Daniel Kuchenski - The Network Stack (Page 3)

New Cisco ISR4000 Series Routers

I got the chance to install a new Cisco ISR 4431 today, and the best surprise (besides the hugely upgraded throughput) is that the onboard router interfaces now support LACP! Before, you had to resort to getting a switch HWIC module, or just using "mode on" channel-groups. Since the 4431

palo alto networks

Palo Alto Firewall HA PAN-OS Upgrade

Below are the steps I used to perform an PAN-OS upgrade from 6.0.4 to 6.0.6 successfully. 1. On the active fw (fw1), log into the cli and enter: request high-availability state suspend. This will force a failover to the secondary firewall (fw2). I lost 2 pings

palo alto networks

Palo Alto Firewall HA CLI Commands

>show high-availability all >show high-availability state >show high-availability link-monitoring >show high-availability path-monitoring Configuring High Availability: https://live.paloaltonetworks.com/docs/DOC-2926 After enabling HA, the interfaces on the firewall will switch from using the interface MAC address to a virtual MAC address. In my case, the Palo Alto updated the

dell

Updating Dell R710 Firmware

Deploying ESXi on some Dell R710 servers we had, so I wanted to update the firmware to latest and greatest. I came across some issues updating, which is why I'm posting this. First, I updated the iDRAC, using information from here: http://en.community.dell.com/techcenter/systems-management/w/wiki/

ruckus

Optimize Ruckus Configuration

I came across a good support forum post (link below) that goes over some CLI configuration changes to optimize your Ruckus setup. Personally, I enabled ofdm-only and changed the bss-minrate and have seen better roaming behavior: 1. SSH into your ZoneDirector 2. Verify your current WLAN settings with show wlan

palo alto networks

Palo Alto GlobalProtect VPN Users

Two quick cli commands to see who is currently logged in, and who logged in previously: show global-protect-gateway current-user show global-protect-gateway previous-user You can also specify the username with each command to see specific results. If want want to force a user logout (from my testing, the user will not

active-directory

Active Directory Delegating Permissions

I needed to delegate permissions to helpdesk (instead of making them domain admins) to create and modify users, and modify group membership. This is slightly different from some of the built in permission groups, since we didn't want helpdesk to delete users. Permissions are delegated at the OU level, and

palo alto networks

Palo Alto Firewall AD Group Mapping

These commands will help troubleshoot and resolve issues with Active Directory groups on your PAN firewall. 1. Shows every AD group added to the PAN firewall: show user group list 2. Shows the user and IP address mapping (or specific user): show user ip-user-mapping all 3. Gives more detailed statistics

ruckus

Ruckus DHCP Filtering/Manipulation

By default, when a client connects to a Ruckus AP and sends a DHCP request, the DHCP request is converted to unicast, and once an IP addresses has been provided to the client, additional DHCP requests from the same client seem to be ignored. This normally works great, and significantly

ubuntu

Linux Packet Capture

If you need to debug traffic going to a linux server or appliance, you can use tcpdump to generate a pcap file you can analyze in wireshark. For example, ssh into the server, and use the following command: tcpdump -s0 port 80 and host 192.168.1.10 -wDebugTraffic.pcap

windows

Windows Server 2008R2/2012 Time Sync

I published a blog post last year regarding verifying NTP settings on a Windows Server. Now, I recently needed to go a step farther and force a server to time sync with a DC. Here are the relevant commands: To find out what server is the time server on your

cisco

Cisco vs HP vs Dell CLI - VLAN Configuration

This post continues my series on the differences between these three manufacturers and how they implement L2 and L3 VLANs. Scenario 1: Create a Layer 2 VLAN Cisco IOS: vlan 10 HP Procurve: vlan 10 Dell Powerconnect: vlan database vlan 10 Scenario 2: Create a Layer 3 VLAN (that's routable)

cisco

Cisco vs HP vs Dell CLI - Interface Configuration

After working with all three switch manufacturers in a short period of time, I figured I would do a quick post on how each chooses how to implement VLANs at the interface level. Scenario 1: Switchport needs to be part of a single native VLAN (VLAN 10) Cisco IOS: interface

hp

HP ProCurve Switch Configuration

After working with ProCurve switches for a while, I figured I would post my general configuration for others to use as a template. This configuration will be a simple setup with two VLAN's, please replace IP addreses and VLAN ID's with what fits your environment: hostname HP-PROCURVE-CORE time timezone -480

ShoreTel Voice Mail Email - Exchange or Google Apps

Plenty of customers choose to setup voicemail "send to email" functionality, so that the ShoreTel system emails the user when they receive an voicemail. The feature isn't extremely well documented, so I will attempt to explain how it works to assist with the troubleshooting process. 1. ShoreTel Director receives a

shoretel

ShoreTel Voicemail Switch Backup

If you do not do daily backups on your 50V or 90V switches, these steps will allow you to backup and restore voicemails. 1. On the ShoreTel Director server, go to the C:\inetpub\ftproot folder and edit the security permissions, so that "\Users" have Write permissions 2. Log into

shoretel

ShoreTel Virtual Voice Switch VMware Tools

VMware Tools needs to be manually upgraded on the new ShoreTel Voice vSwitch or ShoreTel Virtual SA100. As these appliances are running linux, here is the article that VMware published: http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.upgrade.doc_50%2FGUID-08BB9465-D40A-4E16-9E15-8C016CC8166F.html

cisco

Cisco 6500 "Environment Checksum in NVRAM Failed"

Had an issue where an older Cisco 6500 switch was rebooted, and the MSFC would not start correctly and gave the following errors: "environment checksum in nvram failed" and "rommon nvram area is corrupted". When trying to log into the the module from CatOS (session 15), the console stated that

shoretel

Telnet Commands for ShoreTel Switches - Part 2

I've already posted how to enable telnet and get to the shell for ShoreTel (non-V) switches here. Here are some more advanced commands that I have found useful for troubleshooting: Show network interface information: ifShow Test LSP UDP connectivity to "192.168.1.1", repeat 100 times: lsp_ping "192.

cisco

DMVPN Troubleshooting Commands

Some basic IOS IPsec/DMVPN commands to aid with troubleshooting: show dmvpn detail show ip nhrp show ip nhrp multicast show crypto isakmp sa show crypto isakmp policy show crypto ipsec sa show run | s isakmp show run | s ipsec show run | s interface Tunnel debug crypto isakmp debug crypto

cisco

IP SLA, Track Lists and Route Tracking

IP SLA is a powerful tool, which I will only scratch the surface of in this post in regards to route tracking. I had a scenario where the primary default route should be removed if the internet was no longer accessible through the primary interface. This can be achieved with

shoretel

ShoreTel VPN Concentrator NTP Vulnerability

The ShoreTel VPN Concentrator responds to NTP requests (for remote IP phones), which makes it vulnerable to the NTP DDOS attacks that have been happening lately. To enable the WAN firewall on the ShoreTel VPN Concentrator (off by default) you must access a hidden menu. 1. Log into your VPN

cisco

Cisco 3560-X Password Reset

1. Unplug Cisco 3560-X power 2. Hold down "Mode" button on front, and plug in power 3. Continue to hold "Mode" for about 15 seconds, until the SYST LED turns solid green, then release 4. Log into the switch via console, you should see the "switch:" prompt 5. Enter the

cisco

Cisco Show Command for ACL Interfaces

While browsing networkengineering.stackexchange.com, I came across an interesting post regarding easily finding interfaces in a config that have an ACL applied. The thread is found here, and the command is as follows (credit goes to @Santino from the thread): show ip interface | include line protocol|access list

windows

802.1X Wireless Authentication in a Windows Environment

Recently came across an issue where users in an 802.1x wireless environment were logging into their laptops, and the AD logon script would run before they had wireless network connectivity. This was a problem since their network drives would not map. While the users blamed the wireless network, the