ASA8.x - ASDM vs. CLI a sprawa SSL VPN, etc
Hej,
Uff nieco czasu uplynelo i sie zbieralem, zbieralem i jakos sie nie zebralem na skrobniecie jakiegos blogowego wpisu... Obiecuje, ze sie poprawie ![]()
Planowany temat wpisu byl inny, ale nie udalo mi sie zakonczyc testow, ktore chcialem opisac, tak, wiec dzisiaj krociutka wzmianka o "problemie" z konfiguracja niektorych parametrow w SSL VPN na ASA soft 8.x.
Skonczyla sie pewna era dla milosnikow CLI (w tym dla mnie ;-( ) otoz, od softu 8.x (moze bylo to tez w ver 7.x a nie odnotowalem tego, wiec prosba o info). Otoz, czesc parametrow zwiazanych z SSL VPN mozliwa jest do skonfigurowanie tylko via ASDM, np. zawartosc Bookmark-List. To samo dotyczy edycji Portalu (Customization).
Z tego co wiem takich kwiatkow jest wiecej, ale ich jeszcze nie wylapalem...
Tak wiec, jesli ASDM dotychczas nie byl Twoim przyjacielem, to teraz z pewnoscia bedzie ![]()
Dodatkowo, patrzac na ewolucje GUI do PIX/ASA, to trzeba przyznac, ze od czasow PIXowego PDM sporo sie poprawilo, szczegolnie w ostatnich wersjach ASDM, i wyglada to naprawde dobrze, a co najwazniejsze klienci sobie chwala. Oczywiscie optymalizacja konfiguracji, czy tez nazewnictwo komponentow jak ACL, czy crypto map, pozostawia ciagle wiele do zyczenia, ale jest to widoczne tylko jesli uzywa sie rownoczenie CLI. Dla ludzi uzywajacych wylacznie GUI nie ma to w sumie wiekszego znaczenia ![]()
Ole, tyle na dzisiaj, czas pospac ![]()
Cheers
Seba
ebgp-multihop and error messages
Sometimes error messages on IOS platform might be a little more descriptive. Lets consider a following one:
5w4d: %BGP-3-NOTIFICATION: received from neighbor 172.16.5.1 2/5 (authentication failure) 0 bytes
Seems to be easy to debug - authentication failure on BGP session. The only problem is there is no authentication configured between routers and one of them is Juniper. Deep look into configuration of Cisco
router bgp 65511
bgp router-id 172.16.255.2
bgp log-neighbor-changes
neighbor 172.16.5.1 remote-as 65509
neighbor 172.16.5.1 ebgp-multihop 10
neighbor 172.16.5.1 update-source Loopback1000
!
address-family ipv4
neighbor 172.16.5.1 activate
no auto-summary
no synchronization
network 172.16.254.1 mask 255.255.255.0
network 172.16.255.2 mask 255.255.255.255
exit-address-family
and Juniper
neighbor 172.16.255.2 {
export export-direct;
peer-as 65511;
}
and problem is obvious - no multihop configured on Juniper. Session between routers couldn't be established because of default TTL of 1 on eBGP session. But why Cisco can't clearly tell us about that in error message?
Hello
Witam wszystkich
Jest to mój pierwszy w życiu wpis na jakimkolwiek blogu więc proszę o wyrozumiałość![]()
Ilość wypowiedzi będzie uzależniona pewnie od ilości wolnego czasu ale generalnie postaram się skupić na swoich doświadczeniach związanych z pracą z urządzeniami typu routerki od 26xx do 76xx oraz switche od 2924 do 40xx (w przyszłości również 65xx)
Będzie pewnie też coś na temat łączy oferowanych w naszym kraju oraz oczywiście coś związanego z przygotowaniami do różnych egzaminów (w tym CCIE który obecnie mam na tapecie)
Pozdrawiam i miłego czytania
Timers for fast convergence in ISIS
There are several methods to speed up ISIS convergence. Using timers is one of the techniques. ISIS utilizes the SPF (Shortest Path First) algorithm as a way to create the topology view of the network. Changes in the topology trigger to run SPF or PRC (Partial Route Computation). Once a calculation is complete the router sends LSP update to other neighbours. The next device launch SPF or PRC. LSP is generated and sent to adjacent routers. And so on. The network is converged if the LSP database is the same on all routers. This process can be delayed significantly as there are two main holdups which is waiting for SPF or PRC run as well as an LSP generation. There are three timer based commands to improve this. The syntax of the first command linked with SPF is as follows:
spf-interval spf-max-wait spf-initial-wait spf-second-wait
spf-max-wait - It is the maximum time between SPF runs (in sec).
spf-initial-wait - Delay between the first event in the network which trigger SPF run and the actual start-up of SPF (in msec). The default value is 5500 milliseconds which should be definitely altered.
spf-second-wait - Time between first and second SPF calculation (in msec).
An example:
spf-interval 5 10 1000
The initial SPF run is after 10 milliseconds. Then wait 1 second before the next SPF. The next SPF is run after 2 seconds, then 4 sec, 5 sec, 5 sec .. as the maximum wait is set up to 5 seconds. Of course SPF is launched only if there is a trigger. The root cause to do so may be disconnecting/connecting a transit path or a node. When the network is stable and there are no triggers for two times of the maximum wait (10 sec in this example) the delay return to the beginning interval 10 msec.
The second command is reffering to PRC with the following syntax:
prc-interval prc-max-wait prc-initial-wait prc-second-wait
The meaning of timers is identical as previously but with the relation to PRC. Partial Route Computation is much quicker (even 10 times) than SPF and is usually run when leaf prefix is added or removed. It is advisible to use just 1 sec as prc-max-wait as PRC computation before that time. PRC processes about 20 prefixes per millisecond. Thus 1 second for 20000 prefixes is enough in most of the cases. The prc-initial-wait interval can be very low even 1 msec as the backoff mechanism (set prc-second-wait to a higher value) prevents PRC from a constant prefixes flapping.
An example:
prc-interval 1 1 20
SPF and PRC are responsible for calculation the network topology tree. The last command listed here is to improve the LSP generation time.
lsp-gen-interval lsp-max-wait lsp-initial-wait lsp-second-wait
Note that the default lsp-initial-wait is just 50 msec which is very low but still can be changed even to 1 msec. Simply no need to wait for LSP generation. Default settings of lsp-max-wait (5 sec) and lsp-second-wait (5 sec) can also be tuned to as low value as 1 sec and 1 msec respectively.
An example:
lsp-interval 1 1 50
Not only one recommended set of values can be found for timers listed above. Depending on sources it might be "5 1 20" for every of the commands. Some presentations suggest 1 sec max-wait for PRC and LSP generation and the higher than 1 msec value for the second-wait. It vary and depends on the network scale but the initial-wait is definitely not the main concern and can be tuned to the lowest 1 msec interval.
No pausing multi-screen output
Managing routers requires logging the output of several show commands. It is much quicker to turn on logging, paste a list of commands and just to wait until the task is done.
On Juniper routers it is required to add no-more keyword after the pipe |.
What about Cisco? Are you irritated by stroking a space key to see the whole running-config? To avoid it use terminal length 0 to get the output in one block without showing --More-- on the screen. Zero in the command means no page limit. To go back to a former status type terminal no length 0 or terminal length 24. Similarly, ASA has the pager 0 instruction which also turns off pausing.
Seba & blog
Oto pierwszy wpis, powiedzmy testowy ![]()
Jakos dotychczas nie bylem, i ciagle nie jestem, do konca przekonany, czy pisanie bloga to jest cos dla mnie. Ciagly brak czasu i inne takie "problemy" blokuja zazwyczaj takie akcje.
No, ale coz, sprobujemy jak to bedzie ![]()
Tyle tytulem wstepu.
Cheers!
