Cisco PIX Packet Capture

Hi there my blog has moved to Wordpress so if you are looking for this post please take look here.

Cisco ASA and lot of email recipients

Those days we faced the problem that we recived a mail with approx 150 recipients.
Somewhere in the communication it seams that a mail address is broken by the asa.

On the Outside of the ASA you see following in the trace:

        Inside E-Mail Server (Blue) mail.example.com
        Outside E-Mail Server (Red) mail.asdf.com
        220-mail.example.com ESMTP Server [Wed, 18 Aug 2010 10:30:58 +0200]
        220-Ready to recycle your bits, but we don't want 
        220 your unsolicited or bulk e-mail (ie: spam) 
        EHLO mail.asdf.com 
        250-mail.example.com Hello mail.asdf.com [192.168.0.1] 
        250-SIZE 4194304
        250-PIPELINING 
        250-AUTH PLAIN LOGIN CRAM-MD5 NTLM 
        250-STARTTLS 
        250 HELP 
        MAIL FROM:<asdf@asdf.com> SIZE=42157 
        RCPT TO:<user1@example.com> 
        <output omited> 
        RCPT TO:<user20@example.com> 
        RCPT TO:<user21@ 
        250 OK 
        example.com> 
        RCPT TO:<user22@example.com> 
        RCPT TO:<user23@example.com> 
        RCPT TO:<user24@example.com>
        <output omited> 
        250 Accepted 
        <output omited> 
        250 Accepted 
        
            501 <user21@XXXXXXXXXXXXXX: '>' missing at end of address
          
        250 Accepted 
        250 Accepted
        250 Accepted

On the Inside of the ASA you see following in the trace:

        Inside E-Mail Server (Blue) mail.example.com
        Outside E-Mail Server (Red) mail.asdf.com
        220-mail.example.com ESMTP Server [Wed, 18 Aug 2010 10:30:58 +0200]
        220-Ready to recycle your bits, but we don't want
        220 your unsolicited or bulk e-mail (ie: spam)
        EHLO mail.asdf.com
        250-mail.example.com Hello mail.asdf.com [192.168.0.1]
        250-SIZE 4194304
        250-PIPELINING
        250-AUTH PLAIN LOGIN CRAM-MD5 NTLM
        250-STARTTLS
        250 HELP
        MAIL FROM:<asdf@asdf.com> SIZE=42157
        RCPT TO:<user1@example.com>
        <output omited> 
        RCPT TO:<user20@example.com>
        RCPT TO:<user21@ 250 OK
        XXXXXXXXXXXXXX
        RCPT TO:<user22@example.com>
        RCPT TO:<user23@example.com>
        RCPT TO:<user24@example.com>
        <output omited> 
        250 Accepted
        <output omited> 
        250 Accepted
        
            501 <user21@XXXXXXXXXXXXXX: '>' missing at end of address
          
        250 Accepted
        250 Accepted
        250 Accepted

This is a little bit strange so i will ask the Guys from Cisco if this is a known feature or a bug.

For the Momemt we have disabled the esmtp fixup, on monday we will do future analysis.

If you feel this helps a bit or may be not ? Please leave a comment.

Powered by Zoundry Raven

Cisco ASA and SMTP

We recently bought so new Firewalls to replace to aged Cisco PIX515e with some new Gear. We decided to use Ciscos new Firewall flagship the Cisco ASA Devices. Everything was fine after the replacement, we transfered the configuration from the old boxes to the new with the help of the Cisco Security Manager.

Later that day there was complains about e-mails are not delivered properly.

On the Cisco PIX with Software 6.2 we had implemented following:

   
        no fixup smtp

For the ASA5510 we had to implement following

        policy-map type inspect esmtp esmtp_pmap
            parameters
              allow-tls action log
        policy-map global_policy
            class inspection_default
                no inspect esmtp
                inspect esmtp esmtp_pmap
            exit
        exit

If you feel this helps a bit or may be not ? Please leave a comment.

Access-based Enumeration (ABE) and Cisco WAAS

Access-based Enumeration (ABE) is a smart feature to let users see only the folders they have access to.
But if you have Cisco WAAS deployed in your network please be aware you have to add a Dynamic share to the waas configuration so the waas knows about this.

Cisco Wide Area Application Services Configuration Guide (Software Version 4.1.7)

Step 1
For creating a dynamic share you have to add a Domain to the Cental Manager eg "Dynamic Shares"

Step 2
Create a entry under the dynamic shares in the global configuration.

On the WAE CLI

 
ToBe Done

If you feel this helps a bit or may be not ? Please leave a comment.

Cisco MDS 9222i with ACS

If you want to configure tacacs+ on the Cisoc MDS9222i Series you have to enable first the feature.

        feature tacacs+

After this the commands to configure the Tacacs+ are available.

        !
        feature tacacs+
        !
        tacacs+ distribute
        tacacs-server timeout 10
        tacacs-server host 10.0.243.247 key 0 secertkey
        tacacs-server host 10.0.243.248 key 0 secretkey
        tacacs+ commit
        !
        aaa group server tacacs+ AAA-Servers
            server 10.0.243.247
            server 10.0.243.248
            deadtime 5
        !
        aaa authentication login default group AAA-Servers
        aaa authentication login console local
        aaa authentication login error-enable
        !
        ip route 10.0.243.247 255.255.255.255 10.0.160.1 interface mgmt0
        ip route 10.0.243.248 255.255.255.255 10.0.160.1 interface mgmt0
        !
        interface mgmt0
            ip address 10.0.160.99 255.255.255.0
            switchport description Management
            switchport speed 100

If you feel this helps a bit or may be not ? Please leave a comment.

Cisco WAAS and Tacacs+

How To use Tacacs+ with Cisco WAAS for Authentication.

Configuration with the Central Manager

Tacacs+ is configured in the Device Context at Configure > Security > AAA > TACACS+

Go to Configure > Security > AAA > Authentication Methods

Go to Configure > Security > AAA > Command Authorization

On the Accelerator CLI

   tacacs key ****
   tacacs host 10.0.243.247 primary
   tacacs host 10.0.243.248
   tacacs key ****
   authentication login local enable secondary
   authentication login tacacs enable primary
   authentication configuration local enable secondary
   authentication configuration tacacs enable primary
   authentication fail-over server-unreachable
   aaa authorization commands 15 default tacacs+

On the ACS you have to add following Attribute to the Profil

For the cetral manager to work also you have to create a group "admin" and assign the role admin Under Admin > AAA > User Groups

If you feel this helps a bit or may be not ? Please leave a comment.

WAVE-276 and the second Virtuale Blade

So finally with WAAS-4.1.3.55 cames out and you can conifigure a second virtual Blade.

Nice;-)

DMVPN with Linux

I know since i discovered the DMVPN in 2004/5 this is a very intelligent combination of IPsec, GRE and NHRP. Many Thanks to the Guys at Cisco, Christoph, Frederick and all other.

This week i discovered "opennhrp" on sourceforge.

It took me a minute or two to have a VM with debian up and the needed tools installed.

I used VMWare with a bridged ethernet interface for testing, installed debian 4.0 netinstall iso and upgraded to sid / testing, so i got Kernel Version 2.6.26-1-686.

Then downloaded ipsec-tools-0.8-alpha20090126.tar.bz2 from the site. you have to install some libs and tools to build ipsec tools, like kernel headers and so on:-) and done some configure and make stuff.

I went to make opennhrp, well all done with out a problem to here.

Next i configured racoon and ipsec-tools and opennhrp like this:

   /etc/ipsec-tools.conf 
   #!/usr/sbin/setkey -f
   spdflush;
   spdadd 0.0.0.0/0 0.0.0.0/0 gre -P out ipsec esp/transport//require;
   spdadd 0.0.0.0/0 0.0.0.0/0 gre -P in ipsec esp/transport//require;

   /etc/racoon/racoon.conf 
   path pre_shared_key "/etc/racoon/psk.txt";
   remote anonymous {
      exchange_mode main,aggressive;
      lifetime time 24 hour;
      # nat_traversal on;
      script "/etc/opennhrp/racoon-ph1down.sh" phase1_down;
      proposal {
         encryption_algorithm 3des;
         hash_algorithm sha1;
         authentication_method pre_shared_key;
         dh_group 5;
      }
   }
   sainfo anonymous {
      lifetime time 12 hour;
      encryption_algorithm 3des, blowfish 448, rijndael;
      authentication_algorithm hmac_sha1, hmac_md5;
      compression_algorithm deflate;
   }

   /etc/racoon/psk.txt
   10.2.0.90 1234

   /etc/opennhrp/opennhrp.conf
   interface gre1
      map 172.255.255.1/24 10.2.0.90 register cisco
      cisco-authentication 1234
      shortcut

No get the Tunnel UP:

   ip tunnel add gre1 mode gre key 1234 ttl 64
   ip addr add 172.255.255.2/24 dev gre1
   ip tunnel change gre1 local 10.0.81.115
   ip link set gre1 up

Now its time to get on the other side.

We are using a Cisco 1812 with c181x-advsecurityk9-mz.124-15.T7.bin running.

   crypto isakmp policy 10
      encr 3des
      authentication pre-share
      group 5
   !
   crypto isakmp key 1234 address 0.0.0.0 0.0.0.0
   !
   crypto ipsec transform-set TRANSFORMSET_3 esp-3des esp-sha-hmac
      mode transport
   !
   crypto ipsec profile Profile3
      set transform-set TRANSFORMSET_3
   !
   interface Tunnel888
      ip address 172.255.255.1 255.255.255.0
      no ip redirects
      no ip unreachables
      no ip proxy-arp
      ip mtu 1400
      ip flow ingress
      ip nhrp authentication 1234
      ip nhrp map multicast dynamic
      ip nhrp network-id 10064
      ip nhrp holdtime 360
      ip nhrp max-send 200 every 10
      ip route-cache same-interface
      ip tcp adjust-mss 1350
      load-interval 30
      tunnel source 10.2.0.90
      tunnel mode gre multipoint
      tunnel key 1234
      tunnel protection ipsec profile Profile3

and viola

   Router# sh dmvpn interface tunnel 888
   Load for five secs: 8%/3%; one minute: 9%; five minutes: 10%
   Time source is NTP, 22:14:22.148 CET Sat Feb 14 2009
   Legend: Attrb --> S - Static, D - Dynamic, I - Incompletea
   N - NATed, L - Local, X - No Socket
   # Ent --> Number of NHRP entries with same NBMA peer
   Tunnel888, Type:Hub, NHRP Peers:1,
   # Ent Peer NBMA Addr Peer Tunnel Add State UpDn Tm Attrb
   ----- --------------- --------------- ----- -------- -----
   1 10.0.81.115 172.255.255.2 UP never D

   Router# ping 172.255.255.2
   Type escape sequence to abort.
   Sending 5, 100-byte ICMP Echos to 172.255.255.2, timeout is 2 seconds:
   !!!!!
   Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/8 ms

this looks great:-)
Many thanks Timo for doing such a impressiv work. I like the cisco for they impressiv boxes and i also like opensource software.

--- edit February 15, 2009 at 12:09 am ---

I found after a while no packets traveling, the nhrp registration had gone on the cisco side may be holdtimers differ so added "holding-time 360" to the opennhrp.conf , a opennhrpctl purge fixed the problem.

Packetcapture auf der WAAS

Kürzlich hab ich entdeckt das man auf der WAAS Packete mit schneiden kann.

Auf der WAE ist tcpdump installiert, den kann man in der gewohnten weise zum sniffern gebrauchen.

# tcpdump -s 0 -w /local1/out.pcap
# copy disk ftp a.x.y.z / out.pcap /local1/out.pcap
# delfile /local1/out.pcap

Der Rest ist dann ganz normale Arbeit für wireshark.

Ich wuste es doch meine Router sind Telephone

So So ich wuste es doch meine Router sind Telephone oder doch nicht. Nach dem wir auf unseren Zentralen DMVPN Routern das 12.4.15T7 IOS Release eingespielt hatten, sahen wir einen massiven Anstieg im Memory duch den CDP Process. Ein Debug der cdp events ergab folgende Log Meldungen:

Jan 19 12:12:51.513 UTC: CDP-EV: Lookup for ip phone with idb= Tunnel105 ip= a.b.x.y mac= 0000.0000.0000 platform= Cisco 1721
Jan 19 12:12:51.517 UTC: CDP-EV: Lookup for ip phone with idb= Tunnel105 ip= a.b.x.y mac= 0000.0000.0000 platform= Cisco 1812
Jan 19 12:12:52.141 UTC: CDP-EV: Lookup for ip phone with idb= Tunnel105 ip= a.b.x.y mac= 0000.0000.0000 platform= Cisco C836
Funny, mal sehen was das heist:-)

Cisco WAAS mit IOS Router

Die Configuration auf einem IOS Router ist analog zu der Configuration auf den Switchen, deshalb werd ich die hier nicht wiederholen.
Die Configuration auf der WAAS wird nicht fest configuriert sondern über wccp ausgehandelt.

wccp router-list 1 10.2.0.145
wccp tcp-promiscuous router-list-num 1
wccp version 2
egress-method negotiated-return intercept-method wccp

Cisco WAE und 3560

Hi
hm was auf den Routern so einfach ist kann einen auf dem Switch zu verzweiflung bringen.

Also erstmal den Switch auf die 12.2 46 SE IP Services updaten, und auf das SDM Template auf IP Routing umstellen.
SDM steht hier für Switch Database Manager, mit diesem kann man die 3560 Switche fuer verschiedene einsatz Gebiete optimieren.

conf t
sdm prefer routing
end
write
reload

nach dem reload haben wir dann folgende Einstellungen:

switch#sh sdm prefer
The current template is "desktop routing" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.

number of unicast mac addresses:                  3K
number of IPv4 IGMP groups + multicast routes:    1K
number of IPv4 unicast routes:                    11K
  number of directly-connected IPv4 hosts:        3K
  number of indirect IPv4 routes:                 8K
number of IPv4 policy based routing aces:         0.5K
number of IPv4/MAC qos aces:                      0.5K
number of IPv4/MAC security aces:                 1K

Auf dem Switch dann WCCPv2 wie folgt konfiguriern:

ip wccp 61 redirect-list acl-wccp-61
ip wccp 62 redirect-list acl-wccp-62
!
interface FastEthernet0/21
description Switch <-> wave
no switchport
ip address 10.0.136.9 255.255.255.248
no ip proxy-arp
!
interface Vlan 1
description LAN
no switchport
ip address 10.0.136.1 255.255.255.248
ip wccp 61 redirect in
!
interface FastEthernet0/24
description WAN
no switchport
ip address 10.0.134.81 255.255.255.0
ip wccp 62 redirect in
!
ip access-list extended acl-wccp-61
permit tcp 10.0.0.0 0.0.255.255 10.0.136.0 0.0.0.255
permit tcp 10.0.0.0 0.0.255.255 10.0.137.0 0.0.0.255
deny   ip any any
ip access-list extended acl-wccp-62
permit tcp 10.0.136.0 0.0.0.255 10.0.0.0 0.0.255.255
permit tcp 10.0.137.0 0.0.0.255 10.0.0.0 0.0.255.255
deny   ip any any
!

Auf der WAVE oder WAE WCCPv2 wie folgt konfigurien:

interface GigabitEthernet 1/0                   
  ip address 10.0.136.10 255.255.255.248          
!
ip default-gateway 10.0.136.9               
!
wccp router-list 1 10.0.136.9               
wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign                         
wccp version 2

Dann viel spass mit der WAVE:

switch#sh ip wccp 61 detail
Load for five secs: 5%/0%; one minute: 7%; five minutes: 6%
Time source is NTP, 14:40:49.402 UTC Thu Jan 15 2009

      WCCP Client ID:          10.0.136.10
      Protocol Version:        2.0
      State:                   Usable
      Redirection:             L2
      Packet Return:           GRE
      Packets Redirected:    0
      Connect Time:          00:53:54
      Assignment:            MASK

      Mask  SrcAddr    DstAddr    SrcPort DstPort
      ----  -------    -------    ------- -------
      0000: 0x00001741 0x00000000 0x0000  0x0000

      Value SrcAddr    DstAddr    SrcPort DstPort CE-IP
      ----- -------    -------    ------- ------- -----
      0000: 0x00000000 0x00000000 0x0000  0x0000  0x0A00880A (10.0.136.10)
           .... outout omited ......
      0063: 0x00001741 0x00000000 0x0000  0x0000  0x0A00880A (10.0.136.10)

DynDNS mit einem Cisco Router

ip ddns update method dyndns
HTTP
add http://:@members.dyndns.org/nic/update?system=dyndns&hostname=>h<&myip=>a<
interval
maximum 1 0 0 0
!
interface Dialer 1
ip ddns update hostname haha.homelinux.org
ip ddns update dyndns

IPTV mit T-Home

Um IPTV mit einem Cisco Router ans rennen zu bekommen muss ein igmp Proxy auf dem Cisco Configuriert werden. Die nachfolgende Konfiguration ist aus der Cisco Dokumention abgeleitet, es kann sein das noch die Timer angepasst werden müssen. Da ich selber keinen VDSL Zugang habe ist das noch einwenig Theorie.

--- snip ---
ip multicast-routing
ip igmp snooping
!
interface Vlan1
  ip pim sparse-dense-mode
  ip igmp helper-address udl Dialer 2
  ip igmp version 3
  ip igmp mroute-proxy Dialer 2
!
interface Dialer 2
  ip pim sparse-dense-mode
  ip igmp version 3
  ip igmp unidirectional-link
!
--- snip ---

Cisco Customizing IGMP

Bitte vergest nicht auch die Firewall regeln Anzupassen:

--- snip ---

ip access-list extended OUTSIDE

  9 permit ip any 224.0.0.0 15.255.255.255



--- snip --- 

Alternativ sollte auch folgende Konfiguration gehen.

--- snip ---

ip access-list extended OUTSIDE

  7 permit ip 217.0.119.0 0.0.0.255 224.0.0.0 15.255.255.255

  8 permit ip 193.158.35.0 0.0.0.255 224.0.0.0 15.255.255.255

--- snip ---

Zum Testen habe ich folgenden Aufbau gewählt: Als Telekom Router Cisco 1712

--- snip ---
ip multicast-routing
!
interface FastEthernet 0
  description to Customer
  ip address 192.168.2.2 255.255.255.0
  ip pim sparse-dense-mode
  
!
interface Ethernet 0
  description to IPTV Server
  ip address 192.168.4.1 255.255.255.0
  ip pim sparse-dense-mode
!
--- snip ---

Als Home Router Cisco 1812

--- snip ---
ip multicast-routing
ip igmp snooping
!
interface Vlan 1
  description IPTV Client
  ip address 192.168.200.1 255.255.255.0
  ip igmp helper-address udl Vlan 2
  ip igmp version 3
  ip igmp mroute-proxy Vlan 2
  ip pim sparse-dense-mode
!
interface Vlan 2
  description to Internet
  ip address 192.168.2.1 255.255.255.0
  ip igmp version 3
  ip pim sparse-dense-mode
  ip igmp version 3
  ip igmp unidirectional-link
!
--- snip ---

Als IP TV Server Apple Macbook 13' OS X 10.5.6 VLC 0.9.8 zum Starten des Streams hab ich den "Netzwerk Streaming Assistenten" verwendet. Die Stream Parameter sind "UDP Multicast", 239.0.0.42, TTL 10 und natürlich ein Video;-) Als Multicast Receiver diente ein IBM ThinkCenter R51 oder so mit Windows und VLC 0.9.8 installiert.

IP Multicast Routing

Unter IP Multicasting versteht man die Technik Daten, z.B. Video, an mehrer Teilnehmer zu verteilen.

IP Multicasting gibt es unter IPv4 und IPv6.

Einen Schnellen einstieg in die Configuration auf Cisco Routern bietet follgender Quick Start Guide. Weiterführend kann ich euch das Buch "Routing TCP/IP Volume II" empfehlen oder Cisco IOS IP Multicast Configuration Guide, Release 12.4.

Als Multicast Sender und Empfänger kann man VLC nehmen. Wir haben mit zwei 1700er Routern eine einfache Multicast Configuration auf gesetzt.

VideoLAN

Es gibt zwei Möglichkeiten VLC als Streaming Server einzusetzen, die erste Möglichkeit ist die Einrichtung über die Wizards, diese sind selbst erklärend, deshalb werde ich hier auf eine Beschreibung verzichten.

Streaming Server

Der vlc player kann auch über die CLI gesteuert werden. Hier ein einfaches Beispiel zum Starten eines Multicast Streams: vlc -vvv input.mpeg --sout udp:239.0.0.42 --ttl 12 Der Output der Logmeldungen mit "-v" eingrenzen.

Client

vlc udp:@239.0.0.42

Multicast HOWTO

Cisco Router Basic Multicast Configuration

--- snip ---
!
ip multicast-routing
!
! Startet das Multicast Routing
!
interface FastEthernet 0/0
  ip pim sparse-dense-mode
!
interface FastEthernet 0/1
  ip pim sparse-dense-mode
!
--- snip ---

Commands

show ip mroute

VDSL

Das Thema Cisco Router mit einem von den neuen VDSL Anschlüssen ans rennen zu bekommen ist nicht weiter schwierig. Hier ein paar Beispiele: Bei Routern die nur einen eingebauten Switch besitzen, z.B. Cisco 876:

--- snip ---
vlan 7
  name VDSL-VLAN
!
interface FastEthernet 8
  switchport mode trunk
  switchport trunk allowed vlan 1,7,1002-1005
!
interface Vlan 7
  description VLAN fuer VDSL
  no ip address
  pppoe enable group global
  pppoe-client dial-pool-number 1
!
interface Dialer 0
  ip address negotiated
  ip mtu 1452
  ip nat outside
  ip virtual-reassembly
  encapsulation ppp
  ip route-cache policy
  ip route-cache flow
  dialer pool 1
  dialer idle-timeout 0
  dialer persistent
  dialer-group 1
  ppp authentication chap pap callin
  ppp pap sent-username <user>@t-online.de password 0 <password> 
!
--- snip ---

Bei anderen Modellen kann man auch eines der Routing interface nehmen.

--- snip ---
interface FastEthernet 0.7
  encapsulation dot1q 7
  pppoe enable group global
  pppoe-client dial-pool-number 1
!
interface Dialer 0
  ip address negotiated
  ip mtu 1452
  ip nat outside
  ip virtual-reassembly
  encapsulation ppp
  ip route-cache policy
  ip route-cache flow
  dialer pool 1
  dialer idle-timeout 0
  dialer persistent
  dialer-group 1
  ppp authentication chap pap callin
  ppp pap sent-username <user>@t-online.de password 0 <password> 
!
--- snip ---

Mail nur über den 2en Internet Service Provider

Um mit den Cisco Routen Mail nur über einen Provider zu versenden, muss eine Policy Route erstellt werden die den Verkehr erstellt werden.

--- snip ---
ip access-list extended SERVER-RT-MAP-ACL
  10 permit tcp host 192.168.20.1 any eq smtp
!
route-map SERVER-RT-MAP permit 10
  match ip address SERVER-RT-MAP-ACL
  set interface Dialer1
!
interface FastEthernet 0
  ip policy route-map SERVER-RT-MAP 
--- snip ---

NAT mit zwei Internet Providern

Eine subere Verbindung ins Internet mit Zwei Providern zu bekommen ist nicht so einfach mit folgender Configuration zu lösen.

Nicht funtionierende Lösung

--- snip ---
interface FastEthernet 0
  description LAN
  ip address 192.168.20.1 255.255.255.0
  ip nat inside
!
interface Dialer 1
  description Provider 1
  ip nat outside
!
interface Dialer 2
  description Provider 2
  ip nat outside
!
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 2 permit 192.168.20.0 0.0.0.255
!
ip nat inside source list 1 interface Dialer 1 overload
ip nat inside source list 2 interface Dialer 2 overload
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
ip route 0.0.0.0 0.0.0.0 Dialer 2
--- snip ---</pre>

Hier bei kommt es dann zu lustigen Effekten mit den Source Addressen. 
Bzw. durch Packet basiertes Load Balancing kann es sein das nichts Funktioniert oder man im besten Fall nur den Upload verbessert hat.

Die von uns geforterte Configuration benötigte noch das Goodie das ausgehende E-Mails nur über den zweiten Provider zu versenden sind. Da hinter dem Router ein Mail Server mit eigener Domain betrieben wird. 
Dazu aber in einem anderen Posting mehr. 

<h3>Die Lösung könnte folgendermaßen aussehen:</h3>

<pre>--- snip ---
interface FastEthernet 0
  description LAN
  ip address 192.168.20.1 255.255.255.0
  ip nat inside
!
interface Dialer 1
  description Provider 1
  ip nat outside
!
interface Dialer 2
  description Provider 2
  ip nat outside
!
access-list 1 permit 192.168.20.0 0.0.0.255
!
! Die ACL definiert den Verkehr der durch den NAT Process geschickt wird. 
!
route−map dialer1−nat permit 10
match ip address 1
match interface Dialer1
!
route−map dialer2−nat permit 10
match ip address 1
match interface Dialer 2
!
! Die Route-Maps binden die NAT Acl an das ISP Seitige Interface des Routers.
! 
ip nat inside source route−map dialer1−nat interface Dialer1 overload
ip nat inside source route−map dialer2−nat interface Dialer2 overload
!
!
!
ip route 0.0.0.0 0.0.0.0 Dialer 1
ip route 0.0.0.0 0.0.0.0 Dialer 2
!
--- snip ---

Überprüfung

show ip nat translation Zeigt die aktuellen NAT Sessions an.

show ip route Zeigt die Aktiven Routen an.

Weiter gehende Informationen findet ihr unter folgendem Link: Cisco IOS NAT Load-Balancing and Zone-Based Policy Firewall with Optimized Edge Routing For Two Internet Connections

Backup und Recovery der WAVE Virtual Blades

WAVE-274#sh virtual-blade 1 virtual-blade 1 config: device cpu qemu32 device nic rtl8139 device disk IDE memory 512 disk 10 no boot fd-image boot cd-image disk /local1/vbs/lxserver.iso boot from disk interface 1 bridge GigabitEthernet 1/0 mac-address 00:16:3E:FF:FF:FF no autostart state: stopped

Backup

WAVE-274#copy virtual-blade 1 disk 1 ftp 192.168.200.5 / WAVE-274-LX.vb Enter username for remote ftp server: ftp Enter password for remote ftp server: 2460112570 bytes total WAVE-274#

Recovery

WAVE-274#copy ftp virtual-blade 1 disk 1 192.168.200.5 / WAVE-274-LX.vb This will delete the existing disk image. Are you sure you want to proceed? [no]:yes Enter username for remote ftp server: ftp Enter password for remote ftp server: Downloading 10GiB disk image 6314905600 bytes total

The Truth is out there

Einige Wahrheiten über Netzwerke;-)