Outside the Asylum

Category: networking

  • New sandbox PC

    I bought a new PC recently to run virtual machines on.  Virtualisation is all the rage, so I’ve decided to play around with Xen and VMware.  It also gives me an easy way to play with numerous OSes without having to frig around with hardware. As GNS3 is to Cisco routers, this box will be to OS’s.

    I’ve got ESXi on it at the moment with a ReadyNAS NFS fileshare set up as a datastore in addition to the internal disk.

    Thanks to nice corporate discounts, i was able to get this spec for a good price;

    HP Compaq dc5800 SFF

    • Intel Core 2 Quad Q9300 processor
    • 8GB RAM
    • 160GB SATA-2 10K rpm HDD
    • Intel PRO dual port gig-eth network card

    PS: Rational Survivability is a good blog for people interested in Virtualisation and Security

    UPDATE: Something to be aware of. Many corporate desktops have the Virtualisation enhancements in the CPU (Intel: VT-x) turned off by default for security reasons.  On this PC i had to upgrade the BIOS and drill down through the security menu to find the option to turn it on.  There was no doco on it that I could find and HP’s support people had no clue.

  • SANS 2008

    A little while ago I discovered that Verizon has annual training budget for employees to do work related courses of their choice.  Around that time I learned that SANS was holding one of their training events here in Sydney. I’ve always wanted to do a SANS course but the cost put me off.

    I enrolled in “SEC502: Perimeter Protection In-Depth“.  I’ve got a lot of experience with designing and building datacenter networks but it’s been some years since i was was working with people that i could call mentors. So I could do with a bit of a refresher.  The course was being run by its author, Chris Brenton.

    The course finished up yesterday. It was an intense 6 days of theory, practice and examples from Chris’s extensive experience. This course was definately worth the money. I’ve got 6 books of course notes full of scribbled comments. I’ll be going back to the books for months or more, to get what i couldnt absorb during the course itself.

    It was the best course I’ve ever done. Equal best with training i did with Dr. Rex di Bona some years ago.

    My next task is to study for the GIAC certification that’s associated with the course. It’s open book, so that worries me a little. It’ll be hard!

    Another attendee’s blog: Chris Mohan

    Some relevant websites;

    InGuardians Dr Rex Di Bona

    UPDATE: 4 Mar 09 – A week and a bit ago I passed the exam. I’m now a GIAC Certified Firewall Analyst (GCFW)

  • Cisco router lab

    It can be very hard to get hands on practise working with networking technologies. It usually requires a stack of routers and switches to be able to configure up a meaningful topology. There are simulator software packages but they don’t run the code that runs on real routers.

    Recently I discovered dynamips written by Christophe Fillot who is either a phd student or faculty member at UTC (University of Technology of Compiegne, France), I’m not sure which. Its an application that emulates the MIPS hardware of a range of Cisco routers. Cisco IOS software can be booted by this emulator. IOS software is not distributed with dynamips as that would be a violation of Cisco’s copyright. If you have a Cisco support contract you will have access to IOS software downloads. In addition to the core dynamips application there is dynagen (written by a number of people) which is a python user interface which makes interacting with dynamips a whole lot easier.

    To get started, head over to the tutorial on the dynagen website

  • Routing redistribution

    I had a problem a little while ago with a customer who was using RIP between us and them. We’re redistributing RIP routes into BGP to be passed along internally. The problem was, a routing advertisement loop manifested itself. Dagnabbit! Took me a while to figure out what was going on. The symptom was that only about 10-20% of pings were succeeding. I then tracked it down to a route that was coming and going, its metric was winding up to 16 (RIP limit) then being discarded. To cut a long story short, what was happening was; A) a BGP route was advertised to one AS (lets call it 1 ) from another (lets call it 2). B) this route was then redist’d into RIP (for the customer device). C) another router in AS1 has an interface in the same subnet as the RIP advertisement. This router picks up the RIP route and dutifully pops it into BGP. D) the first router gets the route via BGP from the second router and there is the loop.

    drawing1.png

    I had to figure out how to stop the route going around in the loop. In the end i settled on making RIP unicast. I put neighbor statements into the RIP config for each CPE device. This seemed to fix the problem. Later i discovered that i could filter the routes being advertised and learned, either based on tags applied when redistributing or based on a list of networks. I’m not sure what the best way is or the pros and cons of each. The RIP neighbor statements seem to be the easiest, just one line of config! I’m just worried I’ve missed something or there’s some gotcha. The tagging of routes when they’re redistributed from BGP to RIP and then filtering when redistributing from RIP to BGP seems to be the most comprehensive fix, but it is a lot of config. If unicast RIP is just as effective, then I’d rather use that. I like simple fixes. Comments?