snippets101

Back-To-Back cables for T1/E1/BRI/E&M

noreply@blogger.com (Alberto) — Mon, 21 Sep 2009 07:21:00 +0000

This is a simple reference to make back-to-back connections. Very useful in lab scenarios with voice gateways emulating the PSTN.

Thanks to Aashish for this :

T1/E1 crossover (for PRI and CAS back-to-back connection):

RJ-45 ----- RJ-45
   1 ----- 4
   2 ----- 5
   4 ----- 1
   5 ----- 2

RJ-45 ----- DB-15
   1 -----   1
   2 -----   9
   4 -----   3
   5 ----- 11

DB-15 ----- DB-15
   1 -----   3
   3 -----   1
   9 ----- 11
11 -----   9

ISDN BRI crossover (for BRI back-to-back connection):

RJ-45 ----- RJ-45
   3 ----- 4
   4 ----- 3
   5 ----- 6
   6 ----- 5

Analog E&M (for analog E&M back-to-back connection):

RJ-45, 2-wire audio
   1 ----- 8
   2 ----- 7
   4 ----- 5
   5 ----- 4
   7 ----- 2
   8 ----- 1

RJ-45, 4-wire audio
   1 ----- 8
   2 ----- 7
   3 ----- 5
   4 ----- 6
   5 ----- 3
   6 ----- 4
   7 ----- 2
   8 ------ 1

Analog FXS/FXO back-to-back connection:

RJ-11 ----- RJ-11
2 ----- 3
3 ----- 2

    RJ-11 connector
    ===============
         _____
        /    /|
       /4321/ |
      /____/ |
      |||||| /
      |    | /
      |_--_|/
        \_\

    RJ-45 connector
    ===============
     _________
    /        /|
   /87654321/ |
/________/ |
|||||||||| /
|   __   | /
|__| |__|/
      \_\

DB-15 male connector
====================

pin 1 _______________ pin 8
/. . . . . . . .\
\ . . . . . . . /
pin 9 \_____________/ pin 15

Backup data with bcp

noreply@blogger.com (Alberto) — Thu, 21 Aug 2008 10:37:00 +0000

What I wanted was not to have more of two months of data online in my table. In order to do accomplish this task I decided to use Ms SQL Server's Bulk Copy Program (bcp).

Here's the MSDN page on bcp usage :
http://msdn.microsoft.com/en-us/library/ms162802.aspx

Then, using osql (MSDN) I'll clean up the table of the rows backupped.

In my table there's a field named dtRow which contains the timestamp as UTC.

I wrote this little batch :

@echo off

:CHECK_ARGUMENTS

if "%1"=="" goto PRINT_USAGE

if "%1"=="-?" goto PRINT_USAGE

:CHECK_ARG_DIRECTION

if "%1"=="in" goto RESTORE_AREA

if "%1"=="out" goto BACKUP_AREA

goto PRINT_USAGE

:BACKUP_AREA

:CHECK_ARG_DAYS

if %2==-d goto CHECK_ARG_DAYS_2

if not %1==-d goto PRINT_USAGE

:CHECK_ARG_DAYS_2

if not "%3"=="" goto CHECK_ARG_PATH

goto PRINT_USAGE

:CHECK_ARG_PATH

if not "%4"=="" goto CHECK_BCP

goto PRINT_USAGE

:CHECK_BCP

echo Looking for BCP....

IF EXIST %PROGRAMFILES%\Microsoft SQL Server\80\Tools\Binn\bcp.exe GOTO CHECK_BCP_OK ELSE GOTO CHECK_BCP_KO

:CHECK_BCP_OK

echo BCP exists.

goto CHECK_OSQL

:CHECK_BCP_KO

echo BCP does not exist!!.

goto EXITPROGRAM

:CHECK_OSQL

echo Looking for OSQL....

IF EXIST %PROGRAMFILES%\Microsoft SQL Server\80\Tools\Binn\osql.exe goto CHECK_OSQL_OK ELSE GOTO CHECK_OSQL_KO

:CHECK_OSQL_OK

echo OSQL exists.

goto BACKUP_DATA

:CHECK_OSQL_KO

echo OSQL does not exist!!.

goto EXITPROGRAM

:BACKUP_DATA

ECHO BACKUP DATA....

SET query="SELECT * FROM MyDB.dbo.MyTable WHERE dtRow > ((SELECT TOP 1 dtRow FROM MyDB.dbo.MyTable ORDER BY dtRow DESC) - 86400*%3)"

"%PROGRAMFILES%\Microsoft SQL Server\80\Tools\Binn\bcp.exe" %query% queryout %4 -N -U sa -P sa -S.\SQL2000

IF not %ERRORLEVEL%==0 goto ERROR_BACKUP

:DELETE_DATA

ECHO.

ECHO DELETING SAVED ROWS

SET query="DELETE FROM MyDB.dbo.MyTable WHERE dtRow > ((SELECT TOP 1 dtRow FROM MyDB.dbo.MyTable ORDER BY dtRow DESC) - 86400*%3)"

"%PROGRAMFILES%\Microsoft SQL Server\80\Tools\Binn\osql.exe" -S.\SQL2000 -U sa -P sa -d MyDB -Q %query%

ECHO Done.

goto EXITPROGRAM

:RESTORE_AREA

echo RESTORING DATA....

"%PROGRAMFILES%\Microsoft SQL Server\80\Tools\Binn\bcp.exe" MyDB.dbo.MyTable in %4 -N -U sa -P sa -S.\SQL2000

ECHO Done.

goto EXITPROGRAM

:PRINT_USAGE

ECHO Simple Backup Utility

ECHO Usage : obu {in | out} -d days path

ECHO days : Number of days to backup

ECHO starting from the last record.

ECHO path : Path of the backup file.

:ERROR_BACKUP

echo Error during backup phase. Aborting...

goto EXITPROGRAM

:EXITPROGRAM

Cisco and Nokia Dual Mode Part IV : SIP

noreply@blogger.com (Alberto) — Thu, 21 Aug 2008 08:24:00 +0000

Now time's to try the embedded SIP client on the Nokia devices.

As for reference I started with the Cisco manual (quite clear) :
http://www.cisco.com/en/US/partner/docs/voice_ip_comm/cucm/admin/6_0_1/ccmcfg/b09sip3p.html

then I continued sniffing with wireshark the SIP registration (which failed), and at last I found the last useful clues on the Cisco NetPro Forum (thanks Ron!)

I decided to try with the Third Party Basic SIP device, however procedure for the Advanced SIP device is almost the same.

So at last here's the working configuration :

First configure the CUCM :

Get to System->Security Profile->Phone Security Profile and copy the Third-party SIP Device Basic - Standard SIP Non-Secure Profile and rename it (I used Third-party SIP Device Basic - LAB SIP Non-Secure Profile) and check the Enable Digest Authentication option. Leave unchanged the other settings.

Add the device as a Third-party SIP Device (Basic), set the phone's mac address (here's how to get it) and be sure to set this settings :
Device Security Profile to the security profile yuo've created previously
Digest User to your End User

Define the DN for your device.

In the End User configuration set the digest credentials (an alphanumeric password) and make the device association with the SIP phone.

Then it's time to configure the Nokia phone :

First get to Tools->Settings->SIP settings and create a new SIP profile :
Profile name :SIP
Service profile : IETF
Default access-point :<your access point>
Public username : sip:<dn>@><cucm ip>
Use compression : No
Registration : Always on
Use security : No

Proxy server
Proxy server address : sip:<cucm ip>
Realm : ccmsipline
Username : <End user userid>
Password : <Digest credentials>
Allow Loose routing : Yes
Transport type : UDP
Port : 5060

Registrar server
Registrar serv. addr. : sip:<cucm ip>
Realm : ccmsipline
Username : <End user userid>
Password : <Digest credentials>
Transport type : UDP
Port : 5060

Then get to Tools->Settings->Internet tel. settings and create a new SIP profile :
Name : Cisco SIP
SIP profile : SIP

Et voilà, if WLAN configuration is correct, you should see the phone register immediately.

Cisco and Nokia Dual Mode Part III : Mobility my way

noreply@blogger.com (Alberto) — Tue, 19 Aug 2008 08:30:00 +0000

After having configured the networking part of the problem here and then refined roaming here, time's to expose the Communications Manager side.

Targets were simple :

People who have a dual-mode phone should always be reachable via IP if in WLAN coverage, regardless the caller dialed the office number or the mobile number.
People who have a dual-mode phone should not be always reachable regardless the number dialed, but only if called on the cellular number, no automatic call diverting from the office number to the mobile number.
The configuration should be as simple as possible and possibly cheap in terms of DLU

We decided not to implement the entire Cisco Mobility suite, but a subset of functions so saving DLUs and having the funtionality we needed.

Extension Mobility is enabled on all the IP Phones and users. Each desk phone has a dummy (not valid on the PSTN) line in a partition called Logout, from which can call only other desk phones, logged in users and emergency (there's a transformation pattern to make it exit on the PSTN).

Each user has a device profile with his personal line in a partition called Login (where all the logged in lines are).

Each dual-mode nokia mobile has two lines : the first shared with the device profile, the second belonging to a partition called Dual-Mode, unreacheable by anyone except from a particular CSS used by translation patterns.

This way behavior is :
People dialing the user's line while he is logged off from the desk phone and not under WLAN coverage (away) get fast busy or is redirected to VoiceMail.

People dialing the user's line while he is logged off from the desk phone but he is under WLAN coverage succeed in connecting since the line is active on the mobile through the Nokia IntelliSync Call Connect for Cisco.

People dialing the user's line while he is logged in and under WLAN coverage makes both the phones ring (shared line). Two notes on this : while in conversation on the mobile you can put the call on hold and then resume it from the desk phone (useful if you answer while away and the you reach your office), if you answer from the desk phone while both ringing, on the mobile you'll find a fake missed call.

People dialing the user's mobile number while he is under WLAN coverage will have their call translated to the "hidden" line on the mobile so using VoIP.

People dialing the user's mobile number while he is not under WLAN coverage will have their call translated to the "hidden" line on the mobile which have a call forward unregistered entry to the real mobile number.

Here's how this is configurated :

Partitions :
Logout : All the devices with no device profile logged in.
Login : All the lines of the device profiles
DualMode : All the "hidden" second lines on the nokia mobiles.

Desk Phone :
1000 in Logout partition.

Device Profile :
2000 in Login partition.

Mobile Phone :
2000 in Login partition.

7000 in DualMode partition.
Call Forward Unregistered on #3331234567 (mobile number)

Translation Pattern :
03331234567 becomes 7000
This one makes people looking for you on the mobile being translated on VoIP.

Route Pattern :
#.[3]! -> PreDot discard and prepend 0.
If you are not under WLAN coverage, the CFU to #3331234567 is routed to your real mobile. This is necessary because redirecting on the real number (03331234567) would meake the call enter a loop (the above mentioned translation pattern...)

Here's some self-explaining slides :

Cisco and Nokia Dual-Mode Part II : CCKM

noreply@blogger.com (Alberto) — Mon, 18 Aug 2008 08:39:00 +0000

After having made everything work with EAP-MSCHAPv2 (check out chapter one) I started the fine tuning session, thus finding some roaming issues.

In the Nokia IntelliSync Call Connect Datasheet (here) it is clear that the E-series are CCXv3 compatible.

On the Cisco side, this document says that CCKM with EAP-PEAP (MSCHAP) authentication is supported only with CCXv4 compatible devices.

Finally, the authentication provided by MS IAS on our infrastructure do not support LEAP (alternative to PEAP) so we need to move to a Cisco RADIUS authenticator i.e. ACS (at least in this phase, later we'll use the Cisco ACS 4 as a proxy vs. domain authentication).

Ok, we have to move from EAP-PEAP (MSCHAPv2) to EAP-LEAP protocol authenticating on Cisco ACS.

Here's the cisco doc on configuring the Cisco ACS for LEAP.

Once configured, we'll have to change both WLC and Phone's configuration.

The Wireless LAN Controller (from WCS):

Note on the last tab that DHCP Addr. Assignment Required should UNchecked otherwise you could ask for a new IP at each roaming session.

The Nokia Phone :

-Connection name : VoWLAN
-Databearer : Wireless WAN
-WLAN netw. name: TEST-ACS
-Network status: Hidden
-WLAN netw. mode: Infrastructure
-WLAN security mode: 802.1x (NOT WPA/WPA2)
-WLAN security settings :
--WPA mode: EAP
--EAP plug-in settings:
---EAP-LEAP (select only this, put in the higher position and disable all the others) :

---EAP-LEAP Configuration :
----User name: [Your radius user name]
----Prompt password: No
----Password: [Your radius password]

Now set this connection in the SCCP Profile and the registration to Always On (in chapter one you can find more info and links on this).

How can I see if CCKM is active ? Obviously user experience is useful, i.e., fast roaming is easily noticeable when speaking and walking togheter. However sometimes you could experience some holes in conversation without knowing if you have misconfigured CCKM or the WLAN coverage is not excellent, or both.

Debugging a client on the WLC will give you immediate evidence on this.

This Cisco doc is very useful to understand the entire process, however simply checking for a simple word in the debug output is simpler :

On the WLC issue the command "debug client [mac address of the Nokia device]" (here's how to see the nokia device's WLAN mac address).

Now start a conversation (ip obviously) with the nokia device and start walking so forcing a roaming. Each roaming makes the debug session display a huge amount of information about authentication, dot1x, etc (debugging...).
If CCKM is well configured, you should see in the roaming session output

CCKM: Mobile is using CCKM

and NOT see

Received EAPOL-key in REKEYNEGOTIATING state

If you normally experience correct fast roaming (CCKM) sessions and only sometimes you find key renegotiation (together with worse user experience) then you should check WLAN coverage in that areas, however CCKM should be well configured.

Hope this helps.

Cisco ACE and Private VLANs in Switch Mode

noreply@blogger.com (Alberto) — Wed, 13 Aug 2008 11:44:00 +0000

This one comes from the esigence to create a housing zone with a shared load balancer. The idea is to keep things as simple as possible providing isolation and all advanced load balancing feature.

So there will be only one vlan for one-armed servers and isolation will be provided by Private VLANs. However, being the ACE shared across the pvlans I had to add access lists to control traffic from one pvlan through another's vip.

Another element of simplicity in this design is the ACE module in switch-mode, this way providing a unique default gateway for all the servers (loadbalanced and not).

The network diagram :

The ACE configuration :

switch-mode

rserver host SERVER-10.1

ip address 10.0.10.1

inservice

rserver host SERVER-10.2

ip address 10.0.10.2

inservice

serverfarm host LAB-A_20.1:80

rserver SERVER-10.1 80

inservice

rserver SERVER-10.2 80

inservice

serverfarm host LAB-B_21.1:80

rserver SERVER-10.3 80

inservice

rserver SERVER-10.4 80

inservice

class-map match-any L4-SNAT
2 match source-address 1.0.10.0 255.255.255.0

class-map match-all L4-LAB-A_20.1:80

2 match virtual-address 10.0.20.1 tcp eq www

class-map match-all L4-LAB-B_21.1:80

2 match virtual-address 10.0.21.1 tcp eq www

policy-map type loadbalance first-match L7-LAB-A_20.1:80

class class-default

serverfarm LAB-A_20.1:80

policy-map type loadbalance first-match L7-LAB-B_21.1:80

class class-default

serverfarm LAB-B_21.1:80

policy-map multi-match L4-POLICYMAPMULTI
class L4-SNAT
nat dynamic 10 vlan 100

class L4-LAB-A_20.1:80

loadbalance vip inservice

loadbalance policy L7-LAB-A_20.1:80

loadbalance vip icmp-reply active

class L4-LAB-B_21.1:80

loadbalance vip inservice

loadbalance policy L7-LAB-B_21.1:80

loadbalance vip icmp-reply active

service-policy input L4-POLICYMAPMULTI

interface vlan 100

description SERVERSIDE

ip address 1.1.1.200 255.255.255.0

no normalization

no icmp-guard
nat-pool 10 10.0.100.1 10.0.100.15 netmask 255.255.255.224 pat

no shutdown

interface vlan 150

description FIREWALLSIDE

ip address 1.0.0.2 255.255.255.0

no normalization

no icmp-guard

no shutdown

ip route 0.0.0.0 0.0.0.0 1.0.0.1

The router's configuration :

svclc module 11 vlan-group 100

svclc vlan-group 100 10,20,100,150

vlan 10
private-vlan community

vlan 20
private-vlan community

vlan 100
name SERVERSIDE

private-vlan primary
private-vlan association 10,20

vlan 150
name P2P-C65-ACE

interface Vlan100
ip vrf forwarding LAB
private-vlan mapping 10,20

interface Vlan150
ip vrf forwarding LAB
ip address 10.0.0.1 255.255.255.240

As usual, on the ACE there's a nat pool to permit server to server load balancing, further information here and here.

"Horizontal" connections across the VLAN's broadcast are prevented by the private vlans' mechanism. However, a server belonging to the PVLAN A can connect to a VIP belonging (logically, as VIPs on the ACE are not PVLAN aware) to PVLAN B.

Being the ACE the default gateway, default behavior must be permit ip any any. Using access-lists and object-groups I created a matrix of negations between real servers on each pvlan versus all the VIPs of the other PVLANs :

object-group network GROUPA

host 10.0.10.1

host 10.0.10.2

object-group network GROUPB

host 10.0.10.3

host 10.0.10.4

object-group network VIPSGROUPA

host 10.0.20.1

object-group network VIPSGROUPB

host 10.0.20.2

access-list ACL01 line 7 extended deny ip object-group GROUPA object-group VIPSGROUPB

access-list ACL01 line 11 extended deny ip object-group GROUPA object-group VIPSGROUPB

access-list ACL01 line 15 extended permit ip any any

access-group input ACL01

Again, many thanks to Daniele and Marco for support on the lab.

Asymmetric Server Normalization on Cisco ACE

noreply@blogger.com (Alberto) — Tue, 12 Aug 2008 10:42:00 +0000

Summertime, I've some time to spend in the lab to try some new scenarios, optimization or try something read on the release notes.
This scenario is mostly a proof of concept as in our DataCenter many applications use server to server load balancing and it requires a too messy configuration to make it work with ASN.
From the Cisco doc :

Asymmetric Server Normalization (ASN) allows the ACE to load balance an initial request from the client to a real server; however, the server directly responds to the client bypassing the ACE. This behavior allows the acceleration of server to client communications and is transparent to the client. When the ACE operates in ASN, it does not perform any network translation when receiving packets destined to the VIP address. Traffic from the client hits the VIP address and the ACE uses the address as the destination address but rewrites the destination MAC address to the address of the real server.

So the match is speed vs. capabilities.
Since the ACE do not control the entire flow (it sees only the packets vs. the VIP) most of the advanced load balancing features aren't usable.
However, in some cases, where speed is the most important thing and the application flow is quite simple it could be a good choice.
Here's my implementation :

On the ACE :

access-list ACL01 line 8 extended permit ip any any

! The probe should check for the health status of the loopback interface
! on the real server.
probe icmp ICMP
ip address 10.0.20.1
interval 5

rserver host SERVER-10.1
ip address 10.0.10.1
inservice
rserver host SERVER-10.2
ip address 10.0.10.2
inservice

! The transparent command prevents the ACE to make a destination NAT,
! sending the packet as is to the real server.
serverfarm host LAB_20.1:80
transparent
probe ICMP
rserver SERVER-10.1 80
inservice
rserver SERVER-10.2 80
inservice

class-map match-all L4-LAB_20.1:80
2 match virtual-address 10.0.20.1 tcp eq www

policy-map type loadbalance first-match L7-LAB_20.1:80
class class-default
serverfarm LAB_20.1:80
policy-map multi-match L4-POLICYMAPMULTI
class L4-LAB_20.1:80
loadbalance vip inservice
loadbalance policy L7-LAB_20.1:80
loadbalance vip icmp-reply active

service-policy input L4-POLICYMAPMULTI
access-group input ACL01

!The ACE is used as a bare load balancer, diasbling normalization (to make ASN work),
! and icmp-guard.
interface vlan 100
description SERVERSIDE
ip address 1.1.1.199 255.255.255.0
no normalization
no icmp-guard
no shutdown
interface vlan 150
description FIREWALLSIDE
ip address 1.0.0.2 255.255.255.0
no normalization
no icmp-guard
no shutdown

ip route 0.0.0.0 0.0.0.0 1.0.0.1

On the router :

ip route vrf LAB 10.0.20.0 255.255.255.0 10.0.0.2

This way everything works fine. Now it's time to make server to server load balancing work in this scenario.
What I wanted to work is a load balanced server that calls for its VIP being load balanced on itself or on another real server in the same area. Note that this scenario is different since here real server's are one-armed.

The choice to have a point-to-point vlan between the router and the ACE comes with the esigence to control traffic for some feature I needed described further. For simple ASN scenarios the ACE could easily have only one arm on the real servers' vlan (100).

Here's some observations I made :
1) Without any further configuration, server to server loadbalancing doesn't work as there's a loopback interface on the server with the VIP configured on it, you'll never get out of it.
2) You will need both source NAT and destination NAT to make it work.
3) You will have to make the ACE see all of the flow to make the NAT work.
4) You can't use ASN for server to server load balancing

I will not enumerate all of the tries I made to make it work (from which come the observations), here's my solution : double NAT (source and destination) on the router (6513 in this case) so that the ACE treats the connection as a normal external client request.

Here's the router's configuration :

interface Vlan100
ip vrf forwarding LAB
ip address 10.0.10.200 255.255.255.0
ip nat outside
!
interface Vlan150
ip vrf forwarding LAB
ip address 10.0.0.1 255.255.255.0
ip nat inside

ip nat inside source static 10.0.20.1 4.4.4.1
ip nat outside source static 10.0.10.1 6.6.6.1

ip route vrf LAB 10.0.20.0 255.255.255.0 10.0.0.2
ip route vrf LAB 4.4.4.0 255.255.255.0 10.0.0.2
ip route vrf LAB 6.6.6.1 255.255.255.255 10.0.10.199

The last route is a little tricky : as returning packets come from an outside zone to an inside one, packets need to be first routed and the natted. So you'll have to put a "fake" route versus an inside endpoint to make the packet then match the nat rule.

On the real servers you have a route to make all NATted request return by the ACE and not by the default gateway (router). These requests are easily identified by the source address (6.6.6.1).

Note that ASN and server to server load balancing with double NAT (source and destination) can be implemented both on the same box.

Thanks to Daniele and Marco for helping me in the lab.

Nokia E series codes'n'tricks

noreply@blogger.com (Alberto) — Fri, 18 Apr 2008 09:22:00 +0000

Here's some codes and tricks I've found useful while deploying a Cisco WLC - Nokia Dual Mode architecture.

These apply to th e series phones.

To see the phone's WLAN mac-address :
Check behind the battery, or
*#62209526# (mnemonic trick : it is like writing "*#mac wlan#" with T9) will display it.

To reset to factory defaults, get to Tools->Settings->Phone->General->Orig. phone settings
The default unlock code is 12345.

There is also a code to reset the ROM and the factory defaults, without deleting data files : *#7780#

Then there's the Deep Reset code : *#7370#
This one resets factory settings, deletes every data file and uninstall everything. This reset asks for the unlock code too.

To read the phone's IMEI : *#06#

To check the phone's firmware version the code is *#0000#

Then determine if firmware version is up to date : http://europe.nokia.com/A4577224

Push XML to my Cisco IP Phone in .NET

noreply@blogger.com (Alberto) — Tue, 08 Apr 2008 08:54:00 +0000

Or "the Expect-100 story", or the "CiscoIPPhoneError 6 quest"...

I was trying to do a simple thing, i.e., push XML to my Cisco IP Phone, in order to make it display a message and/or display a sound.
Theory is simple : POST an XML message to the IP Phone's /CGI/Execute by means of a simple HTTP connection.
I decided to use the C# HttpWebRequest object, thinking it's exactly what I needed.

Note : this is a story of a good workaround, not of the solution, I'm still workin' on it, stay tuned.

What I wanted was to post this to my IP Phone :
"XML=<ciscoipphoneexecute><executeitem priority="0" url="Play:chime.raw"><executeitem priority="0" url="http://10.10.10.10:8080/textmessage.xml"></executeitem>"

that means : play chime.raw and display the xml returned by a GET from the phone on http://10.10.10.10:8080/textmessage.xml

Here's my simple HttpWebRequest code (NOT working...)

string sXML = "XML=<ciscoipphoneexecute><executeitem priority="0" url="Play:chime.raw"><executeitem priority="0" url="http://10.10.10.10:8080/textmessage.xml"></executeitem>"
HttpWebRequest webRequest = (HttpWebRequest)HttpWebRequest.Create("http://10.1.1.1/CGI/Execute");
webRequest.Method = "POST";
webRequest.Credentials = new NetworkCredential("test", "test");
byte[] bArr = Encoding.UTF8.GetBytes(sXML);
webRequest.ContentType = "application/x-www-form-urlencoded";
webRequest.ContentLength = bArr.Length;
Stream dataStream = webRequest.GetRequestStream();
dataStream.Write(byteArray, 0, byteArray.Length);
dataStream.Close();
HttpWebResponse response = (HttpWebResponse)webRequest.GetResponse();

All I obtained was always a very annoying
<CiscoIPPhoneError Number="6" />

I found nothing on this error, as Cisco docs say :

CiscoIPPhoneError

The following list gives possible CiscoIPPhoneError codes:

Error 1 = Error parsing CiscoIPPhoneExecute object

Error 2 = Error framing CiscoIPPhoneResponse object

Error 3 = Internal file error

Error 4 = Authentication error

So I started sniffing the POST from my dev box to the phone observing some strange traffic before sending the POST message.
The reason is .NET implementation of the HTTP request, that add an Expect 100-Continue header on the very first packet, and then send the real POST after receiving the 100-Continue from the server (the IP Phone in this case).

You can find a more exhaustive explanation on this here.
Note that implementing the solution indicated (set the System.Net.ServicePointManager.Expect100Continue to false) worked not on my code, I'm still workin' on it.

My solution, or workaround if you wish, was to use a simpler object, the MSXML2.XMLHTTPClass class.

Here's the working code :

string sXML = "XML=<ciscoipphoneexecute><executeitem priority="0" url="Play:chime.raw"><executeitem priority="0" url="http://10.10.10.10:8080/textmessage.xml"></executeitem>"
byte[] bb = System.Text.ASCIIEncoding.UTF8.GetBytes("test" + ":" + "test");
MSXML2.XMLHTTPClass xmlhttp = new MSXML2.XMLHTTPClass();

xmlhttp.open("POST", "http://10.1.1.1/CGI/Execute", true, "", "");
xmlhttp.setRequestHeader("Authorization", "Basic " + Convert.ToBase64String(bb));
xmlhttp.setRequestHeader("Connection", "close");
xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xmlhttp.send(sXML);

Cisco Unified Presence Server on my IBM server

noreply@blogger.com (Alberto) — Thu, 07 Feb 2008 16:43:00 +0000

Time to install my Presence Server to test interaction with Microsoft...

No Cisco MCS this time, so I obtained from Cisco the list of compatible servers :

click me

Unified Presence Server 6.0(2) has the same requisites of the CUCM 6.0.

However I tried to use a different processor (more powerful), having the install script to state the the hardware is incompatible.

No workaround till now, however, I found the hardware check log, useful to see what went wrong :

Once the install srcript fails, DO NOT press the "Cancel install" button.
Press ALT+CTRL+F2 to switch console.
At the prompt :
"cd /var/state/xkb/"
then
"cat hw_validation_err"
Here's what I found :

The hardware you are using is not supported for this software

Hardware-check results:

HW type [Vendor/Product]	OK
Number of CPUs (1)	OK
Clock Speed (3600 MHz)	NOT SUPPORTED
Memory size (2048 Mb)	OK

Cisco and Nokia Dual-Mode for Dummies

noreply@blogger.com (Alberto) — Wed, 30 Jan 2008 16:43:00 +0000

Finally I succeeded in configuring my dual-mode Nokia e65 as a SCCP client for our Cisco Unified Communication Manager 6.

As it wasn't simple at all to set up the Nokia to use the Cisco's recommended WLAN security configuration I publish here the result of two days of tweaking on both Cisco WLC and my Nokia e65.

Cisco says (link here) :

The optimal configuration for the controller configuration for the WLAN supporting Cisco Unified Wireless IP Phone 7921s is for the WPA security protocol with TKIP encryption and IEEE 802.1X with CCKM key management.

So, here's how my WLC looks like (seen from WCS) :

Note : I've seen on some document from Nokia that broadcasted SSIDs work better on e-series devices than hidden ones.

Now the Nokia side of the problem. Just remember two things :

1) Not everything it's in the e65 menu means exactly what you think it should mean.
2) Disable every protocol, setting or cipher algorithm you do not use!

First of all you should have your corporate root Certificate installed in your phone. I got it from my Outlook Web Access, navigating from the phone, using my GPRS access obviously.

Remind to have an Internet access (via GPRS or via another WLAN access), you'll need it to activate your free license for Intellisync unless you have the definitive license at your very first activation (not my case).

Now get in the Tools->Connection->Access points->Options->New access point.
Here's my working configuration

-Connection name : VoWLAN
-Databearer : Wireless WAN
-WLAN netw. name: [Your SSID here]
-Network status: Public
-WLAN netw. mode: Infrastructure
-WLAN security mode: 802.1x (NOT WPA/WPA2)
-WLAN security settings :
--WPA mode: EAP
--EAP plug-in settings:
---EAP-PEAP (select only this, put in the higher position and disable all the others) :

---General:
----User certificate: not defined
----CA certificate: [Your Corporate Certificate here]
----User name in use: User-configured
----User name: [Your user name]
----Realm in use: User-configured
----Realm: [balnk]
----Allow PEAPv0 : Yes
----Allow PEAPv1 : Yes
----Allow PEAPv2 : No

---EAP:
----EAP-MSCHAPv2 (select only this, put in the higher position and disable all the others) :
-----User name: [Realm]\[Your user name]
-----Prompt password: No
-----Password: [Your password]

---Cipher:
----RSA,3DES,SHA [enabled]
----DHE-RSA,3DES,SHA [enabled]
----DHE-DDS,3DES,SHA [enabled]
----[disable alle the others]

et voilà, now your WLAN connection is ok.

Next steps are simpler, and all illustrated on the Nokia businness website i.e. :

Install the Cisco option package (COP) file for Nokia Intellisync Call Connect for Cisco clients in your Communications Manager.

Install the Nokia Intellisync Call Connect for Cisco clients in your Nokia e65.

Activate (via Internet) or install your license.

Configure the SCCP Profile for using your brand new WLAN connection. (instructions here)

Configure the Internet Telephony Profile to use the SCCP profile. (instructions here)

The End.

08-20-2008 Update :

Here's a follow up to implement CCKM support.

Source NAT on Cisco ACE

noreply@blogger.com (Alberto) — Wed, 12 Dec 2007 10:16:00 +0000

I've already described the scenario for this issue here.

My first approach on Source NAT for this scenario was a little too CSS-minded, so wasting vip addresses and not considering some new features on the ACE.

For each serverfarm which had to be reached from the same subnet I created two vips, one for everybody, one for SNATted connections from the same subnet.

Now I changed approach, SNATting everything coming from the INTERNAL subnet, no matter which vip is looking for. This way I have not to use different vips depending on source address.

class-map match-all L4-MAP-SNAT-INTERNAL
2 match source address 10.0.11.0 255.255.255.0

class-map match-all L4-MAP-YELLOW-SERVERFARM_20.2:80
2 match virtual-address 10.0.20.2 tcp eq www

policy-map type loadbalance first-match L7-FARM_20.2:80
class class-default
serverfarm YELLOW-SERVERFARM_20.2:80

policy-map multi-match L4-POLICYMAPMULTI-LOADBALANCE
class L4-MAP-SNAT-INTERNAL
nat dynamic 100 vlan 101
class L4-MAP-FARM_20.1:21
loadbalance vip inservice
loadbalance policy L7-FARM_20.2:80
loadbalance vip icmp-reply active

service-policy input L4-POLICYMAPMULTI-LOADBALANCE

interface vlan 101
description SERVERSIDE
ip address 10.0.10.199 255.255.255.0
nat-pool 100 10.0.21.100 10.0.21.115 netmask 255.255.255.0 pat
no shutdown

interface vlan 151
description FIREWALLSIDE
ip address 10.0.0.2 255.255.255.240
no shutdown

In this scenario each connection coming from any server on the 10.0.11.x subnet is subnetted. Then, going down on the multimatch policy, it reaches the vip class which loadbalance on the real servers.
Note that the L4-MAP-SNAT-INTERNAL must be the first class defined in the policy for have things work well.

Tcl tcp check script

noreply@blogger.com (Alberto) — Tue, 11 Sep 2007 18:02:00 +0000

Here's my script I use for TCP port checking on Cisco ACE.

The probe is simple :

probe scripted 8080-TCP-SCRIPT
port 8080
script tcp_check.tcl

and here's the script :

#Procedures
proc opensocket {ip port}
{ set sock [socket $ip $port] }

# Get the IP address of the real server from a predefined global array
set ip $scriptprobe_env(realIP)

# Get port from command line arguments (may be different from real service's one)
if {$argc <> 1 )
{ set port $scriptprobe_env(realPort) }
else
{ set port [lindex $argv 0] }

# Open a socket to the server. This creates a TCP connection to the # real server
set EXIT_MSG "opening socket..."

if { [catch { opensocket $ip $port } sock] }
{
set EXIT_MSG "$ip:$port ERR : $sock"
set expCode1 "timeout"
set expCode2 "connection timed out"
set expCode3 "connection refused"
set expCode4 "Unknown host"
set expCode5 "o route to host"
set expCode6 "nable to connect"
set expCode7 "host is unreachable"

if { [ regexp $expCode1 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode1>"
exit 30002 }

if { [ regexp $expCode2 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode2>"
exit 30002 }

if { [ regexp $expCode3 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode3>"
exit 30002 }

if { [ regexp $expCode4 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode4>"
exit 30002 }

if { [ regexp $expCode5 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode5>"
exit 30002 }

if { [ regexp $expCode6 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode6>"
exit 30002 }

if { [ regexp $expCode7 $sock ] }
{ set EXIT_MSG "probe fail. $ip:$port ERR : <$expCode7>"
exit 30002 }

} else {

set EXIT_MSG "probe success"
close $sock
exit 30001

}

C# IP utilities : Decimal to binary notation

noreply@blogger.com (Alberto) — Thu, 09 Aug 2007 11:26:00 +0000

public string IPdec2binary(string ip)
{

string ret = "";
try
{
string[] theIP = ip.Split('.');

long na = Convert.ToInt64(theIP[0]);

long nb = Convert.ToInt64(theIP[1]);

long nc = Convert.ToInt64(theIP[2]);

long nd = Convert.ToInt64(theIP[3]);

string sa = Convert.ToString(na, 2);

string sb = Convert.ToString(nb, 2);

string sc = Convert.ToString(nc, 2);

string sd = Convert.ToString(nd, 2);

long a = Convert.ToInt64(sa);

long b = Convert.ToInt64(sb);

long c = Convert.ToInt64(sc);

long d = Convert.ToInt64(sd);

ret = Convert.ToString("" + a).PadLeft(8, '0') + ".";

ret += Convert.ToString("" + b).PadLeft(8, '0') + ".";

ret += Convert.ToString("" + c).PadLeft(8, '0') + ".";

ret += Convert.ToString("" + d).PadLeft(8, '0');
}
catch
{
return "";
}

return ret;
}

C# IP utilities : Integer to dotted notation

noreply@blogger.com (Alberto) — Wed, 08 Aug 2007 01:12:00 +0000

public string IPint2dotted(long ip)
   {
     string ret = "";
     try
     {
       string hex = ip.ToString("X");

       if (hex.Length>=8)
         hex = hex.Substring(hex.Length-8);
       else
         hex = hex.PadLeft(8,'0');

       for (int i=hex.Length;i>0;i-=2)
       {
         ret += long.Parse(Convert.ToString(hex[i-2].ToString() + hex[i-1].ToString()), System.Globalization.NumberStyles.HexNumber).ToString()+".";
       }

       if (ret.Length>0)
return ret.Substring(0,ret.Length-1);
else
return "";
}
catch (Exception exc)
{
return "";
}

}

Cisco ACE redundancy issues

noreply@blogger.com (Alberto) — Wed, 08 Aug 2007 00:26:00 +0000

Once you've configured redundancy on the ACEs, there's an active one, and a stand-by one. Ok, this is simple. However, there are some times configuration synch fails, and here's what I observed.

Once redundancy is configured this way :

ACTIVE ACE

ft group 1
peer 1
priority 200
peer priority 101
associate-context CONTEXT1
inservice

STANDBY ACE

ft group 1
peer 1
priority 101
peer priority 200
associate-context CONTEXT1
inservice

As usual, the active one has the highest priority. Now I want this redundancy to be HOT, i.e. sessions remain up during a switchover as they are mantained in sync by the peers.
Typing a show ft group det on the master ACE you could (as I did) see two types of redundancy :

Peer State : FSM_FT_STATE_STANDBY_HOT

or

Peer State : FSM_FT_STATE_STANDBY_COLD

Cold standby state means that sessions during the switchover will be dropped, and that, for some reason, configuration sync failed, so configurations are not even equal between the two peers, and further changes on the master will not be sent to the slave.

Typical reasons for configurations' sync to fail are :

A scripted probe needs its script file on the ACE's disk0:, the standby ACE may not have this file on his disk0:
Interfaces are not configured the same way (missing some interface vlan?)
Svcl groups on the Catalysts hosting the ACE may not pass the same vlans to the two peers.

However, if you made one of these mistakes, as I did, you have your standby ACE in COLD standby state, what to do now ?
Even copying manually the configuration on the second ACE, it will never switch by itself in HOT standby state.

The solution is quite easy :

Solve all the issues that caused the configuration sync to fail (see above).
On the standby ACE, switch off and then on (rapidly) the ft group of the context :

ACE-02/Admin#conf t
ACE-02/Admin(config)#ft group 1
ACE-02/Admin(config-ft-group)#no inservice
ACE-02/Admin(config-ft-group)#inservice

Now you will see the standby ACE erase all of its configuration and then start back to copy it from the master ACE. At the end, you should see on the master :

FT Group : 1
Configured Status : in-service
Maintenance mode : MAINT_MODE_OFF
My State : FSM_FT_STATE_ACTIVE
My Config Priority : 200
My Net Priority : 200
My Preempt : Enabled
Peer State : FSM_FT_STATE_STANDBY_HOT
Peer Config Priority : 101
Peer Net Priority : 101
Peer Preempt : Enabled
Peer Id : 1
Last State Change time : Fri Aug 3 06:22:17 2007

Running cfg sync enabled : Enabled
Running cfg sync status : Running configuration sync has completed
Startup cfg sync enabled : Enabled
Startup cfg sync status : Startup configuration sync has completed
No. of Contexts : 1

Context Name : CONTEXT1
Context Id : 2

Note : During this process configuration is inhibited even on the master ACE.

PS : Thanks to Francesco for helping me in troubleshooting and summarizing the events of that night.

Static NAT on Cisco ACE

noreply@blogger.com (Alberto) — Tue, 10 Jul 2007 13:12:00 +0000

This one's simple. Here's how I managed my first NAT to make a load balanced dual armed farm exit through the ACE towards the Internet. I had to make all of the traffic NATted on a single ip in order to make firewalls' life easy.

Scenario :

Then the configuration :

rserver host SERVER-10.1
ip address 10.0.10.1
inservice

rserver host SERVER-10.2
ip address 10.0.10.2
inservice

serverfarm host FARM_20.1:80
failaction purge
rserver SERVER-10.1 21
inservice
rserver SERVER-10.2 21
inservice

class-map match-any L4-MAP-NAT
2 match source address 10.0.10.1 255.255.255.255
3 match source address 10.0.10.2 255.255.255.255

class-map match-all L4-MAP-FARM_20.1:21
2 match virtual-address 10.0.20.1 tcp eq www

policy-map type loadbalance first-match L7-FARM_20.1:80
class class-default
serverfarm FARM_20.1:80

policy-map multi-match L4-POLICYMAPMULTI-LOADBALANCE
class L4-MAP-FARM_20.1:21
loadbalance vip inservice
loadbalance policy L7-FARM_20.1:80
loadbalance vip icmp-reply active

policy-map multi-match L4-POLICYMAPMULTI-NAT
class L4-MAP-NAT
nat static 10.0.21.1 netmask 255.255.255.255 vlan 151

service-policy input L4-POLICYMAPMULTI-LOADBALANCE

interface vlan 101
description SERVERSIDE
ip address 10.0.10.199 255.255.255.0
service-policy input L4-POLICYMAPMULTI-NAT
no shutdown

interface vlan 151
description FIREWALLSIDE
ip address 10.0.0.2 255.255.255.240
no shutdown

Sorted Hashtable

noreply@blogger.com (Alberto) — Tue, 19 Jun 2007 11:03:00 +0000

Need an HashTable uh? Tired of that messy foreach statement ? Here's a simple implementation of a Dictionary collection, but sortable.

namespace snippets101.Collections
{
public enum sortType
{
NoSort = 1,
Keys = 2,
Values = 3
}
public class sHash
{
private ArrayList _alVals;
private ArrayList _alKeys;
private sortType _sort;

public sHash()
{

_alKeys = new ArrayList();
_alVals = new ArrayList();

_sort = sortType.NoSort;

}

public sortType SortType
{
get { return _sort; }
set { _sort = value; }

}

public void Sort()
{
Array k = _alKeys.ToArray(typeof(object));
Array v = _alVals.ToArray(typeof(object));

if (_sort == sortType.Keys)
Array.Sort(k, v, new sHashComparer());
if (_sort == sortType.Values)
Array.Sort(v, k, new sHashComparer());

_alKeys = ArrayList.Adapter(k);
_alVals = ArrayList.Adapter(v);

}

public void Add(object key, object value)
{
if (_alKeys.Contains(key))
throw new Exception("Key already present.");

_alKeys.Add(key);
_alVals.Add(value);

}

public void Clear()
{
_alKeys.Clear();
_alVals.Clear();
}

public bool Contains(object key)
{
return _alKeys.Contains(key);
}

public IDictionaryEnumerator GetEnumerator()
{
return new sHashDictionaryEnumerator(_alKeys, _alVals);
}

public bool IsFixedSize
{
get { return false; }
}

public bool IsReadOnly
{
get { return false; }
}

public ArrayList Keys
{
get { return _alKeys; }
}

public ArrayList Values
{
get { return _alVals; }
}

public void Remove(object key)
{
_alVals.RemoveAt(_alKeys.IndexOf(key));
_alKeys.Remove(key);
}

public object this[object key]
{
get
{
return _alVals[_alKeys.IndexOf(key)];
}
set
{
if (_alKeys.Contains(key))
{
_alVals[_alKeys.IndexOf(key)] = value;
}
else
{
_alKeys.Add(key);
_alVals.Add(value);
}
}
}

public int Count
{
get { return _alKeys.Count; }
}

private class sHashDictionaryEnumerator : IDictionaryEnumerator
{
DictionaryEntry[] items;
Int32 index = -1;

public sHashDictionaryEnumerator(ArrayList keys, ArrayList mappings)
{
items = new DictionaryEntry[keys.Count];
for (int i = 0; i <> {
items[i] = new DictionaryEntry(keys[i],mappings[i]);
}
}

public Object Current { get { ValidateIndex(); return items[index]; } }

public DictionaryEntry Entry
{
get { return (DictionaryEntry)Current; }
}

public Object Key { get { ValidateIndex(); return items[index].Key; } }

public Object Value { get { ValidateIndex(); return items[index].Value; } }

public Boolean MoveNext()
{
if (index < style="color: rgb(51, 51, 255);"> return true; }
return false;
}

private void ValidateIndex()
{
if (index <>= items.Length)
throw new InvalidOperationException("Enumerator is before or after the collection.");
}

public void Reset()
{
index = -1;
}
}

private class sHashComparer : IComparer
{
private bool isNumeric(Type t)
{
switch (t.Name.ToLower())
{
case "int32":
return true;
case "single":
return true;
case "double":
return true;
default:
return false;
}
}

public int Compare(object x, object y)
{

if ((isNumeric(x.GetType())) && (isNumeric(y.GetType())))
{
double d = Math.Truncate(Convert.ToSingle(x) - Convert.ToSingle(y));
if (d <>
return -1;
if (d == 0)
return 0;
if (d > 0)
return 1;

return 0;
}
if ((isNumeric(x.GetType())) && (!isNumeric(y.GetType())))
return -1;
if ((!isNumeric(x.GetType())) && (isNumeric(y.GetType())))
return 1;

return String.Compare(x.ToString(), y.ToString());
}

}

}
}

Dual armed server to server load balancing con Cisco ACE

noreply@blogger.com (Alberto) — Mon, 11 Jun 2007 11:22:00 +0000

Let's say you have a large data center, let's say that in this data center you have lots of dual-armed load balanced serverfarms. It could happen that these servers need to call each other's balanced services. Here's how this could be accomplished with very light configuration on real servers.

Scenario :

The BLUE-SERVERFARM real servers needs to query a web service located on the YELLOW-SERVERFARM, on tcp port 2000.
All of the real servers use the "upper" interface (vlan 101) to act as servers, i.e. to answer clients' queries coming from the ACE.
The "internal" interface (vlan 102) is used by the servers when they act as client of someone else's service.
Easy to configure this, matter of routes on the servers. The default gateway is always the ACE, there's a static route on the internal interface for all the ips the server could query acting as a client.

Without configuring Source NAT con the ACE, all connections fail, because of asymmetric response from servers of the YELLOW-SERVERFARM.
When a connection arrives from the ACE, the source ip is the internal interface of the client server. As this ip is on a lan directly connected on the destination server, the response will return over the INTERNAL, not over the same route of the request.

Solution:
Source natting this requests on the ACE will cause the destination server not to know as directly connected the source ip, answering on the default gateway (ACE) and so following the same path of the request.
The simplest way I've found is to reserve a new virtual address only for requests coming from the servers on the same lan, as described above. So clients will continue query the service on the VIP 10.20.0.2 port 2000, while servers on the same lan will query the same service on the same port but on VIP 10.20.0.20, being Source-NATted with an IP from the SNATPOOL.

The real server of the YELLOW-SERVERFARM responding to the request, seeing it from a SNATted address will route the response via the default gateway (ACE) which will send back packets on the same path of the request.

probe tcp 2000-TCP
port 2000
interval 10
passdetect interval 5
passdetect count 1

probe icmp ICMP
interval 10
passdetect interval 5
passdetect count 1

rserver host SERVER-10.1
ip address 10.0.10.1
inservice

rserver host SERVER-10.2
ip address 10.0.10.2
inservice

rserver host SERVER-10.3
ip address 10.0.10.3
inservice

rserver host SERVER-10.4
ip address 10.0.10.4
inservice

serverfarm host BLUE-SERVERFARM_20.1:80
failaction purge
probe ICMP
rserver SERVER-10.1 80
inservice
rserver SERVER-10.2 80
inservice

serverfarm host YELLOW-SERVERFARM_20.2:2000
failaction purge
probe 2000-TCP
rserver SERVER-10.3 2000
inservice
rserver SERVER-10.4 2000
inservice

class-map match-all L4-MAP-BLUE-SERVERFARM_20.1:80
2 match virtual-address 10.0.20.1 tcp eq www

class-map match-all L4-MAP-YELLOW-SERVERFARM_20.2:2000
2 match virtual-address 10.0.20.2 tcp eq 2000

class-map match-all L4-SNAT-MAP-YELLOW-SERVERFARM_20.20:2000
2 match virtual-address 10.0.20.20 tcp eq 2000

policy-map type loadbalance first-match L7-BLUE-SERVERFARM_20.1:80
class class-default
serverfarm BLUE-SERVERFARM_20.1:80

policy-map type loadbalance first-match L7-YELLOW-SERVERFARM_20.2:2000
class class-default
serverfarm YELLOW-SERVERFARM_20.2:2000

policy-map multi-match L4-POLICYMAPMULTI

class L4-MAP-BLUE-SERVERFARM_20.1:80
loadbalance vip inservice
loadbalance policy L7-BLUE-SERVERFARM_20.1:80
class L4-MAP-YELLOW-SERVERFARM_20.2:2000
loadbalance vip inservice
loadbalance policy L7-YELLOW-SERVERFARM_20.2:2000
class L4-MAP-YELLOW-SERVERFARM_20.20:2000
loadbalance vip inservice
loadbalance policy L7-YELLOW-SERVERFARM_20.2:2000
nat dynamic 1 vlan 101

interface vlan 101
description SERVERSIDE
ip address 10.0.10.199 255.255.255.0
nat-pool 1 10.0.21.1 10.0.21.254 netmask 255.255.255.0
no shutdown
interface vlan 151
description FIREWALLSIDE
ip address 10.0.0.2 255.255.255.240
service-policy input L4-POLICYMAPMULTI
no shutdown

FTP serverfarm on Cisco ACE

noreply@blogger.com (Alberto) — Fri, 08 Jun 2007 14:17:00 +0000

This is a mix from Cisco forums and hundreds of trials, being the Cisco ACE Server Load Balancing configuration guide not so clear...

Scenario :

Active FTP :
This is the simpler and it's only a matter of ACE configuration :

probe tcp 21-TCP
port 21
interval 10
passdetect interval 5
passdetect count 1

rserver host SERVER-10.1
ip address 10.0.10.1
inservice

rserver host SERVER-10.2
ip address 10.0.10.2
inservice

serverfarm host FTPFARM_20.1:21
failaction purge
probe 21-TCP
rserver SERVER-10.1 21
inservice
rserver SERVER-10.2 21
inservice

sticky ip-netmask 255.255.255.255 address source STICKY-FTPFARM_20.1:21
timeout 20
timeout activeconns
replicate sticky
serverfarm FTPFARM_20.1:21

class-map match-all L4-MAP-FTPFARM_20.1:21
2 match virtual-address 10.0.20.1 any

policy-map type loadbalance first-match L7-FTPFARM_20.1:21
class class-default
sticky-serverfarm STICKY-FTPFARM_20.1:21

policy-map multi-match L4-POLICYMAPMULTI-FTP

class L4-MAP-FTPFARM_20.1:21
loadbalance vip inservice
loadbalance policy L7-FTPFARM_20.1:21
inspect ftp

interface vlan 101
description SERVERSIDE
ip address 10.0.10.199 255.255.255.0
no normalization
no shutdown
interface vlan 151
description FIREWALLSIDE
ip address 10.0.0.2 255.255.255.240
no normalization
service-policy input L4-POLICYMAPMULTI-FTP
no shutdown

Passive FTP :

In order to make Passive FTP connection work, with the firewall checking consistency of source and destination addresses, youll need to change the FTP server configuration.
On the frox server there's a configuration parameter "PASV Reply Address" that should be set to the VIP (10.0.20.1) in order to have the FTP server call back the client (passive mode) with the same address the firewall see for the active client-server communication.

dotted notation to number

noreply@blogger.com (Alberto) — Fri, 08 Jun 2007 10:49:00 +0000

Writing my ip address management software I needed something to order my ips in sql.The dotted notation wasn't so efficient, so, I needed to convert it in an integer.
Wandering on the Net, and with the CCNA study guide open, here's the result, starting from a script read somewhere...

CREATE FUNCTION dbo.IPDottedToNumber( @IPAddress varchar(15))
RETURNS bigint
AS
BEGIN
DECLARE
@biOctetA bigint,
@biOctetB bigint,
@biOctetC bigint,
@biOctetD bigint,
@biIP bigint

DECLARE @tbl TABLE
(
OctetNo smallint,
Octet bigint
)

INSERT INTO @tbl
SELECT ElementID, CONVERT(bigint,Element) FROM dbo.Split(@IPAddress, '.')

IF (SELECT COUNT(*) FROM @tblArray WHERE Octet BETWEEN 0 AND 255) = 4
BEGIN

SET @biOctetA = (SELECT (Octet * 256 * 256 * 256) FROM @tblArray WHERE OctetNo = 1)

SET @biOctetB = (SELECT (Octet * 256 * 256 ) FROM @tblArray WHERE OctetNo = 2)

SET @biOctetC = (SELECT (Octet * 256 ) FROM @tblArray WHERE OctetNo = 3)

SET @biOctetD = (SELECT (Octet) FROM @tblArray WHERE OctetNo = 4)

SET @biIP = @biOctetA + @biOctetB + @biOctetC + @biOctetD

END

RETURN(@biIP)
END

You're welcome

noreply@blogger.com (Alberto) — Thu, 07 Jun 2007 21:28:00 +0000

As a network engineer and a software developer, I must face technical issues every day, of various complexity. Most of them come from my laziness in reading all of the manual....

However, since the 80% of this issues found a solution by reading something on a forum, a blog, or some code exchange site, I thought it were high time to pay back the favour to Internet.

In this blog I'll put all of the solutions I find (by myself or not), code snippets, configurations, strange things that happens to people like me.

Enjoy.

PS: I'm sure my english is one of the worst you can find around the 'net, but hey! I'm an italian guy, please be patient, I know much better how to cook...