Wednesday, 14 August 2013

Linux Survival Commands


/ is root.
/home/mc7 --> go up to root and go down
home/mc7

# ls -l   --> displays file permission


# chmod --> change mode/permission

#groups --> To get a listing of your group memberships

# cd ~ --> go to home directory. cd ~mc7 --> go to mc7 home directory



Monday, 12 August 2013

Pfsense OpenVPN Roadwarriors

Referred to
http://www.youtube.com/watch?v=odjviG-KDq8
http://blog.stefcho.eu/?p=492
http://www.apollon-domain.co.uk/?p=433


Sunday, 11 August 2013

Pfsense site-to-site OpenVPN

PPTP vs OpenVPN vs IPsec VPN
http://www.ivpn.net/knowledgebase/62/PPTP-vs-L2TP-vs-OpenVPN.html

Referred to
http://doc.pfsense.org/index.php/OpenVPN_Site-to-Site_(Shared_Key,_2.0)
http://blog.stefcho.eu/?p=576

Topology


Configure one site as a Server and another as client
Server will listen/wait for client to connect at the specified port. (we can use default port 1194 or different port such as tcp/443)

So, server side firewall must allow traffic from OpenVPN client source IP to access that port.

Routing of additional networks (we can only define one local subnet in openVPN default configuration), add "route 172.16.1.0 255.255.255.0" in advanced configuration box. Of course, the router(pfsense) protecting that network must know how to reach it(add static route)

Access Firewall rules
Fw Access rules via OpenVPN must be configured under OpenVPN tab in firewall section. Firewall in pfsense behaves like cisco ASA - scanning the traffic via incoming interface. So, remember to allow traffic at source firewall (LAN interface) and destination firewall (openVPN) interface.


Dropped Firewall logs


Check OpenVPN logs under Status --> OpenVPN. Check firewall logs under Status --> System Logs.
Pfsense installation using Oracle Virtual Box

Referred to
http://forum.pfsense.org/index.php?topic=47306.0
http://pc-addicts.com/building-the-ultimate-virtualbox-lab-intro/

Download pfsnse .gz file, uncompressed to .img file and convert it to virtual hard disk using "VBoxManage convertfromraw D:\temp\pfSensexx.img D:\temp\pfSensexx..vdi"

Created a VM. Use "Bridge Adapter" to connect pfsense box to local network. Adapter 1 for WAN and adapter 2 for LAN.

(a)pfsense cannot be accessed by WAN interface due to default firewall rule. Use another VM like win XP to access the box via LAN interface. (default userid/password - admin/pfsense)

(b)If (a) is not feasible, we can use VirtualBox option in GNS3 to configure pfsense.

       
Add a cloud and configure it as host machine network adapter



Simulate the lab. First interface of pfsense is em0 and second is em1.

Wednesday, 31 July 2013

Junos CLI basic

The root user must start the CLI from the shell.

user@router>    (the > character identifies operational mode which is to monitor and troubleshoot the device)
user@router#    (the # character identifies configuration mode which is to configure all properties of the Junos OS)

Press Spacebar to complete a command. Press Tab to complete system commands and user-defined variables.


Use configure exclusive to exclude other users from editing the configuration.Any uncommitted changes are discarded when the user exits. In contrast, uncommitted changes are retained when you use standard configure command.

Use configure private to allow multiple users to edit the configuration while committing only their private changes. If a private users issue a rollback 0 command, the software discards only their changes.

Moving between levels is like changing directories. Use up, up 2, top, exit commands.


Viewing differences
Using show | compare displays differences between the candidate config and active configuration also known as rollback 0.

Remember- the rollback command modifies only the candidate configuration. To activate the changes loaded through the rollback operation, issue the commit command.

Run command
The run command allows you to execute operational mode commands while in configuration mode. It is similar to the do command. 


Friday, 12 July 2013

OSPF Basic

OSPF LSA types
LSA Type 1 (Router LSA)
Generated by all routers in an area to describe their directly attached links (Intra-area routes).These do not leave the area.

LSA Type 2 (Network LSA)
Generated by the DR of a broadcast or Nonbroadcast segment to describe the neighbors connected to the segment.These do not leave the area.

LSA Type 3 (Network Summary LSA)
Generated by ABR to describe/advertise a route to neighbors outside the area. (Inter-area routes)

LSA Type 4 (ASBR Summary LSA)
Generated by ABR to advertise a route for/to an ASBR to neighbors outside the area

LSA Type 5 (External LSA)
Generated by ASBR to describe routes redistributed into the OSPF area.These routes appeared as E1 or E2.E2(default) uses a static cost throughout OSPF domain as it only takes the cost into account that is reported at redistribution.E1 uses a cumulative cost of the cost reported into OSPF domain at redribution plus the local cost to the ASBR.

LSA Type 6 (Multicast LSA)
Not supported on Cisco routers.
---------------------------

Unlike EIRGRP, OSPF does not support route summarization anywhere everywhere. It only supports in Area Border Router (ABR). - external route advertisement.

Stub area blocks route updates coming from any external network (redistribution). It only accepts route updates from Area 0, Area 1, so on. ABR generates a default route to this area.

Totally stubby area block external route advertisement and route advertisements from other Areas. It only knows about routes in its own area. ABR generates a default route to this area.


Monday, 8 July 2013

BGP Theory and basic config

Basics
Neighbors are manually configured.
Stage: IDLE, ACTIVE, Open Sent, Open Confirmed, Established

Hello sent every 60 seconds with a hold-down of 180 seconds.
Capable of MD5 authentication

Rule of Synchronization
Routes learnt via iBGP must be validated by the interior routing table before they can be advertised to remote peers - eBGP. Sync can be off/on at bgp router connected to remote ebgp peer.

Rule of Split-Horizon
Routes learnt via IBGP will never be sent to another IBGP peer
Route reflector to overcome this issue.


Attributes (Mandatory, Well-known Optional - transitive/non-transitive)
AS-Path, Next-Hop, Origin (IGP,EGP,Unknown?)
Local Preference(higher better), weight(local router, higher better) = select Exit point
Atomic Aggregate = this route is summarized
MED - used to suggest an entry point into your AS (lower is better)
Aggregator = designates IP addr of the router who performed summarization,
Community = used for route tagging

Basic Configuration
ip address of neighbors must be reachable(eg. via Internal routing protocol); exact subnet mask;
router bgp AS number
neighbor x.x.x.x remote-as 666
network 10.1.0.0 mask 255.255.0.0
neighbor 3.3.3.3 ebgp-multihop 2 -- if interfaces are not directly connected to each other
neighbor 3.3.3.3 update-source loopback 0 - to use if router's bgp address is loopback or not directly connected to neigbor
no auto summary

no synchronization -- turn of rule of synchronization
neighbor 2.2.2.2 next-hop-self -- when ebgp route is advertised back to ibgp

Troubleshooting
debug ip bgp updates