bigblueorange.com The Salty Network

I just got an email about automating some configuration changes, so I figured I would just post about it and send the link.

Basically anything on a network device can be scripted out using Expect as long as it has SSH or Telnet access open to it. There are other ways,such as SNMP set, but I use expect.

Here is a really simple one that you just run from a Linux shell:
/usr/bin/expect
set timeout 10
set hostname “10.4.5.6″

set username “name”
set password “password”
set enablepassword “itsasecret”
spawn telnet $hostname

expect “Username:” {
send “$username\n”
expect “Password:”
send “$password\n”

expect “>” {
send “en\n”
expect “Password:”
send “$enablepassword\n”
expect “#” {
send “config t\n”
expect “#”
send “no tacacs-server host 10.4.11.2
no tacacs-server key 1 *******

tacacs-server host x.x.x.x
tacacs-server key ********

wr me
exit
”
}
}

interact
}

Here is a more automated one that uses the script and a list of IP addresses that you supply in a separate text file named “fw_IP.txt” (or whatever you like, just change it in the script on line 8 also):

#!/bin/sh
# argument for username
#echo $1
# argument for password
#echo $2
# argument for enable password
#echo $3
for i in $(cat fw_IP.txt); do
#echo $i
expect -c ‘
set timeout 15
spawn telnet ‘”$i”‘
expect -re “(sername:|ogin:)” { send “\’”$1″‘\r” }
expect -re “assword:” { send “\’”$2″‘\r” }
expect -re “(>|#)” { send “\enable\r” }
expect -re “assword:” { send “\’”$3″‘\r” }
expect -re “(fw1|fw2|fw3)(>|#)” { send “\show arp\r” }
expect -re “(>|#)” { send “\show run | in static\r” }
expect -re “(>|#)” { send “\exit\r” }
‘
done

This document provides an overview of Cisco’s Storm Control including configuration steps and examples as well as implications of using storm control.

The purpose of storm control is to prevent a packet storm from over-utilizing the resources of a switch. By default storm control is not configured and must be enabled on a per-interface basis. There are three types of storm control; unicast, multicast, and broadcast, and they are all configured separately using the following options, taken from Cisco’s website;

 
 Command
 Purpose
 
Step1
 configure terminal
 Enter global configuration mode.
 
Step2
 interface interface-id
 Specify the interface to be configured, and enter interface configuration mode.
 
Step3
 storm-control {broadcast | multicast | unicast} level {level [level-low] | bps bps [bps-low] | pps pps [pps-low]}
 Configure broadcast, multicast, or unicast storm control. By default, storm control is disabled.

The keywords have these meanings:

• For level, specify the rising threshold level for broadcast, multicast, or unicast traffic as a percentage (up to two decimal places) of the bandwidth. The port blocks traffic when the rising threshold is reached. The range is 0.00 to 100.00.

• (Optional) For level-low, specify the falling threshold level as a percentage (up to two decimal places) of the bandwidth. This value must be less than or equal to the rising suppression value. The port forwards traffic when traffic drops below this level. If you do not configure a falling suppression level, it is set to the rising suppression level. The range is 0.00 to 100.00.

If you set the threshold to the maximum value (100 percent), no limit is placed on the traffic. If you set the threshold to 0.0, all broadcast, multicast, and unicast traffic on that port is blocked.

• For bps bps, specify the rising threshold level for broadcast, multicast, or unicast traffic in bits per second (up to one decimal place). The port blocks traffic when the rising threshold is reached. The range is 0.0 to 10000000000.0.

• (Optional) For bps-low, specify the falling threshold level in bits per second (up to one decimal place). It can be less than or equal to the rising threshold level. The port forwards traffic when traffic drops below this level. The range is 0.0 to 10000000000.0.

• For pps pps, specify the rising threshold level for broadcast, multicast, or unicast traffic in packets per second (up to one decimal place). The port blocks traffic when the rising threshold is reached. The range is 0.0 to 10000000000.0.

• (Optional) For pps-low, specify the falling threshold level in packets per second (up to one decimal place). It can be less than or equal to the rising threshold level. The port forwards traffic when traffic drops below this level. The range is 0.0 to 10000000000.0.

For BPS and PPS settings, you can use metric suffixes such as k, m, and g for large number thresholds.
 
Step4
 storm-control action {shutdown | trap}
 Specify the action to be taken when a storm is detected. The default is to filter out the traffic and not to send traps.

• Select the shutdown keyword to error-disable the port during a storm.

• Select the trap keyword to generate an SNMP trap when a storm is detected.
 
Step5
 end
 Return to privileged EXEC mode.
 
Step6
 show storm-control [interface-id] [broadcast | multicast | unicast] 
 Verify the storm control suppression levels set on the interface for the specified traffic type. If you do not enter a traffic type, broadcast storm control settings are displayed.
 
Step7
 copy running-config startup-config
 (Optional) Save your entries in the configuration file.
 
 

To disable storm control, use the

no storm-control {broadcast | multicast | unicast} level interface configuration command.

For configuration, use the following commands;

Switch# configure terminal

Switch(config)# interface gigabitethernet0/1

Switch(config-if)# storm-control unicast level pps 60k 50k

This configuration would stop forwarding packets when the traffic on the interface reached 60k packets per second, and would not begin forwarding packets again until it dropped below 50k packets per second.

Note: Some customers will require a higher threshold or may need unicast storm-control disabled on certain interfaces to support extremely high bandwidth services.

This document provides a short overview of the limitations of Windows Streaming Media Services when using a Cisco ASA Firewall.

Protocols Used by Windows Media Services 9
Microsoft Windows Media Services 9 uses two protocols to deliver streaming media to client computers: RTSP (Real Time Streaming Protocol) on TCP port 554, and MMS (Microsoft Media Server) on TCP port 1755. If these ports on a firewall cannot be opened, port 80 (HTTP) can be used to stream content via a Windows plug-in. However, if any other service, such as IIS, is using port 80 on the same IP address, you cannot enable the plug-in.

Protocol Rollover
Earlier versions of Microsoft Media Player do not support RTSP, so Microsoft Media Services 9 features automatic protocol rollover. If a computer tries to connect using an earlier version of Windows Media Player using an MMS URL (mms://server/video.file), the best protocol is automatically negotiated.

Limitations
Many protocols open secondary TCP or UDP ports. The initial session negotiates a connection using a well known port number (0 – 1023) and dynamically assigns any additional port numbers. When application-inspection is used on a firewall, the firewall monitors sessions and dynamic port assignments for a session. By default, the ASA firewall configuration matches all application inspection traffic on all interfaces, however, rtsp-inspection does not support NAT, so rtsp-inspect must be disabled on the firewall.

Solution
Since all application inspection is on by default on Cisco ASA firewalls, the configuration must be changed. This can be done by changing the global inspection policy as shown below:

class inspection_default
no inspect rtsp

This can also be done using the ASDM using these steps from the Cisco website:

Step 1 Click Configuration > Firewall > Service Policy Rules.
Step 2 Add or edit a service policy rule according to the “Adding a Service Policy Rule for Through Traffic” section on page 23-4.  If you want to match non-standard ports, then create a new rule for the non-standard ports. See the “Default Inspection Policy” section for the standard ports for each inspection engine. You can combine multiple rules in the same service policy if desired, so you can create one rule to match certain traffic, and another to match different traffic. However, if traffic matches a rule that contains an inspection action, and then matches another rule that also has an inspection action, only the first matching rule is used.
Step 3 On the Edit Service Policy Rule > Rule Actions dialog box, click the Protocol Inspection tab.
For a new rule, the dialog box is called Add Service Policy Rule Wizard – Rule Actions.
Step 4 Check each inspection type that you want to apply.
Step 5 (Optional) Some inspection engines let you control additional parameters when you apply the inspection to the traffic. Click Configure for each inspection type to configure an inspect map.
You can either choose an existing map, or create a new one. You can predefine inspect maps from the Configuration > Firewall > Objects > Inspect Maps pane. See the “Inspect Map Field Descriptions” section for detailed information of each inspect map type.
Step 6 You can configure other features for this rule if desired using the other Rule Actions tabs.
Step 7 Click OK (or Finish from the wizard)

I set this up on my laptop just to try out the Vyatta platform, but it can, and should be run on dedicated hardware for any practical usage. Here’s how I set it up;

1. Download and install the (free) VMWare Player.

2. Download the VC5 Virtual Appliance from Vyatta.

3. Unzip the files to a new folder.

4. Double click the .vmx file in the folder and VMWare Player will open.

5. Click “Power on this virtual machine”.

6.  The Vyatta router appliance will boot up and ask for your username and password, which are “vyatta” and “vyatta”.

7.  After you have logged in you will probably want to enable web (GUI) access, which will require a few configuration changes. Start by typing “configure” to enter configuration mode.

8.  Set up an interface for your internal network. Example: “set interface Ethernet eth0 address 192.168.0.1/24”

9.  Enable web access; “set service https”.

10.  Then you have to save your changes by typing “commit”.

11.  Now open your web browser and enter the address you gave the router.

 
12.  If you get the certificate error, just click “continue to this website…”

13.  Login using the default username and password “vyatta”.