Showing posts with label Tips. Show all posts
Showing posts with label Tips. Show all posts

Using Cisco ASA NAT to Translate Outbound DNS Lookups to OpenDNS

So you have decided to use Cisco Umbrella or OpenDNS as your recursive DNS. Good choice! You update your internal DNS servers to point to 208.67.222.222.

All done, right?

Then you check your firewall logs and notice there are devices sending DNS queries directly to public DNS servers. How can you force those devices to use 208.67.222.222?

With NAT!

First you need to identify which external DNS servers are being used. Then you need to NAT DNS requests to those external DNS servers to the OpenDNS server.


NetApp ONTAP 9 Simulator and Free eBook

Just a quick post.

I found Neil Anderson on Twitter @flackboxtv. Neil is a CCIE as well as NetApp, VMware, FlexPod, Microsoft and AWS certified. His blog, Flackbox, is about Cloud and Data Center technologies.  Neil has many great video tutorials on NetApp and, more broadly, on SAN and NAS Storage Basics.

Neil is also offering a free 177 page eBook "How to Build A NetApp ONTAP 9 Lab". The lab is built on VMware Player with VyOS routing between networks. The lab includes two NetApp ONTAP clusters, SnapMirror, SnapVault, Windows and Linux hosts. To minimize host memory usage, not every VM needs to be powered on at the same time.

Flackbox is definitely worth checking out.

NetApp Simulator 9 Free eBook – Build Your Own NetApp ONTAP 9 Lab!


Cisco Prime Infrastructure 2.1 - Upgrade VMware Tools

Cisco Prime Infrastructure includes a built-in evaluation license valid for 60 days and 100 devices. You can download the virtual appliance from the Cisco Promotional Software Store. I am running this in my lab on a VMware ESXi 5.5 host.

Smug Cisco Guy


After I installed and configured Prime Infrastructure (PI) vSphere Client reported the PI vm was running an outdated version of VMware Tools. To upgrade VMware Tools you need to enable root access on the PI appliances, then follow the VMware instructions for "Manually Install or Upgrade VMware Tools in a Linux Virtual Machine".

Step 1 - SSH into the appliance and login.

Step 2 - Enable root shell and set the password, then log into root


lab-prime/admin# root_enable
Password :
Password Again :
Root enabled
lab-prime/admin#
lab-prime/admin# root
Enter root password :
Starting root bash shell ...
!


Step 3 - On the VMware host, enable Interactive Tools Upgrade. Right click the VM, Guest, Install/Upgrade VMware Tools, and select Interactive Tools Upgrade.

Step 4 - Back in the ssh windows, mount vmware tools and copy to /tmp


ade # mkdir /mnt/cdrom
ade # mount /dev/cdrom /mnt/cdrom
mount: block device /dev/cdrom is write-protected, mounting read-only
ade # cd /mnt/cdrom
ade # ls | grep VMware
VMwareTools-9.4.0-1280544.tar.gz

ade # cp VMwareTools-9.4.0-1280544.tar.gz /tmp
ade # cd /tmp
ade # ls | grep VMware
VMwareTools-9.4.0-1280544.tar.gz


Step 5 - untar the file and run the install

ade # tar zxvf VMwareTools-9.4.0-1280544.tar.gz
ade # cd vmware-tools-distrib/
ade # ./vmware-install.pl



From here just accept the defaults.




Book Review: End-to-End QoS Network Design, 2nd Edition

End-to-End QoS Network Design 2nd Edition
As a Network Consultant and CCIE 5022, I have worked with Cisco QoS since, frankly, the beginning of QoS (yes I am old). I have been eagerly awaiting this books release. In the two weeks, I have had this book; I have already referred to it several times to gain additional insight. This book is an all-encompassing presentation and tutorial on Cisco Quality of Service (QoS).

The book flows very well. A reader new to QoS can start at the beginning and build up to the design strategies and product specific sections. Those more experienced, can fast forward to the more advanced sections. The authors have done a tremendous job explaining the foundational architecture and concepts of QoS, and the flow and syntax of Cisco's Modular QoS Command-line (MQC).

The opening section, “Part 1: QoS Design Overview” (Chapter 1 – 9) layout the history of QoS, including the evolution of IETF RFCs, and the QoS implementation tools. The chapters build on each other, and do a great job of introducing a topic, then diving deeper into the details. Each of these chapters starts with a ‘Terminology’ section. This has the nice effect of clearly defining the chapters’ concepts.

The next section, “Part II: QoS Design Strategies” offers a discussion of business and application QoS requirements and thoroughly explores the overall design principles and implementation strategies. Applications covered include voice, broadcast video, multimedia conferencing, and mission-critical data applications. Within this section are my favorite nuggets… The design best practices and recommendations.

The remaining sections provide comprehensive design and configuration information on campus networks (Cisco Catalyst switches), traditional wireless networks, and new ‘Converged Access’ wired and wireless networks (Catalyst 3850, and Cisco 5760 WLC).

Of particular help to me was the Data Center QoS section. On the Cisco web site, Nexus QoS design and best practices information is lacking. This section fills this void and provides great information on the QoS hardware architectures and configuration. The covered platforms are Nexus 7000, 5500, 2000 and 1000v. Great stuff!

The final sections explore WAN, VPN and Branch QoS. I was pleasantly surprised with the inclusion of the Cisco ASR 1000, ASR 9000, and Cisco CSR.

I strongly recommend this book to anyone working with Cisco infrastructure. QoS is intimidating; however, this book is a tremendous resource that will ease your anxiety.

This book is kept in my cubicle and is already filled with highlights, notes in the margin, and many dog-eared pages.

End-to-End QoS Network Design 2nd Edition at Cisco Press



Cisco ASA Static NAT Multiple Global IPs to Single Real IP

I am finally getting comfortable with Cisco ASA Object NAT introduced with software version 8.3. I like that ACLs use the real IP address not the global/translated IP Address.

I am still struggling when in the CLI trying to parse the different elements of the of the object because there are two "object network XYX" references in the configuration, one for the host and one for the NAT mapping.

Now on to the NAT fun....

I had an interesting Static NAT configuration scenario with Cisco ASA software version 9.1(1) recently. A customer has a domain registered and hosts their own public DNS servers. Originally they had two Authoritative Name Servers (NS) with different IP Addresses.

NS1
Public IP X.X.X.1
Private IP Z.Z.Z.1

NS2
Public IP X.X.X.2
Private IP Z.Z.Z.2

The ASA had the standard object with static nat translations:

object network inside-NS1
 host Z.Z.Z.1
 nat (inside,outside) static X.X.X.1
!
object network inside-NS2
 host Z.Z.Z.2
 nat (inside,outside) static X.X.X.2


They wanted to decommission the NS2. The NS records with the Internet Domain Name Registrar where updated, NS2 was powered off, and object inside-NS2 NAT and access list references was removed from the ASA configuration.

After a few days I saw in the ASA logs, packets blocked for DNS requests to X.X.X.2/Z.Z.Z.2. Since there was no long a real server at Z.Z.Z.2 I could not recreate the NAT translation.

I found Cisco documentation for Static NAT with One-to-Many. This allows for multiple public/global/outside IP addresses to be mapped to a single real/internal address.

1st we have to remove the remaining NS1 translation

object network inside-NS1
 host Z.Z.Z.1
 no nat (inside,outside) static X.X.X.1


2nd we create the object range for the global/outside addresses

object network outside-ns1-ns2
 range X.X.X.1 X.X.X.2


3rd we add a new nat statement

object network inside-ns1
 host Z.Z.Z.1
 nat (inside,outside) static outside-ns1-ns2


The nice thing about this solution is how it handles traffic flows. When Internet traffic sent to X.X.X.1, the returning traffic has a source IP of X.X.X.1, and Internet traffic sent to X.X.X.2, the returning traffic has a source IP of X.X.X.2.

Cisco ASA One to Many Static NAT
Cisco ASA One to Many Static NAT



For this post:
 X.X.X.# = external, public, Internet routable IP Addresses
Z.Z.Z.# = internal, private, IP Addresses.

References:
Cisco Support Forums ASA 8.3 Upgrade - What You Need to Know
Cisco ASA CLI Configuration Guide, 9.0


Home

Cisco Unity vs. Unity Connection - Installation and Recovery Times

Network Engineer After Restoring Cisco Unity
Billy Carter Post Unity Restore
For several years Cisco has offered two Unified Communications voice messaging products. Unity, built on Windows Server, Exchange (or Lotus Domino), and MS SQL, and Unity Connection built on Linux and Informix.

I just spent 12 hours restoring a Cisco Unity system and thought this would be a good time to discuss the installation and disaster recovery process. I will skip the configuration steps to integrate with the phone system, create voice mail users, etc.


Overview of the Cisco Unity Installation Process


I have been building Cisco Unified Communications Systems (or VoIP systems for the ol'timers) since 2000. Regular Unity has always been a complicated and comprehensive installation. There are many steps including things like "click options 2,3 and 5", "before proceeding to the next step, install this patch on the Exchange server", "if the Partner Exchange server is version 20XX, install Engineering Special ES9".

There is really four installations; Windows Server install, MS SQL install, messaging platform install (either full Exchange for Voice mail only, minimal Exchange components for Unified Messaging, or Domino), and finally the Unity application install.

Thankfully Cisco provides separate Cisco Unity Installation Guides or each option. I have to say, after 12 years of Unity Installations, I still always have the guide right in front of me:
  1. Unity Unified Messaging Configuration with Exchange (with Failover Configured)
  2. Unity Unified Messaging Configuration with Exchange (without Failover Configured)
  3. Unity Voice Messaging Configuration with Exchange  (with Failover Configured)
  4. Unity Voice Messaging Configuration with Exchange  (without Failover Configured)
  5. Unity Unified Messaging Configuration with IBM Lotus Domino (with Failover Configured)
  6. Unity Unified Messaging Configuration with IBM Lotus Domino (without Failover Configured)
All of the guides have you install the operating system, SQL, and messaging backend, then they all have to be patched. The Cisco Unity Server Updates wizard automatically installs recommend updates. Depending on the server model, this step takes 1.5 to 2 hours (Prior to the wizard, this was a manual process that often included 93 reboots and took 4 to 8 hours.)

Now that the core components are installed, but before installing the Unity software, the Active Directory scheme is extended and special AD accounts are created (unityinstall, unityadmin, unitydir, and unitymsg).

The Permissions Wizard is run to give these new accounts special permissions in Active Directory. Then you have to manually delegate Exchange Administrative control to some of the special Unity AD accounts. In my experience, 90% of the time when Unity fails to work properly after installation, it is due problems with the Unity accounts and permissions not being properly assigned.


Note - You can see there is extensive changes made to Active Directory, and the Unity accounts have some significant and powerful rights to Active Directory. This DOES make the AD administrators nervous (as it should). After installation, if the Unity AD accounts have some permissions removed, it will break Unity.


Finally the Unity software is installed and connected to the messaging environment.

Total Unity Installation Time: 8 to 16 Hours


Overview of the Cisco Unity Connection Installation Process


There is a single Cisco Unity Connection Installation Guide per Unity Connection version. The installation is very simple:
  1. Put the installation DVD in the server and boot it up
  2. Follow the installation wizard to set IP Addressing, Primary DNS, NTP, Time Zone, DHCP settings, SMTP hostname, and X.509 Certificate information. 
  3. Set the application and operating system usernames and passwords
  4. Identify if the server is the 1st server in the cluster.
  5. To install a Unity Connection High Availability server, follow steps 1-4, but mark the systems as the 2nd server in a cluster and enter the information about the 1st system.
  6. Patch the system buy uploading the single update file and click install.
  7. If using Unified Messaging following the configuration steps.

Total Unity Connection Installation Time: 1 to 1.5 Hours


    Overview of Cisco Unity and Unity Connection Restore Process


    Unity uses the Disaster Recovery Tool (DiRT). DiRT allows you to back up and restore a Unity system. It is very important the exact same version of DiRT is used to backup and restore.

    Cisco Unity Restore Process:
    1. You should already have run a DiRT backup and stored the files off-box
    2. Follow the complete installation process from above (8-16 hours). The version of Unity installed must be the EXACT SAME version that was backed up (major version and Engineering Specials)
    3. Install and run DiRT restore (30 minutes to 1 hour)
    Cisco Unity Connection Restore Process:
    1. You should already have run the Disaster Recovery System backup
    2. Follow the complete installation process from above (1 to 1.5 hours). The information entered in installation steps 2 and 3 must be the same.
    3. The version of Unity Connection installed must be the EXACT SAME version that was backed up (major version and updates)
    4. Sign into the Disaster Recovery System and run the Restore Wizard (~30 minutes)

    Summary


    Unity Connection has several advantages over Unity:

    1. Much faster installation process, thus much shorter RTO
    2. Automated installation eliminates many steps which could break the system
    3. Less dependent on the Active Directory and Messaging environment
    4. Almost complete feature parity with Unity (Cisco says they almost have feature parity, but I can find any features missing that I or my customers want). In fact Unity Connection has many features not available on Unity
    5. Unity Connection is under active development with new features every release while Cisco has announced Unity End Of Life
    6. Its just an easier system  

    What do you think about Unity vs. Unity Connection?

    The Best Solution is the Simplest Solution

    The Fiar of Network Simplicity
    As a consultant I am sometimes brought into, shall we say, challenging situations. Some situations are primarily politically challenging, others are technologically challenging.

    Today I have met a technically challenging situation. I am working on a network that is not, on the surface, much different than many others. In this case, the problem is someone has, from the technology or geek standpoint, created a very complex network. We have OSPF, EIGRP, and static routes. OSPF and EIGRP redistributing each other, and each redistributing static routes, plus back door links.

    Now this environment had some challenging networking issues to deal with. However I am thinking of my favorite philosophical law called  Ockham's Razor. "It is a principle urging one to select among competing hypotheses that which makes the fewest assumptions and thereby offers the simplest explanation of the effect."

    Sometimes the best solution is the simplest.

    Cisco Configuration Tip - Command Macro To Change IP Address

    Network Engineer at a Bar
    Remotely changing an IP address on a Cisco router or switch, or moving an IP from one interface to another can be a challenge.

    Cisco allows you to use macros although I have not really worked with them. rekrowteN has a great blog post about using macros to move an IP address from one VLAN interface to another.

    In a previous Configuration Tip I discussed using the reload in/at commands to prevent getting locked out of a router or switch.

    In this scenario we need to move the IP Address assigned to interface VLAN 1 to VLAN 10.


    For this tip start by entering reload in 15.


    Next we create the macro
    conf t
    macro name mgmtchange
    interface vlan 1
    no ip address
    shutdown
    interface vlan 10
    ip address 172.16.1.1 255.255.255.0
    no shutdown
    @
    The "@" signifys  at the end of the macro. To apply the macro enter:
    conf t
    macro global apply mgmtchange
    Once the change is made and you can reconnect don't forget reload cancel.


    Configuring Command Macros


    Have you used macro's? What Macro scripts do you use?

    Cisco Configuration Tip - Protect Your Tail

    cisco command reload
    I have long been a fan of the Cisco "reload in/at" commands. These have saved my tail a number of times. This enables a brave network engineer to schedule a device reload for either a specific amount of time from now, 15 minutes, or just a specific time such as 11:00pm.

    Protect Your Tail
    Network Engineer Protecting His Tail
    This has saved my tail a few times when working on a remote device. When changing ACLs or firewall rules there is always the potential of getting locked out. It has also saved me when debug messages flooded a device and I could not get the telnet/ssh session to respond.

    Bonus Tip: When I have to debug a router or a switch I open a second telnet/ssh window. The primary window is set to terminal monitor so I can see the messages. In the second window I type in "undebug all" but don't press enter. If the debug messages get out of hand in the primary window, I switch to the second window and hit enter.
     Before making configuration changes, do the following:
    copy run start
    terminal monitor (so you can see reload countdown warnings
    reload in 15

    You are now free to make changes. If you get locked out, sit back and wait for the reload.

    When you have made changes and still have access type:
    reload cancel
    copy run start


    Home

    Configuration Tricks - Catalyst 4900M with CVR-X2-SFP and 1Gb SFP


    Cisco Catalyst 4900M

    The Cisco Catalyst 4900M is a high performance, low latency, layer-3 switch suitable for Top of Rack 10Gb link aggregation or small data centers server connectivity. eWeek testing validated 320 Gbps throughput, or 16 10G ports running at full line speed with latency of ~2.6 microseconds.

    The 4900M chassis includes 8 fixed wire-speed X2 ports. Two half-card module slots can be added for additional ports. Supported modules available are:
    • WS-X4920-GB-RJ45 - 20 port 10/100/1000 RJ45
    • WS-X4904-10GE - 4 port wire speed 10GE (X2)
    • WS-X4908-10GE - 8 PORT 2:1 over subscription 10GE (X2)
    • WS-X4908-10G-RJ45 -  8 PORT 2:1 over subscription 10GbaseT
    I recently had a situation were we deployed a Catalyst 4900M with the WS-X4920-GB-RJ45 and WS-X4908-10GE modules. The switch needed to connect a 1GB metro Ethernet circuit. No problem, with the 20 port 10/100/1000 module we had it covered...So I thought.



    Network Engineer #SMH
    #SMH
    The service provider handed off 1GB multi-mode fiber.









    How Do I Connect 1GB Multi-Mode Fiber To This Thing?

    Cisco 4900M 8port 10Gb Module
    WS-X4908-10GE
    The WS-X4908-10GE offers 8 10GE ports at a 2:1 over subscribed ratio. A feature of this card is the ability to convert 10GB ports to dual-1GB ports with SFP transceivers.



    CVR-X2-SFP
    CVR-X2-SF

    The CVR-X2-SFP Cisco TwinGig Converter is installed into an X2 port and 2 SFPs are plugged into the TwinGig






    (Note: The CVR-X2-SFP10G can be used to convert a 10GB X2 port into a 10GB SFP+ port)


    Pre-Sales - Cisco Dynamic Configuration Tool
    The first step happens in the sales process. Using the Cisco Configuration tool, you choose the WS-X4908-10GE module.

    Second, click the "+" next to the 4908 part number, click the "+" next to the Port Group 1, click "SFP options" then choose the GLC part needed.

    Now you can't see it, but this adds the CVR-X2-SFP TwinGig Converter Module.

    Using this method, the CVR-X2-SFP is included at no-cost. Otherwise the converter sells for $195 list price.

    Installation - Good 'ol CLI
    The half-card slot the WS-X4908-10GE is divided into 4 port-groups. 8 ports divided by 4 port groups = 2 ports per group. A command is required to convert a port-group into 1GB ports. Since an entire port-group is converted, two of the X2 ports are switched to 1GB.

    The Catalyst 4900M is based on the Catalyst 4500 family of switches. the 4900M carries over the configuration concept of modules. Module 1 is the fixed 8 ports of 10GB, module 2 is the top left slot, and module 3 is the top right slot.

    To see the current port-group can be seen with:


    4900# show hw-module module 3 port-group
    Module Port-group Active                         Inactive
    -------------------------------------------------------------
       3        1     Te3/1-2                        Gi3/9-12
       3        2     Te3/3-4                        Gi3/13-16
       3        3     Te3/5-6                        Gi3/17-20
       3        4     Te3/7-8                   Gi3/21-24


    To change the configuration the command is:
    4900(config)# hw-module module 3 port-group 4 select gigabitethernet

    Verify the configuration with:


    4900# show hw-module module 3 port-group
    Module Port-group Active                         Inactive
    -------------------------------------------------------------
       3        1     Te3/1-2                        Gi3/9-12
       3        2     Te3/3-4                        Gi3/13-16
       3        3     Te3/5-6                        Gi3/17-20
       3        4     Gi3/21-24                      Te3/7-8

    Next a reboot is required.

    We ran into a small caveat. We created interfaces G3/23 and G3/24, connected the 1GB SFP into G3/24 but the interface would not connect. We had to move the 1GB SFP to interface G3/23.




    Home

    Putty Beta 0.62 Released

    Putty

    Putty version 0.62 has been released by Simon Tatham. Putty is my favorite Telnet, SSH, Serial Terminal Emulation client.

    VMware ESXi 4.1 Optimizations for Cisco UC on UCS

    In my previous post I discussed the importance of installing the latest version of VMware Tools on UC virtual servers in a Cisco UC on UCS deployment. A second and equally important VMware 'tweak' is disabling Large Receive Offload (LRO) on VMware ESXi hosts.

    VMware Knowledge Base Article 1027511 addresses some Linux TCP/IP stacks perform poorly when handling LRO-generated packets. This results in poor TCP performance.

      Cisco UCS Servers at VMworld
    1. Log into the ESXi host or its vCenter with vSphere Client.
    2. Select the host > Configuration > Software:Advanced Settings.
    3. Select Net and scroll down slightly more than half way.
    4. Set the following parameters from 1 to 0:
      1. Net.VmxnetSwLROSL
      2. Net.Vmxnet3SwLRO
      3. Net.Vmxnet3HwLRO
      4. Net.Vmxnet2SwLRO
      5. Net.Vmxnet2HwLRO
    5. Reboot the ESXi host to activate these changes.

    Your guest VMs should now have normal TCP networking performance.

    References:
    http://docwiki.cisco.com/wiki/Disable_LRO
    VMware Knowledge Base - KB Article 1027511
    Cisco UC on UCS - Don't Forget VMware Tools

    Home

    Cisco UC on UCS - Don't Forget VMware Tools

    Recently we upgraded a Cisco Unified Communications system running on physical HP servers, to Cisco UCS C-Series rack mount servers. Three days after the upgrade, all of the UC applications slowed down.

    When users picked up their phone handset, there was a noticeable delay before dial tone. Delayed dial tone is a classic symptom of an overworked CallManager.

    The Cisco UCS C210M2 servers were more than adequate for the load. Each UCS-C210M2 hosted VMware VMs of CallManager, Unity Connection, and UCCX. All of the VMs were deployed using the Cisco prescribed OVA templates.


    Cisco UCS-C210M2
    Cisco UCS C210M2

    So what is “VMware Tools”?

    According to docwiki.cisco.com/wiki/VMware_Tools:

    VMware Tools are specialized drivers for virtual hardware that is installed in the UC applications when they are running virtualized.

    Now I understand Drivers. Up to date drivers are a good thing. Docwiki goes on to state:


    It is very important that the VMware tools version running in the UC application be in sync with the version of ESXi being used.

    Anyone who has read Cisco documentation before should realize, Cisco doesn’t often use the phrase “it is very important”. This is as close as Cisco gets to saying “you have to do this”.
    So we installed VMware tools on all of the VMs and the Cisco voice system has been stable ever since.

    Cisco has 3 methods for installing VMware Tools on Unified Communications Application VMs dependent on the UC Application version. Visit DocWiki-VMware Tools to find the appropriate method.

    Please Note: VMware Tools will have to be re-installed anytime VMware ESXi is patched or upgraded.


    Home

    Putty Version 0.61 and Putty Connection Manager


    I wanted to update this post. Putty Connection Manager is no longer active.

    I have switched to SuperPuTTY. It is available here SuperPuTTY. SuperPuTTy does not use "login scripts". For SSH connections you can pass username and password, however you can not do this for telnet. Here is a SuperPuTTY new session configuration using SSH and passing username and password.

    SuperPuTTY New Session Dialog





    I use Putty for telnet, SSH, and serial connections to. Putty is an excellent terminal program. I also use Putty Connection Manager for Tabbed windows and login scripts.

    Putty Connection Manager is a Free Putty Client add-on. http://puttycm.free.fr/cms/index.php

    Simon Tatham has released version 0.61 of Putty. Putty 0.61 can be downloaded at: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html


    2011-07-12 PuTTY 0.61 is released
    PuTTY 0.61 is out, after over four years (sorry!), with new features, bug fixes, and compatibility updates for Windows 7 and various SSH server software.
    These features are new in beta 0.61 (released 2011-07-12):

    • Kerberos/GSSAPI authentication in SSH-2.
    • Local X11 authorisation support on Windows. (Unix already had it, of course.)
    • Support for non-fixed-width fonts on Windows.
    • GTK 2 support on Unix.
    • Specifying the logical host name independently of the physical network address to connect to.
    • Crypto and flow control optimisations.
    • Support for the zlib@openssh.com SSH-2 compression method.
    • Support for new Windows 7 UI features: Aero resizing and jump lists.
    • Support for OpenSSH AES-encrypted private key files in PuTTYgen.
    • Bug fix: handles OpenSSH private keys with primes in either order.
    • Bug fix: corruption of port forwarding is fixed (we think).
    • Bug fix: various crashes and hangs when exiting on failure,
    • Bug fix: hang in the serial back end on Windows.
    • Bug fix: Windows clipboard is now read asynchronously, in case of deadlock due to the clipboard owner being at the far end of the same PuTTY's network connection (either via X forwarding or via tunnelled rdesktop).
    Putty Connection Manager Features
    Features
    • Tabs and dockable windows for PuTTY instances.
    • Fully compatible with PuTTY configuration (using registry).
    • Easily customizable to optimize workspace (fullscreen, minimze to tray, add/remove toolbar, etc...).
    • Automatic login feature regardless to protocol restrictions (user keyboard simulation).
    • Post-login commands (execute any shell command when logged).
    • Connection Manager : Manage a large number of connections with specific configuration (auto-login, specific PuTTY Session, post-command, etc...).
    • Quick connect toolbar to quickly launch a PuTTY connection.
    • Import/Export whole connections informations to XML format (generate your configuration automatically from another tool and import it, or export your configuration for backup purpose).
    • Encrypted configuration database option available to store connections informations safely (external library supporting AES algorithm used with key sizes of 128, 192 and 256 bits, please refer for the legal status of encryption software in your country).
    • Standalone executable, no setup required.
    • Localizable : English (default) and French available (only when using setup version, standalone is english only).
    • Completely free for commercial and personal use : PuTTY Connection Manager is freeware.


    Home

    How I passed the CCIE R&S Lab on my 1st Attempt

    CCIE 10 Year

    I am studying for my CCIE Re-Certification. This has re-kindled my interest in many of the “CCIE Lab” study materials out in the Internet. With all of this material available, I wanted to share what I did to pass the CCIE R&S Exam.

    I passed the CCIE Routing and Switching Lab 12 years ago on August 26, 1999. I took my lab exam in the beautiful Halifax, Nova Scotia. This was one of the most beautiful places I have ever visited. I took my exam on a Monday and a Tuesday (yes, back then it was a 2 day exam). My wife accompanied me; we arrived on Saturday and spent a day and a half being tourists.

    When people in the “know” realize I am a CCIE I am often asked, “How many attempts until you passed”. My response is “one”. I say this, not to brag, but to give some credibility to what I am sharing.

    When I started to study there was no study guides. People who had taken the exam would not talk about the test, even the number of routers they saw. The big rumor was there was a major Frame-Relay component, but no one would talk about this.

    I found Bruce Caslow’s book “Cisco Certification: Bridges, Routers and Switches for CCIEs”. This was not a “how to pass the CCIE Exam”; it was a structured road map for preparing for the lab. From this book I discovered and learned how to study technologies inside and out.

    I put together my CCIE lab rack. I quickly realized there was no need to constantly change the cabling. I needed a configuration that gave me a Frame-relay Point-to-Point connection and a Point-to-Multipoint connection. If I needed additional interfaces I could use Loopback interfaces. Quick tip, If you have an Ethernet interface, but no switch/hub to plug it into, “keepalive 0” will make the interface come up.

    Combining the Caslow book with my own plans I did a couple of things structurally that helped:

    • Lab Time
      • Monday – Thursday 7:00pm-Midnight
      • Saturday or Sunday – 8hr
      • Stop Time
      • On Monday – Thursdays I had a hard stop time of midnight.
      • If I completed my tasks with lots of time to spare, I erased the configurations and did it again
      • Otherwise, I used the hard Midnight stop time to pressure me to get it done
      • This way I built in the time factor every day
    • Typical Study Week
      • Each week I had a “topic”
      • One week would be OSPF, the next IS-IS, the next IGRP/RIP redistribution into OSPF/EIGRP/RIP/IGRP, the next week BGP
      • For the week, I would spend the first two days on the easy stuff.
      • The next three days would be “advanced topics
      • On Saturday or Sunday for the 8hr session, I would configure the advanced scenarios from the week and add on other topics to fill out my time

    To summarize what it took me to pass the CCIE Lab…
    • From day 1, I followed a regime that enforced timed deadlines. Every day I was pressured by time
    • Each week I focused on a topic learning each and every the nuance
    • I didn't have study guides that gave me a long string of “sample” test questions
    • I studied each of the protocols in detail to learn how they worked
    • I had a relaxing day and a half before my test

    -Billy

    Telex Radio Dispatch System Integration with Cisco Unified Communications. Part 3

    A reader has asked about our progress with this and it reminded me I haven't talked about our results.

    I want to just reiterate what the Telex Radio Dispatch System is.

    Telex provides an integration with multiple communications systems. This is commonly used in an environment where dispatchers communicate on multiple communications systems. The Telex C-Soft console provides dispatchers a point and click interface to interact with the various communications systems. Dispatchers can increase or decrease audio volumes from a specific radio system. They can also click on a specific radio system and, through their headset, talk on a particular radio system. The Telex Radio Dispatch System also allows for a phone system integration.

    For example, consider an ambulance company. Their ambulances provide services for town A, town B, town C. All these towns communicate on specific radio channels. The ambulance company has radio towers and systems that connect to each radio channel/network. For each radio channel/network/town, Telex has a VoIP adapter that converts the radio communications to VoIP. The Telex system multicasts the audio from the radio system to the dispatchers.

    For Cisco centric people, think Cisco IPICS.

    We were brought in to integrate a Cisco CallManager phone system with the Telex system.

    The primary problem we had was the integration between the physical phone and the Telex C-Soft Dispatch console. The physical integration is provided via in-line adapter connected to the phone (See Part 1). Often a NENA compliant phone is used. Cisco, as well as most other vendors, do not have NENA compliant phones (We later learned NENA compliant phones can cost several thousand dollars a piece). When an inbound call is presented to the dispatcher, they can answer the call by clicking on the appropriate icon on the dispatch console.

    We connected a Cisco IP Phone to the Telex in-line adapter. On an inbound call, the dispatcher had to physically press the appropriate button on the phone to answer the call. This would not work, the customer wanted to use the C-Soft Dispatch Console to click and answer the call.

    We tried removing a physical phone all together and use the C-Soft SIP phone. This worked ok for receiving calls. The C-Soft SIP phone was configured as a basic SIP phone in CallManager. To place outbound calls, dispatchers had to append @10.1.1.1 (CallManager's IP Address) to every outbound call, either internal or external. I held out hope the SIP client would work, but it looked to me like a freeware no frills SIP softphone. For the customer, this was a no go.

    We found a small company in California which produces a box which connects to a physical phone (pretty much any phone) and provides the proper signalling to integrate with Telex (Sorry I don't have the companies name right now, but I can find it on request). With this box, dispatchers could click to answer the call, however C-Soft didn't pickup the audio.

    After much troubleshooting we found the phone system needed to generate a tone or a beep when the call was answered to cause C-Soft to "hear" the call and mix the audio. After banging our heads together a co-worker suggested enabling the "call recording tone" on the dispatchers phones. This is normally used to play a tone to callers indicating the call is being recorded. We were not using a call recording system, but playing this tone caused the C-Soft console to recognize the call and mix the audio.

    Telex Radio Dispatch System Integration with Cisco Unified Communications. Part 1

    Telex Radio Dispatch System Integration with Cisco Unified Communications. Part 2

    Home

    Cisco Wireless AP - LWAPP: How to Recover an AP from Mis-Configuration

    I am quickly learning Cisco Wireless. I had a problem with a Cisco LWAPP AP located at a remote office. This AP had not previously registered with a Wireless LAN Controller (WLC). We rely on the DNS discovery method where the AP boots up and does a DNS lookup for CISCO-LWAPP-CONTROLLER or CISCO-CAPWAP-CONTROLLER.

    Well this is were the fun began. IP address and name-server was manually configured in the AP, but the name-server IP address was fat-fingered. The APs will save their IP and LWAPP configuration automatically. On a reboot, the AP came up with the same configuration. I was finally able to restore the configuration to factory default and have it discover and join the controller.

    To do this a console connection to the AP is required. I had a user at the remote office connect a console cable to a notebook and let me RDP in..

    1) I need to clear the static IP address settings, convert to DHCP, and have the AP connect to the WLC. With LWAPP/CAPWAP APs, you can't just go into the config and change things.

    "debug lwapp console cli" (if that doesn't work try "debug capwap console cli" )

    This allows me to make changes to the running configuration, but these changes can not be saved to what us router-jockeys call "startup-config". The "magic" here is that when a LWAPP/CAPWAP access point connects to a WLC, it saves the controllers address in nvram. Thus when reboted, the AP always knows which WLC to try to connect to.

    "interface f0"
    "ip address dhcp"

    I created a DHCP pool on the core switch and included the correct DNS server. In about 5 seconds, the AP obtained an IP address and the new DNS server. Then it registered with the controller

    2) One problem. After rebooting, the Cisco Wireless AP came up with the old static IP addressing and DNS old/wrong DNS server. I was, however able to register with the controller because it had previously registered with that controller.

    3) I logged into the Cisco Wireless Control System (WCS) and found the AP. I removed the Static IP setting and saved. The AP rebooted and registered, still had the wrong DNS server.

    In WCS I went to Configure - Access Point and found the AP, scrolled to the bottom for "set to factory defaults", clicked "clear config".

    Finally cleared it!

    Home

    Telex Radio Dispatch System Integration with Cisco Unified Communications. Part 2

    After much research, calls to our Cisco SE, a PDI case, and a conference call with Telex we have decided...

    We are going to implement Telex SIP softphones on the desktops. This will provide the best solution short of rigging up some cables connecting the Cisco IP Phone headset port and auxiliary port to the Telex ADHB-4 box. Telex stated this solution has been available for five years but has only caught on in the last year.

    Running this system on SIP softphones leaves me a little unsettled, I am somewhat comforted because Telex seems to be releasing updates to their software on a regular basis. This tells me they are actively fixing problems.

    The main downside to this solution is the Cisco UCCX Call Center version 8.5 doesn't support 3rd party SIP phones. I can't say that I blame the UCC Business Unit since this could require testing and certifying many 3rd party SIP phones. In this testing, of course some vendors would be left out, customers would complain, and this would pull key staff away from fixing bugs and preparing the next version.

    So I will configure CallManager, excuse me, Unified Communications Manager, with 3rd party SIP devices for the Dispatchers' SIP softphones.

    We have two UCMs and the softphones allow for one entry for a SIP server, either IP Address or Domain Name. I read up on creating DNS server entries for SIP servers, so I think I will try creating one DNS SIP SVR entry for two IP addresses.

    An email from Cisco referred to the Cisco Interoperability and Collaboration System (IPICS). This system is basically and Cisco UC systems with some Radio over IP integration. Without any experience on this, I this this is a very good and viable option, however the customer has already purchased a solution supporting the Radio, RoIP, and operator console functions. We are just trying to integrate telephony into the system.


    Stay tuned...We will see how the Telex SIP softphones cooperate with Cisco UCM 8.5 (did I mention we are doing the Cisco UC on UCS with Cisco UCS-C servers?

    FYI...I am also frustrated Cisco doesn't support Cisco Unified Enterprise Attendant Console server installed on the same Cisco UCS-C Class server which also have Cisco UCS installed on them....

    While Cisco supports UxAC running on VMware, it is only supported on Cisco UCS-B or UCS-C servers. These servers can not have other Cisco UC systems loaded on them (same host server)...hhmmm....Such is the question...Install CxAC on Cisco UCS servers with VMware, (which is supported) or on Cisco UCS servers without Cisco UC apps are not installed

    but not on those servers have other Cisco UC applications (which is not supported), Install on VMware with other Cisco UCS servers (which is permitted) or install on

    -Bill

    Telex Radio Dispatch System Integration with Cisco Unified Communications. Part 1

    I have Telex Radio Dispatch system I want to integrate with a Cisco phone system.

    Side note: Using two Cisco UCS C-Servers with VMware. Cisco' UC on UCS. Works great!

    Telex system has interfaces to the radio networks and the telephone network. 

    Each user has a Telex ADHB-4.  This device mixes the audio from the different Radio networks and the telephone. Coming out of the ADHB-4 is a headset for the dispatcher. The dispatcher has a desktop application were they can select different audio sources and the ability to combine audio channels.

    The interface between the phone needs audio tx and rx along with on/off hook switch and ground across 6-wires.  The box/application needs the hook switch to answer and hang up calls.

    I am wondering if I can create a cable from the Phone to the Telex Device. Telex provides a basic diagram:



    I would think I could get TX and RX audio and Ground from the phones headset port. I would also think I could get Hook Switch from the phones aux port (this is the port used for the wireless hook switch feature).

    We will see how today goes, I am almost onsite.

    I'll keep you posted.

    -Bill

    4900M connection to HP Virtual Connect Flex 10 - Not Working

    HP Virtual Connect Flex-10

    Update: The configuration on the HP Virtual Connect side was incorrect. Once the server team reconfigured their side, all was good.

    Today I am posting something I submitted to supportforums.cisco.com.

    The customer has consultants configuring the HP side of things. I was asked to configure a Catalyst 4900M to work with the HP Virtual Connect Flex-10. From the Cisco side, this is not complex.

    Tomorrow I am going onsite. I will open a TAC case on the way and sit beside the server guys.

    4900M connection to HP Virtual Connect Flex 10

    I'm Trying to connect a HP-C7000 blade server with a Virtual Connect Flex 10 connection with 10Gb links to a Catalyst 4900M. I have no control of the HP side.

    From the HP guide, we are following "HP Virtual Connect Ethernet Cookbook" "Scenario 1:5 - VLAN Tagging (802.1q) with Shared Uplink Set (SUS) with Link Aggregation using LACP (802.3ad) - VMware ESX"

    On the 4900M, LLDP sees the Virtual Connect and LCAP up with 2 active links.

    Show interface on Ten1/1, Ten1/2, Port-Channel 1 shows 0 packets input.

    Basically, we can not get any packets from the HP Server/VMware server side through the Catalyst 4900.

    IOS version: 12.2(54)SG

    Switch ports are as follows:
    !
    interface Port-channel1
    description HP FLEX-10-VC
    switchport trunk allowed vlan 4,8,10,11,16,22-24,69,99-  101,156,192,300,500
    switchport mode trunk
    switchport nonegotiate
    spanning-tree portfast trunk
    !
    interface TenGigabitEthernet1/1
    description HP FLEX-10-VC
    switchport trunk allowed vlan 4,8,10,11,16,22-24,69,99-101,156,192,300,500
    switchport mode trunk
    switchport nonegotiate
    spanning-tree portfast trunk
    channel-protocol lacp
    channel-group 1 mode active
    !
    interface TenGigabitEthernet1/2
    description HP FLEX-10-VC
    switchport trunk allowed vlan 4,8,10,11,16,22-24,69,99-101,156,192,300,500
    switchport mode trunkswitchport nonegotiate
    spanning-tree portfast trunk
    channel-protocol lacp
    channel-group 1 mode active
    !

    https://supportforums.cisco.com/thread/2063375