessions matching any given class-map that cross a zone-pair.

In order to configure session control you have to define a parameter map that contain the session limit and attach that to the class-map which is attached with the policy-map.

parameter-map type inspect HTTP-SESSION-CONTROL
sessions maximum [1-2147483647]

policy-map type inspect IN-TO-OUT-POLICY
class type inspect HTTP-TRAFFIC
inspect HTTP-SESSION-CONTROL

4. Out-of-Order Packet Processing Support in the Zone-Based Firewall Application

Out-of-Order (OoO) packet processing support for Common Classification Engine (CCE) firewall application and CCE adoptions of the Intrusion Prevention System (IPS) allows packets that arrive out of order to be copied and reassembled in the correct order. The OoO packet processing reduces the need to retransmit dropped packets and reduces the bandwidth needed for the transmission of traffic on a network. To configure OoO support, use the parameter-map type ooo global command.

parameter-map type ooo global
   tcp reassembly timeout 5
   tcp reassembly queue length 16
   tcp reassembly memory limit 1024
   tcp reassembly alarm off

5. Tuning Zone-Based Policy Firewall Denial-of-Service Protection

Refer Tuning Zone-Based Policy Firewall Denial-of-Service Protection

6. Content Filtering with IOS Zone Based Firewall

Refer Cisco IOS Local Content Filtering

7. Self-Zone Configuration in Zone Based Firewall

For self-zone configuration refer ZBFW Self-Zone Integration

8. Allow SSL WebVPN through Zone Based Firewall

[ Cisco IOS SSL VPN Configuration Guide : http://yadhutony.blogspot.in/2013/06/cisco-ios-ssl-vpn-configuration-guide.html ]

ACL

ip access-list extended SSL_WEBVPN_ACL
permit tcp any any eq 443 *
exit

access-list 104 permit ip any host

Class Map

class-map type inspect match-any SSL_CLASS
match access-group name SSL_WEBVPN_ACL
exit
class-map type inspect match-all SSL_WEBVPN_TRAFFIC
match class-map SSL_CLASS
match access-group 104
exit

Policy Map

policy-map type inspect OUT-TO-SELF
class type inspect SDM_WEBVPN_TRAFFIC
no drop
inspect
exit

Zone Pair

zone-pair security OUT-TO-SELF source OUTSIDE destination self
service-policy type inspect OUT-TO-SELF
exit

* By default port 443 is being used by Cisco SSL VPN.

9. Allow Cisco Configuration Professional through Zone Based Firewall

ACL

ip access-list extended CCP_SSH
permit tcp any any eq 22
exit

ip access-list extended CCP_HTTPS
permit tcp any any eq 443
exit

ip access-list extended CCP_SHELL
permit tcp any any eq cmd
exit

access-list 102 permit ip any any

Class Map

class-map type inspect match-any CCP_SSH_CLASS
match access-group name CCP_SSH
exit

class-map type inspect match-any CCP_HTTPS_CLASS
match access-group name CCP_HTTPS
exit

class-map type inspect match-any CCP_SHELL_CLASS
match access-group name CCP_SHELL
exit

class-map type inspect match-any CCP-ACCESS_CLASS
match class-map CCP_SSH_CLASS
match class-map CCP_HTTPS_CLASS
match class-map CCP_SHELL_CLASS
exit

class-map type inspect match-all CCP-ACCESS
match class-map CCP-ACCESS_CLASS
match access-group 102
exit

Policy Map

policy-map type inspect OUTSIDE-TO-SELF
class type inspect CCP-ACCESS
no drop
inspect
exit

Zone Pair

zone-pair security OUT-TO-SELF source OUTSIDE destination self
service-policy type inspect OUTSIDE-TO-SELF
exit

10. Using IPSec VPN with Zone-Based Policy Firewall

Refer Using VPN with Zone-Based Policy Firewall

Useful Links

Cisco IOS SSL VPN Configuration Guide

2013-06-07T16:52:00.001+05:30

Introduction

The Cisco SSL VPN (also known as WebVPN) is a remote access solution which enables a remote user to access his corporate network from anywhere on the Internet. Remote access is provided through a Secure Socket Layer (SSL) enabled SSL VPN gateway. The SSL VPN gateway allow remote users to establish a secure Virtual Private Network (VPN) tunnel using a web browser.

SSL VPN provides the following three mode of access:

1. Clientless - Clientless mode provides secure access to private web resources. You can access all the resources in your company which uses a web interface.

2. Thin-client - Thin-client mode extend the capability by enabling us to access TCP-based applications such as POP3, SMTP, IMAP, SSH.

3. Full-tunnel - Full-tunnel mode provide access to virtually any application inside your company. Here the remote user will download a Cisco AnyConnect VPN client (next-generation VPN client) from the IOS router to use SSL.

Clientless SSL VPN Vs Easy VPN

Clientless SSL VPN	Easy VPN
Doesn't require any client software on end user but a web browser.	Require VPN client software to be installed on client machine.
Users doesn't have access to all network resources.	Full access to all network resources.
Support mostly web based services.	Support virtually all services.
It can transverse firewall and NAT configuration.	Require to change firewall and NAT configuration.
It won't support low-latency application.	Support low-latency application.

SSL VPN Session Establishment

Step-by-step IOS SSL VPN Configuration

This document will show you how to configure a SSL VPN in full tunnel and clientless mode on an IOS device. Configuration is based on a Cisco 2900 Integrated Service Router running with 15.0(1)M3 code.

Network Diagram

Configuration Tasks

1. Enable and configure AAA.

2. Generate RSA Keypair and Configure Trustpoint.

3. Configure SSL VPN IP pool.

4. Setup SSL VPN Gateway.

5. Upload & Install AnyConnect VPN Software (SVC) on Router.

6. Setup SSL VPN Context and Configure Group policy

1. Configuring AAA for SSL VPN authentication

Enable AAA in router for client authentication. VPN users have to be authenticated with either a local database or an authentication server like RADIUS or TACACS+. In this example I used local database to authenticate VPN users.

CORPORATE(config)#aaa new-model
CORPORATE(config)#aaa authentication login SSL_AUTHEN local

Create username and password in local database:

CORPORATE(config)#username administrator privilege 15 password mypassword
CORPORATE(config)#username tony password cisco123

2. Generating RSA Keypair and Configuring Trustpoint.

We have to create a RSA keypair using the crypto key generate rsa command. Before that you have to make sure that you have set a host name and domain name on your router.

CORPORATE(config)#crypto key generate rsa general-keys label RSA-KEY mod 4096
The name for the keys will be: RSA-KEY

% The key modulus size is 4096 bits
% Generating 4096 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 71 seconds)

Configuring the Trustpoint:

Now we have to declare the trust point that the router should use. To do so type the below commands in global configuration mode.

CORPORATE(config)#crypto pki trustpoint MY-TRUSTPOINT
CORPORATE(ca-trustpoint)#enrollment selfsigned
CORPORATE(ca-trustpoint)#subject-name CN=my-certificate
CORPORATE(ca-trustpoint)#rsakeypair RSA-KEY
CORPORATE(ca-trustpoint)#exit

Enrolling Certificate:

The next step is to enroll the self signed certificate that you have just created. If you have already created a certificate you can either use that or overwrite it by typing yes.

CORPORATE(config)#crypto pki enroll MY-TRUSTPOINT
% Include the router serial number in the subject name? [yes/no]: y
% Include an IP address in the subject name? [no]: n
Generate Self Signed Router Certificate? [yes/no]: y

Router Self Signed Certificate successfully created

3. Configuring SSL VPN pool IP address

CORPORATE(config)#ip local pool SSL-POOL 172.17.0.114 172.17.0.122

4. Setting up SSL VPN Gateway

The WebVPN Gateway is used to terminate the SSL connection from the user. The basic configuration requires an IP address on the same subnet as one of the public network interfaces; this could be the same address used on the public network interface, or another address in the same subnet. Alternately, you can define a loopback interface, and use an address in that subnet, just as long as the address is reachable on the public network.

CORPORATE(config)#webvpn gateway SSLVPNGW
PLEASE READ THE FOLLOWING TERMS CAREFULLY. INSTALLING THE LICENSE OR
LICENSE KEY PROVIDED FOR ANY CISCO PRODUCT FEATURE OR USING SUCH
PRODUCT FEATURE CONSTITUTES YOUR FULL ACCEPTANCE OF THE FOLLOWING
TERMS. YOU MUST NOT PROCEED FURTHER IF YOU ARE NOT WILLING TO BE BOUND
BY ALL THE TERMS SET FORTH HEREIN.
......................................................................................................................................
...................................................................
Activation of the software command line interface will be evidence of
your acceptance of this agreement.

ACCEPT? [yes/no]: yes
CORPORATE(config-webvpn-gateway)#ip address 172.17.0.5 port 443
CORPORATE(config-webvpn-gateway)#ssl trustpoint MY-TRUSTPOINT
CORPORATE(config-webvpn-gateway)#inservice
CORPORATE(config-webvpn-gateway)#exit

5. Upload & Install AnyConnect VPN Software (SVC) on Router

Now upload the Cisco AnyConnect VPN client to the router's flash memory. You can use a TFTP server to do this. In this example we are uploading 'anyconnect-win-3.1.00495-k9.pkg' to router's flash using a TFTP server.

CORPORATE(config)#copy tftp flash:
Address or name of remote host []? 172.17.0.84
Source filename []? anyconnect-win-3.1.00495-k9.pkg
Destination filename [anyconnect-win-3.1.00495-k9.pkg]?
Accessing tftp://172.17.0.84/anyconnect-win-3.1.00495-k9.pkg...
Loading anyconnect-win-3.1.00495-k9.pkg from 172.17.0.84 (via GigabitEthernet0/0): !!!!!!!!!!!!!!!!!!!!!

[OK - 29806775 bytes]

29806775 bytes copied in 50.70 secs (587858 bytes/sec)

Verify the upload using 'show flash' in global configuration command.

Installing SVC (AnyConnect) package:

Install the SSL VPN Client (SVC) on your router. To do so type the below command in global configuration mode.

CORPORATE(config)#webvpn install svc flash://anyconnect-win-3.1.00495-k9.pkg
SSLVPN Package SSL-VPN-Client (seq:1): installed successfully

6. Setup SSL VPN Context and Configure Group policy

The WebVPN context is where the SSL VPN is terminated, and the user's VPN session is established. The context also contains all of the policies that can be applied to a user, including authentication, authorization, and accounting (AAA), virtual routing and forwarding instances (VRFs), and group policies. This is where the user authentication takes place, and group policies are applied to the user session.

Furthermore, the context can define the way the SSL VPN Web portal will appear to the user by specifying the colors and the images. The context is basically a container for user sessions. The WebVPN context uses a WebVPN gateway for the SSL session termination endpoint IP address. Multiple contexts can use one WebVPN gateway by using the domain keyword, and specifying a label.

Type the below commands to setup a context named 'VPN1' and a group policy called 'MYPOLICY'.

CORPORATE(config)#webvpn context VPN1
CORPORATE(config-webvpn-context)#ssl authenticate verify all
CORPORATE(config-webvpn-context)#url-list "WebServers"
CORPORATE(config-webvpn-url)#heading "Intranet Websites"
CORPORATE(config-webvpn-url)#url-text "FTPServer" url-value "ftp://172.17.0.39"
CORPORATE(config-webvpn-url)#url-text "AbcServer" url-value "http://172.17.0.40"
CORPORATE(config-webvpn-url)#exit
CORPORATE(config-webvpn-url)#
CORPORATE(config-webvpn-context)#policy group MYPOLICY
CORPORATE(config-webvpn-group)#banner "Welcome to Tony's SSL VPN Services"
CORPORATE(config-webvpn-group)#functions svc-enabled
CORPORATE(config-webvpn-group)#url-list "WebServers"
CORPORATE(config-webvpn-group)#svc address-pool "SSL-POOL" netmask 255.255.0.0
CORPORATE(config-webvpn-group)#svc keep-client-installed
CORPORATE(config-webvpn-group)#svc dns-server primary 172.17.0.48
CORPORATE(config-webvpn-group)#exit
CORPORATE(config-webvpn-context)#default-group-policy MYPOLICY
CORPORATE(config-webvpn-context)#aaa authentication list SSL_AUTHEN
CORPORATE(config-webvpn-context)#gateway SSLVPNGW
CORPORATE(config-webvpn-context)#max-users 20
CORPORATE(config-webvpn-context)#inservice

There we finish the configuration of Cisco SSL VPN on an IOS Router.

Now enter the address of your WebVPN gateway 'https://172.17.0.5' on a SSL enabled web browser and you will be presented with a SSL VPN login page.

Now you will be presented with your home page.This is the SSL VPN clientless mode from which the user can launch any web services from the WebVPN portal.

SSL VPN Full Tunnel Mode

Click the 'Start' tab, which you find on the right pane of your home page, to start downloading AnyConnect secure mobility client on your PC. The below screenshot shows the AnyConnect client installation process.

After the installation you will get the Cisco AnyConnect Secure Mobility Client on your PC and you can click 'Connect' to establish the secure VPN connection using full tunnel. In full tunnel mode you can access virtually any application in your corporate network.

IOS SSL VPN Portal Customization (Optional)

You can customize the SSL VPN portal by changing the color, banner, adding your company logo etc.

Example of Portal customization :

webvpn context VPN1
title "The Diary of a Networker SSL VPN Services"
logo file flash:/networker.gif
title-color 255,0,255
secondary-color 222,184,135
title-color 205,41,144
ssl authenticate verify all

policy group MYPOLICY
banner "Welcome to Tony's SSL VPN Services"

Below screenshot shows a customized portal of SSL Clientless VPN.

For more info about customization visit SSL VPN Portal Customization.

Allow SSL VPN through Zone Based Firewall

Refer Allow SSL WebVPN through Zone Based Firewall for more information and configuration.

Verification and Troubleshooting

Verification Command List :

show webvpn gateway
show webvpn context
show webvpn install package svc
show webvpn install status svc
show webvpn policy group MYPOLICY context
show webvpn session context all
show webvpn stats detail context all

Troubleshooting Command List :

SSL VPN Clear Commands :

clear webvpn nbns - Clears the NBNS cache on an SSL VPN gateway.
clear webvpn session - Clears SSL VPN remote user sessions.
clear webvpn stats - Clears SSL VPN application and access counters.

SSL VPN Debug Commands :

debug webvpn [verbose] [aaa | acl | cifs | citrix [verbose] | cookie [verbose] | count | csd | data | dns | emweb [state] | entry context-name [source ip [network-mask] | user username] | http [authentication | trace | verbose] | package | sdps [level number] | sock [flow] | sso | timer | trie | tunnel [traffic acl-number | verbose] | url-disp | webservice [verbose]]

Example : debug webvpn

Useful Links

How to Publish Application in Citrix XenApp 6

2013-04-19T14:45:00.001+05:30

In the previous post we saw the Installation and configuration of XenApp Fundamentals 6. This step-by-step guide will show you how to publish an application in XenApp 6.

In this example we are publishing Adobe Reader 10.0.

1.Go to Start > All programs > Citrix > Management Consoles > Citrix Delivery Services Console.

On the left pane expand XenApp and click Applications.

2. In the right action pane click Publish application.

3. Welcome screen will appear and click Next.

4. Enter a Display name for your application and click Next.

5. Choose the type of application to publish as Application and Application type as Accessed from a server and click Next.

6. Now browse the application location. You have to choose the exact '.exe' file of the installed application.

7. Now choose the server by clicking Add and choose the server (XENAPPSERVER) from the Servers and click Add.

8. Below you can see that the server got added. Click Next.

9. Here you want to configure the users who may access the application. Click Add and select users from user Active directory.

10.Click Next.

11. Click Finish to publish the application immediately.

12. Now go to a client computer (Windows 7) and install Citrix Receiver. You can download it from http://www.citrix.com/downloads/citrix-receiver.html . After the installation open a web browser (eg: Firefox) and type the IP address of your Citrix XenApp Server.

Log on with your domain credentials and you will see the published applications as below.

Installation and configuration of XenApp Fundamentals 6

2013-04-19T14:44:00.000+05:30

Citrix XenApp Fundamentals is a remote access solution that enables small to medium-sized business users to securely access their corporate windows applications and files from anywhere, either on LAN or at home, with an internet connection. The applications are securely stored on a central server and delivered to users, ensuring the utmost security of sensitive business data and reducing management costs. The seamless user experience and fast access make this product a complete app virtualization solution for business. For more info visit http://www.citrix.com/products/xenapp/features/editions/fundamentals.html

This guide is divided into two parts:

Step-by-step installation of XenApp Fundamentals 6 on Server 2008R2.

Basic configuration of Citrix XenApp Fundamentals.

System Requirements

1. XenApp 6 Fundamentals Edition must be installed on Windows Server 2008 R2 SP1. (Update your server with latest patches).

2. Enable Microsoft .NET 3.5 SP1 on Server 2008 R2.

3. Install Remote Desktop Services (Remote Desktop Session Host and Remote Desktop Licensing components) on Server 2008R2.

[ Note: Do not install XenApp Fundamentals on a Domain Controller ]

Step-by-step installation of XenApp Fundamentals 6 on Server 2008R2

Note: If you are using Active Directory, add the computer running XenApp Fundamentals to the directory before installation. XenApp Fundamentals can be part of a Windows workgroup or domain. [In this example the computer running XenApp Fundamentals is a part of domain]

1. Log on to the server as a domain administrator.

2. Insert the installation media and click 'Install or run program from your media'

3. On the welcome screen click 'Install'

4. Accept the license agreement and click Next.

5. On the Installation type page select "Application Server" and click Next.

6. Now if you want to view and interact with xenapp users do not select 'Disable shadowing' and click Next.

7. Provide the domain administrator username and password for the SQL database installation and latter management.

8. Now wait for the Citrix components to be installed.

9. The setup will prompt you to restart the computer to continue with the installation. Click 'Yes'

10. After the restart you will get 'XenApp Server Role Manager' console which says XenApp and Web Interface got successfully installed on your server. There we finish the installation of XenApp Fundamentals 6 on Server 2008R2.

Basic Configuration of XenApp Fundamentals 6

1. Go to Start > All Programs > Citrix > Management Consoles > Citrix Delivery Services Console.

Click 'Disable authenticode signature checking'

2. On the 'Select product and component' page select 'XenApp' and click Next.

3. Select the server by clicking 'Add Local Computer' and click Next.

4. Now check the summary and click Next.

5. Once the discovery has completed click 'Finish'.

6. As soon as you click finish you will get a Citrix Delivery Service Console as below. This is the management console for Hotfix, XenApp Fundamentals etc.

Configuring Quick Start Options

7. Now go to Start > All Programs > Citrix > Quick Start. You will get a welcome page and click Next.

8. On the server configuration wizard select 'New Single Server' and click Next.

9. Now click 'Finish'.

10. As soon as you click finish you will get a console like below. Here we need to configure the Citrix license. Follow the below link to configure Citrix licensing : http://support.citrix.com/article/CTX126387
Here you can also activate the Remote Desktop License Server by clicking the Remote Desktop License Server option at the bottom of the console.

From the same page we can add XenApp Administrators and also configure Email alerting by clicking Administrators option on Setup pane.

To know how to publish an application and server desktop in XenApp server read How to Publish Application and Server Desktop in Citrix XenApp 6

Configuring Cisco Router with ADSL Modem (PPPoA / PPPoE) and NAT

2013-02-11T14:13:00.000+05:30

This quick guide will show you how to configure a Cisco Router with external ADSL Modem using PPPoA or PPPoE.

Following is the sample configuration using Cisco 2900 with IOS image version 15.0(1r). Even though the example uses 2900 router, the configuration applies to 800, 1900, & 3900 Router.

Network Diagram

Configuration

LAN interface:

Configure your LAN interface with a static IP address.

int gi0/0
description ADSL-LAN Interface
ip address 172.16.0.1 255.255.0.0
ip nat inside
no shutdown

WAN interface:

Configure PPPoE client on your WAN Interface:

int gi0/1
description ADSL-WAN Interface
pppoe-client dial-pool-number 1
no shutdown

Dialer interface:

Configure a dialer interface as follows:

int Dialer0
encapsulation ppp
dialer pool 1
ip address negotiated
ppp chap hostname YOUR_CHAP_LOGIN
ppp chap password YOUR_CHAP_PASSWORD
ip mtu 1492
ip tcp adjust-mss 1452
ip nat outside

NAT Configuration:

access-list 10 permit 172.16.0.0 0.0.255.255
ip nat inside source list 10 int dialer0 overload

Routing Configuration:

Put a static route for internet:

ip route 0.0.0.0 0.0.0.0 dialer0

How to Install Zimbra 8.0.2 on Ubuntu 12.04 LTS

2013-02-08T15:21:00.000+05:30

Introduction

VMware Zimbra is an enterprise class email, calendar and collaboration suite designed for the cloud, both private and public. The flexibility, scalability and stability of Zimbra make it as a complete email solution that can be deployed in any environment either small or large. Zimbra email server can be accessed from the Zimbra Web Client, Zimbra Desktop offline client, Outlook and a variety of other standards-based email clients and mobile devices.
The three editions of Zimbra are:

1. ZCS Network Edition
2. ZCS hosted email by a Zimbra partner
3. ZCS Open Source Edition (free)

Components included with Zimbra Collaboration Server 8.0.2

Postfix - Free Mail Transfer Agent
MySQL - Database sofware
OpenLDAP - LDAP for User authentication
Jetty - Web application server
Lucene - Test and search engine
ClamAV - Antivirus scanner
SpamAssassin - Anti-spam software
Amavis (amavisd-new) - Content checker
Aspell - Spell checker
James/Sieve - Email filter

Installation of Zimbra 8.0.2 Open Source Edition on Ubuntu 12.04 LTS

System Requirements

Refer the link https://www.zimbra.com/docs/os/8.0.0/multi_server_install/wwhelp/wwhimpl/common/html/wwhelp.htm#href=ZCS_Multiserver_Open_8.0.System_Requirements_for_VMware_Zimbra_Collaboration_Server_8.0.html&single=true

Assumptions

The configuration is based on the following assumptions:

Ubuntu server IP - 192.168.1.100
Ubuntu Server FQDN - mail.mydomain.com
DNS Server IP - 192.168.1.10 (Internal Windows DNS server) , 8.8.8.8
Gateway IP - 192.168.1.1
Domain name - mydomain.com

A.) Preparing Ubuntu for Zimbra Installation

1. Install Ubuntu 12.04 LTS on your server (Include openssh-server during package selection)

2. Login as root user.

3. Update and upgrade Ubuntu

    #apt-get update
    #apt-get upgrade

4. Set a static IP for the server

#vi /etc/network/interfaces

auth eth0
iface eth0 inet static
address 192.168.1.100
gateway 192.168.1.1
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
dns-nameservers 192.168.1.10 8.8.8.8
:wq!

Now restart networking to make the change effective: /etc/init.d/networking restart

5. Set a hostname for the server. Latter this will become the name of your Zimbra email server.

#vim /etc/hostname

mail.mydomain.com

:wq!

6. DNS Configuration:

You can either use BIND or your internal DNS server (eg: Windows DNS server).
Here you can find the configuration of both. In this example I used my Internal Windows DNS server to create A record and MX record.

a.) For BIND configuration follow the below steps:

i. Install BIND9 : # sudo apt-get install bind9
ii. Edit the file : # vi /etc/bind/named.conf
    and remove '//' from forwarders and add DNS server IP address like below:

forwarders {
              8.8.8.8;
         };

And add the below lines and save the file:

zone "mail.mydomain.com" {
          type master;
          file "file.mail.mydomain.com";
};

Now create a file "file.mail.mydomain.com" in /var/cache/bind/ directory and add the following inside the file:

$ttl 38400
@   IN    SOA    mail.mydomain.com.    mail.mydomain.com. (
                                                                    2011091202
                                                                  10800
                                                                   3600
                                                                   604800
                                                                   38400 )
      IN   NS       ns.mail.mydomain.com
     IN    A         192.168.1.100
       IN    MX     10 mail.mydomain.com

@    A    192.168.1.100
ns     A    192.168.1.100
mail A   192.168.1.100

Then edit /etc/resolv.conf and change nameserver to 192.168.1.100

Now restart BIND9 services: # /etc/init.d/bind9 restart

For more info visit http://blog.zimbra.com/blog/archives/2007/06/making-zimbra-bind-work-together.html and http://wiki.zimbra.com/wiki/Split_dns

b.) If it is a Windows DNS Server:

>Edit /etc/resolv.conf and provide the IP address of your Windows DNS server.

nameserver 192.168.1.10

>Create forward lookup zone (mydomain.com) and add the below records:

Forward lookup zone name<-> mydomain.com

A record <-> mail <-> 192.168.1.100

MX record <-> mail <-> mail.mydomain.com <-> priority 10

Now verify the dns configuration using the code #dig mail.mydomain.com mx (in this example I used windows DNS server)

; <<>> DiG 9.8.1-P1 <<>> mail.mydomain.com mx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- 37752="" br="" id:="" noerror="" opcode:="" query="" status:="">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;mail.mydomain.com.                 IN      MX

;; ANSWER SECTION:
mail.mydomain.com.         3600    IN      MX      10 mail.mydomain.com.

;; ADDITIONAL SECTION:
mail.mydomain.com          3600    IN      A       192.168.1.100

;; Query time: 1 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
;; WHEN: Thu Feb 4 20:57:38 2013
;; MSG SIZE rcvd: 63

7. Firewall Configuration (Optional)

Zimbra recommends us to install ZCS on a sytem without a firewall. If required you can configure a firewall in your Ubuntu 12.04 LTS. For more info refer the documents: http://wiki.zimbra.com/wiki/Firewall_Configuration
https://help.ubuntu.com/community/IptablesHowTo#Disabling%20the%20firewall

8. Installing prerequisites:

You have to install the below packages before installing ZCS 8.0.2

#apt-get install netcat-traditional

#apt-get install libperl5.14

#apt-get install libidn11-dev

#apt-get install libgmp3c2 sysstat sqlite3

9. Disable & remove Apparmour

#sudo /etc/init.d/apparmour stop
#sudo /etc/init.d/apparmor teardown
#sudo update-rc.d -f apparmor remove

B.) Installing Zimbra

10. Download Zimbra collaboration suite 8.0.2 from Zimbra website :

#wget http://files2.zimbra.com/downloads/8.0.2_GA/zcs-8.0.2_GA_5569.UBUNTU12_64.20121210115059.tgz

11. Unpack the downloaded zimbra package:

#tar -zxvf zcs-8.0.2_GA_5569.UBUNTU12_64.20121210115059.tgz

12. Go the zimbra package and install it.

#cd zcs-8.0.2_GA_5569.UBUNTU12_64.20121210115059

#./install.sh

Operations logged to /tmp/install.log.1431
Checking for existing installation...
    zimbra-ldap...NOT FOUND
    zimbra-logger...NOT FOUND
    zimbra-mta...NOT FOUND
    zimbra-snmp...NOT FOUND
    zimbra-store...NOT FOUND
    zimbra-apache...NOT FOUND
    zimbra-spell...NOT FOUND
    zimbra-convertd...NOT FOUND
    zimbra-memcached...NOT FOUND
    zimbra-proxy...NOT FOUND
    zimbra-archiving...NOT FOUND
    zimbra-cluster...NOT FOUND
    zimbra-core...NOT FOUND

PLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THE SOFTWARE.
ZIMBRA, INC. ("ZIMBRA") WILL ONLY LICENSE THIS SOFTWARE TO YOU IF YOU
FIRST ACCEPT THE TERMS OF THIS AGREEMENT. BY DOWNLOADING OR INSTALLING
THE SOFTWARE, OR USING THE PRODUCT, YOU ARE CONSENTING TO BE BOUND BY
THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THIS
AGREEMENT, THEN DO NOT DOWNLOAD, INSTALL OR USE THE PRODUCT.

License Terms for the Zimbra Collaboration Suite:
http://www.zimbra.com/license/zimbra_public_eula_2.1.html

Do you agree with the terms of the software license agreement? [N] Y

Oracle Binary Code License Agreement for the Java SE Platform Products

ORACLE AMERICA, INC. ("ORACLE"), FOR AND ON BEHALF OF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES UNDER COMMON CONTROL, IS WILLING TO LICENSE THE SOFTWARE TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS CONTAINED IN THIS BINARY CODE LICENSE AGREEMENT AND SUPPLEMENTAL LICENSE TERMS (COLLECTIVELY "AGREEMENT"). PLEASE READ THE AGREEMENT CAREFULLY. BY SELECTING THE "ACCEPT LICENSE AGREEMENT" (OR THE EQUIVALENT) BUTTON AND/OR BY USING THE SOFTWARE YOU ACKNOWLEDGE THAT YOU HAVE READ THE TERMS AND AGREE TO THEM. IF YOU ARE AGREEING TO THESE TERMS ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY, YOU REPRESENT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND THE LEGAL ENTITY TO THESE TERMS. IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT WISH TO BE BOUND BY THE TERMS, THEN SELECT THE "DECLINE LICENSE AGREEMENT" (OR THE EQUIVALENT) BUTTON AND YOU MUST NOT USE THE SOFTWARE ON THIS SITE OR ANY OTHER MEDIA ON WHICH THE SOFTWARE IS CONTAINED.

I. THIRD PARTY CODE. Additional copyright notices and license terms applicable to portions of the Software are set forth in the THIRDPARTYLICENSEREADME file accessible at http://www.oracle.com/technetwork/java/javase/documentation/index.html. In addition to any terms and conditions of any third party opensource/freeware license identified in the THIRDPARTYLICENSEREADME file, the disclaimer of warranty and limitation of liability provisions in paragraphs 4 and 5 of the Binary Code License Agreement shall apply to all Software in this distribution.

J. TERMINATION FOR INFRINGEMENT. Either party may terminate this Agreement immediately should any Software become, or in either party's opinion be likely to become, the subject of a claim of infringement of any intellectual property right.

K. INSTALLATION AND AUTO-UPDATE. The Software's installation and auto-update processes transmit a limited amount of data to Oracle (or its service provider) about those specific processes to help Oracle understand and optimize them. Oracle does not associate the data with personally identifiable information. You can find more information about the data Oracle collects as a result of your Software download at http://www.oracle.com/technetwork/java/javase/documentation/index.html.

For inquiries please contact: Oracle America, Inc., 500 Oracle Parkway,
Redwood Shores, California 94065, USA.

Last updated May 17, 2011

Do you agree with the terms of the software license agreement? [N] Y

Checking for prerequisites...
     FOUND: NPTL
     FOUND: netcat-openbsd-1.89-4ubuntu1
     FOUND: sudo-1.8.3p1-1ubuntu3.3
     FOUND: libidn11-1.23-2
     FOUND: libpcre3-8.12-4
     FOUND: libgmp3c2-2:4.3.2+dfsg-2ubuntu1
     FOUND: libexpat1-2.0.1-7.2ubuntu1.1
     FOUND: libstdc++6-4.6.3-1ubuntu5
     FOUND: libperl5.14-5.14.2-6ubuntu2.2

Checking for suggested prerequisites...
     FOUND: perl-5.14.2
     FOUND: sysstat
     FOUND: sqlite3
Prerequisite check complete.

Checking for installable packages

Found zimbra-core
Found zimbra-ldap
Found zimbra-logger
Found zimbra-mta
Found zimbra-snmp
Found zimbra-store
Found zimbra-apache
Found zimbra-spell
Found zimbra-memcached
Found zimbra-proxy

Select the packages to install

Install zimbra-ldap [Y] Y

Install zimbra-logger [Y] Y

Install zimbra-mta [Y] Y

Install zimbra-snmp [Y] Y

Install zimbra-store [Y] Y

Install zimbra-apache [Y] Y

Install zimbra-spell [Y] Y

Install zimbra-memcached [N] N

Install zimbra-proxy [N] N

Checking required space for zimbra-core
Checking space for zimbra-store

Installing:
    zimbra-core
    zimbra-ldap
    zimbra-logger
    zimbra-mta
    zimbra-snmp
    zimbra-store
    zimbra-apache
    zimbra-spell

The system will be modified. Continue? [N] Y

Removing /opt/zimbra
Removing zimbra crontab entry...done.
Cleaning up zimbra init scripts...done.
Cleaning up /etc/ld.so.conf...done.
Cleaning up /etc/security/limits.conf...done.

Finished removing Zimbra Collaboration Server.

Installing packages

    zimbra-core......zimbra-core_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-ldap......zimbra-ldap_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-logger......zimbra-logger_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-mta......zimbra-mta_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-snmp......zimbra-snmp_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-store......zimbra-store_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-apache......zimbra-apache_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
    zimbra-spell......zimbra-spell_8.0.2.GA.5434.UBUNTU12.64_amd64.deb...done
Operations logged to /tmp/zmsetup.01222013-154036.log
Installing LDAP configuration database...done.
Setting defaults...     MX: mail.mydomain.com (192.168.1.100)

        Interface: 192.168.1.100
        Interface: 127.0.0.1
        Interface: ::1
                192.168.1.100
done.
Checking for port conflicts

Main menu

   1) Common Configuration:
   2) zimbra-ldap:                             Enabled
   3) zimbra-store:                            Enabled
        +Create Admin User:                     yes
        +Admin user to create:                   admin@mail.mydomain.com
******* +Admin Password                  UNSET
        +Anti-virus quarantine user:            virus-quarantine.wn6wiltei@mail.mydomain.com
        +Enable automated spam training:   yes
        +Spam training user:                       spam.6rcnxbksez@mail.mydomain.com
        +Non-spam(Ham) training user:      ham.s6vyicipjc@mail.mydomain.com
        +SMTP host:                          mail.mydomain.com
        +Web server HTTP port:                 80
        +Web server HTTPS port:              443
        +Web server mode:                        https
        +IMAP server port:                        143
        +IMAP server SSL port:                 993
        +POP server port:                           110
        +POP server SSL port:                   995
        +Use spell check server:                  yes
        +Spell server URL:                     http://mail.mydomain.com:7780/aspell.php
        +Configure for use with mail proxy:    FALSE
        +Configure for use with web proxy:    FALSE
        +Enable version update checks:         TRUE
        +Enable version update notifications: TRUE
        +Version update notification email:    admin@mail.mydomain.com
        +Version update source email:          admin@mail.mydomain.com

   4) zimbra-mta:                              Enabled
   5) zimbra-snmp:                           Enabled
   6) zimbra-logger:                          Enabled
   7) zimbra-spell:                            Enabled
   8) Default Class of Service Configuration:
   r) Start servers after configuration        yes
   s) Save config to file
   x) Expand menu
   q) Quit

Address unconfigured (**) items (? - help)

Enter number 3 to configure Admin password. Set a new password and put r to return and a to apply the configuration.

Select, or 'r' for previous menu [r] r

Main menu

   1) Common Configuration:
   2) zimbra-ldap:                             Enabled
   3) zimbra-store:                            Enabled
   4) zimbra-mta:                              Enabled
   5) zimbra-snmp:                            Enabled
   6) zimbra-logger:                           Enabled
   7) zimbra-spell:                             Enabled
   8) Default Class of Service Configuration:
   r) Start servers after configuration        yes
   s) Save config to file
   x) Expand menu
   q) Quit

*** CONFIGURATION COMPLETE - press 'a' to apply
Select from menu, or press 'a' to apply config (? - help) a
Save configuration data to a file? [Yes] Y
Save config in file: [/opt/zimbra/config.7774]
The system will be modified - continue? [No] Y
Operations logged to /tmp/zmsetup.01222013-154036.log
Setting local config values...
done.
Initializing core config...Setting up CA...done.
Deploying CA to /opt/zimbra/conf/ca ...done.
Creating SSL zimbra-store certificate...done.
Creating new zimbra-ldap SSL certificate...done.
Creating new zimbra-mta SSL certificate...done.
Installing mailboxd SSL certificates...done.
Installing MTA SSL certificates...done.
Installing LDAP SSL certificate...done.
Initializing ldap...done.
Setting replication password...done.
Setting Postfix password...done.
Setting amavis password...done.
Setting nginx password...done.
Creating server entry for mail.mydomain.com...done.
Setting Zimbra IP Mode...done.
Saving CA in ldap ...done.
Saving SSL Certificate in ldap ...done.
Setting spell check URL...done.
Setting service ports on mail.mydomain.com...done.
Adding mail.mydomain.com to zimbraMailHostPool in default COS...done.
Setting zimbraFeatureTasksEnabled=TRUE...done.
Setting zimbraFeatureBriefcasesEnabled=FALSE...done.
Setting MTA auth host...done.
Setting TimeZone Preference...done.
Initializing mta config...done.
Setting services on mail.mydomain.com...done.
Creating domain mail.mydomain.com...done.
Setting default domain name...done.
Creating domain mail.mydomain.com...already exists.
Creating admin account admin@mail.mydomain.com...done.
Creating root alias...done.
Creating postmaster alias...done.
Creating user spam.6rcnxbksez@mail.mydomain.com...done.
Creating user ham.s6vyicipjc@mail.mydomain.com...done.
Creating user virus-quarantine.wn6wiltei@mail.mydomain.com...done.
Setting spam training and Anti-virus quarantine accounts...done.
Initializing store sql database...done.
Setting zimbraSmtpHostname for mail.mydomain.com...done.
Configuring SNMP...done.
Setting up syslog.conf...done.
Starting servers...done.
Installing common zimlets...
        com_zimbra_proxy_config...done.
        com_zimbra_clientuploader...done.
        com_zimbra_srchhighlighter...done.
        com_zimbra_adminversioncheck...done.
        com_zimbra_attachmail...done.
        com_zimbra_date...done.
        com_zimbra_url...done.
        com_zimbra_tooltip...done.
        com_zimbra_ymemoticons...done.
        com_zimbra_webex...done.
        com_zimbra_attachcontacts...done.
        com_zimbra_bulkprovision...done.
        com_zimbra_cert_manager...done.
        com_zimbra_phone...done.
        com_zimbra_email...done.
Finished installing common zimlets.
Restarting mailboxd...done.
Creating galsync account for default domain...done.

You have the option of notifying Zimbra of your installation.
This helps us to track the uptake of the Zimbra Collaboration Server.
The only information that will be transmitted is:
        The VERSION of zcs installed (8.0.2_GA_5434_UBUNTU12_64)
        The ADMIN EMAIL ADDRESS created (admin@mail.mydomain.com)

Notify Zimbra of your installation? [Yes] A Yes/No answer is required

You have the option of notifying Zimbra of your installation.
This helps us to track the uptake of the Zimbra Collaboration Server.
The only information that will be transmitted is:
        The VERSION of zcs installed (8.0.2_GA_5434_UBUNTU12_64)
        The ADMIN EMAIL ADDRESS created (admin@mail.mydomain.com)

Notify Zimbra of your installation? [Yes] Yes
Notifying Zimbra of installation via http://www.zimbra.com/cgi-bin/notify.cgi?VER=8.0.2_GA_5434_UBUNTU12_64&MAIL=admin@mail.mydomain.com

Notification complete

Setting up zimbra crontab...done.

Moving /tmp/zmsetup.01222013-154036.log to /opt/zimbra/log

Configuration complete - press return to exit

12. Check the Zimbra server status:

#su zimbra

#zmcontrol status

Host mail.mydomain.com
        antispam              Running
        antivirus               Running
        ldap                     Running
        logger                  Running
        mailbox                Running
        mta                      Running
        snmp                    Running
        spell                     Running
        stats                     Running
        zmconfigd             Running

13. Now access the Zimbra admin console using https://192.168.1.100:7071

There we finish the installation of Zimbra Collaboration suite 8.0.2 on Ubuntu 12.04 LTS !

Useful Links

1. Ubuntu Server download page -http://www.ubuntu.com/download/server
2. Zimbra Open source edition download page - http://www.zimbra.com/downloads/os-downloads.html
3. Ubuntu 12.04 LTS Documentation - https://help.ubuntu.com/12.04/index.html
4. Zimbra Collaboration Server 8.0 Open Source Edition Documentation - http://www.zimbra.com/community/documentation.html
5. Zimbra Collaboration Server 8.0 Admin guide (Must-Read guide) - http://files.zimbra.com/website/docs/8.0/Zimbra_OS_Admin_Guide_8.0.2.pdf
6. ZCS Install guide on Ubuntu 8.04 LTS - http://wiki.zimbra.com/wiki/Ubuntu_8.04_LTS_Server_%28Hardy_Heron%29_Install_Guide
7. Zimbra Desktop User Guide - http://www.zimbra.com/desktop7/help/en_US/Zimbra_Mail_Help.htm#Getting_Started/Zimbra_User_Help.htm
8. Advantages of Zimbra - http://web-hosting-talks.blogspot.in/2012/11/why-does-business-need-zimbra.html

Have a question ? Ask here or visit official Zimbra forum http://www.zimbra.com/forums/forum.php

Cisco IOS Local Content Filtering

2013-02-04T14:39:00.000+05:30

Introduction

The Cisco IOS content filtering feature allows us to block, log or allow http requests going through the router. It is an excellent feature where we can categorize (social networking, pornography etc. ) and filter the traffic thereby increasing the overall employee productivity and improve the network security by blocking adware, malware, spyware and Phishing sites. Cisco enabled this feature from IOS release 12.04(20)T

Content filtering can be configured in two different ways on an IOS router. They are:

1. Local Content Filtering : A local database of Black and White list on the router.
2. Subscription based Content Filtering : Router will communicate with an external Content filtering server (Trend Micro, Websense and Smartfilter). You need to purchase a valid license from the vendor to do this.

[Note: Content filtering cannot work on https traffic.]

This document will show how to configure a local content filtering on a Cisco IOS Router.

The content filtering works in such a way that when the end user request a URL, it checks with the content filtering services configured on the router to decide whether to permit or deny the URL. The local content filtering contain a limited functionality compared with Trend Micro content filtering services where the local database support only 100 black and white lists.

Prerequisites

This configuration requires a Zone Based Firewall deployed on your router. For more info visit http://yadhutony.blogspot.in/2012/10/cisco-ios-zone-based-firewall-step-by.html
Cisco IOS release 12.4(15)XZ or above.
The Cisco IOS Advanced IP Services or Advanced Security image is required.
For more info visit http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6643/prod_qas0900aecd804abb06.html

Configuration Tasks

Parameter map configuration to define patterns.
Class-map configuration to define URL filtering classes.
Policy-map configuration to allow or reset the classes.
Apply policy-map configuration as a child object Zone-Based firewall security policy.

1. Configuring parameter map of type inspect to define patterns.

parameter-map type urlf-glob FACEBOOK
pattern facebook.com
pattern *.facebook.com

parameter-map type urlf-glob YOUTUBE
pattern youtube.com
pattern *.youtube.com

parameter-map type urlf-glob PERMITTEDSITES
pattern *

2. Class map configuration to define URL filtering classes

class-map type urlfilter match-any BLOCKEDSITES
match server-domain urlf-glob FACEBOOK
match server-domain urlf-glob YOUTUBE

class-map type urlfilter match-any PERMITTEDSITES
match server-domain urlf-glob PERMITTEDSITES

3. Policy map configuration

policy-map type inspect urlfilter CONTENT-FILTERING
class type urlfilter BLOCKEDSITES
log
reset
class type urlfilter PERMITTEDSITES
allow

4. Apply policy-map configuration in Zone-Based firewall security policy.

You have to apply the URL filtering policy as a child policy (with the service-policy urlfilter command) of a zone-based firewall class which matches http traffic.

policy-map type inspect IN-TO-OUT-POLICY
class type inspect HTTP-ACCESS
inspect
service-policy urlfilter CONTENT-FILTERING

There we finish the local content filtering configuration on a Cisco IOS router. Now try to connect the blocked website and see the result.

Verification and Troubleshooting

You can use the below commands for verification and troubleshooting.

show class-map type urlfilter
show policy-map type inspect urlfilter
show parameter-map type urlf-glob

Also you can monitor the blocked sites in your router logs. Below is an example for the same:

For more information about IOS content filtering using Trend Micro services visit http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6643/white_paper_c89-492776.html

Cisco IPSec Easy VPN Server Configuration Guide

2013-01-16T17:46:00.001+05:30

Introduction

The Cisco Easy VPN server allows a remote user to connect the corporate network using an IPSec tunnel. Easy VPN servers can be deployed in a Cisco IOS router or an ASA appliance. To connect with the VPN server, we use a Cisco VPN client software that can be installed on an operating system. The Easy VPN feature minimizes the configuration requirement at a remote location where we can put all the configuration on a VPN server and push the access policies upon a VPN tunnel connection from a Cisco VPN server.

This document will show you how to configure an Easy VPN Server on a Cisco IOS Router.

Network Diagram

Configuration Tasks

Enable AAA on the router.
Create a User account.
Configure IKE Policy.
Define Group policy information.
Configure Phase 2 policy (IPSec Transform-set)
Bind IPSec configuration with a Virtual Interface.

Now we can go into detail and configure each task which is listed above.

1.) Enabling AAA on the router

AAA is enabled using the 'aaa newmodel' command. We can either define the AAA locally on a router or point out an external TACACS+ or RADIUS server for authentication, authorization and accounting. AAA identifies the level of access that has been granted to each user and monitor the user activity to produce accounting information. In this example I am configuring AAA locally on a router.

Router(config)#aaa new-model
Router(config)#aaa authentication login default local
Router(config)#aaa authentication login VPN-USER-AUTH local
Router(config)#aaa authorization exec default local
Router(config)#aaa authorization network VPN-GROUP local

2.) Creating User Account

Router(config)#username tony privilege 15 password mypassword

3.) Configuring IKE Policy

Here we enable the IKE Policy configuration where you can specify the parameters that are used during an IKE negotiation or Phase 1 policy negotiation.

Router(config)#crypto isakmp policy 1
Router(config-isakmp)#authentication pre-share
Router(config-isakmp)#encryption 3des
Router(config-isakmp)#group 2

4.) Defining Group Policy information

We have to create a group and configure all the parameters that need to be pushed into the client as soon as it successfully authenticate to the group. The parameters defined in this example are:
Pre-shared key : The key is used for authentication to the group.
DNS & Wins server : Users authenticating to this group will get this DNS and WINS server IP.
Max-Users : Maximum number of users allowed to connect simultaneously.

Router(config)# crypto isakmp client configuration group vpngroup
Router(config-isakmp-group)# key 6 mysecurekey
Router(config-isakmp-group)# dns 10.0.0.10
Router(config-isakmp-group)# wins 10.0.0.10
Router(config-isakmp-group)# pool VPN-POOL-1
Router(config-isakmp-group)# max-users 20
Router(config-isakmp-group)# netmask 255.255.255.0
Router(config-isakmp-group)# domain tony.com

The pool should contain the IP's that is distributed to the VPN clients as soon as it establish a connection to the VPN server. (Note: The pool should contain a different subnet of IP's than your internal LAN.) Create the pool using the below command:

Router(config)#ip local pool VPN-POOL-1 192.168.1.1 192.168.1.20

5.) Configure Phase 2 policy

a.) IPSec Transform-set

IPSec Transform-set is defined for data encryption and phase 2 authentication. The actual data encryption is happening in this phase. Create a transform-set using the below command:

Router(config)#crypto ipsec transform-set VPN-TRANSFORM-SET esp-3des esp-sha-hmac
Router(cfg-crypto-trans)#exit

b.) Creating ISAKMP Profile

Create an ISAKMP profile that will match the client group (vpngroup) and mention the authentication and authorization used by the profile.

Router(config)#crypto isakmp profile ISAKMP-PROFILE-1
Router(conf-isa-prof)#match identity group vpngroup
Router(conf-isa-prof)#client authentication list VPN-USER-AUTH
Router(conf-isa-prof)#isakmp authorization list VPN-GROUP
Router(conf-isa-prof)#client configuration address respond
Router(conf-isa-prof)#virtual-template 2

Now apply this transform-set to a VPN profile named VPN-PROFILE

Router(config)#crypto ipsec profile VPN-PROFILE
Router(ipsec-profile)#set transform-set VPN-TRANSFORM-SET
Router(ipsec-profile)#set isakmp-profile ISAKMP-PROFILE-1

6.) Binding the configuration with a Virtual Interface

The last step is to bind all the configurations to a virtual interface that will receive all the incoming VPN client connections. The virtual interface should be unnumbered to a physical interface, usually to the internal LAN interface.

Router(config)#interface virtual-template 2 type tunnel
Router(config-if)#ip unnumbered GigabitEthernet0/0
Router(config-if)# tunnel mode ipsec ipv4
Router(config-if)# tunnel protection ipsec profile VPN-PROFILE

Easy VPN and NAT exemption

Now we need to exempt NAT for the VPN users. We need to put a 'no NAT' statement for the VPN traffic, that means if there is a VPN traffic then do not NAT. We have to put the below configuration to achieve the same:

ip nat inside source list 120 interface GigabitEthernet0/1 overload (Gi0/1 is the Internet facing interface)

access-list 120 deny ip 10.0.0.0 0.255.255.255 192.168.1.0 0.0.0.255
access-list 120 permit ip 10.0.0.0 0.255.255.255 any

Here the access-list 120 will deny the local subnet (LAN subnet) to access the VPN users and allow all other traffic.

There we finish our Easy VPN server configuration. Now you can download and install a Cisco VPN client software on your operating system and configure it by referring the below screenshot.
Cisco VPN client download link : https://docs.google.com/folder/d/0BzwBbyVriGKkSGVXTmJJd0xCOVU/edit

Host : Public IP address of the Easy VPN Server

Group Authentication:

Name: 'group name'

Password: 'group password'

Save the configuration and click connect to establish the VPN connection. You will be prompted for a username and password as below.

Enter the correct user credentials in order establish the VPN connection successfully with Easy VPN server from your computer.

Easy VPN and Zone Based Firewall

For more information about how to allow Easy VPN server through a Zone Based Firewall refer Using IPSec VPN with Zone-Based Policy Firewall

Verification and Troubleshooting of Easy VPN

Verification Command List :

show crypto ipsec sa
show crypto ipsec spi-lookup
show crypto isakmp profile
show crypto isakmp policy
show crypto isakmp sa
show crypto isakmp peers
show crypto engine connections active

Troubleshooting Command List :

debug crypto isakmp —Displays errors during Phase 1.
debug crypto isakmp —Displays errors during Phase 2.
debug crypto isakmp —Displays information from the crypto engine.
clear crypto connection connection-id [slot | rsm | vip] —Terminates an encrypted session currently in progress. Encrypted sessions normally terminate when the session times out. (Use the show crypto cisco connections command to see the connection-id value.)
clear crypto isakmp —Clears the Phase 1 security associations.
clear crypto sa —Clears the Phase 2 security associations.

For more IPSec troubleshooting command list visit http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a00800949c5.shtml

You can also find the configuration example of Cisco IPSec Site-to-site VPN in http://yadhutony.blogspot.in/2012/12/cisco-ipsec-site-to-site-vpn.html

DHCP Server configuration on a Cisco Router

2013-01-04T18:17:00.001+05:30

Introduction

DHCP (Dynamic Host Control Protocol) is a protocol used to provide network parameters (IP address, default gateway, DNS server etc.) to network devices (Computers, printers, switches etc.) so that they can communicate on an IP network. A DHCP client (eg. PC) uses the DHCP protocol to obtain the network configuration from the DHCP server (eg. Cisco Router).

How DHCP Works ?

DHCP client uses four phases to obtain network parameters from a DHCP server:

Discover : A client broadcast a DHCP discover message during its initial boot up. This is a broadcast message.
Offer : When the DHCP server receives the discover message, it reserves an IP address for the client and sends a DHCP offer message to the client by offering the reserved IP. This is a unicast message.
Request : The client receives the offer message and sends a request message requesting the IP address. This is again a broadcast message.
Acknowledgement : The DHCP server sends the acknowledgement to the client which contain all the information about the network parameters. This is a unicast message.

Configuring DHCP on a Cisco Router

This configuration is based on a Cisco Router running with 15.x code.

Configuration Scenario

First we have to enable the DHCP service on the router. Use the command as below:

Router#configure terminal

Router(config)#service dhcp

Now create a DHCP pool that contains the pool of IP addresses that will be allocated to the clients:

Router(config)#ip dhcp pool MyDHCPPool

Router(dhcp-config)#network 172.16.0.0 255.255.0.0

Now provide the DHCP parameters that should be distributed to the DHCP clients (default-router, DNS server, lease duration) as below:

Router(dhcp-config)#default-router 172.16.0.1

Router(dhcp-config)#domain-name tony.com

Router(dhcp-config)#lease 15

Now if you want to exclude a range of IP addresses from being distributed via DHCP, use the below commands in global configuration mode:

Router(config)#ip dhcp excluded-address 172.16.0.1 172.16.0.20

Now you can assign IP addresses ranging from 172.16.0.1 to 172.16.0.20 statically.

There we finish the DHCP server configuration on a Cisco Router.

Verification

You can verify the DHCP operation of Cisco Router by using the below command:

Router#sh ip dhcp binding

Cisco IPSec Site-to-site VPN Configuration

2012-12-21T15:15:00.002+05:30

Introduction

IPSec Site-to-site VPN connectivity is used to secure the connection between two sites (eg.Head office and branch office). A secure VPN tunnel is created over the public network (Internet) using advanced encryption technologies where we can transmit our data with high confidentiality and integrity. The major advantages of using IPSec are 1.Confidentiality 2.Integrity 3.Origin Authentication.

This document will show you how to configure a site-to-site IPSec VPN tunnel using two Cisco IOS routes.

How IPSec works on a Cisco Router

IPSec is a layer 3, protocol independent framework that is used to secure unicast network traffic. IPSec is comprised of two distinct phases:

a) Phase 1 : Responsible for session management and authentication of end points. This phase ensure that the connection between endpoints is secured.

b) Phase 2 : It is used to setup the security association (SA) that will be used to secure the target data.

Phase 1

Phase 1 process authenticates endpoints to each other. This is done by single, bidirectional security association (SA). The major component of Phase 1 authentication is IKE Policy.

IKE Policy

The IKE Policy comprises of the following parameters:

Authentication* : Decide the authentication that will be used by the policy.
Encryption : Decide the encryption algorithm that will be used by the policy.
Hashing : Decide the hashing algorithm that will be used by the policy.
Diffe-Hellman group : Decide the Diffe-Hellman group that will be used by the policy.
Life-time : Decide the life-time of SA before re-keying.

*The authentication is based on one of the following:

Pre-shared key (PSK)
RSA Encryption
Digital Certificate

Phase 2

The Phase 2 is used to setup the security associations that will be used to secure the target data between two sites.

The major components of Phase 2 authentication are :

Extended ACL : It is used to find the interesting traffic which should be transmitted over the VPN tunnel.
Transform-Set : Decide the encryption and hashing algorithm. This will provide the authentication to each protocol that is used in the ACL.

Network Diagram

This example is based on a Cisco Integrated Service Router running with 15.0(1r)M15 code.

Configuration Tasks

Create IKE Policy
Setup Pre shared key (PSK)
Configure extended Access-List
Define IPSec Transform-set
Configure Crypto-map
Apply Crypto-map to Interfaces.

Now we should go in details and configure each tasks which is listed above.

1.) Creating IKE Policy

Cisco ISR* 1

Cisco_ISR(config)#crypto isakmp policy 10
Cisco_ISR(config-isakmp)#authentication pre-share
Cisco_ISR(config-isakmp)#encryption aes 256
Cisco_ISR(config-isakmp)#group 5
Cisco_ISR(config-isakmp)#lifetime 86400

Cisco ISR 2

Cisco(config)#crypto isakmp policy 10
Cisco(config-isakmp)#authentication pre-share
Cisco(config-isakmp)#encryption aes 256
Cisco(config-isakmp)#group 5
Cisco(config-isakmp)#lifetime 86400

*ISR - Integrated Service Router

2.) Setup Pre-shared key

Cisco ISR1

Cisco_ISR(config)#crypto isakmp key MYSECUREKEY address 192.168.100.2

Cisco ISR 2

Cisco(config)#crypto isakmp key MYSECUREKEY address 192.168.100.1

3.) Configure extended Access-List

Cisco ISR 1

Cisco_ISR(config)#access-list 100 permit ip 172.16.0.0 0.0.255.255 172.17.0.0 0.0.255.255

Cisco ISR 2

Ciscoconfig)#access-list 100 permit ip 172.17.0.0 0.0.255.255 172.16.0.0 0.0.255.255

4.) Defining IPSec Transform-set

Cisco ISR 1

Cisco_ISR(config)#crypto ipsec transform-set MYTRANSFORMSET esp-aes 256 esp-sha-hmac

Cisco ISR 2

Cisco(config)#crypto ipsec transform-set MYTRANSFORMSET esp-aes 256 esp-sha-hmac

5.) Configure Crypto-map

Cisco ISR 1

Cisco_ISR(config)#crypto map MYCRYPTOMAP 10 ipsec-isakmp
Cisco_ISR(config-crypto-map)#set peer 192.168.100.2
Cisco_ISR(config-crypto-map)#set transform-set MYTRANSFORMSET
Cisco_ISR(config-crypto-map)#match address 100

While you create a crypto-map you will get a message like below:
% NOTE: This new crypto map will remain disabled until a peer
and a valid access list have been configured.
You can safely ignore this message and configure the peer as a next step.

Cisco ISR 2

Cisco(config)#crypto map MYCRYPTOMAP 10 ipsec-isakmp
Cisco(config-crypto-map)#set peer 192.168.100.1
Cisco(config-crypto-map)#set transform-set MYTRANSFORMSET
Cisco(config-crypto-map)#match address 100

6.) Apply Crypto-map to Interfaces

Cisco ISR 1

Cisco_ISR(config)#interface gigabitEthernet 0/1
Cisco_ISR(config-if)#crypto map MYCRYPTOMAP

Cisco ISR 2

Cisco(config)#interface gigabitEthernet 0/1
Cisco(config-if)#crypto map MYCRYPTOMAP

There we finish our configuration.
IPSec VPN and Zone Based Firewall

For more info visit Using IPSec VPN with Zone-Based Policy Firewall.

IPSec Verification & Troubleshooting

a.) Commands used to verify IPSec operation

show crypto isakmp sa
show crypto isakmp policy
show crypto ipsec sa
show crypto session

b.) Commands used to troubleshoot IPSec operation

debug crypto isakmp
debug crypto ipsec

Resetting secure channel between DCs

2012-11-24T17:13:00.000+05:30

Introduction

Secure channel is used for secure communication between the Primary Domain controller and the member servers or workstations. This channel is used to validate the membership of the member servers or workstations. It also enables secure exchange of Challenge/Response messages and pass-through authentication in an NT LAN Manager (NTLM) authentication sequence. The Netlogon service is responsible for setting up a secure channel. During a system startup the Netlogon service creates a secure channel between the first DC that respond to the secure channel request. When you join a computer to a domain a password is shared between the computer and DC and it is stored in the DC along with the computer account. This password helps to authenticate the computer account to the DC and it is changed every 30 days. When the computer authenticate with the DC a secure channel got created between the DC and the computer. In case of a backup DC, during startup the netlogon service try to create a secure channel between the PDC and if this attempt doesn't succeed the secure channel will be broken. This happens due to communication issue, DNS misconfiguration and system time issue.

This post will show you how to reset the secure channel between a Backup DC and PDC.

Typical errors when the secure channel is broken

1. Replication error:

CALLBACK MESSAGE: Error contacting server 2044b77-7bc2-486a-2cfb-9638a99d99dbd._msdcs.xxx.com (network error): 5 (0x5):

Access is denied.

SyncAll exited with fatal Win32 error: 8440 (0x20f8):

The naming context specified for this replication operation is invalid.

The following error occurred during the attempt to contact the Domain Controller PDC001

Access is denied.

You may get Netlogon event ID 3210, 5722, 5723 or NTDS KCC event 1925.

Event Source: Netlogon
Event Category: None Event ID: 3210
User: N/A Event Description:
Failed to authenticate with \\PDC, a Windows NT domain controller for domain DOMAIN.

Event Source: Netlogon
Event ID: 5722
Event Category: None User: N/A Event Description:
The session setup from the computer 1 failed to authenticate. The name of the account referenced in the security database is 2. The following error occurred: n3

2. Logon error:

“Windows cannot connect to the domain either because the domain controller is down or otherwise unavailable or because your computer account was not found.”

"The system could not log you on. Make sure your username and domain are correct."

3. Nltest error:

nltest /sc_query:

access is denied:

Secure Channel Reset

There are two ways to work around the above problems:

Method 1:

Perform the below steps to reset the secure channel between a DC and PDC.

1. Find out the problematic DC and stop the KDC (Key Distribution Center) Service. To do so either go to services.msc and locate Kerberos Key Distribution Service and click stop or use the command net stop KDC on command prompt.

2. Now locate kerbtray.exe from the below location :

C:\Program Files\Windows Resource Kits\Tools\Kerbtray.exe.

Double click the exe file and you will find a green ticket icon on the lower right corner of your desktop.

3. Right click the green ticket icon on your desktop and click purge ticket. You should get a confirmation message that the ticket cache is purged. Click OK.

4. Reset the problematic DC password on the PDC. To do so open command prompt in PDC and type the command :

netdom resetpwd /server:Replication_Partner_Server_Name /userd:domainname\administrator_id /passwordd:password

5. Restart the problematic server. After the restart check the KDC services status. If it is not started then start the service manually.

6. Now synchronize the domain to verify the successful DC replication. To do so open a command prompt and type 'repadmin /syncall'

Method 2

Forcefully demote the faulty DC followed by metadata cleanup and promote the server back as DC,but consider this as last point of restore.

1. Forceful removal of DC : http://support.microsoft.com/kb/332199 and Forcing the Removal of a Domain Controller

2. Metadata cleanup : http://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx

3. Change and Seize FSMO Roles : http://support.microsoft.com/kb/255504

and http://yadhutony.blogspot.in/2012/10/step-by-step-guide-to-transfer-fsmo.html

4. Authoritative time server : http://yadhutony.blogspot.in/2012/10/ntp-time-server-configuration-in.html

PS: To reset secure channel between a Computer and Domain Controller

Refer the link http://technet.microsoft.com/en-us/library/hh849751.aspx