tag:blogger.com,1999:blog-19092145293401669732024-09-09T09:09:40.245-07:00Let's talk about....Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.comBlogger43125tag:blogger.com,1999:blog-1909214529340166973.post-44585432670512560702022-02-09T06:51:00.002-08:002022-02-09T07:05:38.056-08:00VMWare Convertor 轉換經驗<p bis_size="{&quot;x&quot;:8,&quot;y&quot;:8,&quot;w&quot;:684,&quot;h&quot;:22,&quot;abs_x&quot;:170,&quot;abs_y&quot;:230}">&nbsp;VMWare ESXi發展至今，相信很多IT人員已經經歷過企業內部的許多運行在實體機器上面的系統透過VMWare Converter轉到ESXi上運行，在此就不在贅述轉換方式。最近因為公司汰換電腦，原本拿來當作跳板機的筆電要被公司收回去了，已經習慣使用這台電腦當作遠端到客戶環境的跳板機了，因此打算將這台筆電上的系統轉到公司內的ESXi系統上，不過在VMWare官網上找了一段時間一直苦尋不到Converter，後來找到以下這一篇原廠的公告：</p><p bis_size="{&quot;x&quot;:8,&quot;y&quot;:8,&quot;w&quot;:684,&quot;h&quot;:22,&quot;abs_x&quot;:170,&quot;abs_y&quot;:231}"><br /></p><div class="separator" style="clear: both; text-align: center;">https://blogs.vmware.com/vsphere/2022/02/vcenter-converter-unavailable-for-download.html</div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both;">好在同事之前下載後有備份，於是就依照converter的指示將系統轉到ESXi上。不過，初次開機登入後，卻發現連登入的密碼欄位都沒有辦法使用鍵盤輸入，找了一些資料之後發現可能的原因是原本筆電上的Lenovo驅動程式所致，所幸就把筆電上關於Lenovo相關的程式都移除掉，同時參考以下這一篇討論 https://communities.vmware.com/t5/VMware-Workstation-Player/Keyboard-Not-Working-after-VMWare-Conversion/td-p/2166269 的做法解決了。</div><p></p>Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-40882214570065202572016-05-05T02:31:00.004-07:002016-05-05T02:31:18.042-07:00Cisco Flexible Netflow(FNF)中使用Legacy Netflow的show ip cache flowLegacy Netflow中使用show ip cache flow可以看到以下資訊：<br /> <br /> <br /> <b>CC6509#show ip cache flow</b><br /> <br /> -------------------------------------------------------------------------------<br /> MSFC:<br /> IP packet size distribution (2562M total packets):<br /> &nbsp; &nbsp;1-32 &nbsp; 64 &nbsp; 96 &nbsp;128 &nbsp;160 &nbsp;192 &nbsp;224 &nbsp;256 &nbsp;288 &nbsp;320 &nbsp;352 &nbsp;384 &nbsp;416 &nbsp;448 &nbsp;480<br /> &nbsp; &nbsp;.004 .982 .005 .000 .003 .000 .000 .000 .000 .000 .000 .000 .000 .001 .000<br /> <br /> &nbsp; &nbsp; 512 &nbsp;544 &nbsp;576 1024 1536 2048 2560 3072 3584 4096 4608<br /> &nbsp; &nbsp;.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000<br /> <br /> IP Flow Switching Cache, 4456704 bytes<br /> &nbsp; 6 active, 65530 inactive, 98905147 added<br /> &nbsp; 1786040762 ager polls, 0 flow alloc failures<br /> &nbsp; Active flows timeout in 30 minutes<br /> &nbsp; Inactive flows timeout in 15 seconds<br /> IP Sub Flow Cache, 270664 bytes<br /> &nbsp; 6 active, 16378 inactive, 194430814 added, 98905147 added to flow<br /> &nbsp; 0 alloc failures, 133224 force free<br /> &nbsp; 1 chunk, 113 chunks added<br /> &nbsp; last clearing of statistics never<br /> Protocol &nbsp; &nbsp; &nbsp; &nbsp; Total &nbsp; &nbsp;Flows &nbsp; Packets Bytes &nbsp;Packets Active(Sec) Idle(Sec)<br /> -------- &nbsp; &nbsp; &nbsp; &nbsp; Flows &nbsp; &nbsp; /Sec &nbsp; &nbsp; /Flow &nbsp;/Pkt &nbsp; &nbsp; /Sec &nbsp; &nbsp; /Flow &nbsp; &nbsp; /Flow<br /> TCP-Telnet &nbsp; &nbsp;20522857 &nbsp; &nbsp; &nbsp;4.7 &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp;47 &nbsp; &nbsp; 30.0 &nbsp; &nbsp; &nbsp; 5.8 &nbsp; &nbsp; &nbsp;15.4<br /> TCP-FTP &nbsp; &nbsp; &nbsp; &nbsp; 593365 &nbsp; &nbsp; &nbsp;0.1 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;44 &nbsp; &nbsp; &nbsp;0.1 &nbsp; &nbsp; &nbsp; 0.6 &nbsp; &nbsp; &nbsp;15.3<br /> TCP-FTPD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;6766 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;42 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;17.1<br /> TCP-WWW &nbsp; &nbsp; &nbsp; &nbsp;8095942 &nbsp; &nbsp; &nbsp;1.8 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;48 &nbsp; &nbsp; &nbsp;2.3 &nbsp; &nbsp; &nbsp; 1.0 &nbsp; &nbsp; &nbsp;14.7<br /> TCP-SMTP &nbsp; &nbsp; &nbsp; &nbsp;439001 &nbsp; &nbsp; &nbsp;0.1 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;43 &nbsp; &nbsp; &nbsp;0.1 &nbsp; &nbsp; &nbsp; 0.1 &nbsp; &nbsp; &nbsp;15.4<br /> TCP-X &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4197700 &nbsp; &nbsp; &nbsp;0.9 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;40 &nbsp; &nbsp; &nbsp;0.9 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;15.6<br /> TCP-BGP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;23777 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;40 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;16.0<br /> TCP-NNTP &nbsp; &nbsp; &nbsp; &nbsp; 32306 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;40 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;16.0<br /> TCP-Frag &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2338 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;86 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp; 5.8<br /> TCP-other &nbsp; &nbsp; 35616655 &nbsp; &nbsp; &nbsp;8.2 &nbsp; &nbsp; &nbsp; &nbsp;66 &nbsp; &nbsp;40 &nbsp; &nbsp;550.8 &nbsp; &nbsp; &nbsp; 0.8 &nbsp; &nbsp; &nbsp;16.0<br /> UDP-DNS &nbsp; &nbsp; &nbsp; &nbsp;1801203 &nbsp; &nbsp; &nbsp;0.4 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;65 &nbsp; &nbsp; &nbsp;0.4 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;15.5<br /> UDP-NTP &nbsp; &nbsp; &nbsp; &nbsp;5469491 &nbsp; &nbsp; &nbsp;1.2 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;78 &nbsp; &nbsp; &nbsp;1.2 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;15.5<br /> UDP-TFTP &nbsp; &nbsp; &nbsp; &nbsp; 24794 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;43 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;15.5<br /> UDP-Frag &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1523 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 417 &nbsp;1497 &nbsp; &nbsp; &nbsp;0.1 &nbsp; &nbsp; &nbsp; 1.0 &nbsp; &nbsp; &nbsp;15.4<br /> UDP-other &nbsp; &nbsp; 15663208 &nbsp; &nbsp; &nbsp;3.6 &nbsp; &nbsp; &nbsp; &nbsp; 2 &nbsp; 138 &nbsp; &nbsp; &nbsp;8.3 &nbsp; &nbsp; &nbsp; 2.0 &nbsp; &nbsp; &nbsp;15.5<br /> ICMP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6414014 &nbsp; &nbsp; &nbsp;1.4 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;71 &nbsp; &nbsp; &nbsp;1.8 &nbsp; &nbsp; &nbsp; 1.3 &nbsp; &nbsp; &nbsp;15.4<br /> GRE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 20 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; 490 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 0.0 &nbsp; &nbsp; &nbsp;15.5<br /> IP-other &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 177 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; 248 &nbsp; &nbsp; &nbsp;0.0 &nbsp; &nbsp; &nbsp; 3.3 &nbsp; &nbsp; &nbsp;15.4<br /> Total: &nbsp; &nbsp; &nbsp; &nbsp;98905137 &nbsp; &nbsp; 23.0 &nbsp; &nbsp; &nbsp; &nbsp;25 &nbsp; &nbsp;42 &nbsp; &nbsp;596.6 &nbsp; &nbsp; &nbsp; 2.0 &nbsp; &nbsp; &nbsp;15.6<br /> <br /> SrcIf &nbsp; &nbsp; &nbsp; &nbsp; SrcIPaddress &nbsp; &nbsp;DstIf &nbsp; &nbsp; &nbsp; &nbsp; DstIPaddress &nbsp; &nbsp;Pr SrcP DstP &nbsp;Pkts<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 0.0.0.0 &nbsp; &nbsp; &nbsp; &nbsp; Null &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;255.255.255.255 11 0044 0043 &nbsp; &nbsp; 1<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.113 &nbsp; &nbsp;Local &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.254 &nbsp; &nbsp;11 007B 007B &nbsp; &nbsp; 1<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.42 &nbsp; &nbsp; Local &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.254 &nbsp; &nbsp;11 007B 007B &nbsp; &nbsp; 1<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.226 &nbsp; &nbsp;Local &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.254 &nbsp; &nbsp;11 007B 007B &nbsp; &nbsp; 1<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.223 &nbsp; &nbsp;Null &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;239.255.255.250 11 076C 076C &nbsp; &nbsp; 1<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.250 &nbsp; &nbsp;Null &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.198.12 &nbsp;11 007B 007B &nbsp; &nbsp; 1<br /> Vl900 &nbsp; &nbsp; &nbsp; &nbsp; 172.16.0.250 &nbsp; &nbsp;Null &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.198.11 &nbsp;11 007B 007B &nbsp; &nbsp; 1<br /> <br /> -------------------------------------------------------------------------------<br /> PFC:<br /> <br /> Displaying Hardware entries in Module 2<br /> &nbsp;SrcIf &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;SrcIPaddress &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;DstIPaddress &nbsp; &nbsp; &nbsp;Pr &nbsp; &nbsp; &nbsp; SrcP &nbsp; &nbsp; &nbsp;DstP &nbsp; &nbsp; &nbsp;Pkts<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.117.195.154 &nbsp; &nbsp; &nbsp; 10.0.0.138 &nbsp; &nbsp; &nbsp; &nbsp;udp &nbsp; &nbsp; &nbsp;9775 &nbsp; &nbsp; &nbsp;28622 &nbsp; &nbsp; 0<br /> &nbsp;Vl200 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.0.143.215 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;54.250.232.2 &nbsp; &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp;50420 &nbsp; &nbsp; 443 &nbsp; &nbsp; &nbsp; 15<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;52.193.251.190 &nbsp; &nbsp; &nbsp; &nbsp;10.0.86.114 &nbsp; &nbsp; &nbsp; tcp &nbsp; &nbsp; &nbsp;www &nbsp; &nbsp; &nbsp; 55411 &nbsp; &nbsp; 1<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.206.254 &nbsp; &nbsp; &nbsp; 140.127.198.61 &nbsp; &nbsp;icmp &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; 0 &nbsp; &nbsp; &nbsp; &nbsp; 7<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;64.233.189.189 &nbsp; &nbsp; &nbsp; &nbsp;10.0.20.106 &nbsp; &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;443 &nbsp; &nbsp; &nbsp; 51188 &nbsp; &nbsp; 10<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;172.19.9.197 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.198.6 &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;59737 &nbsp; &nbsp; dns &nbsp; &nbsp; &nbsp; 1<br /> &nbsp;Vl200 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.0.120.1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;205.251.212.19 &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp;34178 &nbsp; &nbsp; 443 &nbsp; &nbsp; &nbsp; 12<br /> &nbsp;Vl200 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.0.156.185 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;213.155.215.185 &nbsp; udp &nbsp; &nbsp; &nbsp;16768 &nbsp; &nbsp; 17181 &nbsp; &nbsp; 1<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.2.140.98 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 140.127.198.3 &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;63104 &nbsp; &nbsp; dns &nbsp; &nbsp; &nbsp; 1<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;74.125.194.127 &nbsp; &nbsp; &nbsp; &nbsp;10.0.172.14 &nbsp; &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;19302 &nbsp; &nbsp; 59466 &nbsp; &nbsp; 2<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;205.251.199.239 &nbsp; &nbsp; &nbsp; 140.127.198.6 &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;dns &nbsp; &nbsp; &nbsp; 43517 &nbsp; &nbsp; 1<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.212.25 &nbsp; &nbsp; &nbsp; &nbsp;140.127.198.1 &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;51909 &nbsp; &nbsp; dns &nbsp; &nbsp; &nbsp; 1<br /> &nbsp;Vl200 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.0.182.206 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17.253.17.208 &nbsp; &nbsp; tcp &nbsp; &nbsp; &nbsp;58054 &nbsp; &nbsp; www &nbsp; &nbsp; &nbsp; 649<br /> &nbsp;Vl200 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.200.249 &nbsp; &nbsp; &nbsp; 172.17.0.42 &nbsp; &nbsp; &nbsp; udp &nbsp; &nbsp; &nbsp;5247 &nbsp; &nbsp; &nbsp;1545 &nbsp; &nbsp; &nbsp;16859<br /> &nbsp;Vl200 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1.1.1.1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 10.0.227.120 &nbsp; &nbsp; &nbsp;tcp &nbsp; &nbsp; &nbsp;444 &nbsp; &nbsp; &nbsp; 12536 &nbsp; &nbsp; 6<br /> &nbsp;Vl249 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10.1.213.115 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;140.127.198.10 &nbsp; &nbsp;udp &nbsp; &nbsp; &nbsp;137 &nbsp; &nbsp; &nbsp; 137 &nbsp; &nbsp; &nbsp; 6<br /> ...........(以下省略）<br /> <br /> <br /> <br /> <br /> <b>那如何在Flexible Netflow上如何顯示類似的資料呢？</b><br /> <b>可以嘗試以下指令：</b><br /> <br /> LIC_4500X#<b><span style="color: blue;">show flow monitor CM-v4-monitor cache format table</span></b><br /> &nbsp; Cache type: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Normal<br /> &nbsp; Cache size: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1024<br /> &nbsp; Current entries: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 973<br /> &nbsp; High Watermark: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1024<br /> <br /> &nbsp; Flows added: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1130251984<br /> &nbsp; Flows aged: &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1130251011<br /> &nbsp; &nbsp; - Active timeout &nbsp; &nbsp; &nbsp;( &nbsp;1800 secs) &nbsp; &nbsp; &nbsp;11343<br /> &nbsp; &nbsp; - Inactive timeout &nbsp; &nbsp;( &nbsp; &nbsp;15 secs) &nbsp; 99157047<br /> &nbsp; &nbsp; - Event aged &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0<br /> &nbsp; &nbsp; - Watermark aged &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 301513880<br /> &nbsp; &nbsp; - Emergency aged &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 729568741<br /> <br /> IPV4 SRC ADDR &nbsp; &nbsp;IPV4 DST ADDR &nbsp; &nbsp;TRNS SRC PORT &nbsp;TRNS DST PORT &nbsp;INTF INPUT &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IP PROT &nbsp; &nbsp; &nbsp; bytes &nbsp; &nbsp; &nbsp; &nbsp;pkts &nbsp; &nbsp;time first &nbsp; &nbsp; time last<br /> =============== &nbsp;=============== &nbsp;============= &nbsp;============= &nbsp;==================== &nbsp;======= &nbsp;========== &nbsp;========== &nbsp;============ &nbsp;============<br /> 130.211.141.52 &nbsp; 140.127.223.104 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;443 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;49900 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 123.187.78.231 &nbsp; 140.127.232.208 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;16001 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6999 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; 147 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 203.70.119.117 &nbsp; 140.127.233.120 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 80 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;49390 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; 55138 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;40 &nbsp;17:25:48.983 &nbsp;17:25:51.983<br /> 203.69.105.248 &nbsp; 140.127.220.212 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 80 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;58305 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp;1544 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 10.1.220.3 &nbsp; &nbsp; &nbsp; 203.70.119.117 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 49428 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 80 &nbsp;Te1/5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp;9947 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;24 &nbsp;17:25:48.983 &nbsp;17:25:53.987<br /> 104.250.142.226 &nbsp;140.127.233.62 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;80 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;55613 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; 722 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 115.79.44.172 &nbsp; &nbsp;140.127.218.30 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 54747 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;31999 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 88.168.81.160 &nbsp; &nbsp;140.127.205.84 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 33826 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10150 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 59.50.158.60 &nbsp; &nbsp; 140.127.231.3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;16001 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 7436 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; 294 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2 &nbsp;17:25:48.983 &nbsp;17:25:48.983<br /> 163.28.130.44 &nbsp; &nbsp;140.127.206.35 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 443 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;14145 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; 69031 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;93 &nbsp;17:25:48.983 &nbsp;17:25:57.987<br /> 111.221.77.162 &nbsp; 140.127.233.122 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;40022 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;14515 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;67 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 94.72.2.170 &nbsp; &nbsp; &nbsp;140.127.213.165 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;19689 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6881 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; 149 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 106.10.150.171 &nbsp; 140.127.233.192 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 25 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2521 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; 463 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 114.24.176.211 &nbsp; 140.127.205.84 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;8733 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 7345 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; 355 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 140.127.220.214 &nbsp;72.186.58.131 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6881 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9862 &nbsp;Te1/5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; 337 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 10.1.219.44 &nbsp; &nbsp; &nbsp;65.55.162.26 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 61786 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;443 &nbsp;Te1/5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; 537 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 123.193.80.185 &nbsp; 140.127.206.239 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 9669 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;51413 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;17 &nbsp; &nbsp; &nbsp; &nbsp; 161 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 114.33.204.253 &nbsp; 140.127.206.101 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6690 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;63609 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; 326 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> 140.127.219.216 &nbsp;52.26.91.224 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;6423 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;443 &nbsp;Te1/5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;64 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp;17:25:59.982 &nbsp;17:25:55.986<br /> 114.47.175.31 &nbsp; &nbsp;140.127.205.84 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;7673 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;10214 &nbsp;Te2/1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 6 &nbsp; &nbsp; &nbsp; &nbsp; 128 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2 &nbsp;17:25:55.986 &nbsp;17:25:55.986<br /> ..........(以下省略）<br /> <br /> <b>不過，因為FNF的欄位都是管理者自己定義的，所以無法顯示Legacy Netflow最上方的service port使用排名。（或許可以，不過還要再"菸酒菸酒"）</b><br /> <b><br /></b> <br />Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-83930916757559663652016-05-05T02:22:00.002-07:002016-05-05T02:22:19.587-07:00F5的SNAT與NAT觀念<div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3B-D-SWSMUHyPQN-ryI9LJAMuU70SI8xx46HLPf4JnB68bDsuRzsVoyjLwJANuKTrfDFv7QV-LY7IUd4fqMtxJpYWSYiDvyVGdae48JCnRCSqtYgBuqkNLm6EBC2uLwyPSsJeuXiZBeZF/s1600/F5-SNAT.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3B-D-SWSMUHyPQN-ryI9LJAMuU70SI8xx46HLPf4JnB68bDsuRzsVoyjLwJANuKTrfDFv7QV-LY7IUd4fqMtxJpYWSYiDvyVGdae48JCnRCSqtYgBuqkNLm6EBC2uLwyPSsJeuXiZBeZF/s1600/F5-SNAT.jpg" width="400" /></a></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> SNAT(Secure NAT或Source NAT)是一種多對少的轉址關係，通常用於從F5流出去的outbound流量，如上圖，10.10.10.1、10.10.10.2、10.10.10.3經由F5出去時會被SNAT成Ext這個VLAN的SelfIP(在Automap的情況下)，因為有兩個SelfIP，所以會輪流SNAT成這兩個IP。</div> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> SNAT的IP無法被直接存取，也就是60.249.69.36無法initial session到210.96.88.12及198.66.87.35這兩個IP(Secure NAT由此而來)，但可以接受由這兩個IP所發起的回應連線。</div> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkxVU_hLY1UYs9JNpTMJil1FOKmkG_0YTV0_Fff9X54MX-qGMv_QhX3HXcQuTU2qTbrfOh56aB60ebsQTkGwKBdpBDFjEiDC9g4DwZoeiwn-53ba0fFTEdQNIQrYK2mO8WZUQntgUvhOMR/s1600/F5-NAT.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="337" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkxVU_hLY1UYs9JNpTMJil1FOKmkG_0YTV0_Fff9X54MX-qGMv_QhX3HXcQuTU2qTbrfOh56aB60ebsQTkGwKBdpBDFjEiDC9g4DwZoeiwn-53ba0fFTEdQNIQrYK2mO8WZUQntgUvhOMR/s1600/F5-NAT.jpg" width="400" /></a></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> NAT是一種一對一的轉址關係，是一種雙向的轉址，在這種關係下，VLAN的SelfIP可以直接被存取，例如:60.249.69.36可以直接存取198.66.87.35，存取時其destination IP會被轉成10.10.10.2。而10.10.10.2存取60.249.68.36時，其source address會被轉成198.66.87.35</div> <br /> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgE5DdMtNKgb0hFwdncy8bb1kZfg7ta5-sjGv0SdbJXJdJgeqUsmpuy2VYqjptFhmHnfTumuHMHELeDDFvOSCvMAqO-_xsddfUX6CoBJZVcg_Fx3yQiP9t5n4qgDrIHYLzxM8W8gbE8F4dK/s1600/F5-SNAT+example.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgE5DdMtNKgb0hFwdncy8bb1kZfg7ta5-sjGv0SdbJXJdJgeqUsmpuy2VYqjptFhmHnfTumuHMHELeDDFvOSCvMAqO-_xsddfUX6CoBJZVcg_Fx3yQiP9t5n4qgDrIHYLzxM8W8gbE8F4dK/s1600/F5-SNAT+example.jpg" width="400" /></a></div> <br />Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-51120263706168305572016-05-05T02:22:00.001-07:002016-05-05T02:22:03.926-07:00PaloAlto 7.0版關於Global Protect無法顯示網頁(404 Not Found)問題<div class="separator" style="clear: both; text-align: center;"> 更新完PANOS至7.0版後，發現登入https://vpn-ip後會顯示404 Not Found</div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> 進入PA系統內的Network-&gt;GlobalProtect-&gt;Portals-&gt;進入設定會看到Appearance下方的Disable login page預設是打勾的</div> <div class="separator" style="clear: both; text-align: center;"> 所以解決方式就是把這個勾拿掉</div> <div class="separator" style="clear: both; text-align: center;"> 然後</div> <div class="separator" style="clear: both; text-align: center;"> 把Custom Login Page改選factory-default就大功告成了</div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnwGrmzuNz4zSn1aul62pfppC50olWHSvdajYRU1xo8XpKaFmgFX_zVeXw55vkB0r9nfRx292PFdJPZl3hxsC464sDx0sG5Msj582c4YBpzPPZfQ_0PWcqM6nnDDS2OQ8HNqidBuybpTJS/s1600/%25E8%259E%25A2%25E5%25B9%2595%25E5%25BF%25AB%25E7%2585%25A7+2016-05-05+%25E4%25B8%258B%25E5%258D%25885.12.32.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="402" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnwGrmzuNz4zSn1aul62pfppC50olWHSvdajYRU1xo8XpKaFmgFX_zVeXw55vkB0r9nfRx292PFdJPZl3hxsC464sDx0sG5Msj582c4YBpzPPZfQ_0PWcqM6nnDDS2OQ8HNqidBuybpTJS/s640/%25E8%259E%25A2%25E5%25B9%2595%25E5%25BF%25AB%25E7%2585%25A7+2016-05-05+%25E4%25B8%258B%25E5%258D%25885.12.32.png" width="640" /></a></div> <br /> <br /> <br />Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-64167991035318726352015-08-14T19:33:00.004-07:002015-08-14T19:33:18.901-07:00DNS master與slave同步問題<div class="MsoNormal" style="background-color: #e7e7e7; clear: both; color: #666666; font-family: 'Lucida Grande', 'Lucida Sans Unicode', 'Lucida Sans', sans-serif; font-size: 13px; line-height: 23.3999996185303px; margin-bottom: 1em; margin-top: 1em; padding: 0px; width: 658px;"> <span style="color: black;"><span style="font-size: 14px;"><b><span style="font-family: 新細明體, serif;">資料同步化過程</span><span lang="EN-US">&nbsp;:</span></b></span></span><b><span lang="EN-US"><o:p></o:p></span></b></div> <div class="MsoNormal" style="background-color: #e7e7e7; clear: both; color: #666666; font-family: 'Lucida Grande', 'Lucida Sans Unicode', 'Lucida Sans', sans-serif; font-size: 13px; line-height: 23.3999996185303px; margin-bottom: 1em; margin-top: 1em; padding: 0px; width: 658px;"> <span style="color: black;"><span lang="EN-US">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span><span style="font-family: 新細明體, serif;">在資料同步的過程中。簡單來說，</span><span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">的資料內容來自於</span><span lang="EN-US">Master</span>。但<span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">是如何判斷何時才要同步更新資料。基本上不論是</span><span lang="EN-US">Master</span><span style="font-family: 新細明體, serif;">或是</span><span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">都會有「序號」，並且以此序號的大小來研判是否要更新或是同步。同步更新的方式大約分成兩種</span><span lang="EN-US">:</span></span></div> <div class="MsoNormal" style="background-color: #e7e7e7; clear: both; color: #666666; font-family: 'Lucida Grande', 'Lucida Sans Unicode', 'Lucida Sans', sans-serif; font-size: 13px; line-height: 23.3999996185303px; margin-bottom: 1em; margin-top: 1em; padding: 0px; width: 658px;"> <span style="color: black;"><span style="font-family: 新細明體, serif;">【</span><span lang="EN-US">Master</span><span style="font-family: 新細明體, serif;">主動通知】</span><span lang="EN-US">:&nbsp;</span><span style="font-family: 新細明體, serif;">在修改</span><span lang="EN-US">Master</span><span style="font-family: 新細明體, serif;">的資料內容，並增加序號大小，一但當重啟</span><span lang="EN-US">DNS</span><span style="font-family: 新細明體, serif;">服</span></span></div> <div class="MsoNormal" style="background-color: #e7e7e7; clear: both; color: #666666; font-family: 'Lucida Grande', 'Lucida Sans Unicode', 'Lucida Sans', sans-serif; font-size: 13px; line-height: 23.3999996185303px; margin-bottom: 1em; margin-top: 1em; padding: 0px; width: 658px;"> <span style="color: black;"><span lang="EN-US">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</span><span style="font-family: 新細明體, serif;">務時，</span><span lang="EN-US">Master</span><span style="font-family: 新細明體, serif;">會主動通知</span><span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">有資料更新。以便達到同步。</span></span></div> <div class="MsoNormal" style="background-color: #e7e7e7; clear: both; color: #666666; font-family: 'Lucida Grande', 'Lucida Sans Unicode', 'Lucida Sans', sans-serif; font-size: 13px; line-height: 23.3999996185303px; margin-bottom: 1em; margin-top: 1em; padding: 0px; width: 658px;"> <span style="color: black;"><span style="font-family: 新細明體, serif;">【</span><span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">主動提出要求】</span><span lang="EN-US">:&nbsp;</span><span style="font-family: 新細明體, serif;">基本上</span><span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">會定時的查看</span><span lang="EN-US">Master</span><span style="font-family: 新細明體, serif;">的序號大小，當發現</span><span lang="EN-US">Master</span></span></div> <div class="MsoNormal" style="background-color: #e7e7e7; clear: both; color: #666666; font-family: 'Lucida Grande', 'Lucida Sans Unicode', 'Lucida Sans', sans-serif; font-size: 13px; line-height: 23.3999996185303px; margin-bottom: 1em; margin-top: 1em; padding: 0px; width: 658px;"> <span style="color: black;"><span lang="EN-US">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</span><span style="font-family: 新細明體, serif;">的序號比</span><span lang="EN-US">Slave</span><span style="font-family: 新細明體, serif;">大時，就會主動更新。若序號不變，則不會更新。</span></span></div> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-14211840796913409732013-04-29T05:28:00.001-07:002016-05-05T02:31:58.730-07:00Cisco無線AP與Controller的互聯方式準備工作:<br /> &nbsp; &nbsp; &nbsp; &nbsp;進入到AP console，設定AP的IP address==&gt;<br /> <br /> <br /> <div style="font-family: arial, helvetica, sans-serif; font-size: 12px;"> In a new installation, when a LAP is unable to find a WLC using the discovery algorithms, you can statically configure the information necessary to join a controller via the console port and the AP’s CLI. Refer to&nbsp;<a href="http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00806c9e51.shtml" style="color: #003399; font-size: 11px; text-decoration: none;">Lightweight AP (LAP) Registration to a Wireless LAN Controller (WLC)</a>&nbsp;for more information on the WLC discovery algorithms and the LAP registration process.</div> <div style="font-family: arial, helvetica, sans-serif; font-size: 12px;"> In order to manually configure static information on a LAP using the AP CLI interface, you can use these EXEC mode CLI commands:</div> <blockquote style="font-family: arial, helvetica, sans-serif; font-size: 12px;"> <pre style="font-size: 15.199999809265137px;">AP#<b>capwap ap ip address <span style="font-style: italic; font-weight: normal;">&lt;IP address&gt; &lt;subnet mask&gt;</span> </b> AP#<b>capwap ap ip default-gateway <span style="font-style: italic; font-weight: normal;">&lt;IP-address&gt;</span> </b> AP#<b>capwap ap controller ip address <span style="font-style: italic; font-weight: normal;">&lt;IP-address&gt;</span> </b> AP#<b>capwap ap hostname <span style="font-style: italic; font-weight: normal;">&lt;name&gt;</span> </b> (optional)</pre> </blockquote> <br /> <br /> =======================================================================<br /> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 以下文章引用自:<a href="http://smalleaf.blogspot.tw/2011/10/cisco-apcontroller-join-lightweight-ap.html" style="background-color: transparent;">http://smalleaf.blogspot.tw/2011/10/cisco-apcontroller-join-lightweight-ap.html</a></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 最近常有機會在不同的環境將thin ap 加入controller裡面好讓controller控制，方法很多，到底環境要用什麼樣的方式來加呢?先了解ap如何與controller溝通，再依不同的環境選合適的方式。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> Cisco 瘦AP加入Controller的順序依序如下:</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b><span class="Apple-style-span" style="color: blue;">1.區域廣播(Local IP Subnet Discovery):</span></b></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>原理:</b>先用廣播的方式，找到環境內的Controller，也就是thin AP與Controller在同一個網段裡，這是最快也最簡單的方式。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>方法:</b>只要把AP插上電與網路即可。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b><span class="Apple-style-span" style="color: blue;">2.空中廣播Over The Air Provisioning(OTAP):</span></b></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>原理:</b>當從網路線上廣播找不到controller時，第二步透過空氣中的無線電廣播，找尋有沒有其它ap已經有controller的資訊，有的話就跟著去找到Controller</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>方法:&nbsp;</b>把AP放置在已加入controller的thin ap 附近。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b><span class="Apple-style-span" style="color: blue;">3.Locally Stored Controller IP Address:</span></b></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>原理:</b>如果從空氣中找不到其它AP的訊號，第三步就是找尋自已AP內是不是有設定過Controller的資訊?Controller 的IP地址，有的話即透過此IP地址去找Controller</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>方法:</b>以console線接到ap，從CLI輸入下列指令</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> </div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> lwapp ap controller ip add x.x.x.x</div> <div style="background-color: white; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 上面指令即是告訴AP controller在哪裡，如果環境沒有dhcp先配方ip的話，需要先設定ip給thin ap，指令如下:</div> <div style="background-color: white; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> lwapp ap ip address x.x.x.x x.x.x.x</div> <div style="background-color: white; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b><span class="Apple-style-span" style="color: blue;">4. DHCP option 43:</span></b></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>原理:</b>如果AP本身沒有設定Controller的IP資訊，接下來即找尋DHCP的option43資訊，是否有設定controller的位址，有的話即套用此IP位址與controller溝通</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>方法:&nbsp;</b>以cisco switch為例，設定dhcp 的option如下:</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> </div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> ip dhcp pool wireless</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> &nbsp; &nbsp;network 192.168.1.x 255.255.255.0</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> &nbsp; &nbsp;dns-server 192.168.1.x</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> &nbsp; &nbsp;default-router 192.168.1.254</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> &nbsp; &nbsp;option 43 hex f104.c0a8.a202</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 簡單說明option 43，option43是16進制的IP位址，所以在option43之前需指定hex(16進)，而這16進的號碼是由Type + Length + Value 所組成。Type比較簡單，永遠是0xF1，只取F1為開頭。而Length就看有設定多少個IP位址，以IPv4來說，192.168.10.5是一個IP有四段，所以length為4，如果是兩個ip，比如192.168.10.5與192.168.10.6有兩個IP， length為8。最後Value就是把IP位址改成16進。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 下面的例子是把192.168.10.5與192.168.10.20這兩個controller ip設定成option 43的格式:</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> </div> <pre style="background-color: white; color: #666666;">option 43 hex f108c0a80a05c0a80a14</pre> <br style="background-color: white; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;" /> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <span class="Apple-style-span" style="color: blue;"><b>5. DNS Discovery:</b></span></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>原理:</b>最後，DHCP沒設定option 43的話，就是看DNS有沒有指定Controller在哪?有的話即進行與controller的溝通。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b>方法:</b>&nbsp;即是在DNS上加入一比Recorder ，如下:</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <span class="Apple-style-span" style="font-family: &quot;arial&quot; , &quot;helvetica&quot; , sans-serif;"><span class="Apple-style-span" style="color: #cc0000;">&nbsp;CISCO-CAPWAP-CONTROLLER</span>.<span style="color: black; font-style: italic;">localdomain &nbsp;10.0.0.1</span></span></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <span class="Apple-style-span" style="font-family: &quot;arial&quot; , &quot;helvetica&quot; , sans-serif;">後面的localdomain為環境的網域名稱，上面紅色的部份是ap會找尋的固定名稱，需要一樣</span></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <span class="Apple-style-span" style="font-family: &quot;arial&quot; , &quot;helvetica&quot; , sans-serif;"><span class="Apple-style-span"><i><br /></i></span></span></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <span class="Apple-style-span" style="font-family: &quot;arial&quot; , &quot;helvetica&quot; , sans-serif;"><span class="Apple-style-span"><i><br /></i></span></span></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 當跑完上面五個流程都沒找到，就會從頭再來一次，直到找到controller為止，因為…thin AP沒辦法像FAT AP能夠勇敢、單獨的存在著。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> 所以可以簡單的把Thin AP 加入Controller的方式概分為兩種環境:</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b><span class="Apple-style-span" style="color: #3d85c6;">1.同一個網段裡:</span><span class="Apple-style-span" style="color: blue;">&nbsp;</span></b>這是最簡單的，即上面介紹的第一種方式區域廣播，只需要確認ap有電、有網路線即可。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; line-height: 18px;"> <b><span class="Apple-style-span" style="color: #3d85c6;">2.不同網段裡:</span></b>跨網段可以從上面2~4方式選一種，以簡單方便為主。</div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; font-size: 13px; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; font-size: 13px; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; font-size: 13px; line-height: 18px;"> <br /></div> <div class="separator" style="background-color: white; clear: both; color: #666666; font-family: 'Trebuchet MS', Trebuchet, Verdana, sans-serif; font-size: 13px; line-height: 18px;"> <br /></div> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-15960645050177223672013-02-24T23:35:00.001-08:002015-08-14T19:34:07.757-07:00關於VMWare ESX裡面的網路(轉載)很不錯的一篇文章，轉載自 <a href="http://www.weithenn.org/cgi-bin/wiki.pl?VMware_Networking">http://www.weithenn.org/cgi-bin/wiki.pl?VMware_Networking</a><br /> <br /> <br /> <h2 id="Heading1" style="background-color: white; border-bottom-color: rgb(0, 0, 0); border-bottom-style: solid; border-bottom-width: 2px; clear: both; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: medium; margin: 4ex 0px 1ex; padding: 0px;"> vNetwork 介紹</h2> <div style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> vNetwork 支援二種 Virtual Switch 也就是 Standard Switches (VSS) 及 Distributed Switches (VDS)，而 vNetwrok 提供三種網路服務存取型態 Virtual Machine Port Group、VMKernel Port、Service Console Port</div> <ol style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li>VSS、VDS： 用於 VM 與 VM 之間溝通或 VM 與實體 Switch 溝通之用<ol> <li>vNetwork Standard Switches (VSS) 無法跨 Host 使用</li> <li>vNetwork Distributed Switches (VDS) 可以跨 Host 使用 (Enterprise Plus 版本才有支援此功能)，且當 VM 透過 VMotion 機制移轉至其它台 Host 時原先在虛擬交換器針對 VM 所做的設定，仍然會自動套用到該 Host 上</li> </ol> </li> </ol> <div style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> 虛擬網路 (vNetwork)： vSwitch 支援下列三種連線類型</div> <ol style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li><span style="color: blue;">Virtual Machine</span>： VM，也就是給虛擬機器 VM 連接使用並搭配後續談到的 Port Group 使用</li> <li><span style="color: blue;">VMKernel</span>： vmknic，需要連接 iSCSI、NFS 等 IP Storage 及後續談到的進階功能 vMotion 時使用 (ESXi 稱為 Management Network)</li> <li><span style="color: blue;">Service Console</span>： vswif，安裝完 ESX Host 後與外界溝通的唯一管道用於 vSphere Client 連入時及後續談到的進階功能 HA (HA Heartbeat) 時使用 (只有 ESX Host 才有 Service Console 若是安裝 ESXi 則無)</li> </ol> <div> <h2 id="Heading2" style="background-color: white; border-bottom-color: rgb(0, 0, 0); border-bottom-style: solid; border-bottom-width: 2px; clear: both; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: medium; margin: 4ex 0px 1ex; padding: 0px;"> vSwitch 介紹</h2> <ul style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li>vSwitch 提供 VM 與實體網路交換資訊的能力</li> <li>vSwitch 可配合指定&nbsp;<strong>多片</strong>&nbsp;實體網路卡 (UpLink) 來達到頻寬的負載平衡 (Balances Traffic) 及容錯 (Failover) 也就是 NIC Teaming 功能</li> <li>vSwitch 建立時預設會提供 56 Ports (最大值 4088 Ports) VM 及實體網卡 (UpLink) 存取使用， ESX / ESXi 顯示預設值為 24 Ports，若更改 vSwitch Ports 設定值則必須將 ESX / ESXi Host 重新啟動才會套用新的設定值</li> <li><span style="color: blue;">建立 vSwitch 時若&nbsp;<strong>不勾選任何 vmnic</strong>&nbsp;則表示屆時連接此 vSwitch 的 VM&nbsp;<strong>不</strong>&nbsp;與實體網路卡 (UpLink) 介接也就是只能 VM 與 VM 之間互通，例如可使用於該 VM 是 NAT Client 環境下</span></li> <li><span style="color: blue;">vSwitch 上面沒有接任何 VM 但有連接實體網路卡 (Up Link) 時表示用於 VMkernel 之用</span>，<span style="color: blue;">通常使用於 VMotion 或 IP-SAN(iSCSI) 連接之用且不與 VM 共用實體網路頻寬</span></li> <li>每一台 Host 最多可以建立 248 台 vSwitch (VI3 則為 127 台)</li> <li>每一台 vSwitch 上面皆可切出多個 Port Group 出來，例如 VLAN、頻寬管理...等用途</li> <li><span style="color: blue;">若要支援 Jumbo Frames 則請將 MTU 數值設定為 9000</span>，而 ESXi 則只有及上運作的 VM 能進行設定 ESXi Host 本身無法進行設定。</li> </ul> <div style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> 了解上述 vSwitch 特性後我們可知您可將不同功能用途例如&nbsp;<strong>iSCSI、VMotion、VM、Service Console 都放在同一個 vSwitch 上也可放在不同的 vSwitch 上</strong>，至於何種方式比較好則必須視實際環境、流量負載、傳輸效能而定因為二種方式各有其優缺點。</div> <div style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> 舉例來說若一台 Host 上有三張實體網路卡，若將 iSCSI、VMotion、VM、Service Console 都放在同一個 vSwitch 上或不同 vSwitch 上大致可想得到的優缺點為</div> <ul style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li>同一個 vSwitch： 由於多張實體網路卡指定給同一個 vSwitch 後將具有頻寬的負載平衡 (Balances Traffic) 及容錯 (Failover) 功能，因此好處當實體網路發生問題時因為容錯功能發揮將使得連線不致中斷，但缺點就是所有的服務都在同一個 vSwitch 上亂竄互相影響 (雖然可透過 Port Group 設定進行微調)。</li> <li>不同一個 vSwitch： 好處當然就是相關服務及傳輸都互相隔離，如此一來傳輸效能及品質都將保持一定的水準，但相對來說若實體網路發生問題時服務也將因此中斷。</li> </ul> <div> <span style="font-family: Bookman Old Style, Times New Roman, serif;"><br /></span></div> </div> <div> <span style="font-family: Bookman Old Style, Times New Roman, serif;"><br /></span></div> <div> <span style="font-family: Bookman Old Style, Times New Roman, serif;"><br /></span></div> <div> <h3 id="Heading3" style="background-color: white; border-bottom-color: rgb(0, 0, 0); border-bottom-style: dashed; border-bottom-width: 1px; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: medium; margin: 4ex 0px 1ex; padding: 0px;"> Port Group</h3> <h4 id="Heading4" style="background-color: white; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px; margin: 4ex 0px 1ex; padding: 0px;"> Port Binding 模式</h4> <ul style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li>Static Binding： 表示對應一個 VM 就佔用一個 Port</li> <li>Dynamic Binding： 表示該 VM Power ON 時才佔用一個 Port 若 VM Power Off 則釋放 Port 出來</li> <li>Ephemeral - no Binding： 表示沒有 Port Binding 功能</li> </ul> <h4 id="Heading5" style="background-color: white; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px; margin: 4ex 0px 1ex; padding: 0px;"> 限制流入/流出流量</h4> <div style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> Distributed Switches (VDS) 支援網路流量 流入 Inbound / 流出 Outbound 的限制，而 Standard Switches (VSS)&nbsp;<strong>僅支援</strong>&nbsp;網路流量 流出 Outbound 的限制</div> <ul style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li>Ingress： 即 Traffic Inbound (流入)</li> <li>Dgress： 即 Traffic Outbound (流出)</li> </ul> <h4 id="Heading6" style="background-color: white; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px; margin: 4ex 0px 1ex; padding: 0px;"> Security</h4> <ul style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li>Promiscuous Mode: 是否啟用網卡混亂模式，也就是開啟網卡監聽功能</li> <li>MAC Address Changes: 是否允許 VM 能更改 MAC Address</li> <li>Forged Transmits: 是否啟用阻擋 VM 所送出的封句 (通常配合 Application 進行設定)</li> </ul> <h4 id="Heading7" style="background-color: white; color: #666666; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px; margin: 4ex 0px 1ex; padding: 0px;"> VLANs</h4> <div style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> VLAN 在虛擬環境下有三種不同的方式：</div> <ul style="background-color: white; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px;"> <li><span style="color: blue;">VST (Virtual Switch Tagging)</span>： 虛擬 vSwitch 進行 tagged 及 untagged，由虛擬 vSwitch 來定義 VLAN 而實體 Switch 不作任何 VLAN 設定 (也就是實體網卡 Uplink Port 必須接至實體 Switch 的 Trunk Port)，由於 vSwitch 的 VLAN 是由 VMkernel 來執行 tagged 及 untagged 的動作因此對於 Host 效能有一定程度影響。</li> <li><span style="color: blue;">VGT (Vitual Guest Tagging)</span>： VM (Guest OS) 進行 tagged 及 untagged，由 VM 本身自行設定 VLAN 通常很少使用此方式。</li> <li><span style="color: blue;">EST (External Switch Tag)</span>： 實體 Switch 進行 tagged 及 untagged，由實體 Switch 設定 VLAN 而 VM 及 vSwitch 不作任何 VLAN 設定，也就是 VM 從哪個 Uplink Port 至實體 Switch 即屬於該 VLAN。</li> <li>PVLAN (Private VLAN)： 也就是 VLAN 中又有 VLAN，有如下三種模式 (VDS 才支援，VSS 未支援此功能)<ul> <li>Promiscuous: VM E 及 VM F 可互通，同時也可跟 VM ABCD 互通</li> <li>Isolated: VM C 及 VM D 不會通，跟 VM AB 不通，但跟 VM EF 可互通</li> <li>Community: VM A 及 VM B 可互通，跟 VM CD 不通，但跟 VM EF 會通</li> </ul> </li> </ul> <table class="user" style="background-color: white; border-style: solid; border-width: thin; color: black; font-family: 'Bookman Old Style', 'Times New Roman', serif; font-size: 16px; margin-left: 56.828125px;"><tbody> <tr class="odd first"><td align="center" colspan="2" style="border-style: solid; border-width: thin; padding: 5px;">Community (PVLAN 17)</td><td align="center" colspan="2" style="border-style: solid; border-width: thin; padding: 5px;">Isolated (PVLAN 155)</td><td align="center" colspan="2" style="border-style: solid; border-width: thin; padding: 5px;">Promiscuous (PVLAN 5)</td></tr> <tr class="even"><td align="center" style="border-style: solid; border-width: thin; padding: 5px;">VM A</td><td align="center" style="border-style: solid; border-width: thin; padding: 5px;">VM B</td><td align="center" style="border-style: solid; border-width: thin; padding: 5px;">VM C</td><td align="center" style="border-style: solid; border-width: thin; padding: 5px;">VM D</td><td align="center" style="border-style: solid; border-width: thin; padding: 5px;">VM E</td><td align="center" style="border-style: solid; border-width: thin; padding: 5px;">VM F</td></tr> <tr class="odd"><td align="center" colspan="6" style="border-style: solid; border-width: thin; padding: 5px;">vDS</td></tr> <tr class="even"><td align="center" colspan="6" style="border-style: solid; border-width: thin; padding: 5px;">Primary PVLAN 5</td></tr> </tbody></table> </div> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-69206516236577742832013-02-20T01:24:00.002-08:002013-02-20T01:24:54.474-08:00NAT的種類與特性假設內部位址(Private IP)為N，外部位址(Public IP)為M，NAT的種類分為:<br /> <br /> 1.Dynamic NAT<br /> &nbsp; &nbsp;# N個Private IP嘗試從M個Public IP中挑出一個轉址，如果N&gt;M有可能會導致有IP無法轉<br /> &nbsp; &nbsp; &nbsp; 址，另一個缺點是會浪費Public IP，這種情況建議改用PAT<br /> &nbsp; &nbsp;# NAT timeout可以藉由timeout xlate來改變。<br /> &nbsp; &nbsp;# 無法提供反向存取，遠端Host無法藉由存取Public IP來存取Private IP，<br /> &nbsp; &nbsp; &nbsp; 但在位址轉換期間，遠端Host有機會嘗試藉由存取Public IP來存取Private IP(前提是<br /> &nbsp; &nbsp; &nbsp; Security policy有allow)，有心攻擊者仍有機會藉由工具達成入侵的目的。<br /> <br /> <br /> 2.PAT<br /> &nbsp; &nbsp;# M=1，N個Private IP嘗試從1個Public IP中挑出一個轉址，由於只有一個Public IP，所以<br /> &nbsp; &nbsp; &nbsp; 藉由轉換Port(Port Number &gt; 1024)的方式來達到轉址的目的。<br /> &nbsp; &nbsp; &nbsp; 這種方式在某些多媒體運用無法提供正常運作。<br /> &nbsp; &nbsp;# PAT timeout=30秒，無法改變。<br /> &nbsp; &nbsp;# 無法提供反向存取，遠端Host無法藉由存取Public IP來存取Private IP，<br /> &nbsp; &nbsp; &nbsp; 但在位址轉換期間，遠端Host有機會嘗試藉由存取Public IP來存取Private IP(前提是<br /> &nbsp; &nbsp; &nbsp; Security policy有allow)，有心攻擊者仍有機會藉由工具達成入侵的目的。<br /> <br /> 3.Static NAT<br /> &nbsp; &nbsp;# N=M，提供一對一的轉址<br /> &nbsp; &nbsp;# 提供反向存取，遠端Host可藉由存取Public IP來直接存取Private IP。<br /> &nbsp; &nbsp; &nbsp; (在Juniper Firewall上稱為MIP)<br /> &nbsp; &nbsp;# Static NAT和Dynamic NAT的不同<br /> <br /> 4.Static PAT<br /> &nbsp; &nbsp;#提供外部對內部的存取<br /> <div class="separator" style="clear: both; text-align: center;"> </div> &nbsp; &nbsp;#M=1，藉由存取外部IP:port 來直接存取內部IP。&nbsp;(在Juniper Firewall上稱為VIP)<br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkzdI36A7mSGSrbKfXrHG4GyfWu77onyG7V3fozlYdbDSUtZjq5JIvw3vFKDLePmw-ck9P2vZurmsraqMX7nF5_xHJs8GBcm-l6LGxadA3pUvxRqpdvzvJVdpxZ-VgkJTR-AFO7sYas267/s1600/%25E6%259C%25AA%25E5%2591%25BD%25E5%2590%258D.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkzdI36A7mSGSrbKfXrHG4GyfWu77onyG7V3fozlYdbDSUtZjq5JIvw3vFKDLePmw-ck9P2vZurmsraqMX7nF5_xHJs8GBcm-l6LGxadA3pUvxRqpdvzvJVdpxZ-VgkJTR-AFO7sYas267/s1600/%25E6%259C%25AA%25E5%2591%25BD%25E5%2590%258D.jpg" height="640" width="618" /></a></div> <br />Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-50327834337188994112013-02-19T23:17:00.002-08:002013-02-20T01:34:57.966-08:00關於網路芳鄰的剖析與實務轉載自 <a href="http://www.wretch.cc/blog/ksyuan/11738522">http://www.wretch.cc/blog/ksyuan/11738522</a>Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-2074942773039701532013-01-31T19:54:00.001-08:002013-02-20T01:28:45.863-08:00Cisco Catalyst 2960系列交換器(LAN Base & LAN Lite) Q & A<table bgcolor="#FDF0EB" border="0" style="background-color: #fdf0eb; color: black; width: 647px;"><tbody> <tr><td bgcolor="Peachpuff" class="borderAll" style="border: 1px solid rgb(255, 127, 80);">標題：<span class="fs14" id="ctl00_CPH2_lblSubject" style="font-size: 14px;">Cisco Catalyst 2960系列交換器(LAN Base &amp; LAN Lite) Q &amp; A</span></td></tr> <tr><td><div style="background-color: blanchedalmond; border: 1px solid rgb(255, 160, 122); overflow: auto; width: 647px;"> <span id="ctl00_CPH2_lblDetailDesc"></span><br /> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <span id="ctl00_CPH2_lblDetailDesc"><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">Q1:&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">請問</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">2960</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">可以透過</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">IOS</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">軟體升級或降級達到功能的新增或減少嗎</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">?<o:p></o:p></span></b></span></div> <span id="ctl00_CPH2_lblDetailDesc"> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <span lang="EN-US" style="color: red; font-family: Arial, sans-serif; font-size: 9pt;">A1: No</span><span style="color: red; font-family: 新細明體, serif; font-size: 9pt;">，</span><span lang="EN-US" style="color: red; font-family: Arial, sans-serif; font-size: 9pt;">2960&nbsp;</span><span style="color: red; font-family: 新細明體, serif; font-size: 9pt;">不支援軟體相互更新</span><span lang="EN-US" style="color: red; font-family: Arial, sans-serif; font-size: 9pt;"><o:p></o:p></span></div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <br /></div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">Q2:&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">請問</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">2960 LAN Base&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">與</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">&nbsp;LAN Lite&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">主要的差異在哪裡</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">?<o:p></o:p></span></b></div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">A2:&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">重點的主要差異如下</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">:</span></b><b><span lang="EN-US" style="font-family: 新細明體, serif; font-size: 9pt;"><o:p></o:p></span></b></div> <div class="MsoNormal" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000073"></a><span style="font-family: 新細明體, serif; font-size: 9pt;">‧<span lang="EN-US">&nbsp;Gigabit Ethernet connectivity in 8, 24, and 48 port configurations<o:p></o:p></span></span><br /> <span style="font-family: 新細明體, serif; font-size: 9pt;"><span lang="EN-US"><br /></span></span></div> <div class="MsoNormal" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000074"></a><span style="font-family: 新細明體, serif; font-size: 9pt;">‧&nbsp;<b><span lang="EN-US">RPS</span></b><span lang="EN-US">&nbsp;support and support for a wide range of SFP transceivers<o:p></o:p></span></span><br /> <span style="font-family: 新細明體, serif; font-size: 9pt;"><span lang="EN-US"><br /></span></span></div> <div class="MsoNormal" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000075"></a><span style="font-family: 新細明體, serif; font-size: 9pt;">‧&nbsp;<b><span lang="EN-US">Enhanced security</span></b><span lang="EN-US">&nbsp;through Layer 2-4 access control lists (ACLs), DHCP Snooping, and more&nbsp;</span></span><br /> <span style="font-family: 新細明體, serif; font-size: 9pt;"><span lang="EN-US">&nbsp; extensive Network Admission Control &nbsp;</span></span>capabilities such as Web authentication and 802.1x<br /> &nbsp; enhancements<br /> <br /></div> <div class="MsoNormal" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000076"></a><span style="font-family: 新細明體, serif; font-size: 9pt;">‧&nbsp;<b><span lang="EN-US">Additional QoS capabilities:</span></b><span lang="EN-US">&nbsp;The LAN Base IOS supports policing, class and policy maps,&nbsp;</span></span><br /> <span style="font-family: 新細明體, serif; font-size: 9pt;"><span lang="EN-US">&nbsp; differentiated services code point (DSCP), </span></span>AutoQoS, and configurable queue weights, buffers, &nbsp;<br /> &nbsp; and thresholds<br /> <br /> ‧<span lang="EN-US">&nbsp;Higher network-level availability with features such as <u>Flex Links</u> and <u>Link State Tracking</u></span><br /> <span lang="EN-US"><br /></span></div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000078"></a><span style="font-family: 新細明體, serif; font-size: 9pt;">‧<span lang="EN-US">&nbsp;Increased number of VLANs (256) and other enhancements such as IPv6 Host, MLD&nbsp;</span></span><br /> <span style="font-family: 新細明體, serif; font-size: 9pt;"><span lang="EN-US">&nbsp; Snooping, LLDP-MED, RSPAN, MVR, DHCP Option&nbsp;</span></span>82, and IP SLA (responder)</div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <br /></div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">Q3:&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">請問哪些是</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">2960 LAN Base&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">與</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">&nbsp;LAN Lite</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">相同功能</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">?<o:p></o:p></span></b></div> <div class="MsoNormal" style="margin: 0cm 0cm 0pt;"> <b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">A3:&nbsp;</span></b><b><span style="font-family: 新細明體, serif; font-size: 9pt;">相同點如下</span></b><b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;">:</span></b><span lang="EN-US" style="font-family: Arial, sans-serif; font-size: 9pt;"><o:p></o:p></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Scalable and secure network management: Secure Shell (SSH), Secure Sockets Layer (SSL), &nbsp;</span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US">&nbsp; Secure Copy Protocol (SCP), and SNMPv3 crypto<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000082"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Network management tool support by CiscoWorks, Cisco Network Assistant, and Catalyst &nbsp;</span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US">&nbsp; Device Manager<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000083"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Baseline Network Admission Control and 802.1x MAC Auth Bypass and Protected Port<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000084"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Voice VLAN and voice-aware port security, BPDU Guard, and Root Guard<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000085"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Standard QoS with Class of Service (CoS) marking, Shaped Round Robin, Weighted Tail Drop, &nbsp;&nbsp;</span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US">&nbsp; and Strict Priority scheduling<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000086"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Link aggregation using Port Aggregation Protocol (PAgP) and&nbsp;<st1:chmetcnv hasspace="False" negative="False" numbertype="1" sourcevalue="802.3" tcsc="0" unitname="a" w:st="on">802.3a</st1:chmetcnv>d LACP<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000087"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Complete Spanning Tree Protocol support via 802.1s, 802.1w, and PVST+<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000088"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;VLAN Trunking Protocol (VTP), Cisco Discovery Protocol v2, and LLDP<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000089"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Multicast support in hardware with IGMP Snooping, Filtering, and Querier<o:p></o:p></span></span><br /> <span style="font-family: 新細明體;"><span lang="EN-US"><br /></span></span></div> <div class="pbulletcmt" style="margin: 0cm 0cm 3pt;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp9000090"></a><span style="font-family: 新細明體;">‧<span lang="EN-US">&nbsp;Troubleshooting and monitoring tools such as TDR, SPAN, and UDLD</span></span></div> </span></div> </td></tr> </tbody></table> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-54166978342543725222013-01-04T01:08:00.002-08:002013-01-04T01:59:20.519-08:00Spanning Tree Link Type and lt's applications...分成兩種Type: P2p and Shared<br /> <br /> P2p link type指的是port為full duplex，通常在STP的過程中會比較快收斂；<br /> 而Shared指的是half duplex( 也可設定<span style="background-color: #e0e0e0; color: mediumblue; font-family: Arial, Helvetica, sans-serif; font-size: 14px; font-weight: bold; line-height: 21px;">spanning-tree link-type shared </span><span style="background-color: #e0e0e0; color: mediumblue; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 21px;">&nbsp;</span><span style="background-color: white; color: mediumblue; font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 21px;">&nbsp;)</span>，在STP過程中收斂較慢。<br /> <br /> Loop Guard使用原則:<br /> <br /> 1. Loop Guard用在跟其他鄰近Switch連接的port (non-edge port)上<br /> <br /> 2.不要在Portfast port上同時使用Loop Guard，反之亦然 (跟第一點的描述相同，就是接edge <br /> &nbsp; &nbsp;device的port上不要啟用loop guard)；而因為dynamic vlan port(通常就是edge port)上需要該<br /> &nbsp; &nbsp;port為portfast，所以也不建議在dynamic vlan port上設定loop guard。<br /> <br /> 3.不要在link type是shared的port上使用loop guard<br /> <br /> 4.不要在同一個port上同時使用loop guard和root guard<br /> <br /> 5.建議在access switch的root port和alternate root port(目前是blocked port)上設定loop guard<br /> <br /> Root guard是強行指定某個port為root port。<br /> <br /> <br /> RSTP (802.1w)的運行過程中不使用到任何timer做參數，而是使用link type和edge portJeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-21570156162322386622013-01-01T21:47:00.003-08:002013-01-16T01:15:10.333-08:00802.11N MIMO的spatial stream802.11N MIMO的spatial stream指的是802.11N所使用的天線中所形成的傳輸空間，這些空間分成transmit、receive、transmit and receive，每一台AP所能夠使用的傳輸空間不同，大致上可分為以下幾種:<br /> <br /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">1x1:1 - 1 transmitter, 1 receiver, can transmit or receive 1 spatial stream</span><br /> <br style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;" /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">1x2:1 - 1 transmitter, 2 receivers, can transmit 1 spatial stream, but receive 2 spatial streams</span><br /> <br style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;" /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">2x2:2 - 2 transmitters, 2 receivers, can transmit and receive 2 spatial streams</span><br /> <br style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;" /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">2x3:2 - 2 transmitters, 3 receivers, can transmit and receive 2 spatial streams</span><br /> <br style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;" /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">3x3:2 - 3 transmitters, 3 receivers, can transmit and receive 2 spatial streams</span><br /> <br style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;" /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">3x3:3 - 3 transmitters, 3 receivers, can transmit and receive 3 spatial streams</span><br /> <br style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;" /> <span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">4x4:4 - 4 transmitters, 4 receivers, can transmit and receive 4 spatial streams</span><br /> <br /> 不同的傳輸空間所能夠提供的傳輸速度大概有<span style="font-family: Arial, Helvetica, Verdana, sans-serif; font-size: 12px;">300 Mbps (2x2:2), 450 Mbps (3x3:3), and 600 Mbps (4x4:4).</span>Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-34504425764958908532013-01-01T19:24:00.001-08:002013-01-16T01:04:29.462-08:00使用Spanning Tree做Layer2 Load Sharing 的運用<div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibgDkXk1oBzSeWHs6pXf9Oq4tkze4l2EYBr4JNxikCE0D_5JHDtvhVlBkFi3fcIbopp4sKxa31U-2jelZZheSeQrqXy_Q7W-lk8Xr-DezX705fhEZNgrmyKXzP7BOdo-9wqQ19BqBHcacW/s1600/%E7%B0%A1%E5%A0%B11.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibgDkXk1oBzSeWHs6pXf9Oq4tkze4l2EYBr4JNxikCE0D_5JHDtvhVlBkFi3fcIbopp4sKxa31U-2jelZZheSeQrqXy_Q7W-lk8Xr-DezX705fhEZNgrmyKXzP7BOdo-9wqQ19BqBHcacW/s1600/%E7%B0%A1%E5%A0%B11.jpg" width="640" /></a></div> 使用Spanning Tree最常做的運用就是用來做不同VLAN在不同trunk link上的流量負載分流。<br /> 以本案為例，Switch0 Fa0/1&lt;--&gt;Switch1 Fa0/1間 與&nbsp;Switch0 Fa0/2&lt;--&gt;Switch1 Fa0/2間都是VLAN trunk，我們建立兩個VLAN(VLAN1、VLAN2)，原本的Spanning Tree結果，VLAN1和VLAN2的Blocking port會在Switch0的Fa0/2上，我們在Switch0上使用spanning-tree vlan 2 root primary讓vlan2的Root bridge為Switch0，也讓vlan2的blocking port在switch1的fa0/2上。<br /> <br /> 現在我們希望讓vlan 2的blocking port改成switch1的Fa0/1(當然，也可以讓vlan 2的blocking port也是在switch0上，但為了公平起見，我們希望switch1也有blocking port)，在switch上可以調整的設定有兩種:<br /> <br /> <b>1.調整port priority</b><br /> <b>2.調整port cost</b><br /> <br /> 以上兩種設定的值一定是調整upstream的switch，在本案例中要改變switch1上的spanning tree port的狀態就要調整switch0(switch0為switch1的upstream、switch1為switch0的upstream)。<br /> <br /> 設定的方式就是打開原本的blocking port(打開Switch1的Fa0/2)或是block原本相比較的<br /> port(關閉Switch1的Fa0/1)<br /> <br /> <b style="background-color: yellow;">A.調整port priority</b><br /> <br /> &nbsp; &nbsp; option1:調整switch0的Fa0/1，讓其port priority的值大於預設值128<br /> <br /> &nbsp; &nbsp; option2:調整switch1的Fa0/2，讓其port priority的值小於預設值128<br /> <br /> <br /> &nbsp; &nbsp; option1: Switch0(config)#interface fa 0/1<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Switch0(config-if)#spanning-tree vlan 2 port-priority 240<br /> <br /> &nbsp; &nbsp; <br /> &nbsp; &nbsp; option2:Switch1(config)#interface fa 0/2<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Switch1(config-if)#spanning-tree vlan 2 port-priority 0<br /> <br /> <br /> <br /> <b style="background-color: yellow;">B.調整port cost</b><br /> <br /> &nbsp; &nbsp;&nbsp;option1:調整switch0的Fa0/1，讓其port cost的值大於預設值19<br /> <br /> &nbsp; &nbsp; option2:調整switch1的Fa0/2，讓其port cost的值小於預設值19<br /> <br /> <br /> &nbsp; &nbsp;&nbsp;option1: Switch0(config)#interface fa 0/1<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Switch0(config-if)#spanning-tree vlan 2 cost 21<br /> <br /> &nbsp; &nbsp; <br /> &nbsp; &nbsp; option2:Switch1(config)#interface fa 0/2<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Switch1(config-if)#spanning-tree vlan 2 cost 18<br /> <div> <br /></div> <br /> <br /> &nbsp; Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com4tag:blogger.com,1999:blog-1909214529340166973.post-12555425628119056312012-12-27T01:18:00.000-08:002013-01-01T18:23:36.237-08:00OSPF LSA Type and Special AreaLSA Type 1 (Router LSA):　Area內每個Router用來宣告自己的LSA，無法跨Area<br /> <br /> LSA Type 2 (Network LSA):&nbsp;Area內每個Router用來宣告自己network的LSA，無法跨Area<br /> <br /> LSA Type 3 (Summary&nbsp;Network&nbsp;LSA): ABR用來宣告不同Area所擁有的network的LSA，這個<br /> 　　　　　　　　　　　　　　　　LSA通常是跨Area<br /> <br /> LSA Type 4 (Summary ASBR LSA): 鄰近ASBR的router用來宣告ASBR位置的LSA<br /> <br /> LSA Type 5 (External LSA): 用來傳遞從ASBR學到的network的LSA<br /> <br /> LSA Type 7 (NSSA LSA): NSSA中表示從ASBR中學到的network的LSA<br /> <br /> <br /> stub area會過濾Type 4 和Type 5，繼續過濾Type 3的area叫做totally stub area。<br /> totally stub area如果允許ASBR(這個ASBR應該改稱NSSA ASBR)學到的路由進來，這個area叫做Not-So-Stub Area(NSSA)，而這個LSA定義為Type 7 LSA，Type 7 LSA再由ABR(嚴格的說，應該稱NSSA ABR)轉換成Type 5 LSA傳到其他Area。<br /> <br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZFs8R1F6J-lOaGs6ZAxqmjPbzSwkR-jjP_eg0zs_F8Q_Oy9sAVZ2mc6RBMl3r_14yqMTtfA5rbTvO09m07LxugLYhcyVbHwzhAAUtQaMp5URZ1c9myJ8JValWkJjvMhAa_bulSpAIcBpZ/s1600/%E7%B0%A1%E5%A0%B11.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZFs8R1F6J-lOaGs6ZAxqmjPbzSwkR-jjP_eg0zs_F8Q_Oy9sAVZ2mc6RBMl3r_14yqMTtfA5rbTvO09m07LxugLYhcyVbHwzhAAUtQaMp5URZ1c9myJ8JValWkJjvMhAa_bulSpAIcBpZ/s1600/%E7%B0%A1%E5%A0%B11.jpg" height="300" width="400" /></a></div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTAgmP941iBaNFyQeZpQIwJ89UlxaHyg_mc_poec3alXAPoVqQyUE1dljEzYRgQabpCGiPyPgZ8-kWfBfMckcdpnZPi4C4xxFfQyqieJrQtgg1l3FiFIJdtl7OPZQjjDbkT9yzrxpgdgR4/s1600/%E7%B0%A1%E5%A0%B12.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTAgmP941iBaNFyQeZpQIwJ89UlxaHyg_mc_poec3alXAPoVqQyUE1dljEzYRgQabpCGiPyPgZ8-kWfBfMckcdpnZPi4C4xxFfQyqieJrQtgg1l3FiFIJdtl7OPZQjjDbkT9yzrxpgdgR4/s1600/%E7%B0%A1%E5%A0%B12.jpg" height="300" width="400" /></a></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <br /> <br /> 回到上述的totally stub area，看來這個area內的router都不收其他area來了路由，那這些router的流量怎麼出去？唯一的方式就是靠ABR注入一筆default router。Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-79568566117144621932012-12-26T23:40:00.000-08:002013-01-01T18:23:11.923-08:00OSPF vs RIPv2 Redistribution心得<div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzZzruSSUdV5ZGSHdzdYDNCxiyrihEjkiLS5L5wrs8aDr3HVUvdFNoiwBjUiUm-zgqAEzmXjsrBrAQKNg9UiqLpwdHgiL9xG4XwISgEfAqT4l9rk5seRra0vG51gyWve8AxNovyLu72WzK/s1600/%E7%B0%A1%E5%A0%B11.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzZzruSSUdV5ZGSHdzdYDNCxiyrihEjkiLS5L5wrs8aDr3HVUvdFNoiwBjUiUm-zgqAEzmXjsrBrAQKNg9UiqLpwdHgiL9xG4XwISgEfAqT4l9rk5seRra0vG51gyWve8AxNovyLu72WzK/s1600/%E7%B0%A1%E5%A0%B11.jpg" height="480" width="640" /></a></div> <br /> 我們的目的是希望所有Router都收到除了其他Router Fa interface上的Routing，但Router0和Router1所有的網段是在同一個major net(172.16.0.0/16)，所以每個Router收到的routing必須是<br /> subnet過後的。<br /> <br /> <br /> <b><span style="background-color: yellow; color: blue;">Router0:</span></b><br /> <br /> <span style="color: #6aa84f;">configuration:</span><br /> <span style="color: #6aa84f;"><br /></span> <br /> interface FastEthernet0/0<br /> &nbsp;ip address 172.16.1.254 255.255.255.0<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> !<br /> interface FastEthernet0/1<br /> &nbsp;ip address 172.16.2.254 255.255.255.0<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> !<br /> interface Serial0/1/0<br /> &nbsp;ip address 10.1.1.1 255.255.255.252<br /> &nbsp;clock rate 19200<br /> !<br /> interface Serial0/1/1<br /> &nbsp;no ip address<br /> &nbsp;clock rate 2000000<br /> &nbsp;shutdown<br /> !<br /> interface Vlan1<br /> &nbsp;no ip address<br /> &nbsp;shutdown<br /> !<br /> <b>router rip</b><br /> <b>&nbsp;version 2</b><br /> <b>&nbsp;network 10.0.0.0</b><br /> <b>&nbsp;network 172.16.0.0</b><br /> <b>&nbsp;no auto-summary</b><br /> !<br /> ip classless<br /> <br /> <br /> <span style="color: blue;">RIP需要設定v2，否則其他Router收到的會是summary過後的routing(Classful only)</span><br /> <br /> =======================================================================<br /> <br /> <b><span style="background-color: yellow; color: blue;">Router1:</span></b><br /> <b><span style="color: blue;"><br /></span></b> <span style="color: #38761d;">configuration:</span><br /> <b><span style="color: blue;"><br /></span></b> <br /> interface FastEthernet0/0<br /> &nbsp;ip address 192.168.1.254 255.255.255.0<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> !<br /> interface FastEthernet0/1<br /> &nbsp;ip address 192.168.2.254 255.255.255.0<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> !<br /> interface Ethernet0/0/0<br /> &nbsp;no ip address<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> &nbsp;shutdown<br /> !<br /> interface Serial0/1/0<br /> &nbsp;ip address 10.1.1.2 255.255.255.252<br /> !<br /> interface Serial0/1/1<br /> &nbsp;ip address 10.2.2.1 255.255.255.252<br /> !<br /> interface Vlan1<br /> &nbsp;no ip address<br /> &nbsp;shutdown<br /> !<br /> <b>router ospf 1</b><br /> <b>&nbsp;log-adjacency-changes</b><br /> <b>&nbsp;redistribute rip subnets</b><br /> <b>&nbsp;network 10.2.2.0 0.0.0.3 area 0</b><br /> <b>&nbsp;network 192.168.2.0 0.0.0.255 area 0</b><br /> !<br /> <b>router rip</b><br /> <b>&nbsp;version 2</b><br /> <b>&nbsp;redistribute ospf 1 metric 2</b><br /> <b>&nbsp;network 10.0.0.0</b><br /> <b>&nbsp;network 192.168.1.0</b><br /> <b><span style="color: blue;">&nbsp;</span>no auto-summary</b><br /> <span style="color: blue;">!</span><br /> <span style="color: blue;">ip classless</span><br /> <span style="color: blue;">!</span><br /> <span style="color: blue;"><br /></span> <span style="color: blue;">1.Router0無法收到Router2的subnet routing，必須在RIP的redistribution設定中設定metric值，</span><br /> <span style="color: blue;">&nbsp; &nbsp;這個值範圍可為0~16，但必須設定1~15(我設定2)，否則無法學習完整的路由(設定15，無&nbsp;</span><br /> <span style="color: blue;">&nbsp; &nbsp;法學到192.168.2.0/24)。</span><br /> <span style="color: blue;"><br /></span> <span style="color: blue;">2.RIPv2需要設定no auto-summary，否則Router0收到的不是172.16.3.0/24、172.16.4.0/24，而</span><br /> <span style="color: blue;">&nbsp; 是summary過後的172.16.0.0/16。</span><br /> <span style="color: blue;"><br /></span> <span style="color: blue;">&nbsp; no auto-summary指的是設定的那一台Router送出去的的是沒有summary過後的Routing。</span><br /> <span style="color: blue;"><br /></span> <span style="color: blue;">&nbsp; 所以如果Router1不下這個指令， &nbsp;Router0收到的不是172.16.3.0/24、172.16.4.0/24，而</span><br /> <span style="color: blue;">&nbsp; 是summary過後的172.16.0.0/16。</span><br /> <span style="color: blue;"><br /></span> <span style="color: blue;">&nbsp; 同樣的，如果Router0不下這個指令， &nbsp;Router1收到的不是172.16.1.0/24、172.16.2.0/24，而</span><br /> <span style="color: blue;">&nbsp; 是summary過後的172.16.0.0/16。</span><br /> <span style="color: blue;"><br /></span> <span style="color: blue;">3.RIPv2 redistribute到OSPF需要設定subnet，否則Router2收到的不是172.16.1.0/24、&nbsp;</span><br /> <span style="color: blue;">&nbsp; &nbsp;172.16.2.0/24，而&nbsp; 是summary過後的172.16.0.0/16。</span><br /> <br /> =======================================================================<br /> <b><span style="background-color: yellow; color: blue;">Router2:</span></b><br /> <br /> <span style="color: #38761d;">configuration:</span><br /> <br /> <br /> interface FastEthernet0/0<br /> &nbsp;ip address 172.16.3.254 255.255.255.0<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> !<br /> interface FastEthernet0/1<br /> &nbsp;ip address 172.16.4.254 255.255.255.0<br /> &nbsp;duplex auto<br /> &nbsp;speed auto<br /> !<br /> interface Serial0/1/0<br /> &nbsp;no ip address<br /> &nbsp;clock rate 2000000<br /> !<br /> interface Serial0/1/1<br /> &nbsp;ip address 10.2.2.2 255.255.255.252<br /> &nbsp;clock rate 19200<br /> !<br /> interface Vlan1<br /> &nbsp;no ip address<br /> &nbsp;shutdown<br /> !<br /> <b>router ospf 1</b><br /> <b>&nbsp;log-adjacency-changes</b><br /> <b>&nbsp;network 10.2.2.0 0.0.0.3 area 0</b><br /> <b>&nbsp;network 172.16.3.0 0.0.0.255 area 0</b><br /> <b>&nbsp;network 172.16.4.0 0.0.0.255 area 0</b><br /> !<br /> ip classless<br /> <br /> <span style="background-color: #3d85c6;">=======================================================================</span><br /> <span style="background-color: #3d85c6;"><br /></span> <br /> <b><span style="background-color: yellow; color: blue;">Router0:</span></b><br /> <br /> <span style="color: #6aa84f;">show ip route :</span><br /> <span style="color: #6aa84f;"><br /></span> <br /> <br /> &nbsp; &nbsp; &nbsp;10.0.0.0/30 is subnetted, 2 subnets<br /> C &nbsp; &nbsp; &nbsp; 10.1.1.0 is directly connected, Serial0/1/0<br /> R &nbsp; &nbsp; &nbsp; 10.2.2.0 [120/1] via 10.1.1.2, 00:00:06, Serial0/1/0<br /> &nbsp; &nbsp; &nbsp;172.16.0.0/24 is subnetted, 4 subnets<br /> C &nbsp; &nbsp; &nbsp; 172.16.1.0 is directly connected, FastEthernet0/0<br /> C &nbsp; &nbsp; &nbsp; 172.16.2.0 is directly connected, FastEthernet0/1<br /> R &nbsp; &nbsp; &nbsp; 172.16.3.0 [120/2] via 10.1.1.2, 00:00:06, Serial0/1/0<br /> R &nbsp; &nbsp; &nbsp; 172.16.4.0 [120/2] via 10.1.1.2, 00:00:06, Serial0/1/0<br /> R &nbsp; &nbsp;192.168.1.0/24 [120/1] via 10.1.1.2, 00:00:06, Serial0/1/0<br /> R &nbsp; &nbsp;192.168.2.0/24 [120/2] via 10.1.1.2, 00:00:06, Serial0/1/0<br /> <br /> <br /> <br /> <br /> =======================================================================<br /> <br /> <b><span style="background-color: yellow; color: blue;">Router1:</span></b><br /> <b><span style="color: blue;"><br /></span></b><span style="color: #38761d;">show ip route :</span><br /> <div> <span style="color: #38761d;"><br /></span></div> <div> <div> Router#sh ip route</div> <div> Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP</div> <div> &nbsp; &nbsp; &nbsp; &nbsp;D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area</div> <div> &nbsp; &nbsp; &nbsp; &nbsp;N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2</div> <div> &nbsp; &nbsp; &nbsp; &nbsp;E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP</div> <div> &nbsp; &nbsp; &nbsp; &nbsp;i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area</div> <div> &nbsp; &nbsp; &nbsp; &nbsp;* - candidate default, U - per-user static route, o - ODR</div> <div> &nbsp; &nbsp; &nbsp; &nbsp;P - periodic downloaded static route</div> <div> <br /></div> <div> Gateway of last resort is not set</div> <div> <br /></div> <div> &nbsp; &nbsp; &nbsp;10.0.0.0/30 is subnetted, 2 subnets</div> <div> C &nbsp; &nbsp; &nbsp; 10.1.1.0 is directly connected, Serial0/1/0</div> <div> C &nbsp; &nbsp; &nbsp; 10.2.2.0 is directly connected, Serial0/1/1</div> <div> &nbsp; &nbsp; &nbsp;172.16.0.0/24 is subnetted, 4 subnets</div> <div> R &nbsp; &nbsp; &nbsp; 172.16.1.0 [120/1] via 10.1.1.1, 00:00:13, Serial0/1/0</div> <div> R &nbsp; &nbsp; &nbsp; 172.16.2.0 [120/1] via 10.1.1.1, 00:00:13, Serial0/1/0</div> <div> O &nbsp; &nbsp; &nbsp; 172.16.3.0 [110/65] via 10.2.2.2, 00:16:44, Serial0/1/1</div> <div> O &nbsp; &nbsp; &nbsp; 172.16.4.0 [110/65] via 10.2.2.2, 00:16:44, Serial0/1/1</div> <div> C &nbsp; &nbsp;192.168.1.0/24 is directly connected, FastEthernet0/0</div> <div> C &nbsp; &nbsp;192.168.2.0/24 is directly connected, FastEthernet0/1</div> </div> <div> <br /></div> <div> =======================================================================<br /> <br /> <b><span style="background-color: yellow; color: blue;">Router2:</span></b><br /> <b><span style="color: blue;"><br /></span></b>show ip route :<br /> <br /> <br /> Router#sh ip route<br /> Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP<br /> &nbsp; &nbsp; &nbsp; &nbsp;D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area<br /> &nbsp; &nbsp; &nbsp; &nbsp;N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2<br /> &nbsp; &nbsp; &nbsp; &nbsp;E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP<br /> &nbsp; &nbsp; &nbsp; &nbsp;i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area<br /> &nbsp; &nbsp; &nbsp; &nbsp;* - candidate default, U - per-user static route, o - ODR<br /> &nbsp; &nbsp; &nbsp; &nbsp;P - periodic downloaded static route<br /> <br /> Gateway of last resort is not set<br /> <br /> &nbsp; &nbsp; &nbsp;10.0.0.0/30 is subnetted, 2 subnets<br /> O E2 &nbsp; &nbsp;10.1.1.0 [110/20] via 10.2.2.1, 00:22:10, Serial0/1/1<br /> C &nbsp; &nbsp; &nbsp; 10.2.2.0 is directly connected, Serial0/1/1<br /> &nbsp; &nbsp; &nbsp;172.16.0.0/24 is subnetted, 4 subnets<br /> O E2 &nbsp; &nbsp;172.16.1.0 [110/20] via 10.2.2.1, 00:22:10, Serial0/1/1<br /> O E2 &nbsp; &nbsp;172.16.2.0 [110/20] via 10.2.2.1, 00:22:10, Serial0/1/1<br /> C &nbsp; &nbsp; &nbsp; 172.16.3.0 is directly connected, FastEthernet0/0<br /> C &nbsp; &nbsp; &nbsp; 172.16.4.0 is directly connected, FastEthernet0/1<br /> O E2 192.168.1.0/24 [110/20] via 10.2.2.1, 00:22:10, Serial0/1/1<br /> O &nbsp; &nbsp;192.168.2.0/24 [110/65] via 10.2.2.1, 00:22:10, Serial0/1/1<br /> <br /> <span style="color: blue;">從任何其他Routing protocol redistribute到OSPF的default metric為20</span><br /> <span style="color: blue;">而各Routing protocol的redistribution default metric如下:</span><br /> <table cellpadding="4" cellspacing="0" style="background-color: white; color: black; font-family: sans-serif; font-size: 13px; margin: 0px 0px 12px; padding: 0px; text-align: start;"><tbody style="margin: 0px; padding: 0px;"> <tr style="margin: 0px; padding: 0px;"></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">Source</td><td colspan="5" style="margin: 0px; padding: 8px; vertical-align: top;">Into</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;"></td><td style="margin: 0px; padding: 8px; vertical-align: top;">RIP</td><td style="margin: 0px; padding: 8px; vertical-align: top;">EIGRP</td><td style="margin: 0px; padding: 8px; vertical-align: top;">OSPF</td><td style="margin: 0px; padding: 8px; vertical-align: top;">ISIS</td><td style="margin: 0px; padding: 8px; vertical-align: top;">BGP (MED)</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">Connected</td><td style="margin: 0px; padding: 8px; vertical-align: top;">1</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Int metric</td><td style="margin: 0px; padding: 8px; vertical-align: top;">20 (E2)</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">Static</td><td style="margin: 0px; padding: 8px; vertical-align: top;">1</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Int metric</td><td style="margin: 0px; padding: 8px; vertical-align: top;">20 (E2)</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">RIP</td><td style="margin: 0px; padding: 8px; vertical-align: top;"></td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;">20 (E2)</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td><td style="margin: 0px; padding: 8px; vertical-align: top;">IGP metric</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">EIGRP</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;"></td><td style="margin: 0px; padding: 8px; vertical-align: top;">20 (E2)</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td><td style="margin: 0px; padding: 8px; vertical-align: top;">IGP metric</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">OSPF</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;"></td><td style="margin: 0px; padding: 8px; vertical-align: top;">0</td><td style="margin: 0px; padding: 8px; vertical-align: top;">IGP metric</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">ISIS</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;">20 (E2)</td><td style="margin: 0px; padding: 8px; vertical-align: top;"></td><td style="margin: 0px; padding: 8px; vertical-align: top;">IGP metric</td></tr> <tr style="margin: 0px; padding: 0px;"><td style="margin: 0px; padding: 8px; vertical-align: top;">BGP</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;">Infinite</td><td style="margin: 0px; padding: 8px; vertical-align: top;">1 (E2)</td><td style="margin: 0px; padding: 8px; vertical-align: top;">0<br /></td></tr> </tbody></table> <br /> <span style="color: blue;"><br /></span> <span style="color: blue;"><br /></span> <br /> </div> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-45181383223498686582012-12-23T20:48:00.003-08:002013-07-14T16:53:44.731-07:00Spanning Tree的過程!<div class="separator" style="clear: both; text-align: center;"> </div> <div class="separator" style="clear: both; text-align: center;"> </div> <div class="separator" style="clear: both; text-align: center;"> </div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjl86c6-OrFn-N4GgTlg4cHMsp_zehjF-Z_TULIFEMB4iMYI6ChXfD8OoeK8ew11kHl5czFWkixDk5GPpNSYGzz98n0sIhr77b9JycqVOieuXxb4C_a9rpOMB0sDy8CPsNQV8hg6eH45acA/s1600/%E7%B0%A1%E5%A0%B11.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjl86c6-OrFn-N4GgTlg4cHMsp_zehjF-Z_TULIFEMB4iMYI6ChXfD8OoeK8ew11kHl5czFWkixDk5GPpNSYGzz98n0sIhr77b9JycqVOieuXxb4C_a9rpOMB0sDy8CPsNQV8hg6eH45acA/s1600/%E7%B0%A1%E5%A0%B11.jpg" width="640" /></a></div> <br /> <br /> Spanning Tree的過程包含以下重要步驟:<br /> <br /> 1.選擇Root Bridge：<br /> &nbsp; &nbsp;Root Bridge的選擇是以各Bridge(Switch)的ID大小來做選擇，ID值越小，優先權越高。<br /> &nbsp; &nbsp;這個ID值包含Priority + VLAN ID，Priority預設值為32768，要調整這個值需要以4096為單 <br /> &nbsp; &nbsp;位做增減。<br /> 　一般來說這一個ID值都會是一樣的，所以一開始，每一台Switch會以各自的<br /> &nbsp; &nbsp;System MAC address來做比較，這一個MAC address也可以從show version中的Base ethernet 　MAC Address的知，MAC address的大小最好以二進位來做比較，值越小優先權越高。<br /> 　如上圖，由於每一台的ID值都是32768+1=32769 (1為VLAN ID)，所以比較每一台Switch<br /> &nbsp; &nbsp;System MAC address結果：00E0&gt;0030&gt;000D&gt;0004，優先權0004&gt;000D&gt;0030&gt;00E0，<br /> 　也就是Switch1&gt;Switch0&gt;Switch2&gt;Switch4，所以Switch1為Root Bridge。<br /> 　<br /> 　總的來說，這一個比較值的組合為4個bit的單位值(A)＋12個bit的4096(B)+MAC address(C)<br /> &nbsp; &nbsp; ，預設值A=8，B永遠都是4096，C則因機器而異。<br /> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZ7CNV28hUpOCJ2oKX2rwmc5YDRrYMsHC2cvnXZbm-FtQRB3B9CCYo5DqlaWlvFJFqcThL197_qCs5U9TZbE1otklAGorf0gXi0Ems0Mdo-i7OVXhj3QF4gMYM1OZ48tE1XZw5spwaXyO-/s1600/stp.bmp" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZ7CNV28hUpOCJ2oKX2rwmc5YDRrYMsHC2cvnXZbm-FtQRB3B9CCYo5DqlaWlvFJFqcThL197_qCs5U9TZbE1otklAGorf0gXi0Ems0Mdo-i7OVXhj3QF4gMYM1OZ48tE1XZw5spwaXyO-/s1600/stp.bmp" width="640" /></a></div> <br /> <br /> 2.選擇Root Port(簡稱RP)：<br /> 　Root Port為每一個Switch通往Root Bridge的最短路徑的那一個Port，<u style="background-color: yellow;">每一個Switch必須選 &nbsp;</u><br /> <u style="background-color: yellow;">&nbsp; &nbsp;出唯一一個Root Port</u>，最端路徑的計算方式為每一個通往Root Bridge的Cost加總，每一種<br /> 　網路介面的速度有其預設上被定義好的cost，10G cost=1，1G cost=10，100M cost=19，　<br /> 　10M cost=100。在抉擇的過程中會遇到以下情況：<br /> 　a.同一個Switch通往Root Bridge的cost相同，這時候以相鄰的Bridge中ID值最小的為優先，<br /> 　　如上圖，Switch4有四個Port(Fa0/5、Fa0/6、Fa0/7、Fa0/8)通往Root Bridge Switch1的cost<br /> 　　都相同，因Fa0/7、Fa0/8通往Root Bridge的路徑中相鄰的Switch1其Bridge ID比Fa0/5、<br /> &nbsp; &nbsp; &nbsp; &nbsp;Fa0/6通往Root Bridge路徑中相鄰的Switch2其Bridge ID較低，所以會從Fa0/7、Fa0/8兩者<br /> 　　選擇其中一個Port當作Root Port。<br /> <br /> 　b.同一台Switch通往Root Bridge的Root Port有兩個以上可以選擇，則選擇Port ID較低的<br /> &nbsp; &nbsp; &nbsp; 當作Root Port，如a.的結果，因為Fa0/7的Port ID較Fa0/7的Port ID低，所以選擇<span style="color: #3d85c6;">Fa0/7</span>當<br /> &nbsp; &nbsp; &nbsp; 作Root Port。依此類推，整體架構中的Root Port還有Switch0的<span style="color: #3d85c6;">Fa0/1</span>、Switch2的<span style="color: #3d85c6;">Fa0/3</span>。<br /> 　　而與其做比較的Port就是non-Designated Port，也就是blocked Port。所以Switch3的<br /> &nbsp; &nbsp; &nbsp; Fa0/8、Switch0的Fa0/2、Switch2的Fa0/4都是blocked port。<br /> <br /> 3.選擇Designated Port(簡稱DP):<br /> &nbsp; &nbsp; Designated Port是除了Root Port以外通往Root Bridge的最短路徑的Port，其選擇方式與<br /> 　Root Port相同，Root Bridge本身所有的Port都是Designated Port，而與Root Port相鄰的Port<br /> &nbsp; &nbsp; 也一定是Designated Port。<br /> 　 如果同一個Segment中無法依照上述原則決定DP時，則以Bridge ID較小的Switch上的Port<br /> 　為DP，而相對應的就是non-DP。如本架構，Switch2的F0/5、Fa0/6與Switch3的Fa0/5、<br /> 　Fa0/6做比較，因Switch2的Bridge ID較小，所以選擇Switch2的Fa0/5、Fa0/6當作DP(同一台<br /> 　Switch可以有好幾個DP，所以不需要做Port ID比較）。所以Switch3的Fa0/5、Fa0/6會是<br /> &nbsp; &nbsp; non-DP<br /> <br /> <br /> 其他：<br /> 如上圖，如果要更改Switch0的blocked port為Fa0/1，則需要更改對口的Port Priority，即<br /> Switch1的Fa0/1的Port Priority大於預設值128。<br /> <br /> <br /> &nbsp; 綜合來說，STP的運算過程需要依賴<b>所有參與的交換器所提供的資訊</b>來做運算的依據，<br /> &nbsp; 這些資訊包含Bridge ID、通往Root Bridge的cost、Port Priority等。如果所有參與的交換器<br /> &nbsp; 所提供的資訊不足以作判斷時，就自己做判斷，比如說以Port ID來做判斷。<br /> <br /> 　Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-27012208566145611632012-10-30T23:36:00.001-07:002012-11-04T22:13:01.822-08:00RedHat 6.3上的yum這幾天幫客戶裝了RedHat 6.3 Enterprise版本，安裝完成後客戶又要求安裝其他套件，<br /> 下載了rpm檔之後，安裝上出了問題，於是下載source檔(.tar.gz)，又是因為相依性的問題無法安裝，於是只好改用yum，但問題來了，yum需要向原廠註冊一個帳號才能用，還好客戶是買正式版，也已經註冊了，所以採取以下幾個步驟做註冊:<br /> <br /> <pre><code>rm -rf /etc/sysconfig/rhn_systemid rm -rf /var/cache/yum/* yum clean all</code></pre> <pre><code>subscription-manager register &nbsp; &nbsp; ==&gt;這個步驟會要求輸入註冊的帳號與密碼 subscription-manager subscribe --auto</code><code> &nbsp; ==&gt;這個步驟之後會再做一次確認的動作</code></pre> <pre><code> </code></pre> <pre><code>最後就是做yum update和yum install xxx</code></pre> <pre><code> </code></pre> <pre><code> </code></pre> <pre><code>大功告成~~~</code></pre> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com1tag:blogger.com,1999:blog-1909214529340166973.post-69225322353249749052012-08-31T02:03:00.001-07:002012-10-10T08:27:33.274-07:00Cisco Nexus 7000 support I/O modules (so far on Aug 2012)<span style="font-size: small;"><br /></span> <br /> <div class="pBu1_Bullet1" style="background-color: white; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -0.25in;"><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -0.25in;">&nbsp;截至2012/8/31為止，Cisco Nexus 7000支援以下I/o module"</span></div> <div class="pBu1_Bullet1" style="background-color: white; color: lime; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -0.25in;">•</span><span style="font-size: small;"><img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none; text-indent: -0.25in;" width="19" /></span><span style="font-size: small; text-indent: -0.25in;">F1-Series 32-port 1- and 10-Gigabit Ethernet I/O modules (N7K-F132XP-15)</span></div> <div style="color: lime;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139581" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br style="color: blue;" /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: blue; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />F2-Series 48-port 1-/10-Gigabit Ethernet I/O modules with XL (N7K-F248XP-25)</span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139582" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span> <br /> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 48-port 10/100/1000 I/O modules (N7K-M148GT-11)</span></div> <div style="color: #c27ba0;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139583" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 48-port 10/100/1000 I/O modules with XL option (N7K-M148GT-11L)</span></div> <div style="color: #c27ba0;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139584" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 48-port 1-Gigabit Ethernet I/O modules (N7K-M148GS-11)</span></div> <div style="color: #c27ba0;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139585" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 48-port 1-Gigabit Ethernet I/O modules with XL option (N7K-M148GS-11L)</span></div> <div style="color: #c27ba0;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139586" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 32-port&nbsp;10-Gigabit Ethernet I/O modules (N7K-M132XP-12)</span></div> <div style="color: #c27ba0;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139587" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 32-port&nbsp;10-Gigabit Ethernet I/O modules with XL option (N7K-M132XP-12L)</span></div> <div style="color: #c27ba0;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139588" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #c27ba0; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M1-Series 8-port 10-Gigabit Ethernet I/O modules with XL option(N7K-M108X2-12L)</span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139589" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br style="color: #f1c232;" /></span> <br /> <div class="pBu1_Bullet1" style="background-color: white; color: #f1c232; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M2-Series 24-port 10-Gigabit Ethernet I/O modules with XL option (N7K-M224XP-23L)</span></div> <div style="color: #f1c232;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139590" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; color: #f1c232; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M2-Series 6-port <u><b>40-Gigabit</b> </u>Ethernet I/O modules with XL option (N7K-M206XP-23L)</span></div> <div style="color: #f1c232;"> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1139591" style="background-color: white; font-family: Arial,Helvetica,sans-serif;"></a><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <div style="color: #f1c232;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />M2-Series 2-port <b><u>100-Gigabit</u></b> Ethernet I/O modules with XL option (N7K-M202XP-23L)</span></div> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;">而針對這些module，在設定VDC時需要注意port group，有些模組同一個port group必需配置到同一個VDC中。Port group的分配狀況如下:</span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; N7K-M202CF-22L (1 interface x 2 port groups = 2 interfaces 100G modules)—There are no restrictions on the interface allocation between VDCs.&nbsp;</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1096551"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M206FQ-23L (1 interface x 6 port groups = 6 interfaces 40G modules)—There are no restrictions on the interface allocation between VDCs.&nbsp;</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1096552"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M224XP-23L (1 interface x 24 port groups = 24 interfaces 10G modules)—There are no restrictions on the interface allocation between VDCs.&nbsp;</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1096548"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M108X2-12L (1 interface x 8 port groups = 8 interfaces)—There are no restrictions on the interface allocation between VDCs.&nbsp;</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1090272"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M148GS-11L, N7K-M148GT-11, and N7K-M148GS-11 (12 interfaces x 4 port groups = 48 interfaces)—There are no restrictions on the interface allocation between VDCs, but we recommend that interfaces that belong to the same port group be in a single VDC.&nbsp;</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1086789"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M132XP-12 (4 interfaces x 8 port groups = 32 interfaces)—Interfaces belonging to the same port group must belong to the same VDC.</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1100160"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M148GT-11L (same as non-L M148) (1 interface x 48 port groups = 48 interfaces)—There are no restrictions on the interface allocation between VDCs.&nbsp;</span></div> <div class="pBu1_Bullet1"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1100161"></a></span><br /> <div class="pBu1_Bullet1"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/i/templates/blank.gif" width="19" />N7K-M132XP-12L (same as non-L M132) (1 interface x 8 port groups = 8 interfaces)—All M132 cards require allocation in groups of 4 ports and you can configure 8 port groups. </span></div> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <br /> <div class="separator" style="clear: both; text-align: center;"> <span style="font-size: small;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPPk9qhXaqFGCLPtq6NTvBblP_k3bLPkM88T601Ya_Os4V8yaEZNkZ4FP2kyZ3uOviW5oazYcnz6OZ7d9k9COk-O4EqDhTJF8CVKAO3Q2FPqOQvjt4xYWp2tcUHTbfpyS9-sspoyvVBNp3/s1600/M-series+module+compare.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPPk9qhXaqFGCLPtq6NTvBblP_k3bLPkM88T601Ya_Os4V8yaEZNkZ4FP2kyZ3uOviW5oazYcnz6OZ7d9k9COk-O4EqDhTJF8CVKAO3Q2FPqOQvjt4xYWp2tcUHTbfpyS9-sspoyvVBNp3/s640/M-series+module+compare.jpg" width="640" /></a></span></div> <div class="separator" style="clear: both; text-align: center;"> <span style="font-size: small;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEPMoHrqz12Ir1Wwhu24w9ZgsFMZLkO1e_QmzvxZeRbmVgSFqkMaiIde4fng-hmFfCohfYjbxwYQG3K72tjIo9VgFtnBQNZktDLGuZXqbZUsQQps75zwzfe3N19t6DZQAE-CLpgJgEZdA8/s1600/F+series+module+compare.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEPMoHrqz12Ir1Wwhu24w9ZgsFMZLkO1e_QmzvxZeRbmVgSFqkMaiIde4fng-hmFfCohfYjbxwYQG3K72tjIo9VgFtnBQNZktDLGuZXqbZUsQQps75zwzfe3N19t6DZQAE-CLpgJgEZdA8/s640/F+series+module+compare.jpg" width="640" /></a></span></div> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <span style="font-size: small;"><br /></span> <b><span style="font-size: small;">M系列和F系列的module都可以安裝XL</span></b></div> <div class="pBu1_Bullet1" style="background-color: white; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;"><br /></span></div> <div class="pBu1_Bullet1" style="background-color: white; font-family: Arial,Helvetica,sans-serif; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">And the Fabric supporting matrix is as follows:</span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />Cisco Nexus 7009 chassis uses the Fabric 2 (N7K-C7009-FAB-2) modules.</span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1126523" style="text-indent: 0px;"></a><br /></span> <br /> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />Cisco Nexus 7010 chassis uses the Fabric 1 (N7K-C7010-FAB-1) or Fabric 2 (N7K-C7010-FAB-2) modules.</span></div> <span style="font-size: small;"><a href="http://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1132279" style="text-indent: 0px;"></a><br /></span> <br /> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">•<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none;" width="19" />Cisco Nexus 7018 chassis uses the Fabric 1 (N7K-C7018-FAB-1) or Fabric 2 (N7K-C7018-FAB-2) modules.</span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;">&nbsp; &nbsp; &nbsp;&nbsp;<img alt="" border="0" height="2" src="http://www.cisco.com/en/US/partner/i/templates/blank.gif" style="border: 0px none; text-indent: -28.8px;" width="1" /></span><span style="font-size: small; text-indent: -28.8px;">You can replace a Fabric 1 module with a Fabric 2 module in the Cisco Nexus 7010 and 7018 switches during operations, but while there is a mix of fabric module types, all of the fabric modules perform as Fabric 1 modules.</span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -28.8px;">&nbsp; &nbsp; &nbsp; Nexus7010及7018可以開機狀況下將FAB2換成FAB1，但必須是全換，如果是混插的狀況下，只有FAB1會發揮作用</span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -28.8px;"><br /></span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -28.8px;">&nbsp; &nbsp; &nbsp; &nbsp;If you power up a switch with two types of fabric modules installed, only the Fabric 1 modules will power up. To utilize the Fabric 2 module capabilities, all of the installed fabric modules must be Fabric 2 modules.</span> </div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small; text-indent: -28.8px;">&nbsp; &nbsp; &nbsp; 在FAB1及FAB2混插的情況下，只有FAB1會啟動，只有在全部都是FAB2時，FAB2才會全部啟動</span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;"><br /></span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;"><br /></span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;"><br /></span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;"><br /></span></div> <div class="pBu1_Bullet1" style="margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="font-size: small;"><br /></span></div> <span style="font-size: small;"><br /></span>Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-80091963908430643662012-08-28T00:53:00.000-07:002012-09-03T01:49:43.060-07:00Switch上的基本防護功能-Port SecurityCisco Switch上的Port Security功能不是甚麼稀奇的功能，但很少人知道他的用法與細項設定，在此就來談談他的運用。<br /> 首先來談談他的運用，包含:<br /> <br /> 1.防止非單位的終端設備在未授權的情況下任意接入單位網路中。<br /> <br /> 2.防止單位授權的終端設備但卻接入非該終端設備被授權可以接入的區域(交換器)中<br /> <br /> 3.非授權的電腦任意建立Virtual Machine (一台VM就會有一組mac address)<br /> <br /> 一般在設定port security的方式會有以下幾種方式:<br /> <br /> 方式一:<br /> (config)#interface gigabitethernet 9/10<br /> (config-if)#switchport port-security<br /> (config-if)#switchport port-security maximum 1<br /> (config-if)#switchport port-security 0bdc.1f69.f598<br /> (config-if)#switchport violation shutdown<br /> <br /> 方式二:<br /> <br /> (config)#interface gigabitethernet 9/10<br /> (config-if)#switchport port-security<br /> (config-if)#switchport port-security maximum 1<br /> (config-if)#switchport port-security sticky<br /> (config-if)#switchport violation shutdown<br /> <br /> 其中，<br /> &nbsp; &nbsp;&gt; &nbsp;switchport port-security這個指令就是啟用介面上的port security功能<br /> <br /> &nbsp; &nbsp;&gt; &nbsp;switchport port-security maximum 1這個指令在指定這一個interface上最多可以有幾個<br /> &nbsp; &nbsp; &nbsp; &nbsp;mac-address上來，如果大於這一個值就是violation了。<br /> <br /> &nbsp; &nbsp;&gt; &nbsp;而接下來就是定義mac-address，有以下幾種:<br /> <br /> &nbsp; <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&gt;&gt; <span style="color: #a64d79;">Static</span> : &nbsp;顧名思義就是直接手動設定特定的mac-address，但是設定完之後不會出現<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 在running-config中。如果要讓static mac-address出現在running-config中，需<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 要使用<span style="color: blue;">switchport port-security mac-address sticky xxxx.xxxx.xxxx</span><br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&gt;&gt; <span style="color: #a64d79;">Dynamic</span> : 這是系統預設使用的方式。只要設備還沒有達到maximum上限<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 而且網路介面尚未學習到該mac-address，該mac-address就會被學習進<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 來，但學習到的mac-address是會被age掉的。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&gt;&gt; <span style="color: #a64d79;">Sticky</span> : &nbsp;使用這種方式的行為跟dynamic一樣，但不同的是，這種方式會將學習到的<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mac-address寫入NVRAM中，這樣一來，就算設備重開機，mac-address還<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;是一樣存在，不須重新學習。<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;而sticky學習到的mac-address是不會被age掉。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Sticky跟dynamic這兩種功能是互不相容的，如果啟用sticky，dynamic就會<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;被自動關閉，sticky關掉後，dynamic還是會繼續運作。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;而透過switchport port-security mac-address sticky指令可以將dynamic learning <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mac-address轉成sticky learning mac-address存到running-config中<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;sticky mac-address雖然可以存在NVRAM中，但是可以手動清除:<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span style="color: blue;">#clear port-security sticky [interface fax/y]</span><br /> <span style="color: lime;"><br /></span> <span style="color: lime;">&nbsp;</span> &nbsp;&gt; Aging time : Aging time的參數包含:<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #a64d79;">Static</span>: 對於static mac-address啟用aging time<br /> &nbsp; <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #a64d79;">Time</span>: 設定aging timeout時間<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="background-color: white;"><span style="color: #a64d79;">Type</span>:</span> 設定aging time類型，有absolute及inactive兩種。absolute是絕對時間，<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 只要mac-address經過這一段時間就會從mac-address table中消失掉；<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; inactive是相對時間，只要該mac-address經過這一段時間沒有任何<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; traffic，就會從mac-address table中清除掉。<br /> <br /> &nbsp; &nbsp;&gt; Violation : 有幾種處理方式==&gt;<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #a64d79;">Protect</span>: 會將secured mac-address以外的mac-address丟棄掉，除此之外幾乎不做<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;任何動作<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #a64d79;">Restrict</span>: 除了不把interface shutdown之外，會發出snmp trap、violation counting<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;其他做的事情跟Protect一樣。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span style="color: #a64d79;">Shutdown</span>: interface會呈現err-disabled狀態。可以使用以下方式在經過某一段時<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;間後恢復==&gt;<br /> <br /> <span style="background-color: white;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<span style="color: blue; font-family: Arial, Helvetica, sans-serif; line-height: 20px;">Cat4507 (config)#errdisable recovery cause psecure-violation</span></span><br /> <span style="background-color: white; color: blue; font-family: Arial, Helvetica, sans-serif; line-height: 20px;">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Cat4507 (config)#errdisable recovery interval 30</span><br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-1364521915880442752012-08-23T00:46:00.002-07:002012-09-03T01:50:10.049-07:00How to automatically backup Cisco IOS devices configuration file to a TFTP Server...We can easily backup our Cisco IOS devices configuration files to a TFTP server whenever we issue the "write memory" command. Now how the make it? Follow the steps below:<br /> <br /> #<br /> #config term<br /> (config)#archive<br /> (config-archive)#path tftp://172.16.7.100/switch1-<br /> (config-archive)#write-memory<br /> (config)#exit<br /> #write memory<br /> <br /> then you will see the configuration file with file name such as "switch1-Aug-23-15-23-17-0",that is <br /> the prefix you defined previously plus the date and time.<br /> <br /> Of course, you can also check the startup-config and find that the configuration is also written into the NVRAM.Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-10712015212045295162012-08-19T19:16:00.002-07:002012-12-24T06:40:16.937-08:00PaloAlto SSL VPN設定方式<br /> <div id="sites-chrome-header-wrapper" style="border-bottom-width: 0px !important; color: #333333; font-family: verdana, sans-serif; font-size: 13px;" xmlns="http://www.w3.org/1999/xhtml"> <table border="0" cellpadding="{scmCellpadding}" cellspacing="0" class="sites-layout-hbox" id="sites-chrome-main" style="table-layout: fixed; width: 1366px;"><tbody> <tr><td id="sites-canvas-wrapper" style="vertical-align: top;"><div id="sites-canvas" style="background-image: none; background-position: 100% 0%; background-repeat: no-repeat no-repeat; border: none; font-size: 13px !important; margin: 0px 5px; padding: 0px;"> <div class="sites-canvas-main" id="sites-canvas-main" style="background-image: none; background-position: initial initial; background-repeat: initial initial; min-height: 150px; padding-bottom: 5px; padding-top: 15px;"> <div id="sites-canvas-main-content"> <table cellspacing="0" class="sites-layout-name-one-column sites-layout-hbox" style="margin: 0px; table-layout: fixed; width: 1356px;" xmlns="http://www.w3.org/1999/xhtml"><tbody> <tr><td class="sites-layout-tile sites-tile-name-content-1" style="padding: 10px; vertical-align: top;"><div dir="ltr"> <div> 啟用 SSL VPN client</div> <span style="font-size: x-small;">Device &gt;&nbsp;SSL VPN Client &gt;&nbsp;Activate</span><br /> <div> <br /></div> <div> 建立憑證</div> <div> <span style="font-size: x-small;">Device &gt;&nbsp;Certificates &gt; Generate</span></div> <div> <br /></div> <div> 選擇 SSL VPN 的 user 來源<br /> <span style="font-size: x-small;">Device &gt;&nbsp;Authentication (Local DB, RADIUS, LDAP, Kerberos)</span></div> <div> <br /></div> <div> SSL VPN &nbsp;網路環境設定</div> <div> <div> <span style="font-size: x-small;">Network &gt; Interface</span></div> <div> <span style="font-size: x-small;">Network &gt;&nbsp;Zones</span></div> </div> <div> SSL VPN 連線是必須由 untrust(來源) 到 trust(目地)，所以需設定兩個 ethernet，以及切兩個 zone。</div> <div> <br /></div> <div> 設定路由</div> <div> <span style="font-size: x-small;">Network &gt; Virtual Routers</span></div> <div> 勾選為 SSL VPN 設定的 ethernet，以及一個 tunnel。</div> <div> 設定一條路由往 untrust&nbsp;Destination (e.g: IP 0.0.0.0)，Interface 選擇 untrust 的 ethernet，以及設定該 ethernet 的 Router server IP</div> <div> 另一條設定往 SSL VPN 要前往的網段，Interface 選擇 trust 的 ethernet。</div> <div> <br /></div> <div> 最後設定 SSL VPN</div> <div> <span style="font-size: x-small;">Network &gt; SSL VPN &gt; Add</span></div> <div> 其中 Server Certificate 選擇我們之前建立的憑證， Authentication Profile 選擇我們之前所建立的&nbsp;Authentication。</div> <div> Tunnel Interface 選擇 tunnel，MAX User 也要設定，依該 server model 可選擇最高的 User 數。</div> <div> Gateway Address 請選擇 untrust 來源的 Interface，以及該 ethernet 的 IP。</div> <div> Client Configuration 請設定當 SSL VPN 連線成功後，該 SSL VPN client 解析 DNS 的&nbsp;Primary DNS Server IP， IP pool 則是 SSL VPN client 取得 IP 的網段，</div> <div> Access Router 則是設定 SSL VPN user 可出去的網段 router server IP。</div> <div> <br /></div> <div> 驗證 SSL VPN</div> <div> <span style="font-size: x-small;">https://IP (untrust ethernet IP)</span></div> <div> <span style="font-size: x-small;"><br /></span></div> <div> <span style="font-size: x-small;">以上文章參考至網路上不明來源之文章</span><br /> <span style="font-size: x-small;"><br /></span> <span style="font-size: x-small;"><br /></span> <span style="font-size: x-small;"><br /></span> <br /> <h2 class="posts_title" style="background-color: white; border: 0px; color: #181818; font-family: Tahoma, Helvetica, serif; font-size: 28px; font-weight: normal; font: inherit; line-height: 1.25; margin: 0px 0px 9px; padding: 0px; vertical-align: baseline;"> <a href="http://www.rebootuser.com/?p=683" style="border: 0px; color: #0085cf; font: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;">Palo Alto – SSL VPN Configuration</a></h2> <div class="meta" style="background-color: white; border: 0px; color: #989898; font-family: Tahoma, Helvetica, serif; font-size: 12px; font: inherit; margin: 0px; padding: 0px 0px 10px; vertical-align: baseline;"> Published on&nbsp;<a href="http://www.rebootuser.com/?p=683" style="border: 0px; color: #0085cf; font: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;">March 18, 2011</a> by&nbsp;<a href="http://www.rebootuser.com/?author=2" style="border: 0px; color: #0085cf; font: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" title="Posts by Owen">Owen</a>&nbsp;in&nbsp;<a href="http://www.rebootuser.com/?category_name=palo-alto-networks" rel="category" style="border: 0px; color: #0085cf; font: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" title="View all posts in Palo Alto Networks">Palo Alto Networks</a></div> <div class="entry" style="background-color: white; border: 0px; color: #555555; font-family: Tahoma, Helvetica, serif; font-size: 14px; font: inherit; line-height: 21px; margin: 0px; padding: 0px; vertical-align: baseline;"> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> A brief guide on creating a SSL portal and obtaining/deploying the SSL VPN client.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Download and Enable the SSL Client</strong></div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> Users will need to have the SSL VPN client installed before they’ll be able to access the SSL portal. This client is downloaded on 1st logon, but for it to be available to the user you’ll need to download the installer to the Palo Alto device. This can be accomplished by following the steps below:</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 1. Navigate to Device &gt; SSL-VPN Client &gt; Refresh – for this step to successfully complete the FW will require Internet access.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 2. Choose the&nbsp;appropriate&nbsp;version of the client and select download.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 3. Once downloaded the client will need to be activated. Select ‘activate’ to do this.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 4. The SSL client installer is ready for deployment from the device.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Create a SSL-VPN Profile</strong></div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> This profile will be assigned to clients included in the specified authentication group(s). Different SSL portals can be created for different user/group(s) if required.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 1. Navigate to Network &gt; SSL-VPN &gt; New.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 2. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Portal name:</strong>&nbsp;Enter a portal name.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 3. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Virtual system</strong>: If left blank this will be automatically populated on saving.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 4. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Tunnel interface</strong>: Select or create a tunnel interface that will be used with this profile.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 5. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Authentication</strong>: Select or create an authentication profile.</div> <ul style="border: 0px; font: inherit; list-style-image: initial; list-style-position: inside; margin: 0px 0px 10px 21px; padding: 0px; vertical-align: baseline;"> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Device &gt; Authentication Profile &gt; New.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Name:</strong>&nbsp;Enter a meaningful name for the profile.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Lockout – failed attempts:&nbsp;</strong>If 0 is used the account will never become locked out.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Lockout – lockout time:&nbsp;</strong>If 0 is used the account lockout time never takes effect.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Allow list &gt; Edit allow list:</strong>&nbsp;Enter/select the groups/users that should be granted access to the SSL portal.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Authentication:</strong>&nbsp;Select from the drop-down list the type of authentication that should be used. Methods include Local DB (a user/group will need to be created on the Palo Alto FW), RADIUS or LDAP.</li> </ul> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 6. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Server certificate:</strong>&nbsp;A self-signed certificate can be generated, but if this is to be used on the public domain it may be best to purchase a public cert.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 7. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Enable IPsec encapsulation of client traffic:</strong>&nbsp;Check this box.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 8. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Redirect HTTP traffic to HTTPS login page:</strong>&nbsp;Optional.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 9. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Interface:&nbsp;</strong>Select the interface that will be used for incoming VPN connections.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 10. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">IP address:</strong>&nbsp;Select the&nbsp;appropriate&nbsp;IP address from the list (as more than one may be bound to the interface).</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 11. <strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Login lifetime</strong>: Enter a max session lifetime.</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 12.<strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;Inactivity logout:&nbsp;</strong>Enter an inactivity timeout value .</div> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> 13. Client Configuration.</div> <ul style="border: 0px; font: inherit; list-style-image: initial; list-style-position: inside; margin: 0px 0px 10px 21px; padding: 0px; vertical-align: baseline;"> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Primary/Secondary DNS:&nbsp;</strong>Primary/Secondary&nbsp;DNS server addresses.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Primary/Secondary WINS:</strong>&nbsp;Primary/Secondary WINS server addresses.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">IP Pool – Subnet/Range:</strong>&nbsp;Enter an IP address range that can be assigned to remote clients.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">DNS Suffix</strong>: Enter the DNS suffix.</li> <li style="border: 0px; font: inherit; margin: 0px; padding: 0px; vertical-align: baseline;"><strong style="border: 0px; font: inherit; line-height: inherit; margin: 0px; padding: 0px; vertical-align: baseline;">Split tunnelling route:</strong>&nbsp;If you’re allowing clients use multiple subnets, enter the routes here.</li> </ul> <div style="border: 0px; clear: none; font-size: 14px; font: inherit; line-height: 17px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;"> There you have it, your SSL VPN is created.</div> </div> <br class="Apple-interchange-newline" /></div> </div> </td></tr> </tbody></table> </div> </div> </div> </td></tr> </tbody></table> </div> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-16458706675329520722012-08-07T00:01:00.000-07:002012-08-23T01:02:18.083-07:00關於Broadcast Address.....熟悉Cisco設備的人都知道有個ip helper-address的指令可以幫助我們將DHCP request封包以unicast的方式丟給我們指定的DHCP server，但可能不知道，除了DHCP的封包之外，打開ip helper-address後也順便將以下的protocol以directed broadcast的方式轉發出去:<br /> <div> <br /></div> <div> <ul style="background-color: white; border: 0px; color: #37414b; font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 14px; line-height: 19px; margin: 0px 0px 15px; padding: 0px 0px 0px 20px; vertical-align: baseline;"> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">TFTP (port 69)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">DNS (port 53)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">Time (port 37)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">TACACS (port 49)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">BOOTP client (port 68)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">BOOTP server (port 67)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">NetBIOS name service (port 137)</li> <li style="border: 0px; font-family: inherit; font-size: 14px; font-style: inherit; margin: 0px 0px 5px; padding: 0px; vertical-align: baseline;">NetBIOS datagram service (port 138)</li> </ul> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif; font-size: x-small;"><span style="line-height: 18.984848022460938px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;">如果我們想要將以上幾種之外的UDP封包以directed broadcast的方式轉發出去，可以使用ip forward-protocol的指令。</span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;">而提到directed broadcast可能會想到有個interface上的設定:no ip directed-broadcast，這個設定可以幫助我們避免類似smurf的DoS攻擊，而甚麼是directed broadcast呢?</span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;">說到directed broadcast我們先談談broadcast的種類:</span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;">1.subnet broadcast: 例如: 130.182.1.255</span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;">2.all-subnets-directed broadcast:例如:130.182.255.255</span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;">3.limited broadcast:例如:255.255.255.255，而BOOTP與DHCP都是使用這種broadcast。</span></span><br /> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span><span style="line-height: 18.969696044921875px;">而ip directed-broadcast在Cisco router上的作用可以下面的例子看出差別:</span></span><br /> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span> <br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgR9v9E-f2ZQODNeymWw6TLgaG67j-w-37dT-tHxeJ7axvXz1McPAdUxaHrOprWr7m-kHy9SAUDWO_f2kn0VckKGRx9ccPdb04vgygda3pMWWrpGukGJClkPvy4ErW4ZuRMDCnOOX1cP3CF/s1600/%E5%9C%96%E7%89%871.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><br /></a><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgR9v9E-f2ZQODNeymWw6TLgaG67j-w-37dT-tHxeJ7axvXz1McPAdUxaHrOprWr7m-kHy9SAUDWO_f2kn0VckKGRx9ccPdb04vgygda3pMWWrpGukGJClkPvy4ErW4ZuRMDCnOOX1cP3CF/s1600/%E5%9C%96%E7%89%871.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgR9v9E-f2ZQODNeymWw6TLgaG67j-w-37dT-tHxeJ7axvXz1McPAdUxaHrOprWr7m-kHy9SAUDWO_f2kn0VckKGRx9ccPdb04vgygda3pMWWrpGukGJClkPvy4ErW4ZuRMDCnOOX1cP3CF/s400/%E5%9C%96%E7%89%871.JPG" width="400" /></a></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> 如上圖架構，我們建立一個ACL 101，內容是允許icmp封包通過，套用在R2的e0/0 interface上，同時開啟debug來觀察，並由R1執行ping 10.1.1.255，在R2 e0/0開啟ip directed-broadcast時可以觀察到以下資訊:</div> <div class="separator" style="clear: both; text-align: left;"> </div> <div style="background-color: white; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <span style="color: #454545;">*Jul 25 20:57:03.879: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), </span><span style="color: red;"><b>g=255.255.255.255</b></span><span style="color: #454545;">, len 100, forward directed broadcast</span></div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 20:57:03.879: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), len 100, rcvd 5</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 20:57:03.879: IP: s=12.1.1.2 (local), d=12.1.1.1 (Serial2/0), len 100, sending</div> <div style="background-color: white; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <span style="color: #454545;">*Jul 25 20:57:03.899: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0),</span><span style="color: red;"><b> g=255.255.255.255</b></span><span style="color: #454545;">, len 100, forward directed broadcast</span></div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> （以下重复，输出省略）</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <span style="color: black; font-family: 'Times New Roman'; font-size: small; line-height: normal;">雖然R1 ping的是subnet broadcast 10.1.1.255，但實際上封包到R2時會被轉成limited broadcast 255.255.255.255!</span> </div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <br /></div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <br /></div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <br /></div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> 在R3上開debug看到的資訊如下:</div> <div style="background-color: white; color: #454545; line-height: 25px; padding: 0px;"> </div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.079: IP: s=12.1.1.1 (Ethernet0/0), d=255.255.255.255, len 100, rcvd 2</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.079: IP: s=10.1.1.3 (local), d=12.1.1.1 (Ethernet0/0), len 100, sending</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.099: IP: s=12.1.1.1 (Ethernet0/0), d=255.255.255.255, len 100, rcvd 2</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.099: IP: s=10.1.1.3 (local), d=12.1.1.1 (Ethernet0/0), len 100, sending</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.119: IP: s=12.1.1.1 (Ethernet0/0), d=255.255.255.255, len 100, rcvd 2</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.119: IP: s=10.1.1.3 (local), d=12.1.1.1 (Ethernet0/0), len 100, sending</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.139: IP: s=12.1.1.1 (Ethernet0/0), d=255.255.255.255, len 100, rcvd 2</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.139: IP: s=10.1.1.3 (local), d=12.1.1.1 (Ethernet0/0), len 100, sending</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.167: IP: s=12.1.1.1 (Ethernet0/0), d=255.255.255.255, len 100, rcvd 2</div> <div style="font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; padding: 0px;"> *Jul 25 20:59:06.167: IP: s=10.1.1.3 (local), d=12.1.1.1 (Ethernet0/0), len 100, sending</div> <div style="padding: 0px;"> <span style="font-family: inherit;">可以看出R3是用unicast的方式回應</span></div> <br /> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <br /></div> <br /> <div class="separator" style="clear: both; text-align: left;"> <br /></div> <div class="separator" style="clear: both; text-align: left;"> 但如果把ip directed-broadcast拿掉，同樣用R1去ping 10.1.1.255，則R2上看到的結果如下:</div> <div class="separator" style="clear: both; text-align: left;"> </div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.071: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), len 100, rcvd 5</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.071: IP: s=12.1.1.2 (local), d=12.1.1.1 (Serial2/0), len 100, sending</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.099: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), len 100, rcvd 5</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.099: IP: s=12.1.1.2 (local), d=12.1.1.1 (Serial2/0), len 100, sending</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.131: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), len 100, rcvd 5</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.131: IP: s=12.1.1.2 (local), d=12.1.1.1 (Serial2/0), len 100, sending</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.159: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), len 100, rcvd 5</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.159: IP: s=12.1.1.2 (local), d=12.1.1.1 (Serial2/0), len 100, sending</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.191: IP: s=12.1.1.1 (Serial2/0), d=10.1.1.255 (Ethernet0/0), len 100, rcvd 5</div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> *Jul 25 21:05:22.191: IP: s=12.1.1.2 (local), d=12.1.1.1 (Serial2/0), len 100, sending</div> <div style="background-color: white; color: #454545; line-height: 25px; padding: 0px;"> <span style="font-family: inherit;">可以看出，R2沒有像之前一樣將unicast轉成broadcast再轉發出去給R3了</span></div> <div style="background-color: white; color: #454545; font-family: 'Microsoft Yahei', 微软雅黑, Tahoma, Arial, Helvetica, STHeiti; font-size: 14px; line-height: 25px; padding: 0px;"> <br /></div> <br /> <div class="separator" style="clear: both; text-align: center;"> <br /></div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif; font-size: x-small;"><span style="line-height: 18.969696044921875px;"><br /></span></span></div> <div> <span style="color: #37414b; font-family: Helvetica Neue, Helvetica, sans-serif; font-size: x-small;"><span style="line-height: 18.984848022460938px;"><br /></span></span></div> </div> Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-46699043192610907922012-08-06T20:56:00.002-07:002012-08-06T20:56:48.505-07:00Cisco Layer3 Switch上的IPv6設定方式Step 1: globally enable IPv6<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(config)#ipv6 unicast-routing<br /> <br /> <br /> Step 2: Enable IPv6 on L3 interfaces and setup ipv6 addresses<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (config)#interface vlan 254<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (config-if)#ipv6 enable<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (config-if)#ipv6 address&nbsp;2001:288:123F:254::1/64<br /> <br /> <br /> Step 3: Setup IPv6 default/static routing<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(config)#ipv6 route ::/0 2001:288:123F:254::FFFF<br /> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;(config)#ipv6 route 2001:288:123F:253::/64 2001:288:123F::1:1F<br /> <br />Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-8547992514777334832012-07-27T01:06:00.001-07:002012-07-27T01:29:48.883-07:00淺談Cisco OTV&nbsp; &nbsp; &nbsp; &nbsp;OTV(Overlay Transport Virtualization)這一項技術是Cisco為Data Center Solution所提出來的解決方法，目前並非標準，他所提出的是利用"MAC in IP"的概念將原本一個Data Center中虛擬機器做Vmotion時需要在同一個Layer 2的網路(DataNet)才能完成的限制消除掉，而讓不同Data Center之間的VM彼此也可以做Vmotion，這樣做的好處是可以分散一個Data Center的workload，讓其他Data Center可以彼此分擔workload，如果以更廣的角度來看，OTV讓很多Data Center可以看成同一個Data Center。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp; 雖然OTV是利用Layer2的技術，但是他會過濾掉原有在Layer2的一些frame，包含Spanning-Tree、Broadcast Storm、Unicast flooding等。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp;使用OTV並不需要更動現有的網路架構(所以稱為"Overlay"，覆蓋在既有的網路架構上)，因此當有一個新的Data Center加入時並不需要更動到其他Data Center的網路架構，依照官方的說法最多只需四行指令就可以搞定了。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp;目前Cisco只有Nexus 7000系列才有支援OTV，而目前有支援的module有M series，而F1系列的module則不支援。<br /> <br /> &nbsp; &nbsp; &nbsp; &nbsp;Cisco、VMWare、NetApp近期也提出一個叫做IVA(Imagine Virtually Anything)的概念，其中用到的也是OTV這個技術(其他就是VMWare的Vmotion及NetApp的FlexCache技術)。<br /> IVA相關文章可參考:<br /> <a href="http://www.imaginevirtuallyanything.com/us/solutions-and-technology.html#long">http://www.imaginevirtuallyanything.com/us/solutions-and-technology.html#long</a>Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0tag:blogger.com,1999:blog-1909214529340166973.post-18241001342229383912012-07-25T23:15:00.000-07:002013-01-09T01:06:06.881-08:00EtherChannel&nbsp; &nbsp; &nbsp; 要將兩台Switch之間的連線使用多條線路形成一個trunk通常需要兩台互聯的<i>interface</i>要設定成固定的trunk port (channel-group x mode on, x=ID)，如果所處的兩台switch環境是在異地，如果沒有事先設定好，或是兩台switch已經安裝好但需更改架構，除非兩頭都有網管人員同時設定，如果只有一個網管人員時必須爭取時間，先設定完一頭，再趕忙跑到另一頭，以縮短斷線時間。<br /> <br /> &nbsp; &nbsp; &nbsp; 但如果使用動態的EtherChannel就可以解決這個問題。目前Cisco Switch上的支援兩種動態的EtherChannel協定，包含Cisco自己的PAgP及標準的802.3ad LACP，如果使用PAgP的話有支援幾種模式，每個模式之間可以形成trunk的搭配方式如下:<br /> <br /> <br /> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwzd1qpgnHF8lHWhVd4P0whCxtYh7cjFmb0JpCxO4V4RJzZ7gH2GiOYaUTUhUSZc6KHkTXY08pTFEa1pX8RTembefYG-VusyWuIj_qdQ5ejekDywnBsgtZZdgF1zkSt_nxdp_PSesE-eK7/s1600/%E5%9C%96%E7%89%871.JPG" imageanchor="1" style="background-color: white; margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwzd1qpgnHF8lHWhVd4P0whCxtYh7cjFmb0JpCxO4V4RJzZ7gH2GiOYaUTUhUSZc6KHkTXY08pTFEa1pX8RTembefYG-VusyWuIj_qdQ5ejekDywnBsgtZZdgF1zkSt_nxdp_PSesE-eK7/s640/%E5%9C%96%E7%89%871.JPG" height="134" width="640" /></a><br /> <br /> <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse; width: 527px;"><colgroup><col span="2" style="mso-width-alt: 4416; mso-width-source: userset; width: 104pt;" width="138"></col></colgroup></table> <br /> <br /> 如果使用Static Trunking的方式，PAgP與LACP的設定方式如下:<br /> <br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">This example shows how to configure an EtherChannel. It assigns two ports as static-access ports in VLAN 10 to channel 5 with the PAgP mode&nbsp;<b style="background-color: transparent; background-position: initial initial; background-repeat: initial initial; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">desirable</b>:</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch#</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;configure terminal&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config)#</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;interface range gigabitethernet0/1 -2&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">switchport mode access</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">switchport access vlan 10</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">channel-group 5 mode </span><span style="background-color: white; border: 0px; color: red; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">desirable</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;end&nbsp;</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"><br /></span> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">This example shows how to configure an EtherChannel. It assigns two ports as static-access ports in VLAN 10 to channel 5 with the LACP mode&nbsp;<b style="background-color: transparent; background-position: initial initial; background-repeat: initial initial; border: 0px; margin: 0px; padding: 0px; vertical-align: baseline;">active</b>:&nbsp;</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch#</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;configure terminal&nbsp;</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config)#</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;interface range gigabitethernet0/1 -2&nbsp;</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">switchport mode access</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">switchport access vlan 10</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#&nbsp;</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">channel-group 5 mode </span><span style="background-color: white; border: 0px; color: red; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">active</span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Switch(config-if-range)#</span><span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">&nbsp;end&nbsp;</span> <br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"><br /></span> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;">Summary:</span><br /> <br /> <div class="pTC_TableCap" style="font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; margin: 14px 0em 9px 0.5in; text-indent: -0.5in;"> EtherChannel Modes&nbsp;</div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040218"></a><br /> <div class="pCH1_CellHead1" style="color: #336666; font-family: Arial, Helvetica, sans-serif; font-size: 13.600000381469727px; font-weight: bold; margin: 0em; text-indent: 0em;"> Mode&nbsp;<span style="font-size: 13.600000381469727px; text-indent: 0em;">Description</span></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040222"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> <b class="cBold">on</b></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040224"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> Mode that forces the LAN port to channel unconditionally. In the&nbsp;<b class="cBold">on</b>&nbsp;mode, a usable EtherChannel exists only when a LAN port group in the&nbsp;<b class="cBold">on</b>&nbsp;mode is connected to another LAN port group in the&nbsp;<b class="cBold">on</b>&nbsp;mode. Because ports configured in the&nbsp;<b class="cBold">on&nbsp;</b>mode do not negotiate, there is no negotiation traffic between the ports.<br /> <br /></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040226"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> <b class="cBold">auto</b></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040228"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> PAgP mode that places a LAN port into a passive negotiating state in which the port responds to PAgP packets it receives but does not initiate PAgP negotiation.<br /> <br /></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040230"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> <b class="cBold">desirable</b></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040232"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> PAgP mode that places a LAN port into an active negotiating state in which the port initiates negotiations with other LAN ports by sending PAgP packets.<br /> <br /></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040234"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> <b class="cBold">passive</b></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040236"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> LACP mode that places a port into a passive negotiating state in which the port responds to LACP packets it receives but does not initiate LACP negotiation.<br /> <br /></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040238"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> <b class="cBold">active</b></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040240"></a><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> LACP mode that places a port into an active negotiating state in which the port initiates negotiations with other ports by sending LACP packets.</div> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> <br /></div> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; margin: 1px 0em 6px; text-indent: 0em;"> </div> <div class="pB1_Body1" style="background-color: white; margin: 1px 0em 6px;"> LAN ports can form an EtherChannel when they are in different <b><span style="color: #38761d;">PAgP</span></b> modes if the modes are compatible. For example:</div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040255" style="background-color: white;"></a><br /> <div class="pBu1_Bullet1" style="background-color: white; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="color: blue;"><b>Y</b></span>•<img alt="" border="0" src="http://www.cisco.com/en/US/i/templates/blank.gif" height="2" style="border: 0px;" width="19" />A LAN port in&nbsp;<b class="cBold">desirable</b>&nbsp;mode can form an EtherChannel successfully with another LAN port that is in&nbsp;<b class="cBold">desirable</b>&nbsp;mode.</div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040256" style="background-color: white;"></a><br /> <div class="pBu1_Bullet1" style="background-color: white; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="color: blue;"><b>Y</b></span>•<img alt="" border="0" src="http://www.cisco.com/en/US/i/templates/blank.gif" height="2" style="border: 0px;" width="19" />A LAN port in&nbsp;<b class="cBold">desirable</b>&nbsp;mode can form an EtherChannel with another LAN port in&nbsp;<b class="cBold">auto</b>&nbsp;mode.</div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040257" style="background-color: white;"></a><br /> <div class="pBu1_Bullet1" style="background-color: white; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="color: blue;"><b>N</b></span>•<img alt="" border="0" src="http://www.cisco.com/en/US/i/templates/blank.gif" height="2" style="border: 0px;" width="19" />A LAN port in&nbsp;<b class="cBold">auto</b>&nbsp;mode <u>cannot</u> form an EtherChannel with another LAN port that is also in&nbsp;<b class="cBold">auto</b>&nbsp;mode because neither port initiates negotiation.</div> <div class="pBu1_Bullet1" style="background-color: white; font-size: 12px; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <br /></div> <div class="pBu1_Bullet1" style="background-color: white; font-size: 12px; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <br /></div> <br /> <br /> <span style="background-color: white; border: 0px; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"></span><br /> <div class="pB1_Body1" style="font-family: Arial, Helvetica, sans-serif; font-size: 12px; line-height: normal; margin: 1px 0em 6px;"> <span style="background-color: white; border: 0px; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="color: black;">LAN ports can form an EtherChannel when they are in different </span><span style="color: #38761d;"><b>LACP</b></span> modes as long as the modes are compatible. For example:</span></div> <span style="background-color: white; border: 0px; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-size: 12.800000190734863px;"><a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040269" style="color: black; font-family: Arial, Helvetica, sans-serif; font-size: 12.800000190734863px; line-height: normal;"></a></span></span><br /> <div class="pBu1_Bullet1" style="font-family: Arial, Helvetica, sans-serif; line-height: normal; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="background-color: white; border: 0px; font-family: Arial; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="color: blue; font-size: 16px;"><b>Y</b></span><span style="color: black;">•<span style="font-size: small;"><img alt="" border="0" src="http://www.cisco.com/en/US/i/templates/blank.gif" height="2" style="border: 0px;" width="19" />A LAN port in&nbsp;</span><b class="cBold">active</b><span style="font-size: small;">&nbsp;mode can form an EtherChannel successfully with another LAN port that is in&nbsp;</span><b class="cBold">active</b><span style="font-size: small;">&nbsp;mode.</span></span></span></div> <span style="background-color: white; border: 0px; font-family: Arial; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040270" style="color: black; font-family: Arial, Helvetica, sans-serif; line-height: normal;"></a><div class="pBu1_Bullet1" style="font-family: Arial, Helvetica, sans-serif; line-height: normal; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="color: blue;"><b>Y</b></span><span style="color: black;">•<img alt="" border="0" src="http://www.cisco.com/en/US/i/templates/blank.gif" height="2" style="border: 0px;" width="19" />A LAN port in&nbsp;<b class="cBold">active</b>&nbsp;mode can form an EtherChannel with another LAN port in&nbsp;<b class="cBold">passive</b>&nbsp;mode.</span></div> <a href="https://www.blogger.com/blogger.g?blogID=1909214529340166973" name="wp1040271" style="color: black; font-family: Arial, Helvetica, sans-serif; line-height: normal;"></a><div class="pBu1_Bullet1" style="font-family: Arial, Helvetica, sans-serif; line-height: normal; margin-bottom: 7px; margin-left: 0.25in; margin-right: 0em; text-indent: -0.25in;"> <span style="color: blue;"><b>N</b></span><span style="color: black;">•<img alt="" border="0" src="http://www.cisco.com/en/US/i/templates/blank.gif" height="2" style="border: 0px;" width="19" />A LAN port in&nbsp;<b class="cBold">passive</b>&nbsp;mode <u>cannot</u> form an EtherChannel with another LAN port that is also in&nbsp;<b class="cBold">passive</b>&nbsp;mode, because neither port initiates negotiation.</span></div> </span><br /> <span style="background-color: white; border: 0px; color: #333333; font-family: Arial; font-size: 16px; line-height: 24px; margin: 0px; padding: 0px; vertical-align: baseline;"><br /></span>Jeff Linhttp://www.blogger.com/profile/17318467015285456330noreply@blogger.com0