NetworkJutsu

Network Security Consulting | San Francisco Bay Area

Blog

Two Port T1/E1 Voice/WAN Interface Card

By Leave a Comment

I like using VWIC-2MFT-T1 card since it gives me the ability to save WIC slots on smaller routers, like Cisco 1841. If you’re also in a budget, it is quite useful to combine voice and data T1 with this card. Though, you may want to separate them so it won’t be a single point of failure.

The first time I’ve installed this on a 2821 router, I didn’t see any serial interfaces at all in the show ip int br output, as shown below. Second thing I checked was, if the card was being recognized using show diag and show ver, as shown below.

Router#show ip int br
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         unassigned      YES unset  administratively down down
GigabitEthernet0/1         unassigned      YES unset  administratively down down
Router#show ver | i T1
2 Channelized (E1 or T1)/PRI ports
Router#show diag | i VWIC
        VWIC2-2MFT-T1/E1 - 2-Port RJ-48 Multiflex Trunk - T1/E1
        Product (FRU) Number     : VWIC2-2MFT-T1/E1

Looking at the output, the card was being recognized so I asked myself why was not seeing the serial interfaces. Upon reading Cisco’s documentation, I discovered that I needed to issue commands to enable them and show up as serial interfaces. Though, this may vary router/IOS to router/IOS. When I installed it on a Cisco 1841, I didn’t have to use card type command. In this particular scenario, I am using a Cisco 2901 router with IOS version 15. Normally, you can determine this by doing a show run to see if card type command is needed, as shown below.

Router#sh run
Building configuration...
Current configuration : 880 bytes
!
! No configuration change since last restart
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
! card type command needed for slot/vwic-slot 0/0
! card type command needed for slot/vwic-slot 0/1
! card type command needed for slot/vwic-slot 0/2
!
no aaa new-model
! Output omitted for brevity

As you can see from above, there’s a message that you need to issue the card type command. The commands you need to enable the VWIC-2MFT-T1 or VWIC2-2MFT-T1 are shown below.

Router(config)#card type t1 0 0
Router(config)#controller t1 0/0/0:0
Router(config-controller)#framing esf
Router(config-controller)#linecode b8zs
Router(config-controller)#channel-group 1 timeslots 1-24
Router(config-controller)#
Feb 17 01:07:29.255: %LINK-3-UPDOWN: Interface Serial0/0/0:1, changed state to down
Feb 17 01:07:30.255: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/0:1, changed state to down
Router(config-controller)#controller t1 0/0/0:1
Router(config-controller)#channel-group 1 timeslots 1-24
Router(config-controller)#
Feb 17 01:08:01.031: %LINK-3-UPDOWN: Interface Serial0/0/1:1, changed state to down
Feb 17 01:08:02.031: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/0/1:1, changed state to down
Router(config-controller)#do sh ip int br
Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0         unassigned      YES unset  administratively down down
GigabitEthernet0/1         unassigned      YES unset  administratively down down
Serial0/0/0:1              unassigned      YES unset  down                  down
Serial0/0/1:1              unassigned      YES unset  down                  down

Again, this may not be a good idea if you’re concern about single point of failure. However, I find these cards pretty reliable and I have not seen them fail. They’re best if you’re concern with WIC/VWIC slot density, especially when you start using more than two bonded T1s.

I hope this has been helpful and thank you for reading!

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

Enabling SSH on Cisco ASA

By Leave a Comment

Update: Securing Cisco ASA SSH server

Enabling SSH has been covered here but it only talked about routers and switches. How about Cisco ASA? Today, I had to learn how to do it using CLI and not ASDM since I couldn’t find where the equivalent of aaa authentication ssh console LOCAL and crypto key gen rsa mod 4096  in the ASDM. Since I am really new to Cisco ASA, I am not well-versed in issuing commands under CLI. If you are in a similar situation, I suggest to buy this book. Having said that, I’ve always used ASDM when checking out rules, NATs, and etc but I can understand some of the CLI config. Without further ado, here’s how to enable SSH on a Cisco ASA.

ASA-5505# conf t
ASA-5505 (config)# enable password password_here encrypted
ASA-5505 (config)# username user_here password password_here encrypted privilege 15
ASA-5505 (config)# aaa authentication ssh console LOCAL
ASA-5505 (config)# ssh 192.168.0.10 255.255.255.0 inside
! Obviously, you can add/change IPs that you want to allow SSH from.
ASA-5505 (config)# domain-name networkjutsu.com
ASA-5505 (config)# crypto key gen rsa mod 4096
ASA-5505 (config)# ssh version 2
ASA-5505 (config)# ssh key-exchange group dh-group14-sha1

As you know, it is a good idea to enable SSH and disable Telnet. Since ASA does not enable SSH and/or Telnet by default, you have less to worry about. But if you have to choose between them, of course pick the SSH.

I hope this has been helpful and thank you for reading!

Want to learn more about ASA?

Cisco ASA: All-in-one Next-Generation Firewall, IPS, and VPN Services (3rd Edition)
Cisco ASA for Accidental Administrators: An Illustrated Step-by-Step ASA Learning and Configuration Guide

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

GRE Tunnel Recursive Routing

By Leave a Comment

Ever seen this error message %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing? The most common reason for this error is that the router is trying to route to the tunnel destination address using the tunnel interface itself. This error message will keep flooding your router until someone fixes the misconfiguration of the router. This will also mean that your tunnel interface will keep flapping until fixed.

Let’s take a look at a scenario in which recursive routing is being experienced. In this particular environment, there are several remote branches that will need to establish a GRE tunnel to the headend. For simplicity, the diagram only shows two remote branches and the configuration only shows the headend and a remote branch. Please ignore the IP addressing as I just picked random numbers. The 172.18.0.0/16 address, however, has been assigned to be the serial interfaces of the remote branch routers.

Here are the configuration of the enterprise routers:

GRE-HEADEND

interface Loopback0
 ip address 172.17.254.254 255.255.255.255
!
interface Loopback1
 ip address 172.17.1.254 255.255.255.0
!
interface Tunnel1
 ip unnumbered Loopback0
 tunnel source Serial0/0
 tunnel destination 172.18.1.254 
!
interface Serial0/0
 ip address 172.19.0.254 255.255.255.0 
!
router eigrp 1
 network 172.0.0.0 0.255.255.255
 no auto-summary 
! 
ip route 172.18.0.0 255.255.0.0 Serial0/0
!

REMOTE-R1

interface Loopback0
 ip address 172.17.2.254 255.255.255.255
!
interface Tunnel1
 ip unnumbered Loopback0
 tunnel source Serial0/0
 tunnel destination 172.19.0.254
!
interface FastEthernet0/0
 ip address 172.24.1.254 255.255.255.0
 duplex auto
 speed auto
!
interface Serial0/0
 ip address 172.18.1.254 255.255.255.0
!
router eigrp 1
 network 172.0.0.0 0.255.255.255
 no auto-summary
!
ip route 172.19.0.0 255.255.255.0 Serial0/0
!

Once the routers able to reach their tunnel destination IP address and when the tunnel interfaces comes up/up on both routers, then they’ve established the GRE tunnel. However, once they start exchanging EIGRP the tunnel will go down due to recursive routing. The router will automatically reestablish GRE tunnel and establish EIGRP neighborship but will eventually go down again, as shown below. This is a cycle and will never be fixed unless a human intervention.

GRE-HEADEND#
*Mar  1 03:08:46.087: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
*Mar  1 03:08:50.435: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.17.2.254 (Tunnel1) is up: new adjacency
GRE-HEADEND#show ip eigrp neigh
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   172.17.2.254            Tu1               14 00:00:05   32  5000  2  40
GRE-HEADEND#
*Mar  1 03:08:55.087: %TUN-5-RECURDOWN: Tunnel1 temporarily disabled due to recursive routing
*Mar  1 03:08:56.087: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to down
*Mar  1 03:08:56.127: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.17.2.254 (Tunnel1) is down: interface down

So what’s the problem here? Well, it is quite simple really. The GRE-HEADEND router has a static route that is shorter prefix to reach the tunnel destination address of the remote routers – ip route 172.18.0.0 255.255.0.0 s0/0. Since this is a shorter prefix, the GRE-HEADEND router will eventually learn a better route via EIGRP and will try to use that to reach the tunnel destination address. Unfortunately, that’s not going to work since the router learned it via EIGRP which has a next hop interface of Tunnel1, as shown below.

GRE-HEADEND#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     172.17.0.0/16 is variably subnetted, 3 subnets, 2 masks
D       172.17.2.254/32 [90/297372416] via 172.17.2.254, 00:00:01, Tunnel1
C       172.17.1.0/24 is directly connected, Loopback1
C       172.17.254.254/32 is directly connected, Loopback0
     172.19.0.0/24 is subnetted, 1 subnets
C       172.19.0.0 is directly connected, Serial0/0
     172.18.0.0/16 is variably subnetted, 2 subnets, 2 masks
S       172.18.0.0/16 is directly connected, Serial0/0
D       172.18.1.0/24 [90/297756416] via 172.17.2.254, 00:00:03, Tunnel1
     172.24.0.0/24 is subnetted, 1 subnets
D       172.24.1.0 [90/297270016] via 172.17.2.254, 00:00:03, Tunnel1

The solution for this recursive routing issue is to remove the static route with a shorter prefix and add a static route with a longer prefix, so the router won’t use the route learned via the IGP, in this case EIGRP. Remember the rules of how the router places routes in the routing table: the more specific route gets placed, if it’s a tie then the route with the best AD (Administrative Distance) value, and if the AD value is a tie then the route with the best metric will be placed.

GRE-HEADEND(config)#ip route 172.18.1.0 255.255.255.0 s0/0
GRE-HEADEND#
*Mar  1 03:19:17.611: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel1, changed state to up
GRE-HEADEND#
*Mar  1 03:19:21.171: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.17.2.254 (Tunnel1) is up: new adjacency
GRE-HEADEND#sh ip eigrp neigh
IP-EIGRP neighbors for process 1
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   172.17.2.254            Tu1               14 00:18:20   79  5000  0  81

As you can see above, the EIGRP has been stable for more than 15 minutes compared to the show ip eigrp neighbor output shown above.

I hope this has been helpful and I thank you for reading!

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

IP Address Management

By 4 Comments

IPAM (IP Address Management) software is important in medium and large network. It may be helpful in a small network depending on how you define small. There are several ways to manage IP addresses and the two well known ways are spreadsheet and IPAM software. Managing IP addresses on a spreadsheet can be a nightmare and provides no automation. IPAM software provides automation and an easy to use interface.

IPAM software ranges from zero dollars to thousands of dollars. If your organization has a budget for a paid version of IPAM, then it’s time for you to research and evaluate all the paid versions out there. If the money is tight, then you’re in luck since there are several free IPAM software out there and this article will concentrate on one of them, which is IPplan.

IPplan is a free (GPL), web based, multilingual, TCP IP address management (IPAM) software and tracking tool written in php 4, simplifying the administration of your IP address space. IPplan goes beyond TCPIP address management including DNS administration, configuration file management, circuit management (customizable via templates) and storing of hardware information (customizable via templates). IPplan can handle a single network or cater for multiple networks and customers with overlapping address space. Makes managing ip addresses and managing ip address space simple and easy!

In this tutorial, it assumes that you have and/or know the following:

  • A physical machine or VM with at least 8GB HDD space and 512MB RAM
  • How to install Ubuntu Linux Server Edition with LAMP
  • How to use an editor in Linux environment

Here are the steps to implement IPAM software using IPplan:

Download and install current Ubuntu Linux Server Edition on a physical machine or virtual machine (VM). Do not forget about LAMP when it asks you what packages you want to be installed during the installation process.

Once done with the installation. Update your Ubuntu box. The step is optional, but I recommend you to update your software.

admin@ubuntu:~$ sudo apt-get update
admin@ubuntu:~$ sudo apt-get dist-upgrade

Once your Ubuntu box has been updated, download IPplan from Sourceforge.

admin@ubuntu:~$ wget http://downloads.sourceforge.net/project/iptrack/ipplan/Release%204.92/ipplan-4.92b.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fiptrack%2Ffiles%2Fipplan%2FRelease%25204.92%2F&ts=1325009788&use_mirror=iweb

Once the download is complete, this will create a file on your home folder – in this case it is in /home/admin. The file is called ipplan-4.92b.tar.gz and with part of the URL. There maybe a way to download it and use a specific name instead of a long name, but unfortunately I do not know how to do it since I have a limited experience with wget command. My remedy is to just change the file name by using the command below.

admin@ubuntu:~$ mv ipplan* test.tar.gz

Once renamed, we need to untar (unzip in Windows term) the file. This tar file will unzip a directory called ipplan.

admin@ubuntu:~$ tar -xvzf test.tar.gz

We need to move the ipplan folder to its proper destination where Apache can access it.

admin@ubuntu:~$ sudo mv ipplan /var/www

We now need to create a database, in this tutorial the name of the database is ipplan. Once the command has been issued, it will ask you for the MySQL password. This is the password that you set up during the installation process.

admin@ubuntu:~$ mysqladmin -u root -p create ipplan

Using root to access database is not a good idea, so we need to create a user called ipplan to access the ipplan database.

admin@ubuntu:~$ mysql -u root -p ipplan

We now need to give all rights to ipplan user to modify and access the ipplan database.

mysql> grant all on ipplan.* to ipplan@localhost identified by 'put_your_ipplan_password_here';

Yes, the single (‘) quotation marks are included in the command. If you forget to put the single quotation marks, it will give you an error.

Reload the rights and exit.

mysql>flush privileges;
mysql>exit

Change the config file of IPplan. Feel free to use your favorite Linux editor. This tutorial is using VI editor to edit configuration files.

admin@ubuntu:~$ sudo vi /var/www/ipplan/config.php

Find the following and change the value of DBF_PASSWORD.

define("DBF_TYPE", 'maxsql');
define("DBF_HOST", 'localhost');
define("DBF_USER", 'ipplan');
define("DBF_NAME", 'ipplan');
define("DBF_PASSWORD", 'put_your_ipplan_password_here');

For security purposes, change the password of the IPplan’s admin account. If you exit out of the config.php, go back and look for

define("ADMINUSER", 'admin');
define("ADMINPASSWD", 'put_your_admin_password_here');
define("ADMINREALM", 'IPplan admin authentication');

We need to change permissions to allow access to /var/www/ipplan directory.

admin@ubuntu:~$sudo chown -R www-data /var/www/ipplan
admin@ubuntu:~$sudo chmod -R 750 /var/www/ipplan

You’re now done with the Linux CLI. We can now access the IPplan webpage by going to the URL below. See the screenshot below.

http://ipplan_ip_address_here/ipplan/admin/install.php

By default, the Upgrade option is selected and needs to be changed to New installation. Leave the Run the SQL Now option. Click Go. You will be asked for the IPplan admin user account. Once done, you will see a webpage just like the one below.

The IPplan is now installed and ready to be configured. To access the webpage, go to the URL below

http://ipplan_ip_address_here/ipplan

I hope this has been helpful and I thank you for reading!

Update: This still works under Ubuntu Server 12.04 LTS.

Reference

IPPLAN – The Easy Tutorial by OpenManiak

Disclosure

NetworkJutsu.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.

Switch port density

By Leave a Comment

A Network Engineer was tasked to upgrade the existing switch infrastructure for a site since the current infrastructure does not support PoE for the new project – VoIP and IP enabled CCTV cameras. Upon investigating, he saw that the site has three switches and some ports were not lit up and now needs to know if those ports were lit up last week to help him decide how many switches he really needs to order. Ordering the same amount of switches will drive up the cost, which he is not willing to do since the company is tight with money. Now, the question is, how can he tell that the port is really unused or the people are just on vacation and their PCs are turned off?

There may be tools out there that I am unaware of, but Cisco IOS has a built in show command that you are already familiar with. This is the show interface command. Please look below for the example.

The show command output below was issued on a switch with an uptime of 6 months.

Switch#sh int g0/32
GigabitEthernet0/32 is down, line protocol is down (notconnect)
  Hardware is Gigabit Ethernet, address is f866.f2fd.c020 (bia f866.f2fd.c020)
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
! Remaining output were omitted for brevity

The output below is a port with activity.

Switch#sh int g0/24
GigabitEthernet0/24 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is f866.f2fd.c041 (bia f866.f2fd.c041)
  Internet address is 172.30.99.37/30
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
! Remaining output were omitted for brevity

If you compare the line where it says “Last input”, you’ll see that the first show interface command output says “never” while the other one is saying 00:00:00. Since this switch has been up for six months, it is safe to assume that this port hasn’t been used for six months so time to move on to another port and collect the total port count.

Fortunately, the Network Engineer took his time to collect the information and only ordered two switches which saved the company over $6,000! IT, in most companies, do not generate revenue but can definitely help with the company’s bottom line by spending money efficiently and effectively.

I hope this has been helpful and I thank you for reading!

Follow my CCIE journey on Twitter!