jpudasaini

Sextortion Spam.

noreply@blogger.com (j) — Sat, 12 Jan 2019 12:11:00 +0000

If you received such a mail means bad guys already harvest your email. Don't worry this is only a bait. Below is the sample of mail. Email is received with spoof email address. This email also bypass office 365 ATP as well. Detection status on VT score is none when this email was received.

Message-ID: <003e>
From: <cust>
To: <cust>
Subject: Your account has been hacked! You need to unlock.
Date: 10 Jan 2019 11:03:17 +0800
MIME-Version: 1.0
Content-Type: text/plain;
 charset="ibm852"
Content-Transfer-Encoding: 8bit

Hi, stranger!

I hacked your device, because I sent you this message from your account.
If you have already changed your password, my malware will be intercepts it every time.

You may not know me, and you are most likely wondering why you are receiving this email, right?
In fact, I posted a malicious program on adults (pornography) of some websites, and you know that you visited these websites to enjoy 
(you know what I mean).

While you were watching video clips,
my trojan started working as a RDP (remote desktop) with a keylogger that gave me access to your screen as well as a webcam.

Immediately after this, my program gathered all your contacts from messenger, social networks, and also by e-mail.

What I've done?
I made a double screen video.
The first part shows the video you watched (you have good taste, yes ... but strange for me and other normal people),
and the second part shows the recording of your webcam.

What should you do?

Well, I think $645 (USD dollars) is a fair price for our little secret.
You will make a bitcoin payment (if you don't know, look for "how to buy bitcoins" on Google).

BTC Address: 1GjZSJnpU4AfTS8vmre6rx7eQgeMUq8VYr
(This is CASE sensitive, please copy and paste it)

Remarks:
You have 2 days (48 hours) to pay. (I have a special code, and at the moment I know that you have read this email).

If I don't get bitcoins, I will send your video to all your contacts, including family members, colleagues, etc.
However, if I am paid, I will immediately destroy the video, and my trojan will be destruct someself.

If you want to get proof, answer "Yes!" and resend this letter to youself. 
And I will definitely send your video to your any 17 contacts.

This is a non-negotiable offer, so please do not waste my personal and other people's time by replying to this email.

Bye!

MongoDB Failed to start lsb an object/document-oriented database

noreply@blogger.com (j) — Fri, 28 Dec 2018 13:14:00 +0000

After long gap I'm going to post new blog. Due to the work load and research I have little time.

MongoDB could not started after installation of 3.6 version, However downgrade to the 3.4, still the Mongodb couldn't start and show below error message.

Search don't help to resolved the issue. After so much hit and trail nothing work. One Chinese forum posted this command and its works for me.

cd /var/lib

sudo rm -rf ./mongodb

sudo mkdir mongodb

sudo chown -R mongodb mongodb/

sudo serivce mongodb restart

UBUNTU Files not Opening

noreply@blogger.com (j) — Sun, 05 Feb 2017 13:37:00 +0000

Suddenly My Ubuntu 16.04 LTS giving me a issue, I can't open files manger as well as screenshots app. So I dig into the problem and found this temporary solution for file manager. Still searching for permanent solution. Ubuntu is very buggy since and then, not stable any way.

Step 1:

@jpudasaini:~$ nautilus -q

(nautilus:6210): GLib-GIO-CRITICAL **: g_dbus_interface_skeleton_unexport: assertion 'interface_->priv->connections != NULL' failed

(nautilus:6210): GLib-GIO-CRITICAL **: g_dbus_interface_skeleton_unexport: assertion 'interface_->priv->connections != NULL' failed

(nautilus:6210): Gtk-CRITICAL **: gtk_icon_theme_get_for_screen: assertion 'GDK_IS_SCREEN (screen)' failed

(nautilus:6210): GLib-GObject-WARNING **: invalid (NULL) pointer instance

(nautilus:6210): GLib-GObject-CRITICAL **: g_signal_connect_object: assertion 'G_TYPE_CHECK_INSTANCE (instance)' failed

Step 2:

jpudasaini@jpudasaini:~$ nautilus
Nautilus-Share-Message: Called "net usershare info" but it failed: Failed to execute child process "net" (No such file or directory)

New your file manager is ready to used.

HTH

Cisco ASA in GNS3

noreply@blogger.com (j) — Mon, 23 Jan 2017 15:57:00 +0000

Here is another tutorial running Cisco ASAv on GNS3 using Qemu.

For Configure GNS3

In My case I have used ASAv952-204.qcow2

Go to the GNS3>Edit>Preferences>QEMU>Qemu VMs>New
Follow on screen procedure.

Don't forget to enable kvm and memory allocation.

Now you can see I can run ASAv 9.5.2

Blank Password.

IOS XR GNS3 QEMU

noreply@blogger.com (j) — Mon, 05 Dec 2016 14:58:00 +0000

This time lets have tutorial on Cisco XR 9k series router image running on the GNS3. Please don't ask for the XR image. Your are smart enough to get it.

My system configuration:

Ubuntu 16.04
GNS3 1.4
RAM 8Gig
i7 processor

Used XR Image
iosxrv-k9-demo-6.0.1.qcow2

This image is VIRL extracted image.

You need to convert this image into QEMU image, follow this link

I strongly recommend you to run it on the Linux system.

Now you have converted image, then go to the GNS3>Edit>Preferences>QEMU>Qemu VMs>New
then follow the onscreen procedure.

Setting for QEMU XR Image.

RAM:- 4Gig
CPU:- 1

Adapters at lest 4.

-enable-kvm

Here you can see I can run the XR on my system. Interface is up and system is already booted.

I have run 3 XR router here is my system RAM CPU usages.

RP/0/0/CPU0:XR3(config)#int gi0/0/0/0

RP/0/0/CPU0:XR3(config-if)#ip add 192.168.13.2 255.255.255.252

RP/0/0/CPU0:XR3(config-if)#commit

RP/0/0/CPU0:XR3#ping 192.168.13.1

Mon Dec 5 14:28:29.088 UTC

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.13.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/19 ms

Note: Assign IP on gi0/0/0/0 interface but connect on e1 to e/1 on your router otherwise it will not ping.

Enjoy.

Unit vpnagentd service not loaded.

noreply@blogger.com (j) — Thu, 01 Dec 2016 06:52:00 +0000

Somebody ask me to run Cisco EPIC VPN lab test provide by the Cisco. I just try it done but Anyconnect client doesn't seems to work on ubuntu system. The error message was

How to resolved the issue??

First of all install the following packages.

sudo apt-get install lib32z1 lib32ncurses5

Then try to install the AnyConnect client, if its still show the same error message. Used below command....

sudo apt-get install network-manager-openconnect

Reload the changes using this command....

sudo systemctl daemon-reload

Now AnyConnect should be installed.

Perl Can't Locate in @inc

noreply@blogger.com (j) — Sun, 04 Sep 2016 11:46:00 +0000

Recently I try to install SmokePing (tar ball) on Centos 7, for my company to check Network latency, but same error re-occur.

Multiple Errors:

Then I search a lot, try to install the packages but the problem still appear, then after I found a simple solution.

Solution:

# perl -MCPAN -eshell
Terminal does not support AddHistory.

cpan shell -- CPAN exploration and modules installation (v1.9800)
Enter 'h' for help.

cpan[1]> install Net::OpenSSH
Reading '/root/.cpan/Metadata'
Database was generated on Sat, 03 Sep 2016 21:53:30 GMT
Running install for module 'Net::OpenSSH'
Running make for S/SA/SALVA/Net-OpenSSH-0.73.tar.gz
Fetching with LWP:
http://cpan.communilink.net/authors/id/S/SA/SALVA/Net-OpenSSH-0.73.tar.gz
Fetching with LWP:
http://cpan.communilink.net/authors/id/S/SA/SALVA/CHECKSUMS
Checksum for /root/.cpan/sources/authors/id/S/SA/SALVA/Net-OpenSSH-0.73.tar.gz ok
Scanning cache /root/.cpan/build for sizes
............................................................................DONE

CPAN.pm: Building S/SA/SALVA/Net-OpenSSH-0.73.tar.gz

Checking if your kit is complete...
Looks good
Writing Makefile for Net::OpenSSH
Could not read metadata file. Falling back to other methods to determine prerequisites
cp lib/Net/OpenSSH/ConnectionCache.pm blib/lib/Net/OpenSSH/ConnectionCache.pm
cp lib/Net/OpenSSH/ShellQuoter/fish.pm blib/lib/Net/OpenSSH/ShellQuoter/fish.pm
cp lib/Net/OpenSSH/ShellQuoter.pm blib/lib/Net/OpenSSH/ShellQuoter.pm
cp lib/Net/OpenSSH/ShellQuoter/POSIX.pm blib/lib/Net/OpenSSH/ShellQuoter/POSIX.pm
cp lib/Net/OpenSSH/ModuleLoader.pm blib/lib/Net/OpenSSH/ModuleLoader.pm
cp lib/Net/OpenSSH/ShellQuoter/Chain.pm blib/lib/Net/OpenSSH/ShellQuoter/Chain.pm
cp lib/Net/OpenSSH/SSH.pm blib/lib/Net/OpenSSH/SSH.pm
cp lib/Net/OpenSSH/Constants.pm blib/lib/Net/OpenSSH/Constants.pm
cp lib/Net/OpenSSH/ShellQuoter/MSWin.pm blib/lib/Net/OpenSSH/ShellQuoter/MSWin.pm
cp lib/Net/OpenSSH/OSTracer.pm blib/lib/Net/OpenSSH/OSTracer.pm
cp lib/Net/OpenSSH.pm blib/lib/Net/OpenSSH.pm
cp lib/Net/OpenSSH/ShellQuoter/MSCmd.pm blib/lib/Net/OpenSSH/ShellQuoter/MSCmd.pm
cp lib/Net/OpenSSH/ShellQuoter/csh.pm blib/lib/Net/OpenSSH/ShellQuoter/csh.pm
cp lib/Net/OpenSSH/ObjectRemote.pm blib/lib/Net/OpenSSH/ObjectRemote.pm
Manifying blib/man3/Net::OpenSSH::SSH.3pm
Manifying blib/man3/Net::OpenSSH::Constants.3pm
Manifying blib/man3/Net::OpenSSH::ShellQuoter::MSWin.3pm
Manifying blib/man3/Net::OpenSSH::ConnectionCache.3pm
Manifying blib/man3/Net::OpenSSH::ShellQuoter::MSCmd.3pm
Manifying blib/man3/Net::OpenSSH.3pm
Manifying blib/man3/Net::OpenSSH::OSTracer.3pm
SALVA/Net-OpenSSH-0.73.tar.gz
/usr/bin/make -- OK
'YAML' not installed, will not store persistent state
Running make test
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/1_run.t .... #
# SSH client found: OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013.
# Trying to connect to localhost, timeout is 15s.
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
root@localhost's password:
t/1_run.t .... ok
t/quoting.t .. # unable to exec csh -c echo good
# unable to exec tcsh -c echo good
# unable to exec ksh -c echo good
# unable to exec dash -c echo good
# unable to exec ash -c echo good
# unable to exec pdksh -c echo good
# unable to exec mksh -c echo good
# unable to exec zsh -c echo good
# unable to exec fish -c echo good
# running tests for shells sh bash
t/quoting.t .. ok
t/uri.t ...... ok
All tests successful.
Files=3, Tests=471, 16 wallclock secs ( 0.17 usr 0.01 sys + 1.63 cusr 1.06 csys = 2.87 CPU)
Result: PASS
SALVA/Net-OpenSSH-0.73.tar.gz
/usr/bin/make test -- OK
Running make install
Installing /usr/local/share/perl5/Net/OpenSSH.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ConnectionCache.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ModuleLoader.pm
Installing /usr/local/share/perl5/Net/OpenSSH/SSH.pm
Installing /usr/local/share/perl5/Net/OpenSSH/Constants.pm
Installing /usr/local/share/perl5/Net/OpenSSH/OSTracer.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ObjectRemote.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter/fish.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter/POSIX.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter/Chain.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter/MSWin.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter/MSCmd.pm
Installing /usr/local/share/perl5/Net/OpenSSH/ShellQuoter/csh.pm
Installing /usr/local/share/man/man3/Net::OpenSSH::SSH.3pm
Installing /usr/local/share/man/man3/Net::OpenSSH::Constants.3pm
Installing /usr/local/share/man/man3/Net::OpenSSH::ShellQuoter::MSWin.3pm
Installing /usr/local/share/man/man3/Net::OpenSSH::ConnectionCache.3pm
Installing /usr/local/share/man/man3/Net::OpenSSH::ShellQuoter::MSCmd.3pm
Installing /usr/local/share/man/man3/Net::OpenSSH.3pm
Installing /usr/local/share/man/man3/Net::OpenSSH::OSTracer.3pm
Appending installation info to /usr/lib64/perl5/perllocal.pod
SALVA/Net-OpenSSH-0.73.tar.gz
/usr/bin/make install -- OK

No Matching Host Key Type Found. Their Offer: ssh-rsa

noreply@blogger.com (j) — Thu, 26 May 2016 07:04:00 +0000

After upgrading the Laptop OS when I try to login to my old machine I got this error message....

jay@jay:~$ ssh -p 2222 jay@jpudasaini.com.np
Unable to negotiate with 192.168.156.101 port 2222: no matching host key type found. Their offer: ssh-dss

I can't access the system, here is the solution

jay@jay:~$ ssh -oHostKeyAlgorithms=+ssh-dss -p 2222 jay@jpudasaini.com.npThe authenticity of host '[jpudasaini.com.np]:2222 ([192.168.156.101]:2222)' can't be established.
DSA key fingerprint is SHA256:J#$/zFpzr05gdfrshufHHOQvss6NQcEpPMgKlibTc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[jpudasaini.com.np]:2222,[192.168.156.101]:2222' (DSA) to the list of known hosts.
Password:

Now Just type the password

nslookup Command

noreply@blogger.com (j) — Mon, 21 Mar 2016 06:39:00 +0000

A Network Administrator command which help diagnosis DNS related issue. However to understand this, you should better to know how DNS works.

How to troubleshoot DNS related issue.

1. NSLOOKUP example display "A Record" (IP Adress) of the domain

C:\Users\jpudasaini>nslookup jpudasaini.com.np 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8

Non-authoritative answer:
Name: jpudasaini.com.np
Address: 216.239.32.21

A Non-Authoritative Answer is a response from Cache. A DNS server is
authoritative for zones actually holds it.

The above output shows "A Records" (IP Adress) of the domain
"jpudasaini.com.np". Which is actually query to the public Google DNS. If
you don't put DNS after the domain, it will used your default DNS, in my
case I have used public DNS.

2. MX Record using -query=mx

MX (Mail Exchange) record maps for the specific domain name to verify mail
exchaing servers on that domain.

C:\Users\jpudasaini>nslookup -query=mx gmail.com 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8

Non-authoritative answer:
gmail.com MX preference = 40, mail exchanger =alt4.gmail-smtp-in.l.google
.com
gmail.com MX preference = 20, mail exchanger =alt2.gmail-smtp-in.l.google
.com
gmail.com MX preference = 10, mail exchanger =alt1.gmail-smtp-in.l.google
.com
gmail.com MX preference = 30, mail exchanger =alt3.gmail-smtp-in.l.google
.com
gmail.com MX preference = 5, mail exchanger =gmail-smtp-in.l.google.com

From the above example we can say that 4 MX records used for gmail
domain, the number associat with mx reference the preference of mail
server. Lower the number, higher the preference. So
gmail-smtp-in.l.google.com is the first server which received the mail at
first.

3. NS Record using -query=ns

NS (Name Server) records maps a domain to a list of DNS servers
authoritative for that domain. Here is example of name server which are
associated with jpudasaini.com.np doamain.

C:\Users\jpudasaini>nslookup -query=ns jpudasaini.com.np 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8

Non-authoritative answer:
jpudasaini.com.np nameserver = ns4.afraid.org
jpudasaini.com.np nameserver = ns2.afraid.org
jpudasaini.com.np nameserver = ns1.afraid.org

4. SOA Record using -query=soa

C:\Users\jpudasaini>nslookup -query=soa jpudasaini.com.np 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8

Non-authoritative answer:
jpudasaini.com.np
        primary name server = ns1.afraid.org
        responsible mail addr = dnsadmin.afraid.org
        serial = 1511030001
        refresh = 86400 (1 day)
        retry   = 7200 (2 hours)
        expire = 2419200 (28 days)
        default TTL = 3600 (1 hour)

SOA record (start of authority) which provides the authoritative
information, as well as e-mail address, serial no of the respective
domain.

5. Reserve DNS lookup

The reverse DNS look-up using IP Adress as argument to nslookup
C:\Users\jpudasaini>nslookup 216.239.32.21 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8

Name: any-in-2015.1e100.net
Address: 216.239.32.21

6. Using Specific DNS Server

Make query using particular name server instead of using default DNS server.

C:\Users\jpudasaini>nslookup jpudasaini.com.np ns1.afraid.org
Server: UnKnown
Address: 50.23.197.95

Name: jpudasaini.com.np
Address: 216.239.32.21

EoMPLS Configuration

noreply@blogger.com (j) — Tue, 08 Mar 2016 05:24:00 +0000

EoMPLS is point to point L2 VPN services which is used to transport all Ethernet frame received on particular Ethernet or VLAN, its also called Any Transport over MPLS(ATOM) means this technology can connect like Frame-Relay, PPP, Ethernet,ATM etc.

IOS used
c7200-adventerprisek9-mz.151-4.M

Logical Topology

Make sure MPLS with IGP is confugure as shown in a diagram. I'm not going to configure MPLS here. This tutorial only show how to configure xconnect tunnel peer with other side customer faces interface in our network diagram we interconnect PE1 fa1/0 with PE2 fa0/0 interfaces.

Config of PE1

PE1#sh run
Building configuration...

Current configuration : 1337 bytes
!
upgrade fpd auto
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname PE1
!
ip cef

interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip ospf network point-to-point
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.12.2 255.255.255.252
ip ospf 1 area 0
duplex half
mpls ip
!
interface FastEthernet1/0
no ip address
duplex auto
speed auto
xconnect 3.3.3.3 15 encapsulation mpls
!
router ospf 1

mpls ldp router-id Loopback0 force

======================================

PE1#sh mpls l2transport vc

Local intf     Local circuit              Dest address    VC ID      Status
------------- -------------------------- --------------- ---------- ----------
Fa1/0          Ethernet                   3.3.3.3         15         UP

PE1#sh mpls l2transport vc detail
Local interface: Fa1/0 up, line protocol up, Ethernet up
Destination address: 3.3.3.3, VC ID: 15, VC status: up

pc1

PC1> ping 10.10.10.11
84 bytes from 10.10.10.11 icmp_seq=1 ttl=64 time=39.002 ms
84 bytes from 10.10.10.11 icmp_seq=2 ttl=64 time=39.002 ms
84 bytes from 10.10.10.11 icmp_seq=3 ttl=64 time=39.002 ms
84 bytes from 10.10.10.11 icmp_seq=4 ttl=64 time=40.002 ms
84 bytes from 10.10.10.11 icmp_seq=5 ttl=64 time=31.001 ms

PC1> sh ip

NAME        : PC1[1]
IP/MASK     : 10.10.10.10/24
===============================================================

pc2
====
PC2> ping 10.10.10.10
84 bytes from 10.10.10.10 icmp_seq=1 ttl=64 time=40.002 ms
84 bytes from 10.10.10.10 icmp_seq=2 ttl=64 time=40.002 ms
84 bytes from 10.10.10.10 icmp_seq=3 ttl=64 time=41.002 ms
84 bytes from 10.10.10.10 icmp_seq=4 ttl=64 time=59.003 ms
84 bytes from 10.10.10.10 icmp_seq=5 ttl=64 time=41.003 ms

PC2> sh ip

NAME        : PC2[1]
IP/MASK     : 10.10.10.11/24

=================================================================

PE1#sh mpls ldp neighbor all
    Peer LDP Ident: 1.1.1.1:0; Local LDP Ident 2.2.2.2:0
        TCP connection: 1.1.1.1.646 - 2.2.2.2.47031
        State: Oper; Msgs sent/rcvd: 36/35; Downstream
        Up time: 00:24:20
        LDP discovery sources:
          FastEthernet0/0, Src IP addr: 192.168.12.1
        Addresses bound to peer LDP Ident:
          192.168.12.1    1.1.1.1         192.168.13.1
    Peer LDP Ident: 3.3.3.3:0; Local LDP Ident 2.2.2.2:0
        TCP connection: 3.3.3.3.61604 - 2.2.2.2.646
        State: Oper; Msgs sent/rcvd: 21/22; Downstream
        Up time: 00:11:25
        LDP discovery sources:
          Targeted Hello 2.2.2.2 -> 3.3.3.3, active, passive
        Addresses bound to peer LDP Ident:
          3.3.3.3         192.168.13.2

Configuring a Basic MPLS VPN

noreply@blogger.com (j) — Tue, 08 Mar 2016 03:58:00 +0000

It's been a long time I'm away from blogging due to some R&D on the network with Juniper boxes. On this tutorial I'm going to configure very basic MPLS VPN configuration in GNS3. After that we go for EoMPLS configuration.

This is the logical topology for this tutorial.

Here I only post the configuration file from PE other router configuration is almost same. Here is the points should be remember.

1. Make sure IGP with MPLS is configure on PE,P, it shouldn't be configure on customer facing interface.

2. Make sure all loopback interface is reachable.

3. Configure VRF with RD and RT, then applied it on right interface.

4. Configure MP-BGP on PE and peer it.

5. Make sure to redistribute the CE IGP protocol into the BGP and vice versa.

Below command can be copy paste into your router. Before that make sure you had make change necessary things.

Config from PE1

PE1#sh run
Building configuration...

Current configuration : 2126 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname PE1
!
ip cef
ip tcp synwait-time 5
!
!
!
!
ip vrf CustA
rd 100:1
route-target export 1:100
route-target import 1:100
!
no ip domain lookup
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip ospf network point-to-point
ip ospf 1 area 0
!
interface FastEthernet0/0
ip address 192.168.11.2 255.255.255.252
ip ospf 1 area 0
duplex auto
speed auto
mpls ip
!
interface FastEthernet0/1
ip vrf forwarding CustA
ip address 192.168.13.1 255.255.255.252
duplex auto
speed auto
!
!
router eigrp 1
auto-summary
!
address-family ipv4 vrf CustA
redistribute bgp 1 metric 1500 2000 200 100 15000
network 192.168.13.0
no auto-summary
autonomous-system 100
exit-address-family
!
router ospf 1
log-adjacency-changes
!
router bgp 1
no synchronization
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 1
neighbor 3.3.3.3 update-source Loopback0
no auto-summary
!
address-family vpnv4
neighbor 3.3.3.3 activate
neighbor 3.3.3.3 send-community both
exit-address-family
!
address-family ipv4 vrf CustA
redistribute eigrp 100
no auto-summary
no synchronization
exit-address-family

=============

CE1#ping 192.168.24.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.24.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 36/70/92 ms

CE1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     192.168.13.0/30 is subnetted, 1 subnets
C       192.168.13.0 is directly connected, FastEthernet0/1
     192.168.24.0/30 is subnetted, 1 subnets
D       192.168.24.0 [90/307200] via 192.168.13.1, 00:50:22, FastEthernet0/1

Juniper DHCP Server Configuration

noreply@blogger.com (j) — Tue, 01 Sep 2015 12:17:00 +0000

We already configure our QEMU in GNS3 and run our vSRX Router. Now its time to configure DHCP server in our vSRX router. Lets began.
Logical Diagram for this tutorial

To configure DHCP server

Assign Lowest and highest IP range
root# set system services dhcp pool 192.168.1.0/24 address-range low 192.168.1.50 high 192.168.1.200

Assign DNS server (in my case I had used Router interface IP)
root# set system services dhcp pool 192.168.1.0/24 name-server 192.168.1.1

Assign IP address of the router
root# set system services dhcp pool 192.168.1.0/24 router 192.168.1.1

Assign the lease time
root# set system services dhcp pool 192.168.1.0/24 default-lease-time 3600

Assign DHCP as an allowed inbound service for the interface which we are going to enable DHCP.

root# set security zones security-zone untrust interfaces ge-0/0/1 host-inbound-traffic system-services dhcp

Assign IP address to the client faced interface.
root# set interfaces ge-0/0/1 unit 0 family inet address 192.168.1.1/24

Check our client get the IP Address from the server.

How to statically assign IP with fixed MAC address

root#set system service dhcp static-binding 00:50:79:66:68:00 fixed-address 192.168.1.100

PC1>show ip

Request DHCP IP

PC1>dhcp -d

Enjoy

vSRX GNS3 QEMU

noreply@blogger.com (j) — Tue, 01 Sep 2015 12:06:00 +0000

In this tutorial I'm going to run vSRX JunOS in QEMU and configure it as DHCP Server. Lets began with installing vSRX into QEMU.

I have try vSRX to run into Vbox but never succeeded. So I better to choose QEMU otherwise waste of time.

In my case I had used junos-vsrx-12.1X46-D10.2-domestic to mount into QEMU. Search for it.
Now we have to convert our .vdi file into .image, for that use following command

cd d:\junos\
c:\Program Files\GNS3\qemu\>qemu-img.exe convert -O qcow2 d:\junos\junos-vsrx-12.1X46-D10.2-domestic-disk1.vdi d:\junos\junos-vsrx-12.1X46-D10.2-domestic.img

We just made our image ready to run into QEMU. Go the GNS3

Note: Strongly recommended to use QEMU in linux and enable KVM otherwise it eats up all your CPU and RAM.

-nographic -smp 2 -enable-kvm

>edit>preference>choose "QEMU VMs"
Click on "New" Choose "Default " Gave Name "vSRX" (in my case).

I'll use following topology to configure DHCP server for the tutorial.

Now we ready to move on the next step. Configuration DHCP

Juniper Message from syslogd

noreply@blogger.com (j) — Tue, 01 Sep 2015 08:50:00 +0000

While doing some lab test, this weird syslogd message appear every seconds on the console terminal, so it was very difficult to complete the lab.

This messages are due the following syslog configuration .

So for now we are going to de-activate it to generating the message

#deactivate system syslog user *

#commit

The-requested-url-nagioscgi-binstatusmap-cgi-was-not-found-on-this-server

noreply@blogger.com (j) — Thu, 09 Jul 2015 16:10:00 +0000

Everything goes well while installing the Nagios 4.0.8 into Ubuntu 10.04 LTS. However Nagios Map section doesn't plotted the maps of the device. Displayed error like this way

G for god and G for google, found the solution like

Install the package

apt-get install libgd2-xpm install libgd2-xpm-dev

cd /home/jpudasaini/nagios-4.0.8/

Configure the package for installation

./configure -with-gd-lib=/usr/local/lib/

make cgis

Then copy it into the sbin directory

cp /home/jpudasaini/nagios-4.0.8/cgi/*.cgi /usr/local/nagios/sbin/

Change the permission for that files.

chown nagios:nagios /usr/local/nagios/sbin/*.cgi

vSphere Client Displays Empty Inventory

noreply@blogger.com (j) — Wed, 27 May 2015 12:40:00 +0000

Suddenly my home datacenter vsphere lab show empty inventory in vSphere client. There was no any host at all. I have three ( Cisco IOU, CentOS 7, Ubuntu server) host configure for lab purpose. So I must recover those host to complete my lab because I almost completed all labs. Thus here is process how to retrieve those lost host from vSphere client in vSphere 6 database.

Step 1:
Login to the vSphere client choose your database from Configuration Tab > right click database and choose "Browse Dababase".

Step 2: Now next window open the database page. From here open your host folder then choose ".vmx" right click and choose "Add to inventory" then follow the onscreen instruction.

Next window

Select the database

Next click to finish

Now your server is in the inventory list, you can run the server. In my case its my CentOS 7 server, it will run smoothly.

Table Already Exists SQL Server

noreply@blogger.com (j) — Wed, 27 May 2015 07:34:00 +0000

Somehow I have created or you can say I have imported database into SQL and try to continue installation, but error "table already exists sql server" occur then installation has been interrupted. Meanwhile, another error "SQL=Duplicate entry 'add_user' for key 'PRIMARY':" also appear. In this case I had deleted those tables and modified dbsetup file.

CREATE TABLE logs (
id bigint unsigned NOT NULL AUTO_INCREMENT,

to

CREATE TABLE logs (
id bigint(20) unsigned NOT NULL AUTO_INCREMENT,

On sql I have used this command to delete tables

MariaDB [(none)]> use syslog
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [syslog]> drop table {YourTableName};

Huawei Switch Show Commands

noreply@blogger.com (j) — Mon, 25 May 2015 15:19:00 +0000

Here are basic show commands used in Huawei switch. For configuration of Huawei switch click here.

1. Show VLANs
<sw1>display vlan

8. Show port base VLAN
<sw1>display port vlan
Port Link Type PVID Trunk VLAN List
-------------------------------------------------------------------------------
Eth-Trunk0 hybrid 1 -
GigabitEthernet0/0/1 trunk 1 1
GigabitEthernet0/0/2 hybrid 1 -
GigabitEthernet0/0/3 access 301 -
GigabitEthernet0/0/4 access 302 -
GigabitEthernet0/0/5 hybrid 1 -
GigabitEthernet0/0/6 hybrid 1 -
GigabitEthernet0/0/7 hybrid 1 -
GigabitEthernet0/0/8 hybrid 1 -

2. View Configuration
[sw1]display current-configuration configuration
!Software Version V200R003C00SPC300
#
sysname sw1
#
vlan batch 301 to 302
#
stp region-configuration
region-name JR
instance 1 vlan 20 to 30
active region-configuration
#
vlan 30
description fiber
vlan 20
description Wireless
[sw1-mst-region]active region-configuration

[sw1]display stp instance 0 interface GigabitEthernet 0/0/1 brief
MSTID Port Role STP State Protection
0 GigabitEthernet0/0/1 DESI FORWARDING NONE

interface Eth-Trunk 1
port link-type trunk
port trunk allow-pass vlan 20 30
mode lacp

int gi0/0/5
eth-trunk1
undo negotiation auto

int gi0/0/6
eht-trunk1
undo negotiation auto

3. Show interface configuration
[sw1]display interface Eth-Trunk 1
Eth-Trunk1 current state : UP
Line protocol current state : UP

4. LACP port status

[sw1]display eth-trunk 1
Eth-Trunk1's state information is:
Local:
LAG ID: 1 WorkingMode: LACP
Preempt Delay: Disabled Hash arithmetic: According to SIP-XOR-DIP
System Priority: 32768 System ID: 30d1-7eea-c824
Least Active-linknumber: 1 Max Active-linknumber: 8
Operate status: up Number Of Up Port In Trunk: 2
--------------------------------------------------------------------------------
ActorPortName Status PortType PortPri PortNo PortKey PortState Weight
GigabitEthernet0/0/5 Selected 1GE 32768 1 305 10111100 1
GigabitEthernet0/0/6 Selected 1GE 32768 2 305 10111100 1

Partner:
--------------------------------------------------------------------------------
ActorPortName SysPri SystemID PortPri PortNo PortKey PortState
GigabitEthernet0/0/5 32768 001b-0c17-b780 32768 515 1 10111100
GigabitEthernet0/0/6 32768 001b-0c17-b780 32768 514 1 10111100
VID Status Property MAC-LRN Statistics Description
--------------------------------------------------------------------------------
1 enable default enable disable VLAN 0001
301 enable default enable disable fiber
302 enable default enable disable Wireless

5. Show interface vlan

[sw1]display int Vlanif 25
Vlanif25 current state : UP
Line protocol current state : UP
Last line protocol up time : 2014-07-21 18:57:40 UTC-05:13
Description:
Route Port,The Maximum Transmit Unit is 1500
Internet Address is 10.10.10.11/24
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 30d1-7eea-c824
Current system time: 2014-07-21 19:01:47-05:13
Input bandwidth utilization : --
Output bandwidth utilization : --

6. [sw1]ping 10.10.10.10
PING 10.10.10.10: 56 data bytes, press CTRL_C to break
Reply from 10.10.10.10: bytes=56 Sequence=1 ttl=255 time=4 ms
Reply from 10.10.10.10: bytes=56 Sequence=2 ttl=255 time=5 ms
Reply from 10.10.10.10: bytes=56 Sequence=3 ttl=255 time=5 ms
Reply from 10.10.10.10: bytes=56 Sequence=4 ttl=255 time=7 ms
Reply from 10.10.10.10: bytes=56 Sequence=5 ttl=255 time=5 ms

--- 10.10.10.10 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 4/5/7 ms

Huawei Switch Configuration Commands

noreply@blogger.com (j) — Mon, 25 May 2015 14:59:00 +0000

Here are some Huawei switch configuration command and verification command is here.

1. Enter int to the privilege mode
<sw1>system view

2. Create the VLAN
[sw1]vlan 30
[sw1]des fiber

3. Configure interface trunk
[sw1]interface GigabitEthernet 0/0/1
[sw1-GigabitEthernet0/0/1]port link-type trunk

4. Configure interface access
[sw1-GigabitEthernet0/0/3]port link-type access
[sw1-GigabitEthernet0/0/4]port link-type access

5. Assign vlan to that port
[sw1]vlan 30
[sw1-vlan30]port GigabitEthernet 0/0/3
[sw1]vlan 30
[sw1-vlan30]port GigabitEthernet 0/0/4

6. Change port speed and duplex
[sw1]interface GigabitEthernet 0/0/3
[sw1-GigabitEthernet0/0/3]undo negotiation auto
[sw1-GigabitEthernet0/0/3]speed ?
10 10M port speed mode
100 100M port speed mode
1000 1000M port speed mode
auto-negotiation Auto negotiation
[sw1-GigabitEthernet0/0/3]speed 100
[sw1]int gi0/0/4
[sw1-GigabitEthernet0/0/4]undo negotiation auto
[sw1-GigabitEthernet0/0/4]speed 100

[sw1-GigabitEthernet0/0/4]duplex ?
full Full-Duplex mode
half Half-Duplex mode
[sw1-GigabitEthernet0/0/4]duplex full

7. Configure VLAN and add VLAN in trunk port
[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 301 302
Info: This operation may take a few seconds. Please wait for a moment...done.

8. MST Configuration

[sw1]stp region-configuration
Info: Please activate the stp region-configuration after it is modified.
[sw1-mst-region]region-name JP
[sw1-mst-region]instance 1 vlan instance 1 vlan 10 20 30 to 50 600 to 616
[sw1-mst-region]instance 0 vlan 302

9. Create management interface
[sw1]interface Vlanif 25
Error: Can not create this interface because the interface number of this type has reached its maximum.
[sw1]undo interface Vlanif 1
[sw1-Vlanif25]ip add 10.10.10.11 255.255.255.0
[sw1-Vlanif25]ip route-static 0.0.0.0 0.0.0.0 129.102.0.2

10. Configure SSH

[sw1]rsa local-key-pair create
The key name will be: sw1_Host
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
it will take a few minutes.
Input the bits in the modulus[default = 2048]:1024
Generating keys...
.....++++++
..........++++++
.................+++++
...+++++

11. Create local user
[sw1]aaa
[sw1-aaa]local-user jpudasaini password ?
cipher User password with cipher text
irreversible-cipher User password with irreversible-cipher text
<cr>

[sw1-aaa]local-user jpudasaini password
Please configure the login password (8-16)
It is recommended that the password consist of at least 2 types of characters, including lowercase letters, uppercase letters, numerals and special characters.
Please enter password:
Please confirm password:
Info: Add a new user.

[sw1-aaa]local-user jpudasaini service-type ssh telnet

12. Configure telnet session
[sw1]stelnet server enable
[sw1]ssh authentication-type default password
[sw1]ssh user jpudasaini
[sw1]ssh user jpudasaini authentication-type password
[sw1]ssh user jpudasaini service-type stelnet

[sw1]user-interface vty 0 4
[sw1-ui-vty0-4]authentication-mode aaa
[sw1-ui-vty0-4]protocol inbound ssh

[sw1-aaa]local-user jpudasaini privilege level 15
[sw1-aaa]local-user jpudasaini service-type ssh
[sw1]ssh authentication-type default password

13. DHCP Snooping enable
[huawei-sw1]dhcp enable
[huawei-sw1]dhcp snooping enable ipv4
[huawei-sw1]dhcp server detect

[huawei-sw1]dhcp snooping check dhcp-rate enable
<huawei-sw1>display dhcp snooping
[huawei-sw1]dhcp snooping check dhcp-rate 50

14. Apply to VLAN
[huawei-sw1]vlan 301
[huawei-sw1-vlan301]dhcp snooping enable

15. Apply to Interface
[huawei-sw1-GigabitEthernet0/0/3]dhcp snooping enable
[huawei-sw1-GigabitEthernet0/0/3]dhcp snooping check dhcp-rate enable

16. Apply to Trunk port
[huawei-sw1-GigabitEthernet0/0/4]dhcp snooping trusted

17. Verify Command
[huawei-sw1]display dhcp snooping configuration
#
dhcp snooping enable
dhcp snooping check dhcp-rate enable
dhcp snooping check dhcp-rate 50
dhcp server detect
#
vlan 301
dhcp snooping enable
#
interface GigabitEthernet0/0/3
dhcp snooping enable
dhcp snooping check dhcp-rate enable
#
interface GigabitEthernet0/0/4
dhcp snooping trusted

PERL can't locate module in @ INC

noreply@blogger.com (j) — Fri, 24 Apr 2015 18:12:00 +0000

Hi, recently when I'm trying to install some linux daemon in CentOS 7 I have encountered a PERL issue, indicating that some module are missing e.g.

Can't locate sys/syslog.pm in @INC

It means it can't find the pear-sys-syslog. So I have to install this daemon to continue my installation. In my case its syslog.pm but you may encounter different than this. I mean the module name is different, but the error code is same. You need to search that package and install it. In my case I have just used this module

root@localhost#yum install -y perl-sys-syslog

Now the installation has been working.

show command juniper switch

noreply@blogger.com (j) — Tue, 21 Apr 2015 17:06:00 +0000

Here are some useful command in day to day life while troubleshooting the juniper switch.

1. show mac add of specific vlan
root@jpudasaini#show ethernet-switching table vlan 608

2. compare configure before commit
  root@jpudasaini#show | compare

3. check mac add
  root@jpudasaini#show ethernet-switching table brief

4. show perticular Mac in Juniper
  root@jpudasaini#show ethernet-switching table | match d4ca.6dea.d420

5. show port description/status
  root@jpudasaini#show interfaces descriptions statistics

6. Show configuration in configuration mode
  root@jpudasaini#show configuration | display set

7. show correctness of the command before commit
  root@jpudasaini#commit check

8. Show Link Layer detection Protocol
  root@jpudasaini#show protocols lldp

9. Show vlan in configuration mode
root@jpudasaini#show vlans | display set

PEAR Succeeded but it is not a valid package archive

noreply@blogger.com (j) — Tue, 21 Apr 2015 15:10:00 +0000

Recently I encounter following problem while installing PEAR in Ubuntu 14.04 server, after long search I found that, it is a bug already reported a long before. Solution at bottom of the page.

root@dns:~# pear install DB
WARNING: "pear/DB" is deprecated in favor of "pear/MDB2"
WARNING: "pear/Console_Getopt" is deprecated in favor of "pear/Console_GetoptPlus"
downloading DB-1.8.2.tgz ...
Starting to download DB-1.8.2.tgz (131,693 bytes)
.............................done: 131,693 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/DB-1.8.2.tgz"
Download of "pear/DB" succeeded, but it is not a valid package archive
Error: cannot download "pear/DB"
downloading PEAR-1.9.5.tgz ...
Starting to download PEAR-1.9.5.tgz (290,006 bytes)
...done: 290,006 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/PEAR-1.9.5.tgz"
Download of "pear/PEAR" succeeded, but it is not a valid package archive
Error: cannot download "pear/PEAR"
downloading Archive_Tar-1.3.16.tgz ...
Starting to download Archive_Tar-1.3.16.tgz (20,024 bytes)
...done: 20,024 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/Archive_Tar-1.3.16.tgz"
Download of "pear/Archive_Tar" succeeded, but it is not a valid package archive
Error: cannot download "pear/Archive_Tar"
downloading Console_Getopt-1.4.0.tgz ...
Starting to download Console_Getopt-1.4.0.tgz (4,534 bytes)
...done: 4,534 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/Console_Getopt-1.4.0.tgz"
Download of "pear/Console_Getopt" succeeded, but it is not a valid package archive
Error: cannot download "pear/Console_Getopt"
downloading XML_Util-1.2.3.tgz ...
Starting to download XML_Util-1.2.3.tgz (17,134 bytes)
...done: 17,134 bytes
could not extract the package.xml file from "/build/buildd/php5-5.5.9+dfsg/pear-build-download/XML_Util-1.2.3.tgz"
Download of "pear/XML_Util" succeeded, but it is not a valid package archive
Error: cannot download "pear/XML_Util"
Download failed
install failed

Solution: Edit /usr/share/php/Archive/Tar.php find and replace the following 'gzopen' with gzopen64' and 'gzseek' with gzseek64'

Juniper switch Basic Configuration Commands

noreply@blogger.com (j) — Wed, 31 Dec 2014 06:13:00 +0000

Hello fellow blog reader, after long gap I'm going to write this thread regarding the basic Juniper command and configuration. I try to include as much as troubleshooting/configuration command during day to day work.
I would like to thank to Srijan pointing the error on LACP command.

1. Set username for login
root@jpudasaini#set system root-authentication encrypted-password
New password:
Retype new password:

root@jpudasaini#set system login user jay full-name jaypudasaini uid 400 class super-user authentication encrypted-password

2. Hostname configuration.
root@switch#set system host-name jpudasaini
root@jpudasaini#

3. Set Tacplus authentication for juniper switch.
root@jpudasaini# set system authentication-order tacplus
root@jpudasaini# set system authentication-order password
root@jpudasaini# set system root-authentication encrypted-password "you password here"
root@jpudasaini# set system tacplus-server 10.10.10.10(your tacplus server IP) secret "your server password here"
root@jpudasaini#set system tacplus-options service-name test

4. Configuration VLAN(Group)
root@jpudasaini#set vlans Cust-Fiber vlan-id 500-550
root@jpudasaini#set vlans Cust-Wireless vlan-id 551-575
single vlan
root@jpudasaini#set vlans Cust-A vland-id 25

5. Trunk Port Configuration
root@jpudasaini#set interfaces ge-0/0/9 description connect-to-sw2
root@jpudasaini#set interfaces ge-0/0/9 unit 0 family ethernet-switching port-mode trunk
root@jpudasaini#set interfaces ge-0/0/9 unit 0 family ethernet-switching vlan members Cust-Fiber

6. Access Port Configuration
root@jpudasaini#set interfaces ge-0/0/0 description Link-to-sw3
root@jpudasaini#set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode access
root@jpudasaini#set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 25

7. Port Channel Configuration
root@jpudasaini#set chassis aggregated-devices ethernet device-count 10
root@jpudasaini#set interfaces ae0 description TR-2-Jpudasaini-Sw2
root@jpudasaini#set interfaces ae0 aggregated-ether-options lacp active
root@jpudasaini#set interfaces ae0 unit 0 family ethernet-switching port-mode trunk
root@jpudasaini#set interfaces ae0 unit 0 family ethernet-switching vlan members Cust-Fiber
root@jpudasaini#set interfaces ae0 unit 0 family ethernet-switching vlan members Cust-Wireless

8. Port Channel Assign to the Physical Port
root@jpudasaini#set interfaces ge-0/0/16 description test-sw1
root@jpudasaini#set interfaces ge-0/0/16 ether-options 802.3ad ae0
root@jpudasaini#set interfaces ge-0/0/17 description test-sw1
root@jpudasaini#set interfaces ge-0/0/17 ether-options 802.3ad ae0

9. Configuration management IP for switch.
root@jpudasaini#set interfaces vlan unit 20 family inet address 10.10.10.11/24

10. Configuration snmp.
root@jpudasaini#set snmp name Test-SNMP
root@jpudasaini#set snmp description test-sw2
root@jpudasaini#set snmp location "Jpudasaini-NOC"
root@jpudasaini#set snmp contact "system@jpudasaini.com.np"
root@jpudasaini#set snmp client-list list0 10.10.10.0/24
root@jpudasaini#set snmp community ax3R5vgW authorization read-only
root@jpudasaini#set snmp community ax3R5vgW client-list-name jpudasaini

11. Enable LLDP
root@jpudasaini# set protocols lldp interface all
root@jpudasaini#set protocols lldp-med interface all

12. Configure port as L3
root@jpudasaini#set interface ge-0/0/23 unit 0 family ethernet-switching port-mode trunk
root@jpudasaini#set interface ge-0/0/23 unit 0 family ethernet-switching vlan member 25
root@jpudasaini#set vlan Mgmt vlan-id 25
root@jpudasaini#set vlan Mgmt l3-interface vlan.25
root@jpudasaini#set interface vlan.250 family inet address xxx.xxx.xxx.xxx

13.Rate Limit
Configure the policer

root@jpudasaini# set firewall policer Policer_2M if-exceeding bandwidth-limit 1M
root@jpudasaini# set firewall policer Policer_2M if-exceeding burst-size-limit 2k
root@jpudasaini# set firewall policer Policer_2M then discard

Configure the firewall filter

root@jpudasaini# set firewall family ethernet-switching filter Limit term 1 then accept
root@jpudasaini# set firewall family ethernet-switching filter Limit term 1 then policer Poicer_2M

Apply filter on interface (can be any interface as required)

root@jpudasaini# set interface ge-0/0/24.0 family ethernet-switching filter input Limit

Note: Remember that EX series switches apply rate limit only on ingress.

Cisco Protected Port

noreply@blogger.com (j) — Wed, 29 Oct 2014 16:31:00 +0000

I can see in my network any customer can communicate to any one on the same VLAN. Basically when ever any unknown packets ingress into the switch. Switch found no record in CAM table, so that frame flood every port of the respected VLAN, except the frame received port. Such a communication can very dangerous for the service provider and its customer. Because any one can sniff or send information to other customer in same VLAN.

Broadcast packet also flooded into the network that can bottleneck our network. The way to protect such a bottleneck of the network we can configure switch port as protected port thus no port can directly communicated in a same broadcast domain.

Command:
interface fa0/2
switchchport mode access
switchport access vlan 30
switchport protected

This way we can protect the user in same VLAN. Protected port only be configured in edge port not the trunk port or L3 connected port. Now the protected port prevent any unicast, broadcast or multicast packet entering to the same switch interface. But traffic forwarded to same domain can be communicated through L3 device like router.

How To Configure RSPAN on Cisco Switch

noreply@blogger.com (j) — Wed, 08 Oct 2014 08:38:00 +0000

Sometime I need to analyze network traffic from remote switch. Thus RSPAN is life saver. Go to the site and capturing the packets and analyze the packets is very time consuming. So here a small tutorial which explain how to configure packets with RSPAN.

SW1(This is the remote switch, Which is the source for our packets.)

sw1(config)#vlan 444
sw1(config-vlan)#remote-span
sw1(config)#monitor session 1 source interface Fa1/0/1 - 16
sw1(config)#monitor session 1 destination remote vlan 444

SW2(The destination switch where you going sniff the packets send my remote switch on case sw1.)
sw2(config)#vlan 444
sw2(config-vlan)#name RSPAN_VLAN
sw2(config-vlan)#remote-span

sw2(config)#monitor session 1 destination interface Gi0/17
sw2(config)#monitor session 1 source remote vlan 444

Now you can capture remote packets in port 17.

All these tutorial tested on cisco 3750 switch.