Juniper SRX tacacs+ with Cisco ACS 5.x

SRX configuration

# Authentication order with TACACS+ first and the server details
authentication-order [ tacplus password ];

tacplus-server {
    xxx.xxx.xxx.xxx {
        secret "sharedkey"; ## SECRET-DATA
        single-connection;
      }
    yyy.yyy.yyy.yyy {
        secret "sharedkey"; ## SECRET-DATA
        single-connection;
    }
}

# Remote user templates 
login {
       user netadmin {
        full-name "remote super-user template";
        uid 100;
        class super-user;
    }
    user remote-monitor {
        full-name "remote operator template";
        uid 101;
        class operator;                
    }                                  
}                                      

# tacacs+ accounting 
accounting {
    events [ login change-log interactive-commands ];
    destination {
        tacplus {
            server {
                xxx.xxx.xxx.xxx {
                    secret "sharekey"; ## SECRET-DATA
                    single-connection;
                }
                yyy.yyy.yyy.yyy {
                    secret "sharedkey"; ## SECRET-DATA
                    single-connection;
                }
            }
        }
    }
}

Cisco ACS

The key to Cisco ACS setup is to define "Policy Element" -> "Authorization and Permissions" -> "Device Administrator" -> "Shell Profiles".  Need to create custom shell profile for each "local-user-name" group. Below is an example for the "netadmin" group.

Cisco Prime LMS 4.2.1 Customizable Interface Group

need to remove certain alarms for only certain type of interfaces, and worked many days and finally worked with help from TAC.

1.       Modified group rule for a customizable interface group with a valid group rule (Example: Customizable Interface Group 1) from Admin > System > Group Management > Fault.

2.      Modified the priority of that Interface Threshold Group  to higher priority from Monitor > Fault Settings > Setup > Priority Settings so that the interfaces satisfying the rule will fall under higher priority group.

3.       Apply changes after modifying the priority to apply all changes to in charge server  from Monitor > Fault Settings > Setup > Apply Changes.

4.       Then apply threshold values from Monitor > Fault Settings > Setup > Threshold Settings.

5.      Then apply changes to apply all threshold value changes to in charge server  from Monitor > Fault Settings > Setup > Apply Changes

Ciscoworks Prime LMS 4.2 DFM change of fault threshold

Below is an example of what I have to do to get rid of tons of OutOfRange Temperature o rVoltage Sensors Alerts:

First Stop daemon

  /etc/init.d/dmgtd stop

Modify the entry (please note the highlighted part)for my devices in oid2type_cisco.conf file (<NMSROOT>/objects/smarts/conf/discovery/oid2type_cisco.conf)  as shown below:

# Cisco Nexus 7000

 .1.3.6.1.4.1.9.12.3.1.3.612 {

    TYPE = Switch

    VENDOR = Cisco

    MODEL = N7K-C7010

    CERTIFICATION = CERTIFIED

    CONT = Cisco-EntityRF-Switch

    HEALTH = Nexus-Entity-EntSensor

    BRIDGE = Cisco

    NEIGHBOR = Cisco-Cdp

INSTRUMENTATION:

     Environment                     = CiscoEntityFRU:DeviceID

    Card-Fault                      = CiscoEntityFRU:DeviceID

    CPU/Memory                      = CiscoSystem:DeviceID

     Interface-Fault                 = MIB2

    Interface-Performance           = MIB2

    Port-Fault                      = MIB2

    Port-Performance                = MIB2

}

# Cisco ASR Router - 1004

.1.3.6.1.4.1.9.1.924 {

TYPE = Router

VENDOR = Cisco

MODEL = ASR1004

CERTIFICATION = TEMPLATE

CONT = Cisco-EntityFRU

NEIGHBOR = Cisco-Cdp

HEALTH = Cisco-Router-CRS-EntSensor

INSTRUMENTATION:

Environment = CiscoEntityFRU:DeviceID

CPU/Memory = CiscoRouter:DeviceID

Card-Fault = CiscoEntityFRU

Interface-Fault = MIB2

Interface-Performance = CiscoRouter

Interface-Ethernet-Performance = CiscoRouter_Ethernet

} 

# Cisco VSS Switch 

.1.3.6.1.4.1.9.1.896 {

    TYPE = Switch

    VENDOR = Cisco

    MODEL = VSS-1440

    CERTIFICATION = CERTIFIED

    CONT = Cisco-VSS-Switch

    VLAN = Cisco-Membership

    BRIDGE = Cisco

    NEIGHBOR = Cisco-Cdp

    HEALTH = Cisco-Router-CRS-EntSensor

INSTRUMENTATION:

    Environment                         = CiscoEntityFRU:DeviceID

    CPU/Memory                          = CiscoRouter:DeviceID

    Card-Fault                          = CiscoEntityFRU:DeviceID

    Interface-Fault                     = MIB2

    Interface-Performance               = MIB2

    Port-Fault                          = MIB2

    Port-Performance                    = MIB2

    Port-Ethernet-Performance           = dot3_Ethernet

}

Restart daemon

  /etc/init.d/dmgtd start

Re-discover the devices

exchange server out off disk space due to excessive amount of log files

an old friend called for help.  found exchange 2003 server mtadata folder filled with huge amount of log files (E00....log).   I ran ntbackup and did a exchange information store backup, immediately cleaned all the E00...log files, and reclaimed over 50 GB disk space.

EEM - CDP to monitor connected devices up and down

Based on a post from cisco EEM forum, I created a EEM applet to email on cdp "add" and "del" events.  This pretty cool!  Took me few hours to get all the syntax right and found out this Cisco post.  "show event manager detector .. detailed" commands is really helpful to get the built-in environment variables.


event manager environment email_to ywang@xyz.com
event manager environment email_server xxx.xxx.xxx.xxx
event manager session cli username "xyz"


event manager applet cdp-neighbor-down
 description track device down from cdp event
 event neighbor-discovery interface regexp FastEthernet cdp delete
 action 1.0 info type routername
 action 2.0 mail server "$email_server" to "$email_to" from "eem@$_info_routername" subject "$_nd_cdp_entry_name Down" body "$_event_pub_time: $_nd_cdp_entry_name down at $_nd_local_intf_name"


event manager applet cdp-neighbor-up
 description track device up from cdp event
 event neighbor-discovery interface regexp FastEthernet cdp add
 action 1.0 info type routername
 action 2.0 cli command "enable"
 action 3.0 cli command "config t"
 action 4.0 cli command "interface $_nd_local_intf_name"
 action 5.0 cli command "description $_nd_cdp_entry_name:$_nd_port_id"
 action 6.0 mail server "$email_server" to "ywang@xyz.com" from "eem@$_info_routername" subject "$_nd_cdp_entry_name Up" body "$_event_pub_time: $_nd_cdp_entry_name Up at $_nd_local_intf_name"



--https://supportforums.cisco.com/docs/DOC-24529

In preparing for CiscoLive! in San Diego, I am provisioning our access layer 3560-E switches.  Since things have a tendency to change a lot at an event like CiscoLive! I thought it would be best to make sure our port descriptions are always up-to-date when it comes to reflecting what devices are connected.  To help me do that, I wrote up this small EEM applet policy.  It will update the port's description based on the CDP neighbor learned on that port.  This policy requires EEM 3.2, so you're looking at 12.2(55)SE or higher for the 3560s.  It will also work on 3750s and ISR G2 routers running 15.x code.

event manager applet update-port-description
 event neighbor-discovery interface regexp GigabitEthernet.* cdp add 
 action 1.0 cli command "enable"
 action 2.0 cli command "config t"
 action 3.0 cli command "interface $_nd_local_intf_name"
 action 4.0 cli command "description $_nd_cdp_entry_name:$_nd_port_id"

The result of this will be a description like the following on switch ports:

description SDCC_IDF_1.11:TenGigabitEthernet0/1

Reset Cisco Light Weight AP 1242 to factory default

Struggled a while to figure it out.  "write erase" does not work, and pushing the mode button does not work either.  The command is get to the console and use "clear capwap private-configure" or "clear lwapp private-config".

IEEE 802.1Q Tunneling

 IEEE 802.1Q Tunneling

I wanted to extend a test lab extended to a mini switch at my desk over corporate LAN.  Here is the setup and configure.  It is very neat, now i can connect to my Lab network VLAN 100 at my desk.

referenced Cisco Doc at http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/dot1qtnl.html

I wanted to configure a route to go over specific link in a case with multi-path, and found below info from Cisco Doc, and worked like a charm.  At one site, we have Nexus 7k, the router map had to be build with prefix rather than access-list.

So, the example is 

ip prefix-list LEAK-MAP seq 10 permit 10.1.1.0/24

route-map LEAK-10-1-1 permit 10

match ip address prefix-list LEAK-MAP

----

---Cisco IP Routing Protocol Commands: -

EIGRP Support For Leaking Routes

Configuring the leak-map keyword allows to advertise a component route that would otherwise be suppressed by the manual summary. Any component subset of the summary can be leaked. A route map and access list must be defined to source the leaked route.

The following is default behavior if an incomplete configuration is entered:

•If the leak-map keyword is configured to reference a nonexistent route map, the configuration of this keyword has no effect. The summary address is advertised but all component routes are suppressed.

•If the leak-map keyword is configured but the access-list does not exist or the route map does not reference the access list, the summary address and all component routes are sent.

Examples

The following example, starting in Global configuration mode, configures an administrative distance of 95 on interface Ethernet 0/0 for the 192.168.0.0/16 summary address:

Router(config)# router eigrp 1 

Router(config-router)# exit 

Router(config)# interface Ethernet 0/0 

Router(config-if)# ip summary-address eigrp 1 192.168.0.0 0.0.255.255 95 

The following example, starting in Global configuration mode, configures the 10.1.1.0/24 subnet to be leaked through the 10.0.0.0 summary address:

Router(config)# router eigrp 1 

Router(config-router)# exit 

Router(config)# access-list 1 permit 10.1.1.0 0.0.0.255 

Router(config)# ! 

Router(config)# route-map LEAK-10-1-1 permit 10 

Router(config-route-map)# match ip address 1 

Router(config-route-map)# exit 

Router(config)# interface Serial 0/0 

Router(config-if)# ip summary-address eigrp 1 10.0.0.0 0.0.0.255 leak-map LEAK-10-1-1 

Router(config-if)# end 

Setup yum repositories to install or update from local mounted iso file

First mount iso file
mount -o loop /path/to/isofile.iso /media/cdrom


Create dvd.repo in /etc/yum.repos.d


example dvd.repo

[dvd]
name=Red Hat Enterprise Linux 6.1
mediaid=1305068199.328169
metadata_expire=-1
gpgcheck=0
cost=500
baseurl=file:///media/cdrom/
enabled=1

rsh setup on RHEL

yum install rsh-server
modify /etc/xinetd.d/rsh file to set "disable" to "no"
add "rsh" to /etc/securetty file
add trusted hosts to ~/.rhosts file
add "-A INPUT -m state --state NEW -m tcp -p tcp --dport shell -j ACCEPT" to /etc/sysconfig/iptables
in /etc/pam.d/rsh
change "auth       required   pam_rhosts.so" to "auth       sufficient   pam_rhosts.so"
service xinetd restart
server iptables restart

RHEL Virtual Guest Network Connection

 I liked to use a network bridge to virtual machines direct access to real network, without using the default virtbr0(NATed) networking.  I did following to change the host and Virtual Machine configurations


First, I choose em3 of the quad ports NIC for bridging.


--ifcfg-em3--

DEVICE="em3"

HWADDR="84:2B:2B:73:B2:53"

NM_CONTROLLED="no"

ONBOOT="yse"

BRIDGE=br0

--ifcfg-br0

DEVICE=br0
TYPE=Bridge
BOOTPROTO=none
ONBOOT=yes
DELAY=0
--



#iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
# service iptables save# service iptables restart


# service network restart

#virsh edit vm_system_name
Change interface type='network' to interface type='bridge'.
Change source network='default' to source bridge='br0'.


Or in virtual machine manager, go into Hardware tab to remove NIC and add a new NIC. 


This all worked out right.


Than, I thought of using the first two NICs that had been setup with bonding to do the bridging.


I changed to ifcfg-bond0 with all IP info remarked ,and added "BRIDGE=br0", and moved IP address info into ifcfg-br0.  Again, it worked.  This is what I liked since it has redundancy.

RedHat 6.1 Changes to Network Interface Bonding Configuration

--ifcfg-bond0-

DEVICE=bond0
IPADDR=xxx.xxx.xxx.xxx
NETMASK=xxx.xxx.xxx.xxx
ONBOOT=yes
BOOTPROTO=none
USERCTL=no
BONDING_OPTS="miimon=100 mode=1"
---

Parameters for the bonding kernel module must be specified as a space-separated list in the BONDING_OPTS="<bonding parameters>" directive in the ifcfg-bond<N> interface file. Do not specify options for the bonding device in /etc/modprobe.d/<bonding>.conf, or in the deprecated/etc/modprobe.conf file.

For a channel bonding interface to be valid, the kernel module must be loaded. To ensure that the module is loaded when the channel bonding interface is brought up, create a new file as root named <bonding>.conf in the/etc/modprobe.d/ directory. Note that you can name this file anything you like as long as it ends with a .confextension. Insert the following line in this new file:

alias bond<N> bonding

some redhat commands and info

www.redhat.com/dell/activate, to activate Dell Server with RedHat installation

dmidecode - really cool command
Dmidecode reports information about your system's hardware as described in your system BIOS according to the SMBIOS/DMI standard (see a sample output). This information typically includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details of varying level of interest and reliability depending on the manufacturer. This will often include usage status for the CPU sockets, expansion slots (e.g. AGP, PCI, ISA) and memory module slots, and the list of I/O ports (e.g. serial, parallel, USB).


bonding

• modprobe.conf 
• alias bond0 bonding
•         options bonding miimon=100 mode=1 (mode=802.3ad or 4 for port-channel)
• ifcfg-bond0
• DEVICE=bond0
• USERCTL=no
• ONBOOT=yes
• BOOTPROTO=static
• BROADCAST=xxx.xxx.xxx.xxx
• IPADDR=xxx.xxx.xxx.xxx
• NETMASK=xxx.xxx.xxx.xxx
• NETWORK=xxx.xxx.xxx.xxx
• GATEWAY=xxx.xxx.xxx.xxx
• ifcfg-eth(n)
• DEVICE=eth(n)
• ONBOOT=yes
• BOOTPROTO=none
• MASTER=bond0
• SLAVE=yes
• VLAN taging
• ifcfg-bond0 need to remove all IP address info.
• ifcfg-bond.(vlan_id)
• DEVICE=bond0.(vlan_id)
• ONBOOT=yes
• VLAN=yes
• BOOTPROTO=none (or static with ip info below)

Sniffing COS and VLAN ID

Had a hard time to find COS bits and Vlan ID in all my captures to prove QOS settings for a Nexus 2k switch.  At the end had to use a hub (a old 10 BaseT Ethernet hub, the reason had to use a mini switch before connect to a Nexus 2k port), a mini switch and a old RealTek NIC to get the capture showing the 802.1q tag.  Later found these url http://wiki.wireshark.org/CaptureSetup/VLAN and http://www.intel.com/support/network/sb/CS-005897.htm that explained almost everything.
Below is a Frame showing the COS and VLAN ID.

And here is the Ethernet Frame with 802.1q fields

find files in current and sub folders and execute one command

example"find . -name "*-confg" -exec chmod 440 {} \;".  worked great!

12209 Forefront TMG requires authorization to fulfill the request. Access to the Web Proxy filter is denied

When setting up Avaya SAL (Secure Access Link) Gateway with Proxy.  The connection to Remote Servers would not establish, and Proxy server (a Microsoft Forefront TMG Server) logs shows many SSL-tunnel both Denied and Allowed messages alternating each other.  Had to open firewall to allow the SAL gateway direct Internet Outbound Access.  It seems to be that Microsoft Forefront TMG having  issue with some 3rd party applications going through the proxy.  It has no problem for Firefox going through the same proxy server..

Cisco Security Manager Upgrade Note

When I am doing CSM upgrade from 3.3.0 to 3.3.1, it requires all pending activities being submitted or discarded.  Tried in File -> Discard, did not work, until realized other users signed in.  Had to Go into Tools -> Security Manager Administration > Take Over User Session.  Basically kill others sessions, and redo the File -> Discard.  The installation went ahead after.

Cisco Wireless LAN Controller Multicast Enabled

Enabled Multicast Mode on the Cisco Wireless LAN Controllers, but still could not hear multi casted MoH.  Turns out that the management interface's default router and dynamic interfaces' default router interfaces need to have "ip pim spare-mode".

MoH multicast from remote site SRST router

Setup Cisco IP phones at a remote site to get the MoH from a file on the WAN router at the site.  It turns out have to use spare-dense or dense mode for it to work on the interfaces between LAN and WAN router.

Multicast Audio 6 seconds delay

Have been trying to setup Cisco CallManager Music on Hold (MOH) to do multicasting on the network.  Had issue with the music takes about 6 seconds to be heard.  It doesn't matter, whether used spare or dense mode on the network.  It turns out a Cisco bug CSCth66667 might have caused it.  After upgrade network core switch (Catalyst 6513) where RP is at to 12.2(33)SXI5, the issue was gone.