Destination Unreachable

F5 BIG-IP - SNAT mini-lab

2012-01-24T19:02:00.001+11:00

Webserver IP 10.10.11.101 (I disabled all pool members apart from this one for this test)
F5's internal floating self-ip: 10.10.11.5
Hosts IP (VM on a PC so its VMNIC3's IP): 192.168.242.1

Using SNAT automap you should see the internal floating self-ip address of the F5 when you run a netstat on the webserver:

netstat --tcp --continuous -n

Notice the foreign address is the F5's internal floating self-ip of 10.10.11.5

Using no SNAT

netstat --tcp --continuous -n

I forgot I had snatted all vlans to 172.16.32.1. Looks like that worked too ;)

I'll turn that off... have to delete it actually...one sec...

Thats better...

192.168.242.1 is VMNET3 (aka my PC)

Job done ;)

F5 BIG-IP - Turn off your Healthchecks!

2012-01-24T18:06:00.004+11:00

Actually don't... But if you have a little lab going, and you are playing with NAT/SNAT, you might find that you are looking at the tcp connections on the server to confirm the source address the server is seeing, e.g. You should see the internal floating self ip of the F5 if you are auto-snatting for example. But when you run your netstat command you will see the self ip appear for lots of www and https connections even though you have turned off auto-snat..

So.... Turn off your healthchecks! I had 3, my_http, my_https and my_ssh on each associated pool. Once off, your netstat command output will be much clearer. I'm assuming there are many cooler and less crude ways to massage the output but I like this test becuase I can see the ports the F5 is using for healthchecks and I can see for myself which self-ip its using for its monitors.

Oh and Don't turn off your healthchecks! unless you are in a lab of course ;)

2012-01-16T09:56:00.000+11:00

Thanks vAaron for this! Even the Mayor of New York has made a New Years resolution to learn to program. Check-out this NY based service:

http://www.codecademy.com/

Google Python Class Day 1 Part 1 - Very Rough Notes

2012-01-15T20:17:00.001+11:00

Google Python Class Day 1 Part 1 - Very Rough Notes

Youtube Video

## Dir & Help (high tech way to get more info..)

import sys

dir(sys.argv)
help(sys.argv)
help(sys.exit)
help(len)

## And it turns out the easy way is to use Google ;)
-------------------------------
## REM
# As usual comment/rem works till the end of the line
-------------------------------
## " & '
## You can use either (note the \ if you want to use quotes inside quotes)
>>> a = 'hello'
>>> a = "hello"
>>> "I \"love\" this exercise"
'I "love" this exercise'
>>>
>>> a = "isn't"
>>> a
"isn't"
>>>
-------------------------------
## +
## Puts things together to make a bigger string
>>> a + ' yay!'
"isn't yay!"
>>>
-------------------------------
## To get a length of a string
>>> len(a)
5
>>>
-------------------------------
## To make lowercase run a method (in this case 'lower') on an object (in this case 'a')
>>> a = 'Hello'
>>> a.lower()
'hello'
## Or
>>> b = 'YAY!'
>>> b.lower()
'yay!'
>>>
## Note: The original string is unchanged (as below)
>>> b
'YAY!'
>>>
-------------------------------
## To look Inside of a string
>>> a[0]
'H'
>>> a[1]
'e'
>>> a[2]
'l'
>>> a[3]
'l'
>>> a[4]
'o'
>>> a[5]
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
IndexError: string index out of range
>>>
-------------------------------
## Format String - Another form of a + to put something together %s (% sign combined with something and substitue values to make bigger string, you could use the +)
>>> 'Hi %s I have %d donuts' % ('Nico', 42)
'Hi Nico I have 42 donuts'
>>>
-------------------------------
## Conventional Indexing into something
>>> a = "Hello"
>>> a[0]
'H'
>>> a[1]
'e'
>>> len(a)
5
>>>
-------------------------------
## Referring to sub-part of an element using the colon :
## Start at one and go up to but not including 3 (very pythonic feature.. in other words, using short crisp syntax to express what you want to do)
## aka a Slice (slice syntax)
>>> a[1:3]
'el'
>>>
>>>
>>> a[1:5]
'ello'
>>> a[1:4]
'ell'
>>> a[1:]
'ello'
>>> a[:]
'Hello'
>>>
Thid one is basically removing the first letter (as leaving blank displys the complete string)
>>> a[1:]
'ello'
>>>
## You can also use negative numbers

Figure 1 - Positive and Negative Numbering
H e l l o
0 1 2 3 4
-5 -4 -3 -2 -1

>>> a[-0:]
'Hello'
>>> a[-1:]
'o'
>>> a[-2:]
'lo'
>>> a[-3:]
'llo'
>>> a[-4:]
'ello'
>>> a[-5:]
'Hello'
>>>
This is the SAME AS
>>> a[-4:-2]
'el'
THIS
>>> a[1:3]
'el'
>>>

Answers for Google Python Class day 1

2012-01-15T19:57:00.002+11:00

Answers for Google Python Class day 1

$ cat string1.py
#!/usr/bin/python -tt
# Copyright 2010 Google Inc.
# Licensed under the Apache License, Version 2.0
# http://www.apache.org/licenses/LICENSE-2.0

# Google's Python Class
# http://code.google.com/edu/languages/google-python-class/

# Basic string exercises
# Fill in the code for the functions below. main() is already set up
# to call the functions with a few different inputs,
# printing 'OK' when each function is correct.
# The starter code for each function includes a 'return'
# which is just a placeholder for your code.
# It's ok if you do not complete all the functions, and there
# are some additional functions to try in string2.py.

# A. donuts
# Given an int count of a number of donuts, return a string
# of the form 'Number of donuts: <count>', where <count> is the number
# passed in. However, if the count is 10 or more, then use the word 'many'
# instead of the actual count.
# So donuts(5) returns 'Number of donuts: 5'
# and donuts(23) returns 'Number of donuts: many'
def donuts(count):
if(count >= 10):
    return 'Number of donuts: many'
return 'Number of donuts: %d' % (count)

# B. both_ends
# Given a string s, return a string made of the first 2
# and the last 2 chars of the original string,
# so 'spring' yields 'spng'. However, if the string length
# is less than 2, return instead the empty string.
def both_ends(s):
if(len(s) < 2):
    return ''
return s[0:2] + s[-2:]

# C. fix_start
# Given a string s, return a string
# where all occurences of its first char have
# been changed to '*', except do not change
# the first char itself.
# e.g. 'babble' yields 'ba**le'
# Assume that the string is length 1 or more.
# Hint: s.replace(stra, strb) returns a version of string s
# where all instances of stra have been replaced by strb.
def fix_start(s):
s = s
new = s[1:]
present = new.replace(s[0], '*')
final = s[0] + present
return final

# D. MixUp
# Given strings a and b, return a single string with a and b separated
# by a space '<a> <b>', except swap the first 2 chars of each string.
# e.g.
#   'mix', pod' -> 'pox mid'
#   'dog', 'dinner' -> 'dig donner'
# Assume a and b are length 2 or more.
def mix_up(a, b):
return b[:2] + a[2:] + ' ' + a[:2] + b[2:]

# Provided simple test() function used in main() to print
# what each function returns vs. what it's supposed to return.
def test(got, expected):
if got == expected:
    prefix = ' OK '
else:
    prefix = ' X '
print '%s got: %s expected: %s' % (prefix, repr(got), repr(expected))

# Provided main() calls the above functions with interesting inputs,
# using test() to check if each result is correct or not.
def main():
print 'donuts'
# Each line calls donuts, compares its result to the expected for that call.
test(donuts(4), 'Number of donuts: 4')
test(donuts(9), 'Number of donuts: 9')
test(donuts(10), 'Number of donuts: many')
test(donuts(99), 'Number of donuts: many')

print
print 'both_ends'
test(both_ends('spring'), 'spng')
test(both_ends('Hello'), 'Helo')
test(both_ends('a'), '')
test(both_ends('xyz'), 'xyyz')

print
print 'fix_start'
test(fix_start('babble'), 'ba**le')
test(fix_start('aardvark'), 'a*rdv*rk')
test(fix_start('google'), 'goo*le')
test(fix_start('donut'), 'donut')

print
print 'mix_up'
test(mix_up('mix', 'pod'), 'pox mid')
test(mix_up('dog', 'dinner'), 'dig donner')
test(mix_up('gnash', 'sport'), 'spash gnort')
test(mix_up('pezzy', 'firm'), 'fizzy perm')

# Standard boilerplate to call the main() function.
if __name__ == '__main__':
main()

Creating test HTTP and HTTPS web servers using Apache

2011-12-24T17:55:00.003+11:00

I’musing Ubuntu on VMWare for F5 BIG-IP LTM VE lab testing. The first section is a quick and easy way to get asimple HTTP web page working. Its definitely notbest practice.. The second section is to get HTTPS working for SSL testing:

Note: I’mgoing to use VMnet3 for my web hosts:

Ethernet adapter VMware Network AdapterVMnet3:

Connection-specific DNS Suffix .:

Link-local IPv6 Address . . . . . : fe80::a817:e023:3443:30d3%28

IPv4Address. . . . . . . . . . . : 192.168.242.1

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . :

To see if apache is already installed you can use the “which” command whichwill show the path of the program you're searching for:

nico@web1:~$ which apache2

/usr/sbin/apache2

Or you could search for the apache process:

nico@ubuntu:~$ pgrep apache

9002

9004

9005

9006

Or you could check if the package is actually installed (sooooomay ways, but that’s the joy of Linux!):

nico@ubuntu:~$ dpkg -l "apache*"

Desired=Unknown/Install/Remove/Purge/Hold

| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend

|/ Err?=(none)/Reinst-required(Status,Err: uppercase=bad)

||/ Name Version Description

+++-==============-==============-============================================

un apache (nodescription available)

un apache-common (nodescription available)

un apache-utils (nodescription available)

ii apache2 2.2.17-1ubuntu Apache HTTP Server metapackage

So if it’s notinstalled, install it with the below command (you will need Internet access):

nico@ubuntu:~$ sudo apt-get install apache2

Reading package lists... Done

Building dependency tree

Reading state information...Done

The following extra packageswill be installed:

apache2-mpm-worker apache2-utilsapache2.2-bin apache2.2-common libapr1

libaprutil1 libaprutil1-dbd-sqlite3libaprutil1-ldap

Suggested packages:

apache2-doc apache2-suexecapache2-suexec-custom

The following NEW packages willbe installed:

apache2 apache2-mpm-worker apache2-utilsapache2.2-bin apache2.2-common

libapr1 libaprutil1 libaprutil1-dbd-sqlite3libaprutil1-ldap

0 upgraded, 9 newly installed,0 to remove and 248 not upgraded.

Need to get 3,115 kB ofarchives.

After this operation, 10.5 MBof additional disk space will be used.

Do you want to continue [Y/n]? Y

* Starting web serverapache2 apache2: Could notreliably determine the server's fully qualified domain name, using 127.0.1.1for ServerName

[ OK ]

Setting up apache2(2.2.17-1ubuntu1.4) ...

Processing triggers forlibc-bin ...

ldconfig deferred processingnow taking place

nico@ubuntu:~$

Note the error message regarding the FQDN. Let’s fix that:

nico@ubuntu:~$ sudo gedit/etc/apache2/httpd.conf

When gedit opensup paste the following text in and save:

ServerName 192.168.242.129

Now run therestart command again and notice the error has gone:

nico@ubuntu:~sudo /etc/init.d/apache2 restart

* Restarting web server apache2 ... waiting [ OK ]

nico@ubuntu:~$

Now browse to the IP of the webserver (ifconfig if you don’t knowit), or you could browse to http://localhost/on the webserver itself.

You should see the “Itworks!” page

You can change this text to something unique so you can edit theindex.html that’s in /var/www/ (as below), but if you are going to configureSSL (see next post) then the index.html file location will change so itsprobably not worth changing this one:

nico@web1:~$ sudo gedit /var/www/index.html

<html><body><h1>WebServer 1 works!</h1>

<p>This is the defaultweb page for this server.</p>

</body></html>

If you wantto test HTTPS (SSL) then you will need to do the following:

Confirm youhave open ssl installed:

nico@web1:~$ which openssl

/usr/bin/openssl

nico@web1:~$

Create CertificateAuthorities and self-signed SSL certificates

Wecan create our own CA (Certificate Authority) and self-signed SSL server certificateswith openssl. Self-signing is the simpler route to take, but making our own CAallows the signing of multiple server certificates using the same CA and takesonly a couple extra steps. But we’ll justself-sign a server certificate:

Createa self-signed certificate (if you don’twant to make a CA)
First generate a server key

nico@web1:~$ sudo openssl genrsa -des3 -outserver.key 4096

Generating RSA private key, 4096 bit long modulus

.........................................................................................................................++

...................................................................................++

e is 65537 (0x10001)

Enter pass phrase for server.key:

Verifying - Enter pass phrase for server.key:

nico@web1:~$

Thenfollow the bouncing ball until it asks you for your "Common Name" andmake sure that it is the same fqdn of the server or its IP address. Don’t make a challenge password yet as it willmean more typing:

nico@web1:~$ sudoopenssl req -new -key server.key -out server.csr

Enter pass phrase for server.key:

Country Name (2 letter code) [AU]:AU

State or Province Name (full name)[Some-State]:Victoria

Locality Name (eg, city) []:Melbourne

Organization Name (eg, company) [Internet WidgitsPty Ltd]:nwten.net

Organizational Unit Name (eg, section) []:operations

Common Name (eg, YOUR name) []:192.168.242.129

Email Address []:info@nwten.net

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

nico@web1:~$

Tip: Thedefault values for the questions located at /etc/ssl/openssl.cnf
Nextwe need to sign the certificate signing request. In this case 365 days:

nico@web1:~$ sudoopenssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Signature ok

subject=/C=AU/ST=Victoria/L=Melbourne/O=nwten.net/OU=operations/CN=192.168.242.129/emailAddress=info@nwten.net

Getting Private key

Enter pass phrase for server.key:

nico@web1:~$

Nowmakea version of the server.key which doesn't require a password:

nico@web1:~$ sudoopenssl rsa -in server.key -out server.key.insecure

Enter pass phrase for server.key:

writing RSA key

nico@web1:~$

nico@web1:~$ sudomv server.key server.key.secure

nico@web1:~$ sudomv server.key.insecure server.key

Verify

nico@web1:~$ ls–la

-rw-r--r-- 1nico nico 2025 2011-12-23 01:11 server.crt

-rw-r--r-- 1nico nico 1760 2011-12-23 01:07 server.csr

-rw-r--r-- 1nico nico 3243 2011-12-23 01:13 server.key

-rw-r--r-- 1nico nico 3311 2011-12-23 01:01 server.key.secure

Create an SSL folder to store certificates andrelated files:

nico@web1:~$ sudo mkdir/etc/apache2/ssl

Then copy server.key and server.crt to the new new folder:

nico@web1:~$ sudocp server.key /etc/apache2/ssl

nico@web1:~$ sudocp server.crt /etc/apache2/ssl

Enable ssl

nico@web1:~$ sudoa2enmod ssl

Enabling module ssl.

See /usr/share/doc/apache2.2-common/README.Debian.gzon how to configure SSL and create self-signed certificates.

Run '/etc/init.d/apache2 restart' to activate newconfiguration!

nico@web1:~$

Restartapache

nico@web1:~$ sudo/etc/init.d/apache2 restart

* Restartingweb server apache2 .. waiting [ OK ]

If using an earlier Ubuntu version than10.04 we need to create a stub SSL conf. File to establish a necessary symlink:

nico@web1:~$ sudo cp/etc/apache2/sites-available/default /etc/apache2/sites-available/default-ssl

Next we need to establish a symlink fromthe 'available' default-ssl file to the 'enabled' file:

nico@web1:~$ sudo ln -s /etc/apache2/sites-available/default-ssl/etc/apache2/sites-enabled/000-default-ssl

Thedefault location for HTML pages is /var/www but we need to create a locationfor the ssl files:

nico@web1:/var$ cd /var/www

nico@web1:/var/www$ sudo mkdir html

nico@web1:/var/www$ cd /var

nico@web1:/var$ sudo mkdir www-ssl

nico@web1:/var$ cd www-ssl

nico@web1:/var/www-ssl$ sudo mkdir html

nico@web1:/var/www-ssl$

Nextwe need to configure HTTP over port 80 and HTTPS over 443 (and declare thedocument root folders and the fqdn):

ForHTTP, add the server name, IP or fqdn, in my case I simply used the IP, “192.168.242.129”, I also addedthe error log and custom log, and changed the DocumentRoot to /var/www/html. Lastly I changed the Directory (which Im not sure is necessaryyet):

nico@web1:~$ sudo gedit/etc/apache2/sites-available/default

ServerAdminwebmaster@localhost

ServerName192.168.242.129

ErrorLog /var/log/apache2/error.log

CustomLog /var/log/apache2/access.log combined

DocumentRoot/var/www/html/

OptionsFollowSymLinks

AllowOverrideNone

OptionsIndexes FollowSymLinks MultiViews

AllowOverrideNone

Orderallow,deny

allowfrom all

ForHTTPS, add the server name, IP or fqdn, again I used the IP, “192.168.242.129”, I also addedthe error log and custom log, and changed the DocumentRoot to /var/www/html. I changed the Directory(which Im not sure is necessary yet):

nico@web1:~$ sudocp /etc/apache2/sites-available/default/etc/apache2/sites-available/default-ssl

nico@web1:~$ sudo gedit/etc/apache2/sites-available/default-ssl

ServerAdminwebmaster@localhost

ServerName192.168.242.129

ErrorLog /var/log/apache2/error.log

CustomLog /var/log/apache2/access.log combined

DocumentRoot/var/www-ssl/html/

OptionsFollowSymLinks

AllowOverrideNone

OptionsIndexes FollowSymLinks MultiViews

AllowOverrideNone

Orderallow,deny

allowfrom all

Turn on the SSL engine by making sure the following is located in default-ssl file. The SSLengineshould be on, and the cert and key should be properly pathed:

ServerAdminwebmaster@localhost

ServerName192.168.242.129

SSLEngine On

SSLCertificateFile/etc/apache2/ssl/server.crt

SSLCertificateKeyFile/etc/apache2/ssl/server.key

~~Tell apache to listen to port 443:~~

~~Edit:/etc/apache2/ports.conf and add the line “Listen 443”~~

~~nico@web1:/var/www-ssl$ sudo gedit/etc/apache2/ports.conf~~

~~NameVirtualHost *:80~~

~~Listen 80~~

~~Listen 443~~

Note:I didn’t need to do the last step as 443 was defined in another part of thescript:

Listen 443

Restart apache:

nico@web1:/var/www-ssl$sudo /etc/init.d/apache2 restart

Restarting webserver apache2 ... waiting [OK ]

Nowcreate 2 index.html files, one for HTTP and one for HTTPS:

nico@ubuntu:/$ sudogedit /var/www/html/index.html

<html><body><h1>Web Server 1 works!</h1>

<p>This is the defaultweb page for this server.</p>

</body></html>

nico@ubuntu:/$ sudogedit /var/www-ssl/html/index.html

<html><body><h1>Web Server 1 SSLworks!</h1>

<p>This is the default web page for thisserver.</p>

</body></html>

Sothat’s it, now create 2 or 3 more of these web servers (within VMware and load balancethem with something like F5’s BIG-IP LTM VE. Makes for a nice load balancing lab ;)

Google's Python Class

2011-12-14T23:25:00.000+11:00

Google's Python Class is a free class for people with a little bit of programming experience who want to learn Python. The class includes written materials, lecture videos, and lots of code exercises to practice Python coding.

Google's Python Class

BPDU Guard, BPDU Filter, Root Guard, Loop Guard and UDLD

2011-12-04T22:02:00.001+11:00

BPDU Guard
A switch port with PortFast configured detects and shuts down the switch port if it detects an incoming BPDU frame

BPDU Filter
A switch port with PortFast configured detects and ignores the switch port if there is incoming BPDU frame to the switch port

Unlike BPDU Guard feature, BPDU Filter feature does not shutdown the switch port. However you may need to reset the switch ports (issue shut and no shut on the switch port) in order to "revive" the switch port condition after BPDU frame is received on such switch port.

Root Guard
A switch port configured with Root Guard will never become a Root Port. You might need this feature when the switch port should never become a Root Port, for example when a switch port connects to host or edge port, or possibly a switch port with low bandwidth.

Loop Guard and UDLD
As the name implies, Loop Guard feature sets the switch port to detect potential loop due to inactive UDLD.

More Info: Spanning-Tree Protocol Enhancements using Loop Guard and BPDU Skew Detection Features

More Info: Loop Guard versus UDLD

Pathcost Method Long

2011-12-04T21:55:00.001+11:00

If you are not using spanning-tree pathcost method long, the cost of most links in a data center is almost identical regardless of the available bandwidth along a given path:

1-Gbps link = 4
2- Gbps links = 3
3- Gbps links = 3
4- Gbps links = 3

Spanning tree was designed before the availability of Gigabit Ethernet and 10 Gigabit Ethernet. The default spanning-tree reference cost for a link is inadequate, as most links with 10 Gigabit Ethernet bandwidth or bandwidth with multiples of 10 Gigabit Ethernet will appear to have the same cost.

With spanning-tree pathcost method long enabled, spanning tree calculates the best forwarding path according to the link bandwidth to the root and not based on hop count. With this command, the cost of links is as follows (these numbers are weights so they don’t have a specific measurement unit):

One Gigabit Ethernet link = 20,000
Two Gigabit Ethernet links = 10,000
Three Gigabit Ethernet links = 6660
Four Gigabit Ethernet links = 5000

The cost with 10 Gigabit Ethernet links is as follows:

One 10 Gigabit Ethernet link = 20,000
Two 10 Gigabit Ethernet links = 10,000

sol3523: Choosing a unique Media Access Control (MAC) address for MAC masquerade

2011-12-03T22:17:00.001+11:00

Taken from sol3523: Choosing a unique Media Access Control (MAC) address for MAC masquerade

You can convert the pre-assigned MAC address to a locally administered MAC address by performing the following procedure:

Identify the pre-assigned MAC address.
Convert the first byte of the address to binary.
Change the second to last bit from 0 to 1.
Convert the binary value back to hexadecimal.
Replace the first byte of the original MAC address with the new hexadecimal value.

Note: A shorthand method to the same result is to add 02h to the first byte of the pre-assigned MAC address.
The following table illustrates the conversion for several addresses:

Pre-assigned MAC address	First byte	Local bit	Flipped local bit	New first byte	Locally administered MAC address
00:01:D7:01:02:03	00	00000000	00000010	02	02:01:D7:01:02:03
01:01:D7:01:02:03	01	00000001	00000011	03	03:01:D7:01:02:03
08:01:D7:01:02:03	08	00001000	00001010	0A	0A:01:D7:01:02:03

Note: Even similar MAC addresses will maintain their uniqueness if they are all converted to locally administered

F5 BIG-IP - Setting a shared MAC masquerade address

2011-12-03T21:02:00.001+11:00

Taken from BIG-IP 9.x Network and System Management Guide: Setting up a Redundant System

Setting a shared MAC masquerade address

For active/standby systems only, you can share the media access control (MAC) masquerade address between BIG-IP units. This feature is useful if you want to use the system in a topology with secure hubs. Sharing the MAC masquerade address between units has the following advantages:

Source: BIG-IP 9.x Network and System Management Guide: Setting up a Redundant System

sol7332: Gratuitous ARPs may be lost after a BIG-IP

2011-12-03T20:52:00.001+11:00

sol7332: Gratuitous ARPs may be lost after a BIG-IP LTM failover

F5 LTM Best Practices

2011-12-03T20:43:00.001+11:00

Nice DevCentral Thread "F5 LTM Best Practices"

Asymmetric Routing

2011-12-03T19:58:00.001+11:00

Asymmetrical routing happens when a packet takes a different return path than the path it took on the way to there. So as a simple example:

Host A sends a packet to Host B via Link 1...
But Host B sends the return packet to Host a via Link 2...

For normal data traffic this is usually not an issue but there are times when asymmetrical routing will cause issues. For example, if your traffic is flowing through a stateful-inspection firewall (such as CheckPoint) this routing behavior can cause issues.

Voice networks (VoIP) can also suffer where the total delay of the path is actually more important than the path it takes. If one of the paths is more conjested than the other then quality problems may arrise. Asymmetric routing can also cause jitter, one way audio and packet loss. There may be some used for asymmetrical routing in data networks but not on a voice network.

Also if you have a network that contains lots of asymmetrical routes then it is usually (or at least perceived to be) harder to understand the traffic flows and when necessary troubleshoot. But some peoples opinions is that routing symetery doesn't make much difference.

Note that traffic demands in any realistic IP network are very often asymmetric in volume, i.e. Host A sends to Host B more that B sends to A. But this is a natural asymmetry inherent to general purpose IP networks usage patterns.

Forced path symmetry, unless necessary due to stateful network devices such as firewalls, doesn't acheive much, but it can lead to suboptimalities in your network. Some say that routing symmetry per se is not a valid design goal, but optimal routing in terms of network utilization is.

It's generally inefficient to try and engineer artificial symmetry in a network, especially in networks which are larger. And in some cased its nearly impossible, even if it were desirable, but the general feeling is that it isn't..

F5 BI-IP iRule to Block traffic based on User-Agent

2011-11-29T08:34:00.001+11:00

On occasions you may find that you need to stop a bot(robot) from crawling your website, or maybe just part of your website. One way of doing this is the create an iRulewhich blocks traffic based on the User-Agent which the bot advertises itselfas. An example of the User-Agent fieldmight be “DodgyRobot”:

when HTTP_REQUEST {

if { [HTTP::header "User-Agent"] contains "DodgyRobot" } {

drop

return }

Note that the “contains” operator looks for a substring soas an example will actually catch:

"DodgyRobot/4.0" and"AnotherDodgyRobot/mozilla"

Next we need the iRule to search against a list ofUser-Agents that we stipulate. We dothis by defining a “class” or “datagroup” (both terms are synonymousin F5 speak)

You do this by using the GUI to create a "string"type datagroup named "userAgentsToBlock" that contains the list ofUser-Agents to block:

DodgyRobot

NicosCustomUserAgent

MoreStuffToBlock

SpoofedUserAgent

AngryUserAgent

So our iRule will now look like this:

when HTTP_REQUEST {

if { [matchclass [HTTP::header "User-Agent"] contains $::userAgentsToBlock ] } {

drop

return }

Lastly apply the iRule to the VIP (virtual server) in question and you're done!

Introduction to robots.txt

2011-11-28T14:39:00.001+11:00

This is a nice article from JavaScriptKid on the robots.txt file

There is a hidden, relentless force that permeates the web and its billions of web pages and files, unbeknownst to the majority of us sentient beings. I'm talking about search engine crawlers and robots here. Every day hundreds of them go out and scour the web, whether it's Google trying to index the entire web, or a spam bot collecting any email address it could find for less than honorable intentions. As site owners, what little control we have over what robots are allowed to do when they visit our sites exist in a magical little file called "robots.txt."

"Robots.txt" is a regular text file that through its name, has special meaning to the majority of "honorable" robots on the web. By defining a few rules in this text file, you can instruct robots to not crawl and index certain files, directories within your site, or at all. For example, you may not want Google to crawl the /images directory of your site, as it's both meaningless to you and a waste of your site's bandwidth. "Robots.txt" lets you tell Google just that.

http://www.javascriptkit.com/howto/robots.shtml

List of User-Agents (Spiders, Robots, Crawler, Browser)

2011-11-28T14:36:00.001+11:00

http://www.user-agents.org/

2011-11-28T14:16:00.001+11:00

Cisco WebClass helps you stay informed on the latest technical specifications, information and updates about Cisco technologies and solutions. We’ve added new features and sessions – all on demand for the first time. See each of the sections below for more detail.

Cisco WebClass On Demand

Nexus 1000v LACP Offloading

2011-11-21T19:47:00.001+11:00

You can offload operation of the LACP protocol from the VSM to the VEMs to prevent a situation where the VSM cannot negotiate LACP with the upstream switch when the VEM is disconnected from the VSM (referred to as headless mode).

VEM management of LACP allows LACP to re-establish port channels after the reboot of a headless VEM.

For more information, see the Cisco Nexus 1000V Interface Configuration Guide, Release 4.2(1)SV1(4).

LACP is traditionally a control plane protocol runon the supervisor of a switch (VSM on N1KV).
When VSM is down or disconnected the VEM operatesin Headless Mode, without the ability of LACP control plane operations.
LACP can be run on a single link between a VEM andthe upstream network.
LACP Offload solves this problem by offloading allLACP operations to the VEM.
This makes the data plane more robust and help inFCoE deployments where VSM is behind the VEM.

How to configure and Verify LACP Offload on Nexus 1000v

n1000v# config t
n1000v(config)# lacp offload

Please do a "copy running startup" to ensure the new setting takes effect on next reboot
LACP Offload Status can be verified using "show lacp offload status"
Change in LACP Offload Status takes effect only on the next VSM Reboot
This can potentially cause modules with LACP uplinks to flap

n1000v(config)# copy running-config startup-config
[###############################] 100%

n1000v(config)# reload
!!!WARNING! there is unsaved configuration!!!
This command will reboot the system. (y/n)? [n] y
2010 Sep 3 11:33:35 bl-n1000v %PLATFORM-2-PFM_SYSTEM_RESET: Manual system restart from Command Line Interface

This example shows how to return management of LACP to the VSM and then reload the switch for the change to take effect:

n1000v# config t
n1000v(config)# no lacp offload

Please do a "copy running startup" to ensure the new setting takes effect on next reboot

LACP Offload Status can be verified using "show lacp offload status"
Change in LACP Offload Status takes effect only on the next VSM Reboot
This can potentially cause modules with LACP uplinks to flap

n1000v(config)# copy running-config startup-config
[###############################] 100%

n1000v(config)# reload
!!!WARNING! there is unsaved configuration!!!
This command will reboot the system. (y/n)? [n] y
2010 Sep 3 11:33:35 bl-n1000v %PLATFORM-2-PFM_SYSTEM_RESET: Manual system restart from Command Line Interface

Verify Commands

show lacp offload
Displays the LACP offload status for verification.

show lacp port-channel [interface port-channel channel-number]
Displays information about LACP port channels.

show lacp interface ethernet slot/port
Displays information about specific LACP interfaces.

channel-group auto [mode {on | active | passive}] mac-pinning

Configures port channel mode (active and passive) used by LACP in the port
profile.

Source: Cisco L Commands

Ivan Pepelnjak's article below is a good read and a real world reason to use LACP Offloading:

Nexus 1000V LACP offload and the dangers ofin-band control

A nice Cisco Community article on the configuration: Nexus 1000V 1.4 LACP Offload White Paper

GNS3 Lab... In Progress...

2011-10-31T14:30:00.004+11:00

Don't know about you but I feel like I spend more time installing and configuraing GNS3/Dynamips than I do actually labbing Cisco.. Not the fault of the awesome software, more because I keep changing the topology! This time im writing it all down..

Versions: Im doing this lab on Windows 7 using GNS3 version 0.7.4

Firstly always start GNS3 as Administrator or things may not work right for you, also turn off your personal firewall, and turn on Manual Mode for adding Links or you'll wonder why your slots keep reverting to defaults (its a bug): Go to Edit > pref > General tab > GUI settings > put a check on "Always use manual mode when adding link"

Ok so ive added my manual links the way I want them, Ive put two between R1 and R2 so I can create a port-channel. R1 and R2 have a link each to the PIX and R3 is hanging off the back-end of it. Pretty simple so far..

Next, I've created vlan 100 in the vlan database which we will use for a port-channel between R1/R2:

!
R1#vlan database
R1(vlan)#vlan 100
VLAN 100 added:
Name: VLAN0100

And i've added some access ports into vlan 100:

!
interface FastEthernet0/5
description vlan_100_access
switchport access vlan 100
!
interface FastEthernet0/6
description vlan_100_access
switchport access vlan 100
!

Next configure a management interface for telenet access:

!
interface Vlan1
description Management-VLAN
ip address 10.10.10.1 255.255.255.0
!

Now to configure the EtherChannel between R1/R2:

Start by creating a logical channel (EtherChannel) interface and enable trunking on it:

!
interface Port-channel1
switchport mode trunk
!

Note: This port-channel will only come up after physical port has been assign to it. So next assign some oports to port-channel 1:

!
interface FastEthernet0/1
description LINK 1 to R2
switchport mode trunk
channel-group 1 mode on
!
interface FastEthernet0/2
description LINK 2 to R2
switchport mode trunk
channel-group 1 mode on
!

Verify Commands:

R1# show etherchannel 1 brief
Group state = L2
Ports: 2   Maxports = 8
Port-channels: 1 Max Port-channels = 1

R1# show etherchannel 1 detail
Group state = L2
Ports: 2   Maxports = 8
Port-channels: 1 Max Port-channels = 1
                Ports in the group:
                -------------------
Port: Fa0/1
------------

Port state    = Up Mstr In-Bndl
Channel group = 1           Mode = On/FEC     Gcchange = 0
Port-channel = Po1         GC   = 0x00010001    Pseudo port-channel = Po1
Port index    = 0
Age of the port in the current state: 00d:00h:09m:06s

Port: Fa0/2
------------

Port state    = Up Mstr In-Bndl
Channel group = 1           Mode = On/FEC     Gcchange = 0
Port-channel = Po1         GC   = 0x00010001    Pseudo port-channel = Po1
Port index    = 1
Age of the port in the current state: 00d:00h:08m:56s
                Port-channels in the group:

Port-channel: Po1
------------

Age of the Port-channel   = 00d:00h:47m:41s
Logical slot/port   = 8/0           Number of ports = 2
GC                  = 0x00010001      HotStandBy port = null
Port state          = Port-channel Ag-Inuse

Ports in the Port-channel:

Index   Port   EC state
------+------+------------
0     Fa0/1    on
1     Fa0/2    on

Time since last port bundled:    00d:00h:09m:42s    Fa0/2

R1# show interfaces port-channel 1
Port-channel1 is up, line protocol is up
Hardware is EtherChannel, address is cc04.108c.f001 (bia cc04.108c.f001)
MTU 1500 bytes, BW 200000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s
Members in this channel: Fa0/1 Fa0/2
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:11:48, output never, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 input packets with dribble condition detected
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 collisions, 3 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

R1# show interfaces port-channel 1 switchport
Name: Po1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Disabled
Access Mode VLAN: 0 ((Inactive))
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Trunking VLANs Active: 1,100
Priority for untagged frames: 0
Override vlan tag priority: FALSE
Voice VLAN: none
Appliance trust: none

R1# show interfaces port-channel 1 status
Port    Name               Status       Vlan       Duplex Speed Type
Po1                        connected    trunk      a-full   a-100 10/100BaseTX

R1# show interfaces port-channel 1 etherchannel
Age of the Port-channel   = 00d:00h:54m:50s
Logical slot/port   = 8/0           Number of ports = 2
GC                  = 0x00010001      HotStandBy port = null
Port state          = Port-channel Ag-Inuse

Ports in the Port-channel:

Index   Port   EC state
------+------+------------
0     Fa0/1    on
1     Fa0/2    on

Time since last port bundled:    00d:00h:16m:50s    Fa0/2

R1# show interfaces port-channel 1 trunk
Port      Mode         Encapsulation Status        Native vlan
Po1       on           802.1q         trunking      1

Port      Vlans allowed on trunk
Po1       1-1005

Port      Vlans allowed and active in management domain
Po1       1,100

Port      Vlans in spanning tree forwarding state and not pruned
Po1       1,100

Remember any commands issued in port-channel configuration mode apply to all links in the channel-group, for example:

R1(config)# int port-channel 1
R1(config-if)# shut
R1(config-if)#
*Mar 1 02:08:36.927: %EC-5-UNBUNDLE: Interface Fa0/1 left the port-channel Po1
*Mar 1 02:08:37.019: %EC-5-UNBUNDLE: Interface Fa0/2 left the port-channel Po1
*Mar 1 02:08:37.427: %DTP-5-NONTRUNKPORTON: Port Fa0/1-2 has become non-trunk
R1(config-if)#
*Mar 1 02:08:38.003: %LINEPROTO-5-UPDOWN: Line protocol on Interface Port-channel1, changed state to down
*Mar 1 02:08:38.003: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Mar 1 02:08:38.007: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan100, changed state to down
*Mar 1 02:08:38.855: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down
*Mar 1 02:08:38.931: %LINK-5-CHANGED: Interface FastEthernet0/2, changed state to administratively down
R1(config-if)#
*Mar 1 02:08:39.015: %LINK-5-CHANGED: Interface Port-channel1, changed state to administratively down
*Mar 1 02:08:39.855: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
*Mar 1 02:08:39.931: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down

R1(config-if)# do show ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES unset up                    down
FastEthernet0/1            unassigned      YES unset administratively down down
FastEthernet0/2            unassigned      YES unset administratively down down
FastEthernet0/3            unassigned      YES unset up                    down
FastEthernet0/4            unassigned      YES unset up                    down
FastEthernet0/5            unassigned      YES unset up                    down
FastEthernet0/6            unassigned      YES unset up                    down
FastEthernet0/7            unassigned      YES unset up                    down
FastEthernet0/8            unassigned      YES unset up                    down
FastEthernet0/9            unassigned      YES unset up                    down
FastEthernet0/10           unassigned      YES unset up                    down
FastEthernet0/11           unassigned      YES unset up                    down
FastEthernet0/12           unassigned      YES unset up                    down
FastEthernet0/13           unassigned      YES unset up                    down
FastEthernet0/14           unassigned      YES unset up                    down
FastEthernet0/15           192.168.1.100   YES NVRAM up                    up
Port-channel1              unassigned      YES unset administratively down down
Vlan1                      10.10.10.1      YES manual up                    down
Vlan100                    unassigned      YES manual up                    down
Loopback0                  1.1.1.1         YES NVRAM up                    up
R1(config-if)#

Now perform the same config on R2.. Here's my config's so far:

R1_1.0
R2_1.0

Time to get some external access to the 'real world'... This can be a pain in the ass, ive done this 3-4 times now in different labs and each time I had my MS loopback, routing, IP's configured differently.. So this one worked for me this time..

Run hdwwiz.exe from the Run prompt or Windows7 search box (or go via control panel, if you can...):

Then add a Network Adapter manually from the list and select Microsoft Loopback Adapter, then complete the wizard.

Now REBOOT!

Next configure the Loopback Adapter with an IP address and subnet mast (no need for a gateway), pick any IP address which you are not already using. This will be a unique subnet for this particular loopback. I choose 192.168.200.1 /24

My home LAN is 10.1.1.0 /24. Heres my ipconfig:

Now open up GNS3 and add a Cloud, then configure the cloud to use the loopback created earlier as its interface:

If you cant see the description of the loopback then you will need to run the 'Network device list.cmd' script located int he GNS3 program files folder and take a note of the last 4 digits so you can identify it when selecting it in GNS3.

You will see mine is 'Local Area Connection 3' and my last 4 digits are 38CA:

I noticed a little trick in GNS3, from the Cloud's 'Configure' window, if you highlight the 'Generic Ethernet NIO' dropdown box then you can use the arrow keys to scroll through the interfaces, you will notice the start of the loopback adapter description to the far right-hand side of the text "MS Lo..". This might work for you too so you wont need to run the script and note the identifier.

Next add a router, I chose a 3640, in slot 0 I configured a NM-1FE-TX to connect to the 'real world' via the cloud I just created. In slot 1 I configured a NM-16ESW (as we can change these ports into standard switchports if we desire).

As I mentioned earlier make sure Manual Mode is selected from preferences for adding links..

Now connect the cloud NIO interface to the router on f0/0 which is the routers NM-1FE-TX module and start up R1..

Login to R1 and configure f0/0 (which connects to the cloud) with an IP in the same subnet as the loopback adapter, I chose 192.168.200.254 /24

!
interface FastEthernet0/0
ip address 192.168.200.254 255.255.255.0
duplex auto
speed auto
no shutdown
!

Note: For the external access task I started with a fresh GNS3 lab, so see below config for how little config is in here so far, I only added an IP to interface f0/0, no default route or gateways. I'll fix the config up to how it was at the start fo this blog next so not to confuse..

R1_cloud_config_only

Some of the interfaces in the earlier configs will have changed because I noticed that when connecting to the real world via a loopback usinf an NM-1FE-TX worked for me and I struggled with the NM-16ESW. Hence why I suugested to use the NM-1FE-TX for conenction to the cloud.

So if all went well and your personal firewall is off you should be able to ping both ways from PC to R1 and R1 to your PC.

Here are the updated configs for R1 and R2:
R1_config_b
R2_config_b

Note: Im going over my wireless adapter, my LAN card is not in the mix.

So now I can telnet from myr PC to the GNS3 environment. But I cant get to the www just yet (to sync NTP and ping google for example).

On R2 I added a route so that 192.168.200.0 is reachable:

!

ip route 192.168.200.0 255.255.255.0 10.10.10.1

!

Now to add some authentication and SSH. Below is some config for an authentication test firstly without SSH:

!

aaa new-model

username admin password 0 cisco

line vty 0 871

transport input telnet

!

# Instead of aaa new-model, you can use the login local command.

Ok that worked, so now for the SSH config:

!

ip domain-name lab.nwten.net

!

crypto key generate rsa general-keys modulus 1024

!

ip ssh time-out 60

!

ip ssh authentication-retries 2

!

Optionally restrict access to the vty ports (i've allowed both):

!

line vty 0 871

transport input ssh telnet

!

Below i've ssh'd from my Cygwin terminal:

 ssh -l admin -c 3des 192.168.200.254

and using putty:

Next I've configured the PIX 525 with an inside and outside interface, ive ised the default security-levels of 0 for outside and 100 for inside. Ive named them inside and outside respectively:

!

interface Ethernet0

 speed 100

 duplex full

 nameif outside

 security-level 0

 ip address 192.168.1.100 255.255.255.0

!

interface Ethernet2

 speed 100

 duplex full

 nameif inside

 security-level 100

 ip address 192.168.3.100 255.255.255.0

!

I've also configured R3 with a basic config with connectivity to the PIX (FW1), and daisychained another switch off of R3 (named R4).

I wanted R3 to be able to ping R1 via FW1.

!

access-list 101 extended permit icmp any any

access-group 101 out interface outside 

!

access-list 102 extended permit icmp any any 

access-group 102 in interface outside 

!

Notice I created two rules for both directions, if I didnt do this I would have received this log messgae:

%PIX-3-106014: Deny inbound icmp src outside:192.168.1.1 dst inside:192.168.3.1 (type 0, code 0)
%PIX-3-106014: Deny inbound icmp src outside:192.168.1.1 dst inside:192.168.3.1 (type 0, code 0)

######

Note for later: When I turn on NAT I will be able to ping 192.168.1.1 but the outside will not be able to ping inside because now NAT is enabled I would be attempting access from a lower security interface to a higher, and unless there is an established session (translation) from the inside I wont be able to access the inside network. You'll get an error like this:

305005: No translation group found for icmp src outside:10.20.7.32 dst inside:172.20.103.15 (type 8, code 0)

One option is to use a network NAT:

static (inside,outside) 192.168.3.0 192.168.3.0 netmask 255.255.255.0

But a better solutuion would be to use NAT (0):

nat (inside) 0 192.168.3.0 255.255.255.0

This will keep the same inside IP address through the firewall to the outside interface.

######

Heres the PIX config so far: FW1_1.0

Default Route
Next I configured a default route so that all traffic sent to the PIX will flow to the next upstream router:

route outside 0 0 192.168.1.1

NAT
Now im going to use NAT to allow inside users to connect to the outside. I will use PAT or NAT Overload so that all inside devices can share one public IP address (the outside IP address of the PIX). When a single IP address is specified,the PIX automatically performs Port Address Translation (PAT). A warning messageindicating that the PIX will PAT all addresses is displayed on theconsole.
There should be enough global IP addresses to match the localIP addresses specified by the nat command. If there aren't, you canleverage the shortage of global addresses by PAT entry, which permits up to64,000 hosts to use a single IP address

global (outside) 1 192.168.1.101
nat (inside) 1 192.168.3.0 255.255.255.0

Now all inside clients are able to connect to devices on the public network and share IP address 192.168.1.101. Now I need to create rules to aloow them do so..

Firewall Rules
The clients on the inside will now have NAT translation, but that doesn't necessarily mean that they are allowed access. They now needrules to allow them to access the outside network. And those rules will also need to allow the return traffic to come back in (if necessary). I crearted a coupe of ACL's earlier, so some traffic (ICMP) is currently allowed.

Cisco Nexus 1000v MAC Pinning

2011-10-31T10:20:00.002+11:00

MAC Pinning is a new feature in the Cisco Nexus 1000v for provisioning port-channels used for uplinks. This feature has been released in version 4.0(4)SV1(2) which means that we don't have to configure any port-channels on the switches, we just need to configure the interfaces as trunks and allow the appropriate vlans.

There are two traditional ways to configure the sub-groups, this is based on CDP information or created manually. Obviously for the CDP option to work you will need CDP to be running on your upstream switches. So for example, CDP will say to VSM that these two links are from the same switch so therefore put them in a port-channel automatically. But if you dont have CDP enables then you can assign manual sub-groups by going into each interface and assigning a sub-group of 0 through to 31. So every device that has multiplke links connected will be the same sub-group ID.

In steps MAC Pinning, where each of your virtual interfaces are assigned to a sub-group automatically in a round-robin fasion. So every sub-group is going to be assigned to every uplink. So if I have 4 uplinks then I have 4 sub-group ID's.

Right now if a pinned interface goes offline and back online the other virtual interfaces wont re-pin to the recovered interface. But this behavior is getting fixed in an upcoming version.

This whole blogpost was regurgitated from “Understanding MAC Pinning with Nexus 1000V” by Robert Burns from Cisco TAC

Nice one Robbo
Commands:

Nexus1000V# module vem 3 execute vemcmd show port

  Nexus1000V# module vem 3 execute vemcmd show pinning

HTTP Recipes Test Site

2011-10-31T09:29:00.001+11:00

Very useful if you are playing with HTTP or cookies..

HTTP Recipes Test Site: http://www.httprecipes.com/1/

Set & Clear Coookies: http://www.httprecipes.com/1/2/cookies.php

Temporary e-mail address

2011-10-31T09:16:00.000+11:00

I've no idea why you would want one of these..

http://noclickemail.com/

Mythbusting Layer 2 Data Center Interconnect

2011-10-29T21:07:00.001+11:00

Ivan says "There are numerous reasons people give for the need for layer-2 data center interconnect. They are usually wrong.."

I really enjoyed this

Mythbusting Layer 2 Data Center Interconnect

F5 BIGIP Glossary

2011-10-28T10:02:00.001+11:00

active unit

In a redundant system, the active unit is the system that currently load balances connections. If the active unit in the redundant system fails, the standby unit assumes control and begins to load balance connections. See also redundant system.

archive

An archive is a backup copy of the BIG-IP system configuration data. This archive is in the form of a user configuration set, or UCS. See also user configuration set (UCS).

ARP (Address Resolution Protocol)

ARP is an industry-standard protocol that determines a host’s Media Access Control (MAC) address based on its IP address.

authentication

Authentication is the process of verifying a user’s identity when the user is attempting to log on to a system.

authentication iRule

An authentication iRule is a system-supplied or user-created iRule that is necessary for implementing a PAM authentication module on the LTM system. See also iRule, PAM (Pluggable Authentication Module).

authentication module

An authentication module is a PAM module that you create to perform authentication or authorization of client traffic. See also PAM (Pluggable Authentication Module).

authentication profile

An authentication profile is a configuration tool that you use to implement a PAM authentication module. Types of authentication modules that you can implement with an authentication profile are: LDAP, RADIUS, TACACS+, SSL Client Certificate LDAP, and OCSP. See also PAM (Pluggable Authentication Module).

authorization

Authorization is the process of identifying the level of access that a logged-on user has been granted to system resources.

bigtop

The bigtop utility is a statistical monitoring utility that ships on the BIG-IP system. This utility provides real-time statistical information.

BIND (Berkeley Internet Name Domain)

BIND is the most common implementation of the Domain Name System (DNS). BIND provides a system for matching domain names to IP addresses. For more information, refer to http://www.isc.org/products/BIND.

BPDU (bridge protocol data unit)

A BPDU is a special packet that a spanning tree protocol sends between layer 2 devices to determine redundant paths, and provide loop resolution. See also STP (Spanning Tree Protocol), RSTP (Rapid Spanning Tree Protocol), and MSTP (Multiple Spanning Tree Protocol).

bursting

Bursting is an aspect of rate shaping and occurs when the rate of traffic flow exceeds the base rate defined.

certificate

A certificate is an online credential signed by a trusted certificate authority and used for SSL network traffic as a method of authentication.

certificate authority (CA)

A certificate authority is an external, trusted organization that issues a signed digital certificate to a requesting computer system for use as a credential to obtain authentication for SSL network traffic.

certificate revocation list (CRL)

A certificate revocation list is a list that an authenticating system checks to see if the SSL certificate that the requesting system presents for authentication has been revoked.

certificate verification

Certificate verification is the part of an SSL handshake that verifies that a client’s SSL credentials have been signed by a trusted certificate authority.

chain

A chain is a series of filtering criteria used to restrict access to an IP address. The order of the criteria in the chain determines how the filter is applied, from the general criteria first, to the more detailed criteria at the end of the chain.

chunking

See HTTP chunking.

cipher

A cipher is an encryption/decryption algorithm that computer systems use when transmitting data using the SSL protocol.

client-side SSL profile

A client-side SSL profile is an SSL profile that controls the behavior of SSL traffic going from a client system to the LTM system.

clone pool

This feature causes a pool to replicate all traffic coming into it and send that traffic to a duplicate pool.

configuration object

A configuration object is a user-created object that the LTM system uses to implement a PAM authentication module. There is one type of configuration object for each type of authentication module that you create. See also PAM (Pluggable Authentication Module).

configuration synchronization

Configuration synchronization is the task of duplicating a BIG-IP system’s configuration data onto its peer unit in a redundant system.

Configuration utility

The Configuration utility is the browser-based application that you use to configure the LTM system.

connection persistence

Connection persistence is an optimization technique whereby a network connection is intentionally kept open for the purpose of reducing handshaking.

connection pooling

Connection pooling is an optimization feature that pools server-side connections for re-use by other client requests. Connection pooling reduces the number of new connections that must be opened for server-side client requests.

content switching

Content switching is the ability to select a pool based on data contained within a packet.

cookie persistence

Cookie persistence is a mode of persistence where the LTM system stores persistent connection information in a cookie.

custom profile

A custom profile is a profile that you create. A custom profile can inherit its default settings from a parent profile that you specify. See also parent profile.

data group

A data group is a group of related elements, such as a set of IP addresses for AOL clients. When you specify a data group along with the matchclass command or the contains operator, you eliminate the need to list multiple values as arguments in an iRule expression.

default profile

A default profile is a profile that the LTM system supplies with default setting values. You can use a default profile as is, or you can modify it. You can also specify it as a parent profile when you create a custom profile. You cannot create or delete a default profile. See also profile, custom profile.

default route

A default route is the route that the system uses when no other route specified in the routing table matches the destination address or network of the packet to be routed.

default VLAN

The LTM system is configured with two default VLANs, one for each interface. One default VLAN is named internal and one is named external. See also VLAN.

default wildcard virtual server

A default wildcard virtual server has an IP address and port number of 0.0.0.0:0. or *:* or “any”:”any”. This virtual server accepts all traffic that does not match any other virtual server defined in the configuration.

destination address affinity persistence

Also known as sticky persistence, destination address affinity persistence supports TCP and UDP protocols, and directs session requests to the same server based solely on the destination IP address of a packet.

domain name

A domain name is a unique name that is associated with one or more IP addresses. Domain names are used in URLs to identify particular Web pages. For example, in the URL http://www.siterequest.com/index.html, the domain name is siterequest.com.

Dynamic Ratio load balancing method

Dynamic Ratio mode is like Ratio mode (see Ratio method), except that ratio weights are based on continuous monitoring of the servers and are therefore continually changing. Dynamic Ratio load balancing can be implemented on RealNetworks^® RealServer platforms, on Microsoft^® Windows^® platforms equipped with Windows Management Instrumentation (WMI), or on a server equipped with either the UC Davis SNMP agent or Windows 2000 Server SNMP agent.

dynamic route

A dynamic route is a route that an advanced routing protocol such as RIP adds dynamically to a routing table. See also static route.

EAV (Extended Application Verification)

EAV is a health check that verifies an application on a node by running that application remotely. EAV health check is only one of the three types of health checks available on an LTM system. See also health check, health monitor, and external monitor.

ECV (Extended Content Verification)

ECV is a health check that allows you to determine if a node is up or down based on whether the node returns specific content. ECV health check is only one of the three types of health checks available on an LTM system. See also health check.

external authentication

External authentication refers to the process of using a remote server to store data for the purpose of authenticating users or applications attempting to access the LTM system.

external monitor

An external monitor is a user-supplied health monitor. See also, health check, health monitor.

external VLAN

The external VLAN is a default VLAN on the BIG-IP system. In a basic configuration, this VLAN has the administration ports locked down. In a normal configuration, this is typically a VLAN on which external clients request connections to internal servers.

failback

Failback is the process whereby an active unit relinquishes processing to a previously-failed unit that is now available.

failover

Fail-over is the process whereby a standby unit in a redundant system takes over when a software failure or a hardware failure is detected on the active unit.

failover cable

The fail-over cable directly connects the two units together in a redundant system.

Fastest method

Fastest mode is a load balancing method that passes a new connection based on the fastest response of all currently active nodes.

FDDI (Fiber Distributed Data Interface)

FDDI is a multi-mode protocol used for transmitting data on optical-fiber cables at speeds up to 100 Mbps.

floating self IP address

A floating self IP address is an additional self IP address for a VLAN that serves as a shared address by both units of a BIG-IP redundant system.

forwarding virtual server

A forwarding virtual server is a virtual server that has no pool members to load balance. The virtual server simply forwards the packet directly to the destination IP address specified in the client request. See also virtual server.

gateway pool

A gateway pool is a pool of routers that you can create to forward traffic. After creating a gateway pool, you can specify the pool as a gateway, within a TMM routing table entry.

hash persistence

Hash persistence allows you to create a persistence hash based on an existing iRule.

health check

A health check is an LTM system feature that determines whether a node is up or down. Health checks are implemented through health monitors. See also health monitor, ECV, EAV, and external monitor.

health monitor

A health monitor checks a node to see if it is up and functioning for a given service. If the node fails the check, it is marked down. Different monitors exist for checking different services. See also health check, EAV, ECV, and external monitor.

host virtual server

A host virtual server is a virtual server that represents a specific site, such as an Internet web site or an FTP site, and it load balances traffic targeted to content servers that are members of a pool.

HTTP chunking

HTTP chunking refers to the HTTP/ 1.1 feature known as chunked encoding, which allows HTTP messages to be broken up into several parts. Chunking is most often used by servers when sending responses.

HTTP redirect

An HTTP redirect sends an HTTP 302 Object Found message to clients. You can configure a pool with an HTTP redirect to send clients to another node or virtual server if the members of the pool are marked down.

HTTP transformation

When the LTM system performs an HTTP transformation, the system manipulates the Connection header of a server-side HTTP request, to ensure that the connection stays open. See also connection persistence.

ICMP (Internet Control Message Protocol)

ICMP is an Internet communications protocol used to determine information about routes to destination addresses.

i-mode

i-mode^® is a service created by NTT DoCoMo, Inc., that allows mobile phone users access to the Internet.

interface

The physical port on a BIG-IP system is called an interface.

internal VLAN

The internal VLAN is a default VLAN on the BIG-IP system. In a basic configuration, this VLAN has the administration ports open. In a normal configuration, this is a network interface that handles connections from internal servers.

IPSEC

IPSEC (Internet Security Protocol) is a communications protocol that provides security for the network layer of the Internet without imposing requirements on applications running above it.

iRule

An iRule is a user-written script that controls the behavior of a connection passing through the LTM system. iRules™ are an F5 Networks feature and are frequently used to direct certain connections to a non-default load balancing pool. However, iRules can perform other tasks, such as implementing secure network address translation and enabling session persistence.

iSNAT (intelligent SNAT)

An iSNAT is the mapping of one or more original client IP addresses to a translation address from within an iRule. Before writing an iRule to create an iSNAT, you must create a SNAT pool. See also SNAT pool.

JAR file

A JAR file is a file in Java^TM Archive (JAR) file format that enables you to bundle multiple files into a single archive file. Typically, a JAR file contains the class files and auxiliary resources associated with applets and applications.

JDBC

JDBC is a Java^TM technology. It is an application programming interface that provides database management system (DBMS) connectivity across a wide range of SQL databases, as well as access to other tabular data sources, such as spreadsheets or flat files.

Kilobytes/Second mode

The Kilobytes/Second mode is a dynamic load balancing mode that distributes connections based on which available server currently processes the fewest kilobytes per second.

Link Aggregation Control Protocol (LACP)

LACP is an industry-standard protocol that aggregates links in a trunk, to increase bandwidth and provide for link failover.

last hop

A last hop is the final hop a connection takes to get to the BIG-IP system. You can allow the BIG-IP system to determine the last hop automatically to send packets back to the device from which they originated. You can also specify the last hop manually by making it a member of a last hop pool.

layer 1 through layer 7

Layers 1 through 7 refer to the seven layers of the Open System Interconnection (OSI) model. Thus, layer 2 represents the data-link layer, layer 3 represents the IP layer, and layer 4 represents the transport layer (TCP and UDP). Layer 7 represents the application layer, handling traffic such as HTTP and SSL.

layer 2 forwarding table

A layer 2 forwarding table correlates MAC addresses of network devices to the BIG-IP system interfaces through which those devices are accessible. On a BIG-IP system, each VLAN has its own layer 2 forwarding table.

LDAP (Lightweight Directory Access Protocol)

LDAP is an Internet protocol that email programs use to look up contact information from a server.

LDAP authentication module

An LDAP authentication module is a user-created module that you implement on an LTM system to authenticate client traffic using a remote LDAP server.

LDAP client certificate SSL authentication module

An LDAP client certificate SSL authentication module is a user-created module that you implement on an LTM system to authorize client traffic using SSL client credentials and a remote LDAP server.

Least Connections method

Least Connections mode is a dynamic load balancing method that bases connection distribution on which server currently manages the fewest open connections.

link aggregation

Link aggregation is the process of combining multiple links in order to function as though it were a single link with higher bandwidth. Link aggregation occurs when you create a trunk. See also trunk and Link Aggregation Control Protocol (LACP).

load balancing method

A particular method of determining how to distribute connections across a load balancing pool.

load balancing pool

See pool.

load balancing virtual server

A load balancing virtual server is a virtual server that directs client traffic to a load balancing pool. This is the most basic type of virtual server. See also virtual server.

local traffic management (LTM)

Local traffic management (LTM) is the process of managing network traffic that comes into or goes out of a local area network (LAN), including an intranet.

loopback adapter

A loopback adapter is a software interface that is not associated with an actual network card. The nPath routing configuration requires you to configure loopback adapters on servers.

MAC (Media Access Control)

MAC is a protocol that defines the way workstations gain access to transmission media, and is most widely used in reference to LANs. For IEEE LANs, the MAC layer is the lower sublayer of the data link layer protocol.

MAC address

A MAC address is used to represent hardware devices on an Ethernet network.

management interface

The management interface is a special port on the BIG-IP system, used for managing administrative traffic. Named MGMT, the management interface does not forward user application traffic, such as traffic slated for load balancing. See also TMM switch interface.

management route

A management route is a route that forwards traffic through the special management (MGMT) interface.

MCPD service

The Master Control Program Daemon (MCPD) service manages the configuration data on a BIG-IP system.

MindTerm SSH

MindTerm SSH is the third-party application on 3-DNS Controllers that uses SSH for secure remote communications. SSH encrypts all network traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other network-level attacks. SSH also provides secure tunneling capabilities and a variety of authentication methods.

minimum active members

The minimum active members is the number of members that must be active in a priority group in order for the LTM system to send its requests to that group. If the number of active members falls below this number, requests are sent to the next highest priority group (the priority group with the next lowest priority number).

monitor

The LTM system uses monitors to determine whether nodes are up or down. There are several different types of monitors and they use various methods to determine the status of a server or service.

monitor association

A monitor association is an association that a user makes between a health or performance monitor and a pool, pool member, or node.

monitor instance

You create a monitor instance when a health monitor is associated with a pool member or node. It is the monitor instance that actually performs the health check, not the monitor.

monitor template

A monitor template is an internal mechanism that the LTM system uses to provide default values for a custom monitor when no pre-configured monitor exists.

MSRDP persistence

MSRDP persistence tracks sessions between clients and servers running the Microsoft^® Remote Desktop Protocol (RDP) service.

MSTP (Multiple Spanning Tree Protocol)

Defined by IEEE, MSTP is an enhanced spanning tree protocol. Unlike STP and RSTP, MSTP is VLAN-aware and therefore incorporates the concept of MSTP regions. See also STP (Spanning Tree Protocol) and RSTP (Rapid Spanning Tree Protocol).

MSTP region

An MSTP region is a group of layer 2 devices that have identical values for certain configuration settings. When devices constitute a region, the spanning tree algorithm takes VLANs into account when blocking and unblocking redundant paths.

name resolution

Name resolution is the process by which a name server matches a domain name request to an IP address, and sends the information to the client requesting the resolution.

NAT (Network Address Translation)

A NAT is an alias IP address that identifies a specific node managed by the LTM system to the external network.

network virtual server

A network virtual server is a virtual server whose IP address has no bits set in the host portion of the IP address (that is, the host portion of its IP address is 0). There are two kinds of network virtual servers: those that direct client traffic based on a range of destination IP addresses, and those that direct client traffic based on specific destination IP addresses that the LTM system does not recognize.

node

A node address is the IP address associated with one or more nodes. This IP address can be the real IP address of a network server, or it can be an alias IP address on a network server.

node alias

A node alias is a node address that the LTM system uses to verify the status of multiple nodes. When the LTM system uses a node alias to check node status, it pings the node alias. If the LTM system receives a response to the ping, it marks all nodes associated with the node alias as up. If the LTM system does not receive a response to the ping, it marks all nodes associated with the node alias as down.

node port

A node port is the port number or service name that is hosted by a specific node.

node status

Node status indicates whether a node is up and available to receive connections, or down and unavailable. The LTM system uses the node ping and health check features to determine node status.

Observed method

Observed mode is a dynamic load balancing method that bases connection distribution on a combination of two factors: the server that currently hosts the fewest connections and also has the fastest response time.

OCSP (Online Certificate Status Protocol)

OCSP is a protocol that authenticating systems can use to check on the revocation status of digitally-signed SSL certificates. The use of OCSP is an alternative to the use of a certificate revocation list (CRL). See also certificate revocation list (CRL).

OCSP authentication module

An OCSP authentication module is a user-created module that you implement on an LTM system to authenticate client traffic using a remote OCSP responder. The purpose of an OCSP authentication module is to check on the revocation status of a client SSL certificate.

OCSP responder

An OCSP responder is an external server used for communicating SSL certificate revocation status to an authentication server such as the LTM system.

OCSP responder object

A responder object is a software application on the LTM system that communicates with an OCSP responder, for the purpose of checking revocation status of a client or server SSL certificate.

OneConnect^TM

The F5 Networks OneConnect^TM feature optimizes the use of network connections by keeping server-side connections open and pooling them for re-use.

packet rate

The packet rate is the number of data packets per second processed by a server.

PAM (Pluggable Authentication Module)

A PAM module is a software module that a server application uses to authenticate client traffic. The modular design of a PAM module allows an organization to add, replace, or remove that authentication mechanism from a server application with minimal impact to that application. An example of a PAM module is an application that uses a remote Lightweight Directory Access Protocol (LDAP) server to authenticate client traffic. See also LDAP (Lightweight Directory Access Protocol).

parent profile

A parent profile is a profile that can propagate its values to another profile. A parent profile can be either a default profile or a custom profile. See also profile.

performance monitor

A performance monitor gathers statistics and checks the state of a target device.

persistence

See connection persistence or session persistence.

persistence profile

A persistence profile is a configuration tool for implementing a specific type of session persistence. An example of a persistence profile type is a cookie persistence profile.

pipelining

Pipelining is a feature of HTTP/1.1 that allows clients to make requests even when prior requests have not yet received a response from the server.

pool

A pool is composed of a group of network devices (called members). The LTM system load balances requests to the nodes within a pool based on the load balancing method and persistence method you choose when you create the pool or edit its properties.

pool member

A pool member is a server that is a member of a load balancing pool.

port

A port can be represented by a number that is associated with a specific service supported by a host. Refer to the Services and Port Index for a list of port numbers and corresponding services.

port mirroring

Port mirroring is a feature that allows you to copy traffic from any port or set of ports to a single, separate port where a sniffing device is attached.

port-specific wildcard virtual server

A port-specific wildcard virtual server is a wildcard virtual server that uses a port number other than 0. See wildcard virtual server.

pre-configured monitor

A pre-configured monitor is a system-supplied health or performance monitor. You can use a pre-configured monitor as is, but you cannot modify or delete one. See also monitor.

Predictive method

Predictive mode is a dynamic load balancing method that bases connection distribution on a combination of two factors: the server that currently hosts the fewest connections, and also has the fastest response time. Predictive method also ranks server performance over time, and passes connections to servers which exhibit an improvement in performance rather than a decline.

profile

A profile is a configuration tool containing settings for defining the behavior of network traffic. The LTM system contains profiles for managing FastL4, HTTP, TCP, FTP, SSL, and RTSP traffic, as well as for implementing persistence and application authentication.

profile setting

A profile setting is a configuration attribute within a profile that has a value associated with it. You can configure a profile setting to customize the way that the LTM system manages a type of traffic.

profile type

A profile type is a category of profile that you use for a specific purpose. An example of a profile type is an HTTP profile, which you configure to manage HTTP network traffic.

protocol profile

A protocol profile is a profile that you create for controlling the behavior of FastL4, TCP, UDP, OneConnect, and RTSP traffic.

Quality of Service (QoS) level

The Quality of Service (QoS) level is a means by which network equipment can identify and treat traffic differently based on an identifier. Essentially, the QoS level specified in a packet enforces a throughput policy for that packet.

RADIUS (Remote Authentication Dial-in User Service)

RADIUS is a service that performs remote user authentication and accounting. Its primary use is for Internet Service Providers, though it can also be used on any network that needs a centralized authentication and/or accounting service for its workstations.

RADIUS authentication module

A RADIUS authentication module is a user-created module that you implement on an LTM system to authenticate client traffic using a remote RADIUS server.

RAM cache

A RAM cache is a cache of HTTP objects stored in the BIG-IP system’s RAM that subsequent connections reuse to reduce the amount of load on the back-end servers.

rate class

You create a rate filter from the Configuration utility or command line utility. When you assign a rate class to a rate filter, a rate class determines the volume of traffic allowed through a rate filter. See also rate shaping.

rate shaping

Rate shaping is a type of extended IP filter. Rate shaping uses the same IP filter method but applies a rate class, which determines the volume of network traffic allowed. See also rate class.

ratio

A ratio is a parameter that assigns a weight to a virtual server for load balancing purposes.

Ratio method

The Ratio load balancing method distributes connections across an array of virtual servers in proportion to the ratio weights assigned to each individual virtual server.

Real-Time Stream Protocol (RTSP)

See RTSP.

receive expression

A receive expression is the text string that the LTM system looks for in the web page returned by a web server during an extended content verification (ECV) health check.

redundant system

Redundant system refers to a pair of units that are configured for fail-over. In a redundant system, there are two units, one running as the active unit and one running as the standby unit. If the active unit fails, the standby unit takes over and manages connection requests.

referenence link

A reference link is the lowest-numbered interface in a trunk and is used for link aggregation.

remote administrative IP address

A remote administrative IP address is an IP address from which a BIG-IP system allows shell connections, such as Telnet or SSH.

responder object

See OCSP responder object.

RFC 1918 addresses

An RFC 1918 address is an address that is within the range of non-routable addresses described in the IETF RFC 1918.

Round Robin mode

Round Robin mode is a static load balancing mode that bases connection distribution on a set server order. Round Robin mode sends a connection request to the next available server in the order.

router

A router is a layer 3 networking device. If no VLANs are defined on the network, a router defines a broadcast domain.

RSTP (Rapid Spanning Tree Protocol)

Defined by IEEE, RSTP is an enhanced version of STP (Spanning Tree Protocol). RSTP provides faster spanning tree performance compared to STP. See also STP (Spanning Tree Protocol) and MSTP (Multiple Spanning Tree Protocol).

RTSP

RTSP (Real-Time Streaming Protocol) establishes and controls one or more time-synchronized streams of continuous media such as audio or video.

secure network address translation (SNAT)

See SNAT (secure network address translation). See also iSNAT.

self IP address

Self IP addresses are the IP addresses owned by the BIG-IP system that you use to access the internal and external VLANs.

send string

A send string is the request that the LTM system sends to the web server during an extended content verification (ECV) health check.

server-side SSL profile

A server-side SSL profile is an SSL profile that controls SSL traffic going between an LTM system and a destination server system.

service

Service refers to services such as TCP, UDP, HTTP, and FTP.

services profile

A services profile is a configuration tool on the LTM system for managing either HTTP or FTP network traffic.

session persistence

A series of related connections received from the same client, having the same session ID. When persistence is enabled, an LTM system sends all connections having the same session ID to the same node, instead of load balancing the connections. Session persistence is not to be confused with connection persistence.

Setup utility

The Setup utility walks you through the initial system configuration process. You can run the Setup utility from the Configuration utility start page.

simple persistence

See source address affinity persistence.

SIP persistence

SIP persistence is a type of persistence used for servers that receive Session Initiation Protocol (SIP) messages sent through UDP. SIP is a protocol that enables real-time messaging, voice, data, and video.

SNAT (Secure Network Address Translation)

A SNAT is a feature you can configure on the LTM system. A SNAT defines a routable alias IP address that one or more nodes can use as a source IP address when making connections to hosts on the external network. See also Standard SNAT and iSNAT.

SNAT pool

A SNAT pool is a pool of translation addresses that you can map to one or more original IP addresses. Translation addresses in a SNAT pool are not self-IP addresses.

SNMP (Simple Network Management Protocol)

SNMP is the Internet standard protocol, defined in STD 15, RFC 1157, developed to manage nodes on an IP network.

source address affinity persistence

Also known as simple persistence, source address affinity persistence supports TCP and UDP protocols, and directs session requests to the same server based solely on the source IP address of a packet.

source processing

Source processing means that the interface rewrites the source of an incoming packet.

spanning tree

A spanning tree is a logical tree structure of layer 2 devices on a network, created by a spanning tree protocol algorithm and used for resolving network loops.

spanning tree instance

A spanning tree instance is a specific, named spanning tree that a spanning tree protocol creates. See also spanning tree protocols.

spanning tree protocols

Spanning tree protocols are the IEEE-specified set of protocols known as Spanning Tree Protocol (STP), Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Tree Protocol (MSTP). The BIG-IP system includes support for all of these protocols. See also STP (Spanning Tree Protocol), RSTP (Rapid Spanning Tree Protocol), and MSTP (Multiple Spanning Tree Protocol).

SSH

SSH is a protocol for secure remote login and other secure network services over a non-secure network.

SSL (Secure Sockets Layer)

SSL is a network communications protocol that uses public-key technology as a way to transmit data in a secure manner.

SSL persistence

SSL persistence is a type of persistence that tracks non-terminated SSL sessions, using the SSL session ID.

SSL profile

An SSL profile is a configuration tool that you use to terminate and initiate SSL connections from clients and servers.

standard SNAT

A standard SNAT is a SNAT that you implement by using the SNAT screens of the Configuration utility. See also SNAT and iSNAT.

standby unit

A standby unit in a redundant system is a unit that is always prepared to become the active unit if the active unit fails.

state mirroring

State mirroring is a feature on the LTM system that preserves connection and persistence information in a redundant system.

static route

A static route is a route that you must explicitly configure on a layer 3 device in its routing table. See also dynamic route.

static self IP address

A static self IP address is a self IP address that is not shared between two units of a redundant system.

sticky persistence

See destination address affinity persistence.

STP (Spanning Tree Protocol)

Defined by IEEE, STP is a protocol that provides loop resolution in configurations where one or more external switches are connected in parallel with the BIG-IP system. See also RSTP (Rapid Spanning Tree Protocol) and MSTP (Multiple Spanning Tree Protocol).

subdomain

A subdomain is a sub-section of a higher level domain. For example, .com is a high level domain, and F5.com is a subdomain within the .com domain.

TACACS (Terminal Access Controller Access Control System)

TACACS is an older authentication protocol common to UNIX systems. TACACS allows a remote access server to forward a user’s login password to an authentication server.

TACACS+

TACACS+ is an authentication mechanism designed as a replacement for the older TACACS protocol. There is little similarity between the two protocols, however, and they are therefore not compatible.

TACACS+ authentication module

A TACACS+ authentication module is a user-created module that you implement on an LTM system to authenticate client traffic using a remote TACACS+ server.

tagged interface

A tagged interface is an interface that you assign to a VLAN in a way that causes the system to add a VLAN tag into the header of any frame passing through that interface. Tagged interfaces are used when you want to assign a single interface to multiple VLANs. See also VLAN (virtual local area network).

Tcl

Tcl (Tools Command Language) is an industry-standard scripting language. On the LTM system, users use Tcl to write iRules^TM.

TMM (Traffic Management Microkernel) service

The TMM service is the process running on the BIG-IP system that performs most traffic management for the product.

TMM switch interface

A TMM switch interface is an interface that the BIG-IP system uses to forward user application traffic such as HTTP or SSL traffic. Thus, when load balancing application traffic, the BIG-IP system uses TMM switch interfaces. See also management interface.

TMM switch route

A Traffic Management Microkernel (TMM) switch route is a route that forwards traffic through the TMM switch interfaces and not the management interface.

transparent node

A transparent node appears as a router to other network devices, including the BIG-IP system.

trunk

A trunk is a combination of two or more interfaces and cables configured as one link.

trusted CA file

A trusted CA file is a file containing a list of certificate authorities that an authenticating system can trust when processing client requests for authentication. A trusted CA file resides on the authenticating system and is used for authenticating SSL network traffic.

Type of Service (ToS) level

The Type of Service (ToS) level is another means, in addition to the Quality of Service (QoS) level, by which network equipment can identify and treat traffic differently based on an identifier.

Universal Inspection Engine (UIE)

The Universal Inspection Engine (UIE) is a feature that offers universal persistence and universal content switching, to enhance your load balancing capabilities. The UIE contains a set of rule variables and functions for building expressions that you can specify in pool definitions and rules.

universal persistence

Universal persistence gives you the ability to persist on any string found within a packet. Also, you can directly select the pool member to which you want to persist.

user configuration set (UCS)

A user configuration set is a backup file that you create for the BIG-IP system configuration data. When you create a UCS, the BIG-IP system assigns a .ucs extension to the filename. See also archive.

user role

A user role is a type and level of access that you assign to a BIG-IP system user account. By assigning user roles, you can control the extent to which BIG-IP system administrators can view or modify the BIG-IP system configuration.

virtual address

A virtual address is an IP address associated with one or more virtual servers managed by the LTM system.

virtual port

A virtual port is the port number or service name associated with one or more virtual servers managed by the LTM system. A virtual port number should be the same TCP or UDP port number to which client programs expect to connect.

virtual server

Virtual servers are a specific combination of virtual address and virtual port, associated with a content site that is managed by an LTM system or other type of host server.

VLAN (virtual local area network)

A VLAN is a logical grouping of interfaces connected to network devices. You can use a VLAN to logically group devices that are on different network segments. Devices within a VLAN use layer 2 networking to communicate and define a broadcast domain.

VLAN group

A VLAN group is two or more VLANs that you put together into a VLAN group. A primary use of a VLAN group is to successfully route traffic when both the source and the destination hosts reside on the same network.

VLAN name

A VLAN name is the symbolic name used to identify a VLAN. For example, you might configure a VLAN named marketing, or a VLAN named development. See also VLAN (virtual local area network).

VLAN tag

An IEEE standard, a VLAN tag is an identification number inserted into the header of a frame that indicates the VLAN to which the destination device belongs. VLAN tags are used when a single interface forwards traffic for multiple VLANs.

WAP (Wireless Application Protocol)

WAP is an application environment and set of communication protocols for wireless devices designed to enable manufacturer-, vendor-, and technology-independent access to the Internet and advanced telephony services.

watchdog timer card

A watchdog timer card is a hardware device that monitors the BIG-IP system for hardware failure.

wildcard virtual server

A wildcard virtual server is a virtual server that uses an IP address of 0.0.0.0, * or “any”. A wildcard virtual server accepts connection requests for destinations outside of the local network. Wildcard virtual servers are included only in Transparent Node Mode configurations.

WKS (well-known services)

Well-known services are protocols on ports 0 through 1023 that are widely used for certain types of data. Some examples of some well-known services (and their corresponding ports) are: HTTP (port 80), HTTPS (port 443), and FTP (port 20).

Vyatta Networking Solutions

2011-10-27T20:17:00.001+11:00

Below is a quick overview of the Vyatta networking solutions. From virtual to software, Vyatta is the world's only platform independent network operating system. If you are connecting and protecting virtual datacenters, private or public cloud computing environments or traditional physical networks, Vyatta can meet the demands of the growing enterprise with unmatched price, performance, and flexibility for connecting and securing your business.

Vyatta Virtual Machines

Vyatta Virtual Machines
Vyatta Subscription Edition for network virtualization is designed for users requireing complete routing and network security functionality to VMware, Xen/XenServer, and KVM virtual or cloud computing environments.

Vyatta Appliances:

Vyatta Appliances
Vyatta appliances integrate Vyatta Network OS with high-performance, modular designs that employ standard x86 based multicore processors to support Vyatta’s advanced routing and security functionality.

Vyatta Software :

Subscription Edition Software
Build custom routing and security solutions using standard x86-based hardware and/or Virtual Machines - scales from small LAN to large WAN edge.

Upgrading Nexus 1000v

2011-10-25T21:21:00.002+11:00

Notes on upgrading to v1.4 aka 4.2(1)SV1(4)

Upgrade VEM then the VSM. So there is no disruption.
Disable HA on ESX clusters with Fault Tolerance and Distributed Power Management
Must use ESX or ESXi 4.0 update 1 minimum.
Pre-Upgrade utility to avoid known issues (on windows or linux). Performs 9 checks like port-profile limits etc. Its a TCL type execution. Its located in the /upgrade folder in the package.
Use the Upgrade Application availanble only in 4.0(4)SV1(3) or later, simplifies the many steps to upgrade, higher sucess rate than with the manual upgrade.
Only use the manual upgrade if the App cant be used as there are more steps and its not as clean to manage the upgrade flow.
When upgrading an N1010 start by making the secondary VSM the active (by switchover).
Note the Upgrade Path between versions from Cisco website. You will need to do both the VEM and VSM in versious orders depending on your current code version (for non-distruptive upgrades).

Upgrade the VEM First
1) Download Image from CCO and Unzip it (vem.tar)
2) copy it to FTP or SCP to VSM Bootflash
3) Notify vCentre and update bundle repository: vmware vem upgrade update-vibs bootflash:vem-release_final.tar.gz
4) Check Status: show vmware vem upgrade status
5) Notify vCentre Server and Server Admin: vmware vem upgrade notify
6) Server admin will see notification under networking summary tab in vcentre and she will need to accept this upgrade
7) On the VSM run the proceed command (if using VUM it will automatically update all hosts and DRS migrates VM's off to available servers, put the server in maintenance mode, and upgrades the VEM) : vmware vem upgrade proceed
8) Last step, execute: vmware vem upgrade complete (this will upgrade the VEM's)

Upgrade the VSM (using the Upgrade Application)
1) Go to VSM's IP address to Home and select Launch Upgrade Application. Only visible after at least 1 VEM is upgraded
2) Prompt for appropriate additional IP addresses, based on the 'show svs domain'
3) Select new system/kickstart image
4) verify summary
5) start the upgrade
6) Standby VSM is reloaded and prompt is shown (show mod). Here make sure all the VEM are connected to both VSM's
7) select proceed
8) Restore VSM IP config (by overwriting the current config with the saved config file)

Cisco Nexus 1000V Software Upgrade Guide
Cisco N1000v Installation Screencasts
Brighttalk Webcasts
Nexus 1000V Portfolio: Spring '11 Public Webinar Series

Nexux 1000v New Features

2011-10-25T21:09:00.003+11:00

New features in v1.4 a.k.a. 4.2(1)SV1(4
vPath
Network State Tracking (NST)
LACP Offlload (VEM processes its own PDU's). Commands to enable are: 'feature lacp' & 'lacp offload'
Class-Based Weighted Fair-Queuing
Policy Based ERSPAN
Restrict Port Profile Visibility in vSentre Server (or port group in VM speak)
Hardware iSCSI multipathing (NIC based iSCSI multipathing)
Ephermeral Port Binding - for connecting to vCloud Director and VDI deployments (or anywhere that requires the dynamic allocation and reallocation of the port ID on a VDF). The port is set and released upon VM power on/off.

Scalability
64 VEMs per VSM
2048 VLANS for VSM
2048 port profiles per VSM - good for cloud or large scale deployment
4000 MAC addresses per VLAN
16,000 Mac Addressess per VEM - each host (ESX server) can have 16k mac addresses

How Does Cisco Load Balancing Work?

2011-10-25T08:35:00.000+11:00

Load balancing is a standard functionality of the Cisco IOS router software, and is available across all platforms. It is automatically activated if the routing table has multiple paths to a destination and is based on standard routing protocols, such as RIP, RIPv2, EIGRP, OSPF and IGRP. It is also derived from statically configured routes and packet forwarding mechanisms and allows a router to use multiple paths to a destination when forwarding packets.

Load Balancing

When a router learns multiple routes to a specific network via multiple routing processes (or routing protocols), it installs the route with the lowest administrative distance in the routing table.

See: Route Selection in Cisco Routers

Sometimes the router must select a route from many learned via the same routing process with the same administrative distance. In this case, the router chooses the path with the lowest cost (or metric) to the destination.

Each routing process calculates its cost differently and the costs may need to be manipulated in order to achieve load-balancing.

If the router receives and installs multiple paths with the same administrative distance and cost to a destination, load-balancing can occur.

The number of paths used is limited by the number of entries the routing protocol puts in the routing table. Four entries is the default in IOS for most IP routing protocols with the exception of Border Gateway Protocol (BGP), where one entry is the default. Six different paths configured is the maximum number.

The IGRP and EIGRP routing processes also support unequal cost load-balancing. You can use the variance command with IGRP and EIGRP to accomplish unequal cost load-balancing. Issue the maximum-paths command in order to determine the number of routes that can be installed based on the value configured for the protocol. If you set the routing table to one entry, it disables load balancing.

See: How Does Unequal Cost Path Load-Balancing (Variance) Work in IGRP and EIGRP?

You can usually use the show ip route command to find equal cost routes. For example, below is the show ip route command output to a particular subnet that has multiple routes. Notice there are two routing descriptor blocks. Each block is one route. There is also an asterisk (*) next to one of the block entries. This corresponds to the active route that is used for new traffic. The term 'new traffic' corresponds to a single packet or an entire flow to a destination, depending on the type of switching configured.

For process-switching—load balancing is on a per-packet basis and the asterisk (*) points to the interface over which the next packet is sent.

For fast-switching—load balancing is on a per-destination basis and the asterisk (*) points to the interface over which the next destination-based flow is sent.

The position of the asterisk (*) keeps rotating among the equal cost paths each time a packet/flow is served.

Per-Destination and Per-Packet Load Balancing

You can set load-balancing to work per-destination or per-packet. Per-destination load balancing means the router distributes the packets based on the destination address. Given two paths to the same network, all packets for destination1 on that network go over the first path, all packets for destination2 on that network go over the second path, and so on. This preserves packet order, with potential unequal usage of the links. If one host receives the majority of the traffic all packets use one link, which leaves bandwidth on other links unused. A larger number of destination addresses leads to more equally used links. To achieve more equally used links use IOS software to build a route-cache entry for every destination address, instead of every destination network, as is the case when only a single path exists. Therefore traffic for different hosts on the same destination network can use different paths. The downside of this approach is that for core backbone routers carrying traffic for thousands of destination hosts, memory and processing requirements for maintaining the cache become very demanding.

Per-packet load-balancing means that the router sends one packet for destination1 over the first path, the second packet for (the same) destination1 over the second path, and so on. Per-packet load balancing guarantees equal load across all links. However, there is potential that the packets may arrive out of order at the destination because differential delay may exist within the network. In Cisco IOS software, except the release 11.1CC, per packet load balancing does disable the forwarding acceleration by a route cache, because the route cache information includes the outgoing interface. For per-packet load balancing, the forwarding process determines the outgoing interface for each packet by looking up the route table and picking the least used interface. This ensures equal utilization of the links, but is a processor intensive task and impacts the overall forwarding performance. This form of per-packet load balancing is not well suited for higher speed interfaces.

Per-destination or per-packet load-balancing depends on the type of switching scheme used for IP packets. By default, on most Cisco routers, fast switching is enabled under interfaces. This is a demand caching scheme that does per-destination load-balancing. To set per-packet load-balancing, enable process switching (or disable fast switching), use these commands:

Now the router CPU looks at every single packet and load balances on the number of routes in the routing table for the destination. This can crash a low-end router because the CPU must do all the processing. To re-enable fast switching, use these commands:

Newer switching schemes such as Cisco Express Forwarding (CEF) allow you to do per-packet and per-destination load-balancing more quickly. However, it does imply that you have the extra resources to deal with maintaining CEF entries and adjacencies.

When you work with CEF, you could ask: Who does the load balancing, CEF or the routing protocol used? The way in which CEF works is that CEF does the switching of the packet based on the routing table which is being populated by the routing protocols such as EIGRP. In short, CEF performs the load-balancing once the routing protocol table is calculated.

Refer to Troubleshooting Load Balancing Over Parallel Links Using Cisco Express Forwarding and Load Balancing with CEF for more information about CEF load balancing.

These documents provide more information about how various protocols select a best path, calculate their costs to specific destinations, and how they perform load-balancing when applied.

Introduction to RIP
IGRP Metric - Example and Explanation
Setting a Preferred Route by Influencing EIGRP Metrics
OSPF Cost
BGP Path Selection Algorithm

This document explains how to use BGP multipath. BGP multipath allows multiple BGP paths to the same destination to be installed in the IP routing table together with the best path for load-sharing.

MLP Bundling section of Configuring an ADSL WAN Interface Card on Cisco 1700 Series Routers

Reference: How Does Load Balancing Work?

Interesting Thread: OSPF Load Balancing Across Equal Cost Path

Quick Tip: Check ISO's MD5 in Cygwin

2011-10-17T20:47:00.002+11:00

Copy the.iso to a folder within your cygwin directory, for example C:\cygwin\tmp

From aCygwin terminal use the md5sum command and type in the filename (and locationif you are not in the context)

md5sum/tmp/vyatta-livecd-virt_VC6.3-2011.07.21_i386.iso

The result will besomething similar to this:

7cba5ccd3e1facb0e8b596dfd340a483*/tmp/vyatta-livecd_VC6.3

If MD5 hash is stored in the file youcan verify the MD5sum with the below:

md5sum -c /tmp/vyatta-livecd-virt_VC6.3-2011.07.21_i386.iso.md5

Dont forget to diff theresults! Dont forget to diff the results!

Splunk Resources

2011-10-13T09:12:00.002+11:00

Splunk... there can be only one

splunk>docs
splunk>tutorial
splunk>base
search>examples
search>cheatsheet
send>email

Expect script "troubleshooting snapshots using host list"

2011-10-09T19:33:00.002+11:00

#!/usr/bin/expect

# This script executes Cisco troubleshooting snapshot commands using a host list

set timeout 20

set hostlist "10.1.1.254 10.1.1.253"
foreach host $hostlist {
spawn telnet $host
expect "Username:"
send "nico\r"
expect "Password:"
send "cisco\r"
expect "1841-rtr>"
send "enable\r"
expect "Password:"
send "secret\r"
set time [exec date \+\%y\%m\%dT\%H\%M]
set filename [append host "_" $time]
log_file /bin/$filename
send "term length 0\r"
send "!\r"
send "clear arp\r"
send "!\r"
send "show spanning-tree\r"
send "!\r"
send "show proc cpu sorted | ex 0.0\r"
send "!\r"
send "show proc history\r"
send "!\r"
send "show log\r"
send "!\r"
send "show tech\r"
send "!\r"
send "exit\r"
expect eof
}

Cisco Timezones 2011

2011-10-09T19:00:00.001+11:00

australia.gov.au

Australian Eastern Standard Time (AEST)

Covers the eastern states of Queensland, New South Wales (with the exception of the town of Broken Hill), Victoria, Tasmania and the Australian Capital Territory.
AEST is equal to Coordinated Universal Time plus 10 hours (UTC +10).

Daylight saving

Daylight Saving Time (DST) is the practice of advancing clocks one hour during the warmer months of the year. In Australia, Daylight saving is observed in New South Wales, Victoria, South Australia, Tasmania, and the Australian Capital Territory.

Daylight Saving Time begins at 2am (AEST) on the first Sunday in October and ends at 2am (AEST) (which is 3am Australian Eastern Daylight Time) on the first Sunday in April.

Where Daylight saving is observed:

NSW, ACT,Vic and Tas move from AEST to Australian Eastern Daylight Time (AEDT), and clocks are advanced to UTC +11.

!
clock timezone AEDT 11
clock summer-time AEST recurring last Sun Oct 2:00 last Sun Apr 2:00
!

More Info from Cisco: Australia Daylight Saving Time (DST) Changes for 2008 to Present

Expect script "troubleshooting commands and log to file"

2011-10-09T16:37:00.001+11:00

This will help to capture this diagnostics info easily when troubleshooting issues (troubleshooting.exp):
#!/usr/bin/expect

# This script executes Cisco troubleshooting snapshot commands

set timeout 20

spawn telnet 10.1.1.253
expect "Username:"
send "nico\r"
expect "Password:"
send "cisco\r"
expect "1841-rtr>"
send "enable\r"
expect "Password:"
send "secret\r"
log_file /bin/snapshot.txt
send "term length 0\r"
send "!\r"
send "clear arp\r"
send "!\r"
send "show spanning-tree\r"
send "!\r"
send "show proc cpu sorted | ex 0.0\r"
send "!\r"
send "show proc history\r"
send "!\r"
send "show log\r"
send "!\r"
send "show tech\r"
send "!\r"
send "exit\r"
expect eof

Expect Script "telnet and save config to a log file"

2011-10-09T16:28:00.003+11:00

Heres an example of using a log file (telnet_wrmem_log.exp):

#!/usr/bin/expect

# This script telnet to a switch and saves the config (wr mem)

set timeout 20

spawn telnet 10.1.1.253
expect "Username:"
send "nico\r"
expect "Password:"
send "cisco\r"
expect "1841-rtr>"
send "enable\r"
expect "Password:"
send "secret\r"
log_file /bin/logfile.txt
send "term length 0\r"
send "show run\r"
send "exit\r"
expect eof

Using an Expect script to save Cisco configs

2011-10-09T13:48:00.001+11:00

Sometimes simple is effective, like with Expect scripts. This is my first attempt so im not 100% sure if it could be better when working with a lot of devices. I'll update this post as I work it out..

I tested this on Windows using Cygwin. I've been using Console2 as my terminal as it has tabs. It takes a bit of setting up though to get copying/pasting button how you like them etc.

When installing Cygwin (or use the setup executable if you have already installed it) and make sure expect is installed. I ran cygcheck -c to see if I had already installed it. Im sure theres a better command..

expect is located in /bin/ directory. I saved my scripts there too which is bad practice but im crazy like that.. Save the scripts with the extension .exp.

This is the syntax to run a script: expect scriptname.exp

Doesnt take a genius does it.

So heres my first script which uses ssh to log onto a router and save the running config to memory (wr mem), then it logs out again (wrmem.exp):

#!/usr/bin/expect

# This script telnet's to a switch and saves the config (wr mem)

set timeout 20

spawn telnet 10.1.1.253
expect "Username:"
send "nico\r"
expect "Password:"
send "cisco\r"
expect "1841-rtr>"
send "enable\r"
expect "Password:"
send "secret\r"
send "wr mem\r"
send "exit\r"
expect eof

Start an Immediate Wireshark with Windows Shortcut

2011-10-08T19:03:00.003+11:00

Create a shortcut to Wireshark on your desktop
Add -i -k flags to target and the interface UID (name) you want to capture on (from wireshark capture options)
Close off quotes for good practice (but not necessary)
Click it!

Source: http://wiresharkdownloads.riverbed.com/video/wireshark/custom-shortcuts/

Joomla backup and recovery steps

2011-09-18T12:00:00.000+10:00

I've been getting hacked a fair bit recently, probably due to me being tight and using a cheap host and something to do with the ever-growing population of losers we are encountering recently.. Anyway here's what I recommend as a little "backup & recovery" process thats working for me:

Install Akeeba Backup
Install Akeeba Remote Control (so you can initiate and download backups from your Desktop when you make changes to your website)
and/or Configure the Akeeba Backup Lazy Scheduling plugin (from Plugin Manager)
Set a Google Calendar reoccurring reminder to make sure the backup automation is working and downloading.
Don't trust backups downloaded over HTTP. I do an automoated HTTP download at 3am but also do an FTP download directly from the server when I get my Google reminder.
Make sure you get the automated update emails from Akeeba (that seem to be quite regular)
Surf away, happy as Larry..
Then you get hacked by a loser..

So you...

Read THIS if you want to know what you are doing. If not, carry on..
Delete everything under public_html folder (to make sure all the nasty code is removed, I used CPanel FileManager).
I had to start doing this as some of the hackers code prevents the below kickstart.php from initiating and displays a 404 error when you try to browse to it.
You'll like this, the last guys to hack on of my sites actually deleted my com_akeeba folders where by default the actual backup files (.jpa) are kept. Nasty buggers. Hence why you should point them to a different location (which they will probably find anyway...)
For the record, the default location where Akeeba keeps the backup files is /administrator/components/com_akeeba/backup
Download Akeeba Kickstart (cool script to automate the recovery of your site)
Copy the kickstart.php to the root of your public_html (or equivalent)
FTP (using Binary mode) the .jpa Akeeba backup file to the public_html also
Check your permissions to the files if the next steps dont work. Try at least 755
Browse to http:///kickstart.php
Note point 8..
Run the installer and follow the bouncing ball. I didn't change anything apart from the admin password.
Use the GUI to remove the installation files
Surf away, happy as Larry...
See point 8
Relaise why I made a process
Be nice to everyone

Cisco Nexus 7000 and Virtual Device Contexts (VDC)

2011-08-30T08:21:00.006+10:00

The Cisco Nexus 7000 data center switch provides layer 3 capabilities in the Nexus data center product lineup using the Cisco NX-OS operating system. The Nexus data center switch is the first Cisco switch to provide virtual device context (VDC) capabilities that allow the data center switch to be logically segmented into up to four different switches (device contexts).

When the Nexus 7000 switch is first booted, all interfaces of all line cards in the modular switch platform are placed in the default VDC (VDC 1). Up to four VDCs can be created, including the default VDC, but an interface can only belong to one VDC. Interfaces from different line cards can be placed in different VDCs. Once an interface is placed into a VDC, the interface can no longer be managed in the default VDC context.

Each VDC is configured by name, but a VDC identifier is assigned automatically in the order in which the VDCs were configured. The following configuration will create a VDC called Highpoint and assign all 32 ports of line card 18 in the Nexus 7018 10GE line card:

■N7000#config t
■N7000(config)#vdc Highpoint
■N7000(config-vdc)#allocate interface Ethernet 18/1 — 32

Ethernet ports 18/1 – 32 have been assigned to the Highpoint VDC and will not show up if the show interface brief command while in the default VDC context. The show vdc command will display all VDC names, VDC IDs, and mgmt 0 interface MAC address. The Mgmt 0 interface is an Ethernet-based interface on the supervisor module of the platform. The show vdc membership command will display all VDCs and the interfaces to which they are applied.

To switch the configuration mode from the default VDC to the Highpoint VDC context, use the following commands:

■N7000(config-vdc)#end
■N7000#switchto vdc Highpoint

It is recommended to change the hostname of each VDC to change the configuration prompt to indicate which VDC you are configuring. NX-OS uses the switchname command instead of the standard Cisco IOS hostname command. To switch back to the default VDC context, use the switchback or exit commands. Each VDC is managed as if it were a separate switch.

There are components that are shared between VDC(s), which include the following:

A single instance of the kernel which supports all of the processes and VDCs.
Supervisor modules
Fabric modules
Power supplies
Fan trays
System fan trays
CMP
CoPP
Hardware SPAN resources

Original Article by Dennis Hartmann: Cisco Nexus 7000 and Virtual Device Contexts

Reference: Introduction to Cisco NX-OS

Outburst: Cisco Catalyst 6500 ASA Services Module

2011-08-29T08:50:00.000+10:00

Interesting article from By Greg Ferro 31 March 2011

Note: The comments are interesting also

The Cisco C6500 ASA module has * finally* been released. Let take a look and make some comments.

The module has arrived two or so years later than expected. It may have missed the window of opportunity when Service Modules were in demand.
Given that Nexus 7K/5K is the future, C6500 is, for all practical purposes, on a downward slide to history.
The question is “will people actually buy the ASA service modules ?”
will people buy enough of them for Cisco to continue to produce them. Cisco has a habit of killing products that don’t make money, or are not popular. Consider the CSM module which has only this month has been EOL because enough people were buying them.
are you taking a risk buying a product that might die in a years time ? I think the answer is yes, it’s a risky purchase.
I’m planning on waiting for a year to see how much demand there is or whether Cisco kills it off for lack of sales.
Cisco will support the C6500 but don’t expect much product development in the next ten years, if any.
As such, the C6500 it will be a nice profitable business for Cisco “selling ice to the eskimos”.

So who might buy the C6500 ASA-SM ?

people who have already got Services modules – especially FWSM that need more performance.
FWSM handles IPv6 badly. ASA-SM seems to do better, so it might be the IPv6 upgrade for existing networks.

Comments

Performance:

20 Gbps maximum firewall throughput (max)
16 Gbps of maximum firewall throughput (multi-protocol)
300,000 connections per second
10 million concurrent connections
250 security contexts
1,000 VLANs

The performance list looks pretty good.
This has me wondering what the price point is going to be.
I’m also wondering how what the maximum performance per flow will be. For the FWSM, it can handle only 1Gbps flows due to the way that the backplane transfers data to the module. If the ASA SM handles up to 20Gbps, how does that connectivity work ?
Anything I’ve missed ?

Cisco Catalyst 6500 Series ASA Services Module – Products & Services – Cisco Systems

Reference: http://etherealmind.com/c6500-asa-module-comments/

Which came first, NAT or the ACL?

2011-08-26T08:30:00.000+10:00

"An Access Control List takes precedence over NAT. That is, an ACL is evaluated FIRST and then a NAT rule is applied to the packet"

Reference: Access Lists and NAT on Cisco ASA Firewalls. Some Clarifications

F5 BIG-IP - EUD (end-user diagnostics)

2011-08-23T15:11:00.000+10:00

This technical note describes how to use the end-user diagnostics (EUD) to identify possible hardware problems.

Supplemental Document: EUD 11.4 Field Testing BIG-IP Hardware

F5 BIG-IP - Configuring the cipher strength for SSL profiles (SOl781)

2011-08-23T15:05:00.001+10:00

You can configure each SSL profile to use a custom cipher suite that specifies the ciphers and strengths that will be available for use with client SSL connections using this profile. By applying different profiles to different virtual servers, you can make some client SSL virtual servers more permissive than others. For example, you can use this approach to allow only ciphers using 80 bit encryption or better, thereby enforcing the PCI requirement for strong cryptography and eliminating Weak Supported SSL Ciphers Suite violations.

Configuring the SSL profile to block anonymous ciphers and SSL connections that use less than 128-bit ciphers

To configure the SSL profile to block anonymous ciphers and SSL connections that use less than 128-bit ciphers, perform the following procedure:

1.Log in to the Configuration utility.

2.Click Local Traffic.

3.Click Profiles.

4.Choose Client from the SSL drop-down menu.

5.Click Create.

6.Type a name for the SSL profile.

7.Choose clientssl from the Parent Profile drop-down menu.

8.Choose Advanced from the Configuration drop-down menu.

9.Click the Custom box for Ciphers.

10.Enter the following string in the Ciphers box:

DEFAULT:!ADH:!EXPORT40:!EXP:!LOW

11.Click Finished.

You must now associate the SSL profile with the virtual server.

Note: Alternatively, to perform this operation from the BIG-IP system command line, run the following commands:

bigpipe profile clientssl { ciphers 'DEFAULT:!ADH:!EXPORT40:!EXP:!LOW' }

bigpipe save

For more information about using the bigpipe utility, refer to the Bigpipe Utility Reference Guide.

Reference: sol6768: Restricting Configuration utility access to SSL clients that are 128 bits or higher

Reference: sol7815: Configuring the cipher strength for SSL profiles

TIP! Use SSL Digger to test the cipher strength once complete.

F5 BIG-IP - v.10 Introduction to the tmsh Command Shell (Traffic Management Shell)

2011-08-18T08:58:00.001+10:00

TMSH - Overview

tmsh is F5's on-device shell for managing all aspects of the BIG-IP. With scripting capability and script-level variables, it is a powerful tool for automation and standardizing frequently performed operations. A fully functional command language for command line manipulation of BIG-IP objects, tmsh promises to be one of the most-discussed items on DevCentral in the coming years. This page should help you figure out how to get started, where to find references and even pre-written scripts, and when/why/how you can use tmsh to power up your infrastructure.

Reference: DevCentral Hot Topics

Reference: v.10 Introduction to the tmsh Command Shell

Reference: TMSH Scripting in v10.1

Reference: Traffic Management Shell (tmsh) Reference Guide

F5 BIG-IP - Overview of the Auto Last Hop setting (sol11796)

2011-08-18T08:32:00.005+10:00

Editors note: Auto lasthop dictates that LTM will route the response back out the same interface to the same MAC address that the request came from.

From F5: Auto Last Hop is a global setting that is used to track the source MAC address of incoming connections. When enabled, Auto Last Hop allows the BIG-IP system to send return traffic from pools to the MAC address that transmitted the request, even if the routing table points to a different network or interface. As a result, the BIG-IP system can send return traffic to clients even when there is no matching route. For example, if the BIG-IP system does not have a default route configured and the client is located on a remote network. Additionally, Auto Last Hop is useful when the BIG-IP system is load balancing transparent devices that do not modify the source IP address of the packet. Without the last hop option enabled, BIG-IP could return connections to a different transparent node, resulting in asymmetric routing.

For most network configurations, Auto Last Hop is a desired behavior and so it is enabled by default. F5 Networks strongly recommends leaving the Auto Last Hop setting enabled unless you have a specific reason for disabling it. For some network configurations, Auto Last Hop is not the desired behavior. For example, if you want the BIG-IP system to use the routing table to determine the next hop for return traffic, Auto Last Hop must be disabled. Additionally, Auto Last Hop may not function properly in environments where the last hop MAC address can change.

Reference: sol11796: Overview of the Auto Last Hop setting
Reference: sol2211: Using last hop pools to correctly return traffic to upstream redundant devices