==== BGP =====
RegEX:
^ Matches the beginning of input.
$ matches the end of input
|(pipe) A logical "or" statement.
.(period) matches a SINGLE character.
+ matches the character to the left 1 or more times.
* matches the character to the left 0 or more times.
? matches the character to the left 0 or 1 times.
\ removes special meanings.
() affects order of operations
[] creates a group of characters.
_ white space.
Examples:
150.1.1.0/24
AS Path: 6733 982 43 239 852 4439 10295 6010 10
1. only match 43: _43_
2. only match 43 or 10: _43_|_10_
3. only match the last previous 6733: ^6733 ---begins with 6733, it reads left to right.
4. only match AS originated 10: _10$ --match end of the string, which is 10 orginated AS.
(_33_|_44_)_982_
match EITHER 33 OR 44 FOLLOW BY 982.
^6733_. ====matches most recent AS and anything behind, but not originated from 6733. The period is 1 charater, so matches any AS, no matter how many, after 6733, since 1 character after.
^[0-9]+$ ====match to the left of + one or more times. just match one AS.
[300]+ === match 300 one or more times.
AS 300 300 300 300
to match 300 again and again:
^(300)+$
$([0-9]+)(_\1)*$ ===0-9 one or more times. AS 1234, 555, etc. To match ANY AS that has been prepended.
5. Match stuff originated from my AS. Match internal routes only. Inside our AS. Only when leaves our AS, do we put the AS on it.
^$
6. ^\(64512) ==removes special meaning from the parentheses.
If in AS Path: (6733 982) 43 239 852 4439
The AS inside the AS path with parentheses is Confederation.
7. Match everything: .*
==================
AS Path Access-list / filtering
permit .....
deny ....
permit ....
permit .* ===permit all at the end.
conf t
ip as-path access-list 1 deny ^300_ -- match everything from 300 most recently. or _300_ anywhere there's 300, deny.
ip as-path access-list 1 permit .* ===need this, else there's a implicit deny all.
route-map FILTER_300 permit 10
match as-path 1 ===if want "or" 1 2 3 4: match as-path 1 or 2 or 3 or 4.
router bgp 500
neighbor 1.1.1.1 route-map FILTER_300 out
example 2:
match as-path 500 and set weight 1000, so prefer that route from that neighbor.
ip as-path access-list 10 permit _500_
route-map INFLUENCE
match as-path 10
set weight 1000
router bgp 200
neighbor 199.9.9.2 route-map INFLUENCE in ====Routes from that neighbor pass to the route map and set weight to 1000...so, routes outbound will prefer path to the neighbor.
===================
Prefix List filtering:
route matching system better than ACLs. Improved processor util., Better subnet mask matching.
2 stage matching: Match network first, then match mask.
example:
ip prefix-list NEWLIST permit 172.30.0.0/16 le 20
(Network) (mask)
ip prefix-list NEWLIST permit 172.30.0.0/16 ge 24 le 24 == exactly 24.
ip prefix-list NEWLIST permit 172.30.0.0/16 ge 24 le 30 == between 24-30 subnet mask.
ip prefix-list NEWLIST permit 0.0.0.0/0 === This does NOT match everything. ONLY match exactly that route. The default route.
ip prefix-list NEWLIST permit 0.0.0.0/0 le 32 ===This match all. Permit any.
ip prefix-list NEWLIST permit 0.0.0.0/0 ge 32 ===This match only Host routes. all hosts /32.
ip prefix-list NEWLIST permit 0.0.0.0/1 ge 24 le 24 === Any class A address, and subnet mask is a /24. The first octet is 0000000.------- in the network section.
class A: 0-127 (bit 0----)
class B: 128-192 (bit 10---)
class C: 192-223 (bit 110--)
ip prefix-list NEWLIST-PF permit 128.0.0.0/2 ge 16 === Any class B network with mask of /16.
128 = 1000000 = class B.
conf t
router bgp 500
neighbor 1.1.1.1 prefix-list NEWLIST in ===routes coming in filtered.
show ip prefix-list
clear ip bgp 1.1.1.1
example 2:
route-map SET-LP
match ip add prefix-list NEWLIST-PF
st local-pre 9000
route-map SET-LP 20 ====THIS NEEDS TO BE IN to do permit all at end. else routes not match for this route-map will be filtered.
neighbor 1.1.1.1 route-map SET-LP in ==as route come in from neighbor, change Localpref.
=====================================
Soft reconfiguration: Prefix list , route maps changes can be updated to neighbors w/o tearing down peers.
- Outbound soft reconfiguration
ex.) clear ip bgp 1.1.1.1 soft out
This don't need to be activated.
- Inbound soft reconfiguration:
- keeps the whole inbound routes from neighbor in memory before any filters applied. Then passes through filters, ie pF, routemaps and then update the BGP table.
This needs to be configured.
neighbor 1.1.1.1 soft-reconfig in ==to activate it to have a full route copy in memory from neighbor.
- Route Refresh--started in 12.1. BGP can tell its neighbor to resend routes.
Don't need: neighbor 1.1.1.1 soft-reconfig in
Just clear ip bgp 1.1.1.1 soft in ===This will automatically do Route Refresh.
==================================================
ORF - Outbound Route Filtering
Why send 1000s of routes if they're filtered.
ORF allows you to transmits inbound filters to a neighbor to be apply in the outbound on that neighbor.
Neighbors must support ORF types.
Configured PER NEIGHBOR
neighbor 1.1.1.1 capability orf prefix-list send/receive. local is send--ISP receive.
clear ip bgp 1.1.1.1 in prefix-filter
========================
BGP COMMUNITIES
================
Route Reflectors iBGP
If received routes from eBGP peer---- send to ALL iBGP/eBGP peers.
If received routes from iBGP non-client peer, --- send to all eBGP and client peers only. Makes sense, since iBGP don't send to other iBGP peers by default.
If received routes from iBGP CLIENT peer, --- send to all peers.
Loop preventions for redundant RR is clusterID. If have 3 RR, then it's a Group. RR groups add a cluster-ID tag or attribut to routes they advertise out to other RR peer. The eBGP router needs to peer to all 3 RR Group.
Originator-ID -- if RR sees it's own originator ID, it will also reject the route to prevent loop.
RR clients are oblivious to everything.
========================
Confederation: Use private AS: 64512 - 65535
An AS inside and AS.
RR taken to the next level.
Alternative to RR.
Uses Intra-AS numbers which are stripped before sending updates to eBGP peers.
Inter-Confedration peers are treated as eBGP to establish, but iBGP relating to attributes.
Still ONE IGP for the entire system.
Can combine RR inside confederation.
router bgp 64513
bgp confederation identifier 500 ===this is what's used to communicate to eBGP peers.
bgp confederation peers 64514 64515 64516 -- need to list all private AS in the whole system. Both need to be applied to all routers.
==================================
BGP can kill your router and how to stop it:
- Filter
OPtimize BGP
BGP PROCESSES:
BGP OPEN - STARTS PEERS UP
BGP I/O - Prepares / processes updates, keepailives
BGP Scanner - checks next hops, determines routes to advertise. Check the entire BGP table and make sure next hop is reachable. Runs at a certain interval. CPU intensive.
BGP router process - calculates best path, processes route changes. Looks at weight, etc to calculate best path. Runs at certain interval. CPU heavy.
All these does not affect stuff going through the router....all these handle by CEF.
TUNE IMPROVE BGP:
Use the global IP TCP PATH-MTU-DISCOVERY: BGP defaults to 536 bytes. This let BGP negotiates better performance for stuff going to the router or from the router, not stuff going THROUGH the router. By default rediscovers every 30 seconds.
show ip bgp neighbors | i max
2. Use BGP peer Groups.
3. Increase INPUT queues (HOld-queue in) -- This is how much packet I can hold before I start tail dropping.
4. Tune BGP Scanner timer
router bgp 500
bgp scan-time 60 ( default is 60) --- time check the next hop reachability.
advertisement-interval is per neighbor-- default 30 sec. ... how often it queues updates or messages for a neighbor.
5. Set a maximum prefix limit. Upstream ISP may go bad and affect your BGP table to the max.
neighbor 1.1.1.1 maximum-prefix 500000 warning-only --- if just hit enter, it will take down neighbor when max is reached...and an admin need to do a clear ip bgp neighbor x.x.x.x.
show ip bgp summ -- get an idea how many prefix came in.
==================================================
PEER GROUPS /
ROUTE DAMPENING for flapping routes. AFter 3 route flaps, BGP will be down for 30 mins...no route, until the dampening and penalty came down.
max is 60mins.
clear ip bgp dampening 150.1.1.0 255.255.255.0 ==== to start reusing/readvertise immediately., but still remembers the penalty. == clear the reuse, but not the penalty.
clear ip bgp 1.1.1.1 flap-statistics === clears the penalty and not the reuse.
12/18/2019
ASA-ACL-OBJECT-GR
======= ASA MFP======
INGRESS: MFP first, then ACL
EGRESS: ACL first.
====================== ASA ACL Oject Groups ================
4 ways to group obj. groups.
1. protocol
tcp, udp, esp , gre, etc
2. network
ip add, subnet, etc
3. service
tcp port# and udp port#
4. icmp type
echo, echo-reply, unreachable, etc.
example:
object-group network OUTSIDE_TRUSTED_HOSTS
network-object host 200.0.0.1
network-object host 200.0.0.2
object-group network PUBLICK_INSIDE_SERVERS
network-object host 10.0.100
network-object host 10.0.101
object-group service PUBLIC_INSIDE_SERVER_PORTS tcp
port-object eq www
port-object eq https
port-object eq smtp
access-l 101 extended permit tcp object-group OUTSIDE_TRUSTED_HOSTS object-group PUBLIC_INSIDE_SERVERS object-group PUBLIC_INSIDE_SERVER_PORTS
access-l 101 extended permit tcp object-group "THE-SOURCE-IP" object-group "the-destination-IP" object-group "THE-DESTINATION-PORT#"
access-group 101 in interface outside
This way don't need to do so many access-l to add additonal servers or add an outside host to access in.
IPSLA - TRACK
track 20 ip sla 1 reachability
ip sla 1
icmp-echo 6.16.5.13 source-interface GigabitEthernet0/2
timeout 1500
threshold 500
frequency 3
ip sla schedule 1 life forever start-time now
ip route 0.0.0.0 0.0.0.0 6.16.5.13 track 20
ip route 0.0.0.0 0.0.0.0 21.19.25.2 254
Cisco Password Recovery - 2900 and ASA
===========For 2900 Series======
Reboot the router and press the "Break key" to interrupt the boot sequence.
1.) Either switch off or shut down the router.
1a.) Take out flash card and switch on the router.
1b.) Once the router is on Rommon mode, reinsert the compact flash.
For break key sequences, refer to this Cisco link: http://www.cisco.com/en/US/products/hw/routers/ps133/products_tech_note0.
alt+b for teraterm
1.) Type "confreg 0x2142". ====This tells the router to bypass NVRAM during bootup. In other words, your existing configuration won't be loaded. The good news is that it won't be deleted either.
2.) Type "reset" to reboot the router.
Answer "No" when prompted to run setup.
2a.) type "enable" to get into enable mode.
3.) "copy **startup-config** running". ========This loads your startup configuration into memory. Now, if you type a show run config, ou'll see the router configuration. Also, you should notice that your router name is now in the prompt instead of the default “Router”.
4.) conf t === Change the enable- “enable password new_password”
and (config)#enable secret cisco
4b.) username
5.) Change the register back to 0x2102:
(config)#config-register 0x2102
6.) "exit" and Save the password so that it will be persistent during reboots, type "copy run start" or wr mem.
7.) Reboot the router by typing reload at the enable prompt.
========================================================================
========================***** ASA Password Recovery ***** ============
1.) Power off the security appliance, and then power it on.
2.) During the startup messages, press the Escape key when prompted to enter ROMMON.
3.) rommon #1> confreg
and asks if you want to change the value:
Current Configuration Register: 0x00000001 === note this
Configuration Summary:
Do you wish to change this configuration? y/n [n]: y
Take all defaults except:
Do you wish to change this configuration? y/n [n]:
The security appliance prompts you for new values.
4.) Accept the default values for all settings, except for the "disable system configuration?" value; at that prompt, enter Y.
5.) Reload the security appliance by entering the following command:
rommon #2> boot
The security appliance loads a default configuration instead of the startup configuration.
6.) Enter privileged EXEC mode by entering the following command:
hostname> enable
7.) When prompted for the password, press Return.
The password is blank.
8.) hostname# copy startup-config running-config
9.) hostname# configure terminal
10. hostname(config)# username name password password pri 15
11.) Change the configuration register to load the startup configuration at the next reload by entering the following command:
hostname(config)# config-register value
Where value is the configuration register value you noted in Step 5 and 0x1 is the default configuration register. For more information about the configuration register, see the Cisco Security Appliance Command Reference.
12.) hostname(config)# copy running-config startup-config
Reboot the router and press the "Break key" to interrupt the boot sequence.
1.) Either switch off or shut down the router.
1a.) Take out flash card and switch on the router.
1b.) Once the router is on Rommon mode, reinsert the compact flash.
For break key sequences, refer to this Cisco link: http://www.cisco.com/en/US/products/hw/routers/ps133/products_tech_note0.
alt+b for teraterm
1.) Type "confreg 0x2142". ====This tells the router to bypass NVRAM during bootup. In other words, your existing configuration won't be loaded. The good news is that it won't be deleted either.
2.) Type "reset" to reboot the router.
Answer "No" when prompted to run setup.
2a.) type "enable" to get into enable mode.
3.) "copy **startup-config** running". ========This loads your startup configuration into memory. Now, if you type a show run config, ou'll see the router configuration. Also, you should notice that your router name is now in the prompt instead of the default “Router”.
4.) conf t === Change the enable- “enable password new_password”
and (config)#enable secret cisco
4b.) username
5.) Change the register back to 0x2102:
(config)#config-register 0x2102
6.) "exit" and Save the password so that it will be persistent during reboots, type "copy run start" or wr mem.
7.) Reboot the router by typing reload at the enable prompt.
========================================================================
========================***** ASA Password Recovery ***** ============
1.) Power off the security appliance, and then power it on.
2.) During the startup messages, press the Escape key when prompted to enter ROMMON.
3.) rommon #1> confreg
and asks if you want to change the value:
Current Configuration Register: 0x00000001 === note this
Configuration Summary:
Do you wish to change this configuration? y/n [n]: y
Take all defaults except:
Do you wish to change this configuration? y/n [n]:
The security appliance prompts you for new values.
4.) Accept the default values for all settings, except for the "disable system configuration?" value; at that prompt, enter Y.
5.) Reload the security appliance by entering the following command:
rommon #2> boot
The security appliance loads a default configuration instead of the startup configuration.
6.) Enter privileged EXEC mode by entering the following command:
hostname> enable
7.) When prompted for the password, press Return.
The password is blank.
8.) hostname# copy startup-config running-config
9.) hostname# configure terminal
10. hostname(config)# username name password password pri 15
11.) Change the configuration register to load the startup configuration at the next reload by entering the following command:
hostname(config)# config-register value
Where value is the configuration register value you noted in Step 5 and 0x1 is the default configuration register. For more information about the configuration register, see the Cisco Security Appliance Command Reference.
12.) hostname(config)# copy running-config startup-config
ASA-VPN-Setup
You need a policy nat for private to public interface vpn.
STEP 1:
access-list policy-nat-acl extended permit ip your-internal-ip 255.255.255.0 your-destinationIP 255.255.0.0
==
access-list COMPANYA extended permit ip host 207.108.219.254 10.30.4.0 255.255.255.128 == no need here.
access-list COMPANYA extended permit ip host 192.168.1.159 10.30.4.0 255.255.255.128 ***should be
Identify interesting traffic as source and destination needed to be natted on above ACL.
-------------------------------------------------------------
STEP 2:
static (inside,outside) xxx.xxx.xxx.xxx access-list policy-nat-acl ====
static (INSIDE,OUTSIDE) 207.108.219.250 192.168.1.159 netmask 255.255.255.255
static (INSIDE,OUTSIDE) 207.108.219.250 access-list COMPANYA ===should be this.***
Now static-nat your source-private to pbulic address in the "xxx.xxx.xxx.xxx" use the public ip range as you wish.
-------------------------------------------------------------
STEP3:
access-list outside_4_cryptomap extended permit ip xxx.xxx.xxx.xxx mask.mask.mask.mask 172.x.0.0 255.255.0.0
access-list COMPANYA extended permit ip host 207.108.219.254 10.30.4.0 255.255.255.128
in the crypto-acl above you could use network address itself plus its mask or an IP address along but be consistance with step 2, the remainging config is just like regular vpn tunnel setup.
STEP 1:
access-list policy-nat-acl extended permit ip your-internal-ip 255.255.255.0 your-destinationIP 255.255.0.0
==
access-list COMPANYA extended permit ip host 207.108.219.254 10.30.4.0 255.255.255.128 == no need here.
access-list COMPANYA extended permit ip host 192.168.1.159 10.30.4.0 255.255.255.128 ***should be
Identify interesting traffic as source and destination needed to be natted on above ACL.
-------------------------------------------------------------
STEP 2:
static (inside,outside) xxx.xxx.xxx.xxx access-list policy-nat-acl ====
static (INSIDE,OUTSIDE) 207.108.219.250 192.168.1.159 netmask 255.255.255.255
static (INSIDE,OUTSIDE) 207.108.219.250 access-list COMPANYA ===should be this.***
Now static-nat your source-private to pbulic address in the "xxx.xxx.xxx.xxx" use the public ip range as you wish.
-------------------------------------------------------------
STEP3:
access-list outside_4_cryptomap extended permit ip xxx.xxx.xxx.xxx mask.mask.mask.mask 172.x.0.0 255.255.0.0
access-list COMPANYA extended permit ip host 207.108.219.254 10.30.4.0 255.255.255.128
in the crypto-acl above you could use network address itself plus its mask or an IP address along but be consistance with step 2, the remainging config is just like regular vpn tunnel setup.
9/24/2015
BGP Prefix List filtering:
Prefix List filtering and Local Pref at bottom:
- Route matching system better than ACLs. Improved processor utilization., Better subnet mask matching.
- a TWO stage matching: Match network first, then match mask.
example:
ip prefix-list NEWLIST permit 172.30.0.0/16 le 20
(Network) (mask)
ip prefix-list NEWLIST permit 172.30.0.0/16 ge 24 le 24 == exactly 24.
ip prefix-list NEWLIST permit 172.30.0.0/16 ge 24 le 30 == between 24-30 subnet mask.
ip prefix-list NEWLIST permit 0.0.0.0/0 === This does NOT match everything. ONLY match exactly that route. The default route.
ip prefix-list NEWLIST permit 0.0.0.0/0 le 32 ===This match all. Permit any.
ip prefix-list NEWLIST permit 0.0.0.0/0 ge 32 ===This match only Host routes. all hosts /32.
ip prefix-list NEWLIST permit 0.0.0.0/1 ge 24 le 24 === Any class A address, and subnet mask is a /24. The first octet is 0000000.------- in the network section.
class A: 0-127 (bit 0----)
class B: 128-192 (bit 10---)
class C: 192-223 (bit 110--)
ip prefix-list NEWLIST-PF permit 128.0.0.0/2 ge 16 === Any class B network with mask of /16.
128 = 1000000 = class B.
Example:
conf t
router bgp 500
neighbor 1.1.1.1 prefix-list NEWLIST in ===routes coming in filtered.
show ip prefix-list
clear ip bgp 1.1.1.1
example 2:
route-map SET-LP
match ip add prefix-list NEWLIST-PF
st local-pre 9000
route-map SET-LP 20 ==== THIS NEEDS TO BE IN to do permit all at end. else routes not match for this route-map will be filtered.
neighbor 1.1.1.1 route-map SET-LP in ==as route come in from neighbor, change Localpref.
- Route matching system better than ACLs. Improved processor utilization., Better subnet mask matching.
- a TWO stage matching: Match network first, then match mask.
example:
ip prefix-list NEWLIST permit 172.30.0.0/16 le 20
(Network) (mask)
ip prefix-list NEWLIST permit 172.30.0.0/16 ge 24 le 24 == exactly 24.
ip prefix-list NEWLIST permit 172.30.0.0/16 ge 24 le 30 == between 24-30 subnet mask.
ip prefix-list NEWLIST permit 0.0.0.0/0 === This does NOT match everything. ONLY match exactly that route. The default route.
ip prefix-list NEWLIST permit 0.0.0.0/0 le 32 ===This match all. Permit any.
ip prefix-list NEWLIST permit 0.0.0.0/0 ge 32 ===This match only Host routes. all hosts /32.
ip prefix-list NEWLIST permit 0.0.0.0/1 ge 24 le 24 === Any class A address, and subnet mask is a /24. The first octet is 0000000.------- in the network section.
class A: 0-127 (bit 0----)
class B: 128-192 (bit 10---)
class C: 192-223 (bit 110--)
ip prefix-list NEWLIST-PF permit 128.0.0.0/2 ge 16 === Any class B network with mask of /16.
128 = 1000000 = class B.
Example:
conf t
router bgp 500
neighbor 1.1.1.1 prefix-list NEWLIST in ===routes coming in filtered.
show ip prefix-list
clear ip bgp 1.1.1.1
example 2:
route-map SET-LP
match ip add prefix-list NEWLIST-PF
st local-pre 9000
route-map SET-LP 20 ==== THIS NEEDS TO BE IN to do permit all at end. else routes not match for this route-map will be filtered.
neighbor 1.1.1.1 route-map SET-LP in ==as route come in from neighbor, change Localpref.
BGP AS Path Access-list / filtering
AS Path Access-list / filtering
permit .....
deny ....
permit ....
permit .* ===permit all at the end.
Example 1:
conf t
ip as-path access-list 1 deny ^300_ -- match everything from 300 most recently. or _300_ anywhere there's 300, deny.
ip as-path access-list 1 permit .* === need this, else there's a implicit deny all.
route-map FILTER_300 permit 10
match as-path 1 ===if want "or" 1 2 3 4: match as-path 1 or 2 or 3 or 4.
router bgp 500
neighbor 1.1.1.1 route-map FILTER_300 out
Example 2:
match as-path 500 and set weight 1000, so prefer that route from that neighbor.
ip as-path access-list 10 permit _500_
route-map INFLUENCE
match as-path 10
set weight 1000
router bgp 200
neighbor 199.9.9.2 route-map INFLUENCE in == Routes from that neighbor pass to the route map and set weight to 1000...so, routes outbound will prefer path to the neighbor.
permit .....
deny ....
permit ....
permit .* ===permit all at the end.
Example 1:
conf t
ip as-path access-list 1 deny ^300_ -- match everything from 300 most recently. or _300_ anywhere there's 300, deny.
ip as-path access-list 1 permit .* === need this, else there's a implicit deny all.
route-map FILTER_300 permit 10
match as-path 1 ===if want "or" 1 2 3 4: match as-path 1 or 2 or 3 or 4.
router bgp 500
neighbor 1.1.1.1 route-map FILTER_300 out
Example 2:
match as-path 500 and set weight 1000, so prefer that route from that neighbor.
ip as-path access-list 10 permit _500_
route-map INFLUENCE
match as-path 10
set weight 1000
router bgp 200
neighbor 199.9.9.2 route-map INFLUENCE in == Routes from that neighbor pass to the route map and set weight to 1000...so, routes outbound will prefer path to the neighbor.
BGP Regular Expression hints
RegEX:
^ Matches the beginning of input.
$ matches the end of input
| (pipe) A logical "or" statement.
. (period) matches a SINGLE character.
+ matches the character to the left 1 or more times.
* matches the character to the left 0 or more times.
? matches the character to the left 0 or 1 times.
\ removes special meanings.
( ) affects order of operations
[ ] creates a group of characters.
_ white space.
Examples:
150.1.1.0/24
AS Path: 6733 982 43 239 852 4439 10295 6010 10
1. only match 43: _43_
2. only match 43 or 10: _43_|_10_
3. only match the last previous 6733: ^6733 ---begins with 6733, it reads left to right.
4. only match AS originated 10: _10$ --match end of the string, which is 10 orginated AS.
(_33_|_44_)_982_
match EITHER 33 OR 44 FOLLOW BY 982.
^6733_. ====matches most recent AS and anything behind, but not originated from 6733. The period is 1 charater, so matches any AS, no matter how many, after 6733, since 1 character after.
^[0-9]+$ ====match to the left of + one or more times. just match one AS.
[300]+ === match 300 one or more times.
AS 300 300 300 300
to match 300 again and again:
^(300)+$
$([0-9]+)(_\1)*$ ===0-9 one or more times. AS 1234, 555, etc. To match ANY AS that has been prepended.
5. Match stuff originated from my AS. Match internal routes only. Inside our AS. Only when leaves our AS, do we put the AS on it.
^$
6. ^\(64512) ==removes special meaning from the parentheses.
If in AS Path: (6733 982) 43 239 852 4439
The AS inside the AS path with parentheses is Confederation.
7. Match everything: .*
6/29/2015
Cacti Bulk Tree Add Command line
If you want to add hundreds on ports in Cacti automatically without point and click on the GUI, do below:
1. Add a new device using GUI like you normally do.
2. Create your Graph Tree and add your new Tree item for your new device.
3. That's it on the GUI. The rest you will do by command line to add your hundreds of ports to monitor for that device under your Tree.
Go to:
ssh to your cacti server:
cd /usr/share/cacti/cli
sudo php -q add_tree.php --list-trees
sudo php -q add_tree.php --list-hosts
sudo php -q add_tree.php --list-nodes --tree-id=2 | grep Header ===get parent-node.
sudo php -q add_tree.php --list-graphs --host-id=20 ---will see the IDs and need this for next step.
for i in {664..781} ;
do sudo php -q add_tree.php --type=node --node-type=graph --tree-id=2 --parent-node=492 --host-id=20 --graph-id=${i};
Another example:
for i in {35..70}
do sudo php -q add_tree.php --type=node --node-type=graph --tree-id=2 --parent-node=1573 --host-id=11 --graph-id=${i};
done
1. Add a new device using GUI like you normally do.
2. Create your Graph Tree and add your new Tree item for your new device.
3. That's it on the GUI. The rest you will do by command line to add your hundreds of ports to monitor for that device under your Tree.
Go to:
ssh to your cacti server:
cd /usr/share/cacti/cli
sudo php -q add_tree.php --list-trees
sudo php -q add_tree.php --list-hosts
sudo php -q add_tree.php --list-nodes --tree-id=2 | grep Header ===get parent-node.
sudo php -q add_tree.php --list-graphs --host-id=20 ---will see the IDs and need this for next step.
for i in {664..781} ;
do sudo php -q add_tree.php --type=node --node-type=graph --tree-id=2 --parent-node=492 --host-id=20 --graph-id=${i};
Another example:
for i in {35..70}
do sudo php -q add_tree.php --type=node --node-type=graph --tree-id=2 --parent-node=1573 --host-id=11 --graph-id=${i};
done
4/03/2015
Basic Juniper Setup with VLAN Routing, OSPF, Display Set
Basic Juniper Setup:
1. From factory default, login as:
root / no password
login: root
Password:
root@:RE:0%
2. At % prompt type:
root@:RE:0% cli
3. root> show version
4. root> show interfaces terse
5. root> configure or edit
root#
6. Set the hostname. For example:
root# set system host-name Chicago
7. Set the IP addresses of the built-in Ethernet ports. For example:
root# set interfaces ge-0/0/0 unit 0 family inet address 1.1.2.31/24
root# set interfaces ge-0/0/1 unit 0 family inet address 1.6.2.1/24
root# set interfaces ge-0/0/2 unit 0 family inet address 2.8.3.1/24
The unit number is the logical interface number. IP addresses are configured on the logical interface. Setting
the protocol family to inet specifies the routing table of IPv4 addresses.
7b. Set a default route (default gateway) for IPv4 packets. For example:
root# set routing-options static route 1.6.2.1/24 next-hop 10.1.1.50
7c. Configure one or more static routes:
root# set routing-options static route destination-prefix next-hop address
8. root# commit
===========
9. set root password / create user acct
set system root-authentication plain-text-password
set system login user BOB class super-user authentication plain-text-password
=== VLAN, VLAN IP Address, and Interface mapping to VLAN: 2 OPTIONS ===
OPTION 1 SET ROOT MODE#:
10. Create some VLANs.
a. root# set vlans WIFI vlan-id 1 === assign vlan 1 to WIFI vlan.
b. root# set vlans v10 vlan-id 10
c. root# set vlans STUDENT vlan-id 20
11. Assign IP Address to the VLAN: Create RVI.
a. root# set interfaces vlan unit 1 family inet address 192.168.1.2/24 === associates ip address to
(unit 1) the vlan-id 1, which is the WIFI vlan.
b. root# set interfaces vlan unit 10 family inet address 10.16.23.65/26 ==== the unit 10 here associates the vlan-id 10 (v10) to the IP Address.
c. root# set interfaces vlan unit 20 family inet address 10.1.20.1/24
12. Assign interfaces to their respective VLANs.
a. set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members WIFI
b. set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members WIFI
c. set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members WIFI
d. set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members v10
e. set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members v10
f. set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members v10
g. set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members STUDENT
h. set interfaces ge-0/0/7 unit 0 family ethernet-switching vlan members STUDENT
i. set interfaces ge-0/0/8 unit 0 family ethernet-switching vlan members STUDENT
13. Enable INTER-VLAN routing:
a. root# set vlans WIFI l3-interfce vlan.1
b. root# set vlans v10 l3-interfce vlan.10
c. root# set vlans STUDENT l3-interfce vlan.20
14. Set Default Route in the Switch:
a. root# set routing-options static route 0.0.0.0/0 next-hop 10.16.23.10
15. Set management path:
a. root# set system services web-management http interface vlan.20 === This only allows web management for the switch only from VLAN 20, STUDENT VLAN.
16. Enable Telnet / SSH:
a. root# set system services telnet
b. root# set system services ssh
17. Set DHCP forwarding options (in cisco ip helper address).
a. root# set forwarding-options helpers bootp interface vlan.1 server 10.16.23.10 === DHCP forwarding
for WIFI VLAN, VLAN1.
b. root# set forwarding-options helpers bootp interface vlan.10 server 10.16.23.68 === DHCP forwarding
for v10 VLAN, VLAN 10.
c. root# set forwarding-options helpers bootp interface vlan.20 server 10.16.23.99 === DHCP forwarding
for STUDENT VLAN, VLAN 20.
18. Save the config
root# commit and-quit
19. root# run show interfaces terse vlan
root> show ethernet-switching interfaces
SHOW:
show vlans
root# run show interfaces terse vlan
root# run show route 192.168.1/24
OPTION 2 hierarchy mode:
On EX4200
== VLAN, VLAN IP Address, and Interface mapping to VLAN ===
1. root@:RE:0% cli
2. root> show vlans
3. root> edit
4. root# edit vlans
5. root# set VLAN10 vlan-id 10
6. root# set ENDUSERS vlan-id 20
7. root# set SERVERS vlan-id 30
8. root# show
9. Apply the VLANs to interfaces and mode access
root# top === exit out of vlan config.
root# edit interfaces === enter interfaces hierarchy
root# edit ge-0/0/1 unit 0 family ethernet-switching
root# set port-mode access
root# set vlan members VLAN10 === Map this interface to VLAN10 or ENDUSERS or other VLAN.
root# up 3 === go up 3 levels in the hierarchy.
root# edit ge-0/0/2 unit 0 family ethernet-switching
root# set port-mode access
root# set vlan members ENDUSERS
root# up 3
root# edit ge-0/0/3 unit 0 family ethernet-switching
root# set port-mode access
root# set vlan members SERVERS
10. Create TRUNK interface on Juniper switch:
root# edit interfaces
root# edit ge-0/0/0 unit 0 family ethernet-switching
root# set port-mode trunk
root# set vlan members VLAN10
root# set vlan members ENDUSERS
root# set vlan members SERVERS
root# show
11. commit
12. root# exit
root> show vlans
====== Juniper Factory Default Config ===
root% cli
root> configure
root# load factory-default
root# set system root-authentication plain-text-password == Set new root password
root# commit and-quit
root# request system reboot === reload the switch
====================================
==== Enable OSPF in Juniper ====
set interfaces ge-0/2/0 unit 0 family inet address 10.0.0.1
set protocols ospf area 0.0.0.0 interface ge-0/2/0
commit
or
set interfaces ge-0/2/0 unit 0 family inet address 10.0.0.1
edit protocols ospf
set area 0 interface ge-0/0/1
set area 0 interface lo0
==== Troubleshoot or Debug OSPF Juniper ====
1. do debug by: It need to create a file to do a debug in /var/log.
# edit protocols ospf
edit traceoptions
set file ospf-trace
set flag hello detail ===type of packets to capture.
commit
2. run monitor start ospf-trace == the file you created.
3. run monitor stop ==== STOPS all debug on the box. But still be written to the log file.
4. run show log ospf-trace === The filename == See log still increment after monitor stop.
5. To completely disable Debug or trace
# deactivate traceoptions
#show === When do show, will see the "inactive" statement. And when commit, Junos will ignore the inactive statement in the config.
=====================================================
# show interfaces
user@host# show protocols ospf
show ospf interface detail
show ospf3 interface detail
show configuration protocols ospf
show ospf interface
show ospf nei
show ospf data
==== Config OSPF Passive Interface Juniper ====
Enabling OSPF on an interface (by including the interface statement), disabling it (by including the disable
statement), and not actually having OSPF run on an interface (by including the passive statement) are mutually
exclusive states.
set protocols ospf area 0.0.0.1 interface ge-0/2/0 passive
user@host# show protocols ospf
area 0.0.0.1 {
interface ge-0/2/0.0 {
passive;
}
}
================== commit / compare ====
To check what has been changed, but UNcommited in Junos configuration, go to cli top and do "show | compare".
This will show the candidate configuration and compare it to current commited configuration.
User@Host# show | compare
sysT3ms@FIFE-DC-EX1> show system commit
====================================================
cisco vs juniper
Cisco
conf t
Int Gi1/0/1
shut
no shut
Juniper
config
set interfaces ge-5/0/42 disable
commit
delete interfaces ge-5/0/42 disable
commit
1. From factory default, login as:
root / no password
login: root
Password:
root@:RE:0%
2. At % prompt type:
root@:RE:0% cli
3. root> show version
4. root> show interfaces terse
5. root> configure or edit
root#
6. Set the hostname. For example:
root# set system host-name Chicago
7. Set the IP addresses of the built-in Ethernet ports. For example:
root# set interfaces ge-0/0/0 unit 0 family inet address 1.1.2.31/24
root# set interfaces ge-0/0/1 unit 0 family inet address 1.6.2.1/24
root# set interfaces ge-0/0/2 unit 0 family inet address 2.8.3.1/24
The unit number is the logical interface number. IP addresses are configured on the logical interface. Setting
the protocol family to inet specifies the routing table of IPv4 addresses.
7b. Set a default route (default gateway) for IPv4 packets. For example:
root# set routing-options static route 1.6.2.1/24 next-hop 10.1.1.50
7c. Configure one or more static routes:
root# set routing-options static route destination-prefix next-hop address
8. root# commit
===========
9. set root password / create user acct
set system root-authentication plain-text-password
set system login user BOB class super-user authentication plain-text-password
=== VLAN, VLAN IP Address, and Interface mapping to VLAN: 2 OPTIONS ===
OPTION 1 SET ROOT MODE#:
10. Create some VLANs.
a. root# set vlans WIFI vlan-id 1 === assign vlan 1 to WIFI vlan.
b. root# set vlans v10 vlan-id 10
c. root# set vlans STUDENT vlan-id 20
11. Assign IP Address to the VLAN: Create RVI.
a. root# set interfaces vlan unit 1 family inet address 192.168.1.2/24 === associates ip address to
(unit 1) the vlan-id 1, which is the WIFI vlan.
b. root# set interfaces vlan unit 10 family inet address 10.16.23.65/26 ==== the unit 10 here associates the vlan-id 10 (v10) to the IP Address.
c. root# set interfaces vlan unit 20 family inet address 10.1.20.1/24
12. Assign interfaces to their respective VLANs.
a. set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members WIFI
b. set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members WIFI
c. set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members WIFI
d. set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members v10
e. set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members v10
f. set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members v10
g. set interfaces ge-0/0/6 unit 0 family ethernet-switching vlan members STUDENT
h. set interfaces ge-0/0/7 unit 0 family ethernet-switching vlan members STUDENT
i. set interfaces ge-0/0/8 unit 0 family ethernet-switching vlan members STUDENT
13. Enable INTER-VLAN routing:
a. root# set vlans WIFI l3-interfce vlan.1
b. root# set vlans v10 l3-interfce vlan.10
c. root# set vlans STUDENT l3-interfce vlan.20
14. Set Default Route in the Switch:
a. root# set routing-options static route 0.0.0.0/0 next-hop 10.16.23.10
15. Set management path:
a. root# set system services web-management http interface vlan.20 === This only allows web management for the switch only from VLAN 20, STUDENT VLAN.
16. Enable Telnet / SSH:
a. root# set system services telnet
b. root# set system services ssh
17. Set DHCP forwarding options (in cisco ip helper address).
a. root# set forwarding-options helpers bootp interface vlan.1 server 10.16.23.10 === DHCP forwarding
for WIFI VLAN, VLAN1.
b. root# set forwarding-options helpers bootp interface vlan.10 server 10.16.23.68 === DHCP forwarding
for v10 VLAN, VLAN 10.
c. root# set forwarding-options helpers bootp interface vlan.20 server 10.16.23.99 === DHCP forwarding
for STUDENT VLAN, VLAN 20.
18. Save the config
root# commit and-quit
19. root# run show interfaces terse vlan
root> show ethernet-switching interfaces
SHOW:
show vlans
root# run show interfaces terse vlan
root# run show route 192.168.1/24
OPTION 2 hierarchy mode:
On EX4200
== VLAN, VLAN IP Address, and Interface mapping to VLAN ===
1. root@:RE:0% cli
2. root> show vlans
3. root> edit
4. root# edit vlans
5. root# set VLAN10 vlan-id 10
6. root# set ENDUSERS vlan-id 20
7. root# set SERVERS vlan-id 30
8. root# show
9. Apply the VLANs to interfaces and mode access
root# top === exit out of vlan config.
root# edit interfaces === enter interfaces hierarchy
root# edit ge-0/0/1 unit 0 family ethernet-switching
root# set port-mode access
root# set vlan members VLAN10 === Map this interface to VLAN10 or ENDUSERS or other VLAN.
root# up 3 === go up 3 levels in the hierarchy.
root# edit ge-0/0/2 unit 0 family ethernet-switching
root# set port-mode access
root# set vlan members ENDUSERS
root# up 3
root# edit ge-0/0/3 unit 0 family ethernet-switching
root# set port-mode access
root# set vlan members SERVERS
10. Create TRUNK interface on Juniper switch:
root# edit interfaces
root# edit ge-0/0/0 unit 0 family ethernet-switching
root# set port-mode trunk
root# set vlan members VLAN10
root# set vlan members ENDUSERS
root# set vlan members SERVERS
root# show
11. commit
12. root# exit
root> show vlans
====== Juniper Factory Default Config ===
root% cli
root> configure
root# load factory-default
root# set system root-authentication plain-text-password == Set new root password
root# commit and-quit
root# request system reboot === reload the switch
====================================
==== Enable OSPF in Juniper ====
set interfaces ge-0/2/0 unit 0 family inet address 10.0.0.1
set protocols ospf area 0.0.0.0 interface ge-0/2/0
commit
or
set interfaces ge-0/2/0 unit 0 family inet address 10.0.0.1
edit protocols ospf
set area 0 interface ge-0/0/1
set area 0 interface lo0
==== Troubleshoot or Debug OSPF Juniper ====
1. do debug by: It need to create a file to do a debug in /var/log.
# edit protocols ospf
edit traceoptions
set file ospf-trace
set flag hello detail ===type of packets to capture.
commit
2. run monitor start ospf-trace == the file you created.
3. run monitor stop ==== STOPS all debug on the box. But still be written to the log file.
4. run show log ospf-trace === The filename == See log still increment after monitor stop.
5. To completely disable Debug or trace
# deactivate traceoptions
#show === When do show, will see the "inactive" statement. And when commit, Junos will ignore the inactive statement in the config.
=====================================================
# show interfaces
user@host# show protocols ospf
show ospf interface detail
show ospf3 interface detail
show configuration protocols ospf
show ospf interface
show ospf nei
show ospf data
==== Config OSPF Passive Interface Juniper ====
Enabling OSPF on an interface (by including the interface statement), disabling it (by including the disable
statement), and not actually having OSPF run on an interface (by including the passive statement) are mutually
exclusive states.
set protocols ospf area 0.0.0.1 interface ge-0/2/0 passive
user@host# show protocols ospf
area 0.0.0.1 {
interface ge-0/2/0.0 {
passive;
}
}
================== commit / compare ====
To check what has been changed, but UNcommited in Junos configuration, go to cli top and do "show | compare".
This will show the candidate configuration and compare it to current commited configuration.
User@Host# show | compare
sysT3ms@FIFE-DC-EX1> show system commit
====================================================
cisco vs juniper
Cisco
conf t
Int Gi1/0/1
shut
no shut
Juniper
config
set interfaces ge-5/0/42 disable
commit
delete interfaces ge-5/0/42 disable
commit
Cacti Backup and Restore Script
Cacti Backup:
Files will be saved in /home/cacti-backup/
-rw-r--r-- 1 root root 6851095 Mar 31 08:23 /home/cacti-backup/CactiFolder-2015-03-31.tar.gz
-rw-r--r-- 1 root root 25800 Mar 31 08:20 /home/cacti-backup/CLI_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 845639 Mar 31 08:20 /home/cacti-backup/LOG_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 65301949 Mar 31 08:20 /home/cacti-backup/RRAXML_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 5806 Mar 31 08:20 /home/cacti-backup/SCRIPT_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 2462302 Mar 31 08:23 /home/cacti-backup/Cacti-Database-2015-03-31.sql
Script:
After run the backup script, enter your mysql password when ask.
[root@localhost backup]# cat cactibackup.sh
##################################################
#!bin/bash
#
# Script for backing up Cacti and all related folders
#
# This function finds all rrd files runs the rrdtool dump feature and deletes the xml file
rrdump ()
{
for rrd in `find /home/cacti-backup/rra/ -type f -name "*.rrd"`
do
xml=`echo $rrd | sed 's/.rrd//g'`
rrdtool dump $rrd > $xml.xml
rm $rrd
done
}
#
# Timestamp in YYYY-MM-DD
TIME_STAMP="$(date +%Y-%m-%d)"
#
# Backup the MySQL database
mysqldump -u root -p cacti > /home/cacti-backup/Cacti-Database-${TIME_STAMP}.sql
#
# Backup and archive the Cacti folder
tar -cvpzf /home/cacti-backup/CactiFolder-${TIME_STAMP}.tar.gz /usr/share/cacti
#
# Copy the RRA directory to the backup directory
cd /var/lib/cacti
cp -R rra /home/cacti-backup/
#
# Find all files with the extension rrd and run the RRDTOOL DUMP feature
rrdump
#
# Backup and archive the RRA folder
tar -cvpzf /home/cacti-backup/RRAXML_files-${TIME_STAMP}.tar.gz /home/cacti-backup/rra
#
# Remove the RRA folder
cd /home/cacti-backup
rm -rf rra
#
# Backup and archive all other required folders
tar -cvpzf /home/cacti-backup/CLI_files-${TIME_STAMP}.tar.gz /var/lib/cacti/cli
tar -cvpzf /home/cacti-backup/LOG_files-${TIME_STAMP}.tar.gz /var/log/cacti/
tar -cvpzf /home/cacti-backup/SCRIPT_files-${TIME_STAMP}.tar.gz /var/lib/cacti/scripts
##################################################
=============================================
Cacti restore:
cacti@cacti01:~/cacti-backup$ cat restore.sh
##################################################
#!/bin/bash
#
# Script for restoring Cacti and all related folders
#
# This function finds all rrd files runs the rrdtool dump feature and deletes the xml file
rrdrestore ()
{
for xml in `find . -type f -name "*.xml"`
do
rrd=`echo $xml | sed 's/.xml//g'`
rrdtool restore $xml $rrd.rrd
rm $xml
done
}
restore ()
{
#Restoring Database
mysql -u root -p cacti < $MySQLDatabase
#Unpacking RRA files from archive
tar -xvzf $RRAFiles -C /
#Restore RRD files using RRDTOOL restore
rrdrestore
#Copy RRA folder to /var/lib/cacti
cd /home/cacti-backup/
cp -R rra /var/lib/cacti/
#Delete RRA folder
cd /home/cacti-backup
rm -rf rra
#Change ownership of RRA directory
chown -R cacti:cacti /var/lib/cacti/rra
chown cacti:root /var/lib/cacti/rra
#Restore all other folders
tar -xvzf $LOGFiles -C /
tar -xvzf $CLIFiles -C /
tar -xvzf $SCRIPTFiles -C /
tar -xvzf $CactiFolder -C /
#Change ownershipt of log/cacti directory
chown -R cacti:apache /var/log/cacti
echo
echo Restoration Complete. Please restart server.
echo Please note: You may need to rebuild the poller cache once logged into Cacti
}
#
# Requesting information from user - date of backup in format YYYY-MM-DD
echo
echo
echo -n "Please enter the date from which you would like to restore from (YYYY-MM-DD):"
read date
echo
echo
echo Restoring from date $date
echo
echo
#
# Checking files exist
cd /home/cacti-backup/
MySQLDatabase=Cacti-Database-$date.sql
CactiFolder=CactiFolder-$date.tar.gz
RRAFiles=RRAXML_files-$date.tar.gz
LOGFiles=LOG_files-$date.tar.gz
CLIFiles=CLI_files-$date.tar.gz
SCRIPTFiles=SCRIPT_files-$date.tar.gz
#
#
echo Checking if files exist:
echo
echo
if [ -f $MySQLDatabase ]; then
echo "File $MySQLDatabase exists. SUCCESS!"
else
echo "File $MySQLDatabase does not exist. FAIL!"
fi
#
#
if [ -f $CactiFolder ]; then
echo "File $CactiFolder exists. SUCCESS!"
else
echo "File $CactiFolder does not exist. FAIL!"
fi
#
#
if [ -f $RRAFiles ]; then
echo "File $RRAFiles exists. SUCCESS!"
else
echo "File $RRAFiles does not exist. FAIL!"
fi
#
#
if [ -f $CLIFiles ]; then
echo "File $CLIFiles exists. SUCCESS!"
else
echo "File $CLIFiles does not exist. FAIL!"
fi
#
#
if [ -f $LOGFiles ]; then
echo "File $LOGFiles exists. SUCCESS!"
else
echo "File $LOGFiles does not exist. FAIL!"
fi
#
#
if [ -f $SCRIPTFiles ]; then
echo "File $SCRIPTFiles exists. SUCCESS!"
else
echo "File $SCRIPTFiles does not exist. FAIL!"
fi
#
echo
echo
#
#Asking user if they want to continue
echo WARNING: IF ANY OF THE FILES ABOVE FAIL, RESTORE MAY.
while true; do
read -p "DO YOU WANT TO CONTINUE?" yn
case $yn in
[Yy]* ) restore; break;;
[Nn]* ) exit;;
* ) echo "Please answer yes or no.";;
esac
done
##################################################
Or if you ONLY want the database restored that contains all your devices and ports monitored just do:
After a fresh reinstall of Cacti:
cacti@cacti01:~/script$ mysql -u root -p cacti < Cacti-Database-2015-03-31.sql
Files will be saved in /home/cacti-backup/
-rw-r--r-- 1 root root 6851095 Mar 31 08:23 /home/cacti-backup/CactiFolder-2015-03-31.tar.gz
-rw-r--r-- 1 root root 25800 Mar 31 08:20 /home/cacti-backup/CLI_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 845639 Mar 31 08:20 /home/cacti-backup/LOG_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 65301949 Mar 31 08:20 /home/cacti-backup/RRAXML_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 5806 Mar 31 08:20 /home/cacti-backup/SCRIPT_files-2015-03-31.tar.gz
-rw-r--r-- 1 root root 2462302 Mar 31 08:23 /home/cacti-backup/Cacti-Database-2015-03-31.sql
Script:
After run the backup script, enter your mysql password when ask.
[root@localhost backup]# cat cactibackup.sh
##################################################
#!bin/bash
#
# Script for backing up Cacti and all related folders
#
# This function finds all rrd files runs the rrdtool dump feature and deletes the xml file
rrdump ()
{
for rrd in `find /home/cacti-backup/rra/ -type f -name "*.rrd"`
do
xml=`echo $rrd | sed 's/.rrd//g'`
rrdtool dump $rrd > $xml.xml
rm $rrd
done
}
#
# Timestamp in YYYY-MM-DD
TIME_STAMP="$(date +%Y-%m-%d)"
#
# Backup the MySQL database
mysqldump -u root -p cacti > /home/cacti-backup/Cacti-Database-${TIME_STAMP}.sql
#
# Backup and archive the Cacti folder
tar -cvpzf /home/cacti-backup/CactiFolder-${TIME_STAMP}.tar.gz /usr/share/cacti
#
# Copy the RRA directory to the backup directory
cd /var/lib/cacti
cp -R rra /home/cacti-backup/
#
# Find all files with the extension rrd and run the RRDTOOL DUMP feature
rrdump
#
# Backup and archive the RRA folder
tar -cvpzf /home/cacti-backup/RRAXML_files-${TIME_STAMP}.tar.gz /home/cacti-backup/rra
#
# Remove the RRA folder
cd /home/cacti-backup
rm -rf rra
#
# Backup and archive all other required folders
tar -cvpzf /home/cacti-backup/CLI_files-${TIME_STAMP}.tar.gz /var/lib/cacti/cli
tar -cvpzf /home/cacti-backup/LOG_files-${TIME_STAMP}.tar.gz /var/log/cacti/
tar -cvpzf /home/cacti-backup/SCRIPT_files-${TIME_STAMP}.tar.gz /var/lib/cacti/scripts
##################################################
=============================================
Cacti restore:
cacti@cacti01:~/cacti-backup$ cat restore.sh
##################################################
#!/bin/bash
#
# Script for restoring Cacti and all related folders
#
# This function finds all rrd files runs the rrdtool dump feature and deletes the xml file
rrdrestore ()
{
for xml in `find . -type f -name "*.xml"`
do
rrd=`echo $xml | sed 's/.xml//g'`
rrdtool restore $xml $rrd.rrd
rm $xml
done
}
restore ()
{
#Restoring Database
mysql -u root -p cacti < $MySQLDatabase
#Unpacking RRA files from archive
tar -xvzf $RRAFiles -C /
#Restore RRD files using RRDTOOL restore
rrdrestore
#Copy RRA folder to /var/lib/cacti
cd /home/cacti-backup/
cp -R rra /var/lib/cacti/
#Delete RRA folder
cd /home/cacti-backup
rm -rf rra
#Change ownership of RRA directory
chown -R cacti:cacti /var/lib/cacti/rra
chown cacti:root /var/lib/cacti/rra
#Restore all other folders
tar -xvzf $LOGFiles -C /
tar -xvzf $CLIFiles -C /
tar -xvzf $SCRIPTFiles -C /
tar -xvzf $CactiFolder -C /
#Change ownershipt of log/cacti directory
chown -R cacti:apache /var/log/cacti
echo
echo Restoration Complete. Please restart server.
echo Please note: You may need to rebuild the poller cache once logged into Cacti
}
#
# Requesting information from user - date of backup in format YYYY-MM-DD
echo
echo
echo -n "Please enter the date from which you would like to restore from (YYYY-MM-DD):"
read date
echo
echo
echo Restoring from date $date
echo
echo
#
# Checking files exist
cd /home/cacti-backup/
MySQLDatabase=Cacti-Database-$date.sql
CactiFolder=CactiFolder-$date.tar.gz
RRAFiles=RRAXML_files-$date.tar.gz
LOGFiles=LOG_files-$date.tar.gz
CLIFiles=CLI_files-$date.tar.gz
SCRIPTFiles=SCRIPT_files-$date.tar.gz
#
#
echo Checking if files exist:
echo
echo
if [ -f $MySQLDatabase ]; then
echo "File $MySQLDatabase exists. SUCCESS!"
else
echo "File $MySQLDatabase does not exist. FAIL!"
fi
#
#
if [ -f $CactiFolder ]; then
echo "File $CactiFolder exists. SUCCESS!"
else
echo "File $CactiFolder does not exist. FAIL!"
fi
#
#
if [ -f $RRAFiles ]; then
echo "File $RRAFiles exists. SUCCESS!"
else
echo "File $RRAFiles does not exist. FAIL!"
fi
#
#
if [ -f $CLIFiles ]; then
echo "File $CLIFiles exists. SUCCESS!"
else
echo "File $CLIFiles does not exist. FAIL!"
fi
#
#
if [ -f $LOGFiles ]; then
echo "File $LOGFiles exists. SUCCESS!"
else
echo "File $LOGFiles does not exist. FAIL!"
fi
#
#
if [ -f $SCRIPTFiles ]; then
echo "File $SCRIPTFiles exists. SUCCESS!"
else
echo "File $SCRIPTFiles does not exist. FAIL!"
fi
#
echo
echo
#
#Asking user if they want to continue
echo WARNING: IF ANY OF THE FILES ABOVE FAIL, RESTORE MAY.
while true; do
read -p "DO YOU WANT TO CONTINUE?" yn
case $yn in
[Yy]* ) restore; break;;
[Nn]* ) exit;;
* ) echo "Please answer yes or no.";;
esac
done
##################################################
Or if you ONLY want the database restored that contains all your devices and ports monitored just do:
After a fresh reinstall of Cacti:
cacti@cacti01:~/script$ mysql -u root -p cacti < Cacti-Database-2015-03-31.sql
3/24/2015
Juniper Switch Software Install, Upgrade, or Downgrade using USB port
I bought 2 EX4200 from eBay and wanted to do virtual-chassis. Here are some things I learned:
1. The 2 switches came with different Software version 10 and 12.
2. Had to buy the vcp cable for virtual chassis.
3. Had to connect the cable in the back vcp-0 to vcp-0 and vcp-1 to vcp-1 to make a ring, else wouldn't work. You'll see a status of "NotPrsnt."
4. Both switches need to be on the same software, so this is what I did:
I had to downgrade the new switch to 10.4R5.5 – the simplest and safest way to do this is with the switch in standalone and put the image on a USB Key and plug in back of EX4200.
Here are the steps:
a. Download your image from Juniper.net and put in the root of a FAT32 formatted USB Key in your laptop/
b. Insert the USB key into the back of the EX4200 and boot the switch if Needed.
Then mount the usb key
root@:RE:0% mount_msdosfs /dev/da1s1 /mnt
Once the USB has been mounted you can run the request system software add command. This command installs any software version you specified...upgrade or downgrade.
root> request system software add /mnt/jinstall-ex-4200-10.4R5.5-domestic-signed.tgz
You now have to be patient as this process takes a few minutes, once the image has been loaded you will be asked to reboot.
Checking pending install on fpc0
Validating on fpc0
Done with validate on all virtual chassis members
fpc0:
WARNING: A reboot is required to install the software
WARNING: Use the ‘request system reboot’ command immediately
root@:RE:0% cli
{master:0}
root> request system reboot
Reboot the system ? [yes,no] (no) yes
*** FINAL System shutdown message from root@ ***
System going down IMMEDIATELY
Once the switch has rebooted a show version will show the switch is now running the 10 or any Image you had installed.
root> show version
1. The 2 switches came with different Software version 10 and 12.
2. Had to buy the vcp cable for virtual chassis.
3. Had to connect the cable in the back vcp-0 to vcp-0 and vcp-1 to vcp-1 to make a ring, else wouldn't work. You'll see a status of "NotPrsnt."
4. Both switches need to be on the same software, so this is what I did:
I had to downgrade the new switch to 10.4R5.5 – the simplest and safest way to do this is with the switch in standalone and put the image on a USB Key and plug in back of EX4200.
Here are the steps:
a. Download your image from Juniper.net and put in the root of a FAT32 formatted USB Key in your laptop/
b. Insert the USB key into the back of the EX4200 and boot the switch if Needed.
Then mount the usb key
root@:RE:0% mount_msdosfs /dev/da1s1 /mnt
Once the USB has been mounted you can run the request system software add command. This command installs any software version you specified...upgrade or downgrade.
root> request system software add /mnt/jinstall-ex-4200-10.4R5.5-domestic-signed.tgz
You now have to be patient as this process takes a few minutes, once the image has been loaded you will be asked to reboot.
Checking pending install on fpc0
Validating on fpc0
Done with validate on all virtual chassis members
fpc0:
WARNING: A reboot is required to install the software
WARNING: Use the ‘request system reboot’ command immediately
root@:RE:0% cli
{master:0}
root> request system reboot
Reboot the system ? [yes,no] (no) yes
*** FINAL System shutdown message from root@ ***
System going down IMMEDIATELY
Once the switch has rebooted a show version will show the switch is now running the 10 or any Image you had installed.
root> show version
3/16/2015
BGP LAB 1: BGP Access List Filtering and Answer
2 routers connected with eBGP. Want to filter some routes (10.x.x.x) from the neighbor router using Extended Access List.
Goal:
Config like diagram.
Configure EBGP between router Tristram and Sanctuary.
Advertise the loopback interfaces on both routers in BGP.
Configure a summary that advertises 10.0.0.0/8 towards router Sanctuary.
Configure an extended access-list on router Sanctuary that will block the 10.0.0.0/8 prefix but allows all other prefixes.
Configure an extended access-list on router Tristram that blocks network 10.2.2.0/24.
Answer:
Tristram Router:
router bgp 1
no synchronization
bgp log-neighbor-changes
network 1.1.1.1 mask 255.255.255.255
network 10.0.0.0 === Advertise the 10.x network, then need the summary-only next statement.
aggregate-address 10.0.0.0 255.0.0.0 summary-only === This is to summarize the 10.x.
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 distribute-list 100 in ===Deny the ACL 100 from coming in.
access-list 100 deny ip 10.0.0.0 0.255.255.255 any === Deny the 10.x network.
access-list 100 permit ip any any
Sanctuary Router:
router bgp 2
no synchronization
bgp log-neighbor-changes
network 2.2.2.2 mask 255.255.255.255
network 10.2.2.0 mask 255.255.255.0
aggregate-address 10.0.0.0 255.0.0.0 summary-only
neighbor 192.168.12.1 remote-as 1
neighbor 192.168.12.1 soft-reconfiguration inbound
neighbor 192.168.12.1 distribute-list 100 in
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
sh ip bgp nei 192.168.12.1 received-routes
sh ip route
====================================
Note: I got this from gns3vault.com, but I posted my answer for my own reference.
Goal:
Config like diagram.
Configure EBGP between router Tristram and Sanctuary.
Advertise the loopback interfaces on both routers in BGP.
Configure a summary that advertises 10.0.0.0/8 towards router Sanctuary.
Configure an extended access-list on router Sanctuary that will block the 10.0.0.0/8 prefix but allows all other prefixes.
Configure an extended access-list on router Tristram that blocks network 10.2.2.0/24.
Answer:
Tristram Router:
router bgp 1
no synchronization
bgp log-neighbor-changes
network 1.1.1.1 mask 255.255.255.255
network 10.0.0.0 === Advertise the 10.x network, then need the summary-only next statement.
aggregate-address 10.0.0.0 255.0.0.0 summary-only === This is to summarize the 10.x.
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 distribute-list 100 in ===Deny the ACL 100 from coming in.
access-list 100 deny ip 10.0.0.0 0.255.255.255 any === Deny the 10.x network.
access-list 100 permit ip any any
Sanctuary Router:
router bgp 2
no synchronization
bgp log-neighbor-changes
network 2.2.2.2 mask 255.255.255.255
network 10.2.2.0 mask 255.255.255.0
aggregate-address 10.0.0.0 255.0.0.0 summary-only
neighbor 192.168.12.1 remote-as 1
neighbor 192.168.12.1 soft-reconfiguration inbound
neighbor 192.168.12.1 distribute-list 100 in
access-list 100 deny ip 10.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
sh ip bgp nei 192.168.12.1 received-routes
sh ip route
====================================
Note: I got this from gns3vault.com, but I posted my answer for my own reference.
3/04/2015
How to Secure Your Network
This is a precursor to my new post on how to secure your network from the outside.
Securing networks from the outside in is quite easy. All you need is to buy an appliance device, either a hardware device or software device to do the job.
But how does one decide with vendor to get, Cisco ASA, Juniper, or others, like the NextGen Firewall and UTM.
I will tell you that we decided to get rid of our Cisco ASA FW and Content filtering, with Sophos UTM. And it has worked wonderfully. NO SPAM, Virus, Web filtering, stopping outside threat coming in, etc.
On my next post I will tell you why.
Securing networks from the outside in is quite easy. All you need is to buy an appliance device, either a hardware device or software device to do the job.
But how does one decide with vendor to get, Cisco ASA, Juniper, or others, like the NextGen Firewall and UTM.
I will tell you that we decided to get rid of our Cisco ASA FW and Content filtering, with Sophos UTM. And it has worked wonderfully. NO SPAM, Virus, Web filtering, stopping outside threat coming in, etc.
On my next post I will tell you why.
Cisco to Juniper (Junos) Redistributing EIGRP to OSPF
In my previous post,
A problem comes up when you're redistributing from EIGRP to OSPF with external routes, ie. external EIGRP.
This is when you use the redistribute command in EIGRP, which gives AD of 170. To solve this, you'll need to add:
distance ospf external 171
in the router ospf 1 process. Do a "show ip route ospf" in the core router that does the EIGRP/OSPF redistribution to see the difference.
To simulate:
Router 4 / router 6 / other normal router:
router eigrp 2
network 172.17.39.0 0.0.0.3
redistribute connected
redistribute static === The redistribute command will have the AD of 170 (external EIGRP). Internal EIGRP is 90 with the "network" command.
Router 2: == This is the router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.34.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Router 3: == The core router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 3.3.3.3
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.35.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Both R2 and R3# sh ip ro os === WILL SHOW THE SAME OSPF route to the OSPF domain.
Gateway of last resort is 172.17.32.1 to network 0.0.0.0
192.168.60.0/32 is subnetted, 1 subnets
O 192.168.60.1 [110/3] via 172.17.34.1, 2d01h, FastEthernet1/0
R2#
Redistribute EIGRP and OSPF / Route Tagging
I talked about route tagging, but it works only for internal routes redistributing from EIGRP to OSPF.A problem comes up when you're redistributing from EIGRP to OSPF with external routes, ie. external EIGRP.
This is when you use the redistribute command in EIGRP, which gives AD of 170. To solve this, you'll need to add:
distance ospf external 171
in the router ospf 1 process. Do a "show ip route ospf" in the core router that does the EIGRP/OSPF redistribution to see the difference.
To simulate:
Router 4 / router 6 / other normal router:
router eigrp 2
network 172.17.39.0 0.0.0.3
redistribute connected
redistribute static === The redistribute command will have the AD of 170 (external EIGRP). Internal EIGRP is 90 with the "network" command.
Router 2: == This is the router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.34.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Router 3: == The core router that does the EIGRP/OSPF redistribution and connected to the JUNIPER.
router eigrp 2
network 172.17.0.0
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP
router ospf 1
router-id 3.3.3.3
log-adjacency-changes
redistribute eigrp 2 subnets route-map EIGRP-TO-OSPF
network 172.17.35.0 0.0.0.3 area 0
default-information originate
distance ospf external 171 === Need this on the router that does the EIGRP/OSPF redistribution. Else traffic FROM EIGRP domain GOING TO another EIGRP domain that did the REDISTRIBUTE STATIC, etc. will take the path of OSPF, and not through the EIGRP to EIGRP.
Both R2 and R3# sh ip ro os === WILL SHOW THE SAME OSPF route to the OSPF domain.
Gateway of last resort is 172.17.32.1 to network 0.0.0.0
192.168.60.0/32 is subnetted, 1 subnets
O 192.168.60.1 [110/3] via 172.17.34.1, 2d01h, FastEthernet1/0
R2#
2/10/2015
BGP Load Balancing
BGP Load Balancing
In order to do BGP load balancing, the route selection must be the same up to 5.5. I had thought it was at 8.5, but after testing, it's at 5.5.
1 Weight
2 Local pref
3 Self-originated next hop = 0.0.0.0)
4 AS Path
5 Origin i, then, e, then, ?
5.5 --note: When "bgp bestpath as-path multipath-relax" is used, it's actually at this point it will load balance when above 3 are the same. Not anything else below. Any else below don't matter. If above 5 are the same for that route, it will load balance when do a "show ip route" will see 2 routes there.
6 Med (metric)
7 external ebgp over igp
8 IGP cost
8.5 --Max Path Checks -- If all above are the same for a route with multiexit points, will load balance. Put in routing table. Will see 2 routes in "sh ip ro", then you know it's load balanced.
R1(config)#
router bgp 100
maximum-paths 2
bgp bestpath as-path multipath-relax (A hidden Command).
9 Ebgp peering -older routes better
10 rid lower
R1#sh run | s bgp
router bgp 1
no synchronization
bgp log-neighbor-changes
bgp bestpath as-path multipath-relax
network 1.1.1.1 mask 255.255.255.255
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 soft-reconfiguration inbound
neighbor 192.168.12.2 route-map SET-MED-ASPATH in
neighbor 192.168.13.3 remote-as 3
neighbor 192.168.13.3 route-map SET-ORIGIN-IGP in
maximum-paths 2
no auto-summary
=====
R1#sh ip bgp
m multipath,
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.1/32 0.0.0.0 0 32768 i
*m 5.5.5.5/32 192.168.12.2 999 0 2 2 5 i
*> 192.168.13.3 3 0 3 4 5 i
R1#
R1#sh ip route
Gateway of last resort is not set
1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
5.0.0.0/32 is subnetted, 1 subnets
B 5.5.5.5 [20/999] via 192.168.13.3, 03:14:22
[20/999] via 192.168.12.2, 03:14:22
192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.12.0/24 is directly connected, FastEthernet0/1
L 192.168.12.1/32 is directly connected, FastEthernet0/1
192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.13.0/24 is directly connected, FastEthernet0/0
L 192.168.13.1/32 is directly connected, FastEthernet0/0
R1#
From R1, you want to BGP load balance out to R2, R3.
In order to do BGP load balancing, the route selection must be the same up to 5.5. I had thought it was at 8.5, but after testing, it's at 5.5.
1 Weight
2 Local pref
3 Self-originated next hop = 0.0.0.0)
4 AS Path
5 Origin i, then, e, then, ?
5.5 --note: When "bgp bestpath as-path multipath-relax" is used, it's actually at this point it will load balance when above 3 are the same. Not anything else below. Any else below don't matter. If above 5 are the same for that route, it will load balance when do a "show ip route" will see 2 routes there.
6 Med (metric)
7 external ebgp over igp
8 IGP cost
8.5 --Max Path Checks -- If all above are the same for a route with multiexit points, will load balance. Put in routing table. Will see 2 routes in "sh ip ro", then you know it's load balanced.
R1(config)#
router bgp 100
maximum-paths 2
bgp bestpath as-path multipath-relax (A hidden Command).
9 Ebgp peering -older routes better
10 rid lower
R1#sh run | s bgp
router bgp 1
no synchronization
bgp log-neighbor-changes
bgp bestpath as-path multipath-relax
network 1.1.1.1 mask 255.255.255.255
neighbor 192.168.12.2 remote-as 2
neighbor 192.168.12.2 soft-reconfiguration inbound
neighbor 192.168.12.2 route-map SET-MED-ASPATH in
neighbor 192.168.13.3 remote-as 3
neighbor 192.168.13.3 route-map SET-ORIGIN-IGP in
maximum-paths 2
no auto-summary
=====
R1#sh ip bgp
m multipath,
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.1/32 0.0.0.0 0 32768 i
*m 5.5.5.5/32 192.168.12.2 999 0 2 2 5 i
*> 192.168.13.3 3 0 3 4 5 i
R1#
R1#sh ip route
Gateway of last resort is not set
1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
5.0.0.0/32 is subnetted, 1 subnets
B 5.5.5.5 [20/999] via 192.168.13.3, 03:14:22
[20/999] via 192.168.12.2, 03:14:22
192.168.12.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.12.0/24 is directly connected, FastEthernet0/1
L 192.168.12.1/32 is directly connected, FastEthernet0/1
192.168.13.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.13.0/24 is directly connected, FastEthernet0/0
L 192.168.13.1/32 is directly connected, FastEthernet0/0
R1#
10/15/2014
Redistribute EIGRP and OSPF / Route Tagging
In route redistribution, the router process asks this question first:
Ask this question:
1. Does the route exist in my router process that it will redistribute into?
No, then Redistribute the route.
Yes, then Go TO 2.
2. If so, Does the route have a better AD?
NO, then Don't redistribute the route.
YES, then Redistribute the route.
Example:
So, change the external EIGRP route from default 170 to 171 when redistribute into OSPF.
170 = is AD for External EIGRP routes.
171 = in this example, we use 171 for external OSPF route to stop the routing loops, but when you shutdown the interface with the injected route, the route updated LSAs still goes in circle.
R2(config)#
router eigrp 10
redistribute ospf 1
network x.x.x.x 0.0.0.255
default-metric 100000 0 255 1 1500
no-auto
router ospf 1
redistribute eigrp 10 subnets
distance ospf external 171 ==== only locally significant.
Use route tagging is better.
Route Tagging:
Most situation, you don't need route tags, since the above 2 questions hold. But in situations where you have external routes coming into your domain, then you'll need route tagging.
STEPS:
route-map OSPF-TO-EIGRP deny 10
match tag 170
route-map OSPF-TO-EIGRP PERMIT 20
SET tag 110
route-map EIGRP-TO-OSPF DENY 10
match tag 110
route-map EIGRP-TO-OSPF permit 20
set tag 170
R2:
conf t
router eigrp 10
network 10.1.12.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ===
!
router ospf 1
log-adjacency-changes
redistribute eigrp 10 subnets route-map EIGRP-TO-OSPF ======
network 10.1.22.0 0.0.0.3 area 0.0.0.0
R3:
conf t
router eigrp 10
network 10.1.13.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ====
!
router ospf 1
log-adjacency-changes
redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF ==========
network 10.1.23.0 0.0.0.3 area 0.0.0.0
DONE.
TEST:
R4-EIGRP-ROUTER# sh ip ro 192.168.1.1
Routing entry for 192.168.1.1/32
Known via "eigrp 100", distance 170, metric 28416
Tag 110, type external
Redistributing via eigrp 100
Last update from 10.1.12.2 on FastEthernet1/0, 00:38:36 ago
Routing Descriptor Blocks:
* 10.1.13.2, from 10.1.13.2, 00:38:36 ago, via FastEthernet1/1
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
10.1.12.2, from 10.1.12.2, 00:38:36 ago, via FastEthernet1/0
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
R1-OSPF-ROUTER# sh ip ro 172.16.1.1
Routing entry for 172.16.1.0/24
Known via "ospf 1", distance 110, metric 20
Tag 170, type extern 2, forward metric 1
Last update from 10.1.22.2 on FastEthernet1/0, 00:40:31 ago
Routing Descriptor Blocks:
* 10.1.23.2, from 10.1.23.2, 00:48:47 ago, via FastEthernet1/1
Route metric is 20, traffic share count is 1
Route tag 170
10.1.22.2, from 10.1.22.2, 00:40:31 ago, via FastEthernet1/0
Route metric is 20, traffic share count is 1
Route tag 170
Ask this question:
1. Does the route exist in my router process that it will redistribute into?
No, then Redistribute the route.
Yes, then Go TO 2.
2. If so, Does the route have a better AD?
NO, then Don't redistribute the route.
YES, then Redistribute the route.
Example:
So, change the external EIGRP route from default 170 to 171 when redistribute into OSPF.
170 = is AD for External EIGRP routes.
171 = in this example, we use 171 for external OSPF route to stop the routing loops, but when you shutdown the interface with the injected route, the route updated LSAs still goes in circle.
R2(config)#
router eigrp 10
redistribute ospf 1
network x.x.x.x 0.0.0.255
default-metric 100000 0 255 1 1500
no-auto
router ospf 1
redistribute eigrp 10 subnets
distance ospf external 171 ==== only locally significant.
Use route tagging is better.
Route Tagging:
Most situation, you don't need route tags, since the above 2 questions hold. But in situations where you have external routes coming into your domain, then you'll need route tagging.
STEPS:
route-map OSPF-TO-EIGRP deny 10
match tag 170
route-map OSPF-TO-EIGRP PERMIT 20
SET tag 110
route-map EIGRP-TO-OSPF DENY 10
match tag 110
route-map EIGRP-TO-OSPF permit 20
set tag 170
R2:
conf t
router eigrp 10
network 10.1.12.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ===
!
router ospf 1
log-adjacency-changes
redistribute eigrp 10 subnets route-map EIGRP-TO-OSPF ======
network 10.1.22.0 0.0.0.3 area 0.0.0.0
R3:
conf t
router eigrp 10
network 10.1.13.0 0.0.0.3
network 10.1.15.0 0.0.0.3
redistribute ospf 1 metric 100000 1 255 1 1500 route-map OSPF-TO-EIGRP ====
!
router ospf 1
log-adjacency-changes
redistribute eigrp 100 subnets route-map EIGRP-TO-OSPF ==========
network 10.1.23.0 0.0.0.3 area 0.0.0.0
DONE.
TEST:
R4-EIGRP-ROUTER# sh ip ro 192.168.1.1
Routing entry for 192.168.1.1/32
Known via "eigrp 100", distance 170, metric 28416
Tag 110, type external
Redistributing via eigrp 100
Last update from 10.1.12.2 on FastEthernet1/0, 00:38:36 ago
Routing Descriptor Blocks:
* 10.1.13.2, from 10.1.13.2, 00:38:36 ago, via FastEthernet1/1
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
10.1.12.2, from 10.1.12.2, 00:38:36 ago, via FastEthernet1/0
Route metric is 28416, traffic share count is 1
Total delay is 110 microseconds, minimum bandwidth is 100000 Kbit
Reliability 255/255, minimum MTU 1500 bytes
Loading 1/255, Hops 1
Route tag 110
R1-OSPF-ROUTER# sh ip ro 172.16.1.1
Routing entry for 172.16.1.0/24
Known via "ospf 1", distance 110, metric 20
Tag 170, type extern 2, forward metric 1
Last update from 10.1.22.2 on FastEthernet1/0, 00:40:31 ago
Routing Descriptor Blocks:
* 10.1.23.2, from 10.1.23.2, 00:48:47 ago, via FastEthernet1/1
Route metric is 20, traffic share count is 1
Route tag 170
10.1.22.2, from 10.1.22.2, 00:40:31 ago, via FastEthernet1/0
Route metric is 20, traffic share count is 1
Route tag 170
10/08/2014
Block RFC 1918 and Others Coming In Your Network
If you're an enterprise, chances are your ISP may have already blocked some or all private addresses from the internet.
But you should also block the IP subnets assigned to you by your ISP, if you see that IP coming in, then somone is spoofing your IP.
For security, it's best to block all RFC 1918 and you many want to block others as well.
Below is what I use:
access-list 199 deny ip 10.0.0.0 0.255.255.255 any
access-list 199 deny ip 127.0.0.0 0.255.255.255 any
access-list 199 deny ip 172.16.0.0 0.15.255.255 any
access-list 199 deny ip 169.254.0.0 0.0.255.255 any
access-list 199 deny ip 192.0.2.0 0.0.0.255 any
access-list 199 deny ip 192.168.0.0 0.0.255.255 any
access-list 199 deny ip 224.0.0.0 0.0.0.255 any
access-list 199 deny ip 239.0.0.0 0.255.255.255 any
access-list 199 deny ip host 255.255.255.255 any
access-list 199 deny ip YOUR-SUBNET-HERE 0.0.0.31 any --- This should be the IP Subnet assigned to you by your ISP. You don't want to see the originator's IP is your own IP.
access-list 199 permit ip any any --- This permits everything else.
Now apply this access list to the interface facing or connecting to your ISP.
interface Serial0/1/0
ip address 29.6.11.261 255.255.255.252
ip access-group 199 in
ip nbar protocol-discovery
ip flow ingress
ip flow egress
no cdp enable
You want to apply the access-list 199 to inbound traffic.
Done.
But you should also block the IP subnets assigned to you by your ISP, if you see that IP coming in, then somone is spoofing your IP.
For security, it's best to block all RFC 1918 and you many want to block others as well.
Below is what I use:
access-list 199 deny ip 10.0.0.0 0.255.255.255 any
access-list 199 deny ip 127.0.0.0 0.255.255.255 any
access-list 199 deny ip 172.16.0.0 0.15.255.255 any
access-list 199 deny ip 169.254.0.0 0.0.255.255 any
access-list 199 deny ip 192.0.2.0 0.0.0.255 any
access-list 199 deny ip 192.168.0.0 0.0.255.255 any
access-list 199 deny ip 224.0.0.0 0.0.0.255 any
access-list 199 deny ip 239.0.0.0 0.255.255.255 any
access-list 199 deny ip host 255.255.255.255 any
access-list 199 deny ip YOUR-SUBNET-HERE 0.0.0.31 any --- This should be the IP Subnet assigned to you by your ISP. You don't want to see the originator's IP is your own IP.
access-list 199 permit ip any any --- This permits everything else.
Now apply this access list to the interface facing or connecting to your ISP.
interface Serial0/1/0
ip address 29.6.11.261 255.255.255.252
ip access-group 199 in
ip nbar protocol-discovery
ip flow ingress
ip flow egress
no cdp enable
You want to apply the access-list 199 to inbound traffic.
Done.
10/01/2014
EXPECT: Can not telnet/ssh to switches directly - Only one switch to others
Can not telnet/ssh to switches directly. Can only ssh into a ASR/switch then from the switch ssh to each switch.
ACL only allows ASR device to SSH to each switch.
This can be done with a for loop within the "expectscript.exp" script.
Create a file with the names/IP’s of the devcies you want to connect to from the ASR:
STEPS:
1. [root@localhost script]# vi device-list
10.x.x.1
10.x.x.2
10.x.x.3
10.x.x.4
2. [root@localhost script]# vi from-one-device-TO-ALL-others.exp
#!/usr/bin/expect -f
# Set variables - some of which were sent from the calling bash script
set hostname [lindex $argv 0]
set username "YOURUSERNAME"
set password [lindex $argv 1]
set enablepassword [lindex $argv 2]
set timeout 5
# Where to put the Log file results
log_file -a /root/script/results.log
spawn ssh -o StrictHostKeyChecking=no $username\@$hostname
expect "*assword: "
send "$password\r"
# SSH to each IP/Hostname in local file named "device-list", do a "show clock", then exit
set devicelist [open device-list]
while {[gets $devicelist line] != -1} {
expect "*>"
send "ssh $line \n"
expect "Password:"
send "$password\r"
expect "*>"
send "show clock\n"
expect "*>"
send "exit\n"
expect "*>"
}
close $devicelist
send "exit\n"
expect ":~\$"
exit
3. Now RUN it:
[root@localhost script]# ./from-one-device-TO-ALL-others.exp
ACL only allows ASR device to SSH to each switch.
This can be done with a for loop within the "expectscript.exp" script.
Create a file with the names/IP’s of the devcies you want to connect to from the ASR:
STEPS:
1. [root@localhost script]# vi device-list
10.x.x.1
10.x.x.2
10.x.x.3
10.x.x.4
2. [root@localhost script]# vi from-one-device-TO-ALL-others.exp
#!/usr/bin/expect -f
# Set variables - some of which were sent from the calling bash script
set hostname [lindex $argv 0]
set username "YOURUSERNAME"
set password [lindex $argv 1]
set enablepassword [lindex $argv 2]
set timeout 5
# Where to put the Log file results
log_file -a /root/script/results.log
spawn ssh -o StrictHostKeyChecking=no $username\@$hostname
expect "*assword: "
send "$password\r"
# SSH to each IP/Hostname in local file named "device-list", do a "show clock", then exit
set devicelist [open device-list]
while {[gets $devicelist line] != -1} {
expect "*>"
send "ssh $line \n"
expect "Password:"
send "$password\r"
expect "*>"
send "show clock\n"
expect "*>"
send "exit\n"
expect "*>"
}
close $devicelist
send "exit\n"
expect ":~\$"
exit
3. Now RUN it:
[root@localhost script]# ./from-one-device-TO-ALL-others.exp
9/30/2014
Block Windows AD/DHCP/NetBios from Crossing One Network to Another
Create an access-list to block all these Microsoft Windows services ports:
Here's my list that blocks Windows TEST LAB network from messing up the production environment.
access-list 199 deny tcp any any eq 389
access-list 199 deny udp any any eq 389
access-list 199 deny tcp any any eq 636
access-list 199 deny tcp any any eq 3268
access-list 199 deny tcp any any eq 3269
access-list 199 deny tcp any any eq 88
access-list 199 deny udp any any eq 88
access-list 199 deny tcp any any eq 445
access-list 199 deny udp any any eq 445
access-list 199 deny tcp any any eq 135
access-list 199 deny udp any any eq 135
access-list 199 deny tcp any any eq 5722
access-list 199 deny tcp any any eq 646
access-list 199 deny udp any any eq 646
access-list 199 deny udp any any eq netbios-dgm
access-list 199 deny tcp any any eq 9389
access-list 199 deny udp any any eq bootps
access-list 199 deny udp any any eq 2535
access-list 199 deny udp any any eq netbios-ns
access-list 199 deny tcp any any eq 139
access-list 199 permit ip any any
Here's the complete lists of ports used by Windows.
http://technet.microsoft.com/en-us/library/cc875824.aspx
But I only used the above to block my TEST LAB windows environment from crossing over the production network.
Get into interface mode and apply the access list from entering.
interface GigabitEthernet0/2
no switchport
ip address 172.16.0.1 255.255.255.252
ip access-group 199 in
end
done.
Here's my list that blocks Windows TEST LAB network from messing up the production environment.
access-list 199 deny tcp any any eq 389
access-list 199 deny udp any any eq 389
access-list 199 deny tcp any any eq 636
access-list 199 deny tcp any any eq 3268
access-list 199 deny tcp any any eq 3269
access-list 199 deny tcp any any eq 88
access-list 199 deny udp any any eq 88
access-list 199 deny tcp any any eq 445
access-list 199 deny udp any any eq 445
access-list 199 deny tcp any any eq 135
access-list 199 deny udp any any eq 135
access-list 199 deny tcp any any eq 5722
access-list 199 deny tcp any any eq 646
access-list 199 deny udp any any eq 646
access-list 199 deny udp any any eq netbios-dgm
access-list 199 deny tcp any any eq 9389
access-list 199 deny udp any any eq bootps
access-list 199 deny udp any any eq 2535
access-list 199 deny udp any any eq netbios-ns
access-list 199 deny tcp any any eq 139
access-list 199 permit ip any any
Here's the complete lists of ports used by Windows.
http://technet.microsoft.com/en-us/library/cc875824.aspx
But I only used the above to block my TEST LAB windows environment from crossing over the production network.
Get into interface mode and apply the access list from entering.
interface GigabitEthernet0/2
no switchport
ip address 172.16.0.1 255.255.255.252
ip access-group 199 in
end
done.
Subscribe to:
Posts (Atom)