Paris

CMAS*

Heute hab ich meinen CMAS* bestanden.

5 Tauchgänge.

Tauchen in Monte Mare

Heute waren wir im Indoor Tauchzentrum Monte Mare in Rheinbach..

WAVE-276 and the second Virtuale Blade

So finally with WAAS-4.1.3.55 cames out and you can conifigure a second virtual Blade.

Nice;-)

A Keyboard for Blondes

While Surfing a round for a new Keyboard i dicovered the Keyboard for Blondes, maybe:-)

This keyboard has been aproved for Blondes by the American Blondes Association of America.

Thanks to Das Keyboard maybe my next one.:-)

Vienna 2009

DMVPN with Linux

I know since i discovered the DMVPN in 2004/5 this is a very intelligent combination of IPsec, GRE and NHRP. Many Thanks to the Guys at Cisco, Christoph, Frederick and all other.

This week i discovered "opennhrp" on sourceforge.

It took me a minute or two to have a VM with debian up and the needed tools installed.

I used VMWare with a bridged ethernet interface for testing, installed debian 4.0 netinstall iso and upgraded to sid / testing, so i got Kernel Version 2.6.26-1-686.

Then downloaded ipsec-tools-0.8-alpha20090126.tar.bz2 from the site. you have to install some libs and tools to build ipsec tools, like kernel headers and so on:-) and done some configure and make stuff.

I went to make opennhrp, well all done with out a problem to here.

Next i configured racoon and ipsec-tools and opennhrp like this:

   /etc/ipsec-tools.conf 
   #!/usr/sbin/setkey -f
   spdflush;
   spdadd 0.0.0.0/0 0.0.0.0/0 gre -P out ipsec esp/transport//require;
   spdadd 0.0.0.0/0 0.0.0.0/0 gre -P in ipsec esp/transport//require;

   /etc/racoon/racoon.conf 
   path pre_shared_key "/etc/racoon/psk.txt";
   remote anonymous {
      exchange_mode main,aggressive;
      lifetime time 24 hour;
      # nat_traversal on;
      script "/etc/opennhrp/racoon-ph1down.sh" phase1_down;
      proposal {
         encryption_algorithm 3des;
         hash_algorithm sha1;
         authentication_method pre_shared_key;
         dh_group 5;
      }
   }
   sainfo anonymous {
      lifetime time 12 hour;
      encryption_algorithm 3des, blowfish 448, rijndael;
      authentication_algorithm hmac_sha1, hmac_md5;
      compression_algorithm deflate;
   }

   /etc/racoon/psk.txt
   10.2.0.90 1234

   /etc/opennhrp/opennhrp.conf
   interface gre1
      map 172.255.255.1/24 10.2.0.90 register cisco
      cisco-authentication 1234
      shortcut

No get the Tunnel UP:

   ip tunnel add gre1 mode gre key 1234 ttl 64
   ip addr add 172.255.255.2/24 dev gre1
   ip tunnel change gre1 local 10.0.81.115
   ip link set gre1 up

Now its time to get on the other side.

We are using a Cisco 1812 with c181x-advsecurityk9-mz.124-15.T7.bin running.

   crypto isakmp policy 10
      encr 3des
      authentication pre-share
      group 5
   !
   crypto isakmp key 1234 address 0.0.0.0 0.0.0.0
   !
   crypto ipsec transform-set TRANSFORMSET_3 esp-3des esp-sha-hmac
      mode transport
   !
   crypto ipsec profile Profile3
      set transform-set TRANSFORMSET_3
   !
   interface Tunnel888
      ip address 172.255.255.1 255.255.255.0
      no ip redirects
      no ip unreachables
      no ip proxy-arp
      ip mtu 1400
      ip flow ingress
      ip nhrp authentication 1234
      ip nhrp map multicast dynamic
      ip nhrp network-id 10064
      ip nhrp holdtime 360
      ip nhrp max-send 200 every 10
      ip route-cache same-interface
      ip tcp adjust-mss 1350
      load-interval 30
      tunnel source 10.2.0.90
      tunnel mode gre multipoint
      tunnel key 1234
      tunnel protection ipsec profile Profile3

and viola

   Router# sh dmvpn interface tunnel 888
   Load for five secs: 8%/3%; one minute: 9%; five minutes: 10%
   Time source is NTP, 22:14:22.148 CET Sat Feb 14 2009
   Legend: Attrb --> S - Static, D - Dynamic, I - Incompletea
   N - NATed, L - Local, X - No Socket
   # Ent --> Number of NHRP entries with same NBMA peer
   Tunnel888, Type:Hub, NHRP Peers:1,
   # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
   ----- --------------- --------------- ----- -------- -----
   1 10.0.81.115 172.255.255.2 UP never D

   Router# ping 172.255.255.2
   Type escape sequence to abort.
   Sending 5, 100-byte ICMP Echos to 172.255.255.2, timeout is 2 seconds:
   !!!!!
   Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

this looks great:-)
Many thanks Timo for doing such a impressiv work. I like the cisco for they impressiv boxes and i also like opensource software.

--- edit February 15, 2009 at 12:09 am ---

I found after a while no packets traveling, the nhrp registration had gone on the cisco side may be holdtimers differ so added "holding-time 360" to the opennhrp.conf , a opennhrpctl purge fixed the problem.

We have 1234567890

We have 1234567890 regarding to Unix-Time:

$ date -d @1234567890
Sa 14. Feb 00:31:30 CET 2009

Wash me till i am clean

Belkin hat eine waschbare Maus heraus gebracht.

Na also da brauch ich mir keine Gedanken wegen meines Kaffeekonsums und meiner Maus zumachen, bleibt nur die Frage offen, ob man die Maus auch in den Trockner geben darf?

A Valentine’s Day Gift Idea

Das ist doch mal ein Valentines Geschenk. Was denkt ihr?

Packetcapture auf der WAAS

Kürzlich hab ich entdeckt das man auf der WAAS Packete mit schneiden kann.

Auf der WAE ist tcpdump installiert, den kann man in der gewohnten weise zum sniffern gebrauchen.

# tcpdump -s 0 -w /local1/out.pcap
# copy disk ftp a.x.y.z / out.pcap /local1/out.pcap
# delfile /local1/out.pcap

Der Rest ist dann ganz normale Arbeit für wireshark.

wordpress blog

Hab entschieden das blog hier in Deutsch zubelassen und das Blog auf wordpress.com in English zuführen.

Wordpress as Blog

Thinking about to move my blog to wordpress.com
Today i have registered my blog under http://patrickpreuss.wordpress.com

oh its really nice form wordpress to import my old blog:-)

The top 10 tracks of 2008

2K8 is history :-( so now it is time for a top 10 :-)
2008 ist Geschichte :-( es ist zeit für eine Top 10 :-)

1	Linkin Park – One Step Closer
2	AC/DC – Back in Black
3	Metallica – Enter Sandman
4	Linkin Park – Hands Held High
5	Linkin Park – Bleed It Out
6	Peter Fox – Alles Neu
7	AC/DC – Shoot to Thrill
8	KoЯn – Got the Life
9	KoЯn – Freak on a Leash
10	Linkin Park – Given Up

Ich wuste es doch meine Router sind Telephone

So So ich wuste es doch meine Router sind Telephone oder doch nicht. Nach dem wir auf unseren Zentralen DMVPN Routern das 12.4.15T7 IOS Release eingespielt hatten, sahen wir einen massiven Anstieg im Memory duch den CDP Process. Ein Debug der cdp events ergab folgende Log Meldungen:

Jan 19 12:12:51.513 UTC: CDP-EV: Lookup for ip phone with idb= Tunnel105 ip= a.b.x.y mac= 0000.0000.0000 platform= Cisco 1721
Jan 19 12:12:51.517 UTC: CDP-EV: Lookup for ip phone with idb= Tunnel105 ip= a.b.x.y mac= 0000.0000.0000 platform= Cisco 1812
Jan 19 12:12:52.141 UTC: CDP-EV: Lookup for ip phone with idb= Tunnel105 ip= a.b.x.y mac= 0000.0000.0000 platform= Cisco C836
Funny, mal sehen was das heist:-)

Cisco WAAS mit IOS Router

Die Configuration auf einem IOS Router ist analog zu der Configuration auf den Switchen, deshalb werd ich die hier nicht wiederholen.
Die Configuration auf der WAAS wird nicht fest configuriert sondern über wccp ausgehandelt.

wccp router-list 1 10.2.0.145
wccp tcp-promiscuous router-list-num 1
wccp version 2
egress-method negotiated-return intercept-method wccp

Cisco WAE und 3560

Hi
hm was auf den Routern so einfach ist kann einen auf dem Switch zu verzweiflung bringen.

Also erstmal den Switch auf die 12.2 46 SE IP Services updaten, und auf das SDM Template auf IP Routing umstellen.
SDM steht hier für Switch Database Manager, mit diesem kann man die 3560 Switche fuer verschiedene einsatz Gebiete optimieren.

conf t
sdm prefer routing
end
write
reload

nach dem reload haben wir dann folgende Einstellungen:

switch#sh sdm prefer
The current template is "desktop routing" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.

number of unicast mac addresses:                  3K
number of IPv4 IGMP groups + multicast routes:    1K
number of IPv4 unicast routes:                    11K
  number of directly-connected IPv4 hosts:        3K
  number of indirect IPv4 routes:                 8K
number of IPv4 policy based routing aces:         0.5K
number of IPv4/MAC qos aces:                      0.5K
number of IPv4/MAC security aces:                 1K

Auf dem Switch dann WCCPv2 wie folgt konfiguriern:

ip wccp 61 redirect-list acl-wccp-61
ip wccp 62 redirect-list acl-wccp-62
!
interface FastEthernet0/21
description Switch <-> wave
no switchport
ip address 10.0.136.9 255.255.255.248
no ip proxy-arp
!
interface Vlan 1
description LAN
no switchport
ip address 10.0.136.1 255.255.255.248
ip wccp 61 redirect in
!
interface FastEthernet0/24
description WAN
no switchport
ip address 10.0.134.81 255.255.255.0
ip wccp 62 redirect in
!
ip access-list extended acl-wccp-61
permit tcp 10.0.0.0 0.0.255.255 10.0.136.0 0.0.0.255
permit tcp 10.0.0.0 0.0.255.255 10.0.137.0 0.0.0.255
deny   ip any any
ip access-list extended acl-wccp-62
permit tcp 10.0.136.0 0.0.0.255 10.0.0.0 0.0.255.255
permit tcp 10.0.137.0 0.0.0.255 10.0.0.0 0.0.255.255
deny   ip any any
!

Auf der WAVE oder WAE WCCPv2 wie folgt konfigurien:

interface GigabitEthernet 1/0                   
  ip address 10.0.136.10 255.255.255.248          
!
ip default-gateway 10.0.136.9               
!
wccp router-list 1 10.0.136.9               
wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign                         
wccp version 2

Dann viel spass mit der WAVE:

switch#sh ip wccp 61 detail
Load for five secs: 5%/0%; one minute: 7%; five minutes: 6%
Time source is NTP, 14:40:49.402 UTC Thu Jan 15 2009

      WCCP Client ID:          10.0.136.10
      Protocol Version:        2.0
      State:                   Usable
      Redirection:             L2
      Packet Return:           GRE
      Packets Redirected:    0
      Connect Time:          00:53:54
      Assignment:            MASK

      Mask  SrcAddr    DstAddr    SrcPort DstPort
      ----  -------    -------    ------- -------
      0000: 0x00001741 0x00000000 0x0000  0x0000

      Value SrcAddr    DstAddr    SrcPort DstPort CE-IP
      ----- -------    -------    ------- ------- -----
      0000: 0x00000000 0x00000000 0x0000  0x0000  0x0A00880A (10.0.136.10)
           .... outout omited ......
      0063: 0x00001741 0x00000000 0x0000  0x0000  0x0A00880A (10.0.136.10)