Windows IP conflict when there is no conflict
Just had an interesting problem with a customer that seems a bit obscure, so I figured I would write it down to help someone else. All of the other solutions to this issue focus solely on there being a problem on the Windows side, which may not necessarily be the case.
Situation: customer is setting up a Windows 2008 R2 server in a VMware cluster, on a VLAN that is sitting behind a firewall. The firewall is is the gateway for the VLAN (say 192.168.34.1). When configuring the network interface on the server, picking ANY IP address in the 192.168.34.0/24 network results in the error message “Windows had detected an IP address conflict”. This happens even if there are no other devices on the VLAN aside from the firewall.
The issue? There was a static (identity) NAT entry in the Cisco ASA firewall for 192.168.34.0/24. By default, Cisco firewalls will proxy ARP for NAT entries.
- (8.3(1), 8.3(2), and 8.4(1)) The default behavior for identity NAT has proxy ARP disabled. You cannot configure this setting.
- (8.4(2) and later) The default behavior for identity NAT has proxy ARP enabled, matching other static NAT rules. You can disable proxy ARP if desired.
This is desirable behavior for a firewall on the edge of the network because the upstream router needs to know where to send traffic for NAT’ed hosts. For internal firewalls this can cause issues, especially with 8.4 code where you need to setup identity NAT to exempt devices from NAT.
The solution? Add “no-proxy-arp” to the end of your identity NAT statements:
nat (inside,outside) source static obj_Internal obj_Internal no-proxy-arp route-lookup
The other (less desirable) solution is to disable the ARP-checking functionality in Windows, but this means it won’t be able to detect a legitimate IP conflict. You can do this through a quick registry hack: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, create a DWORD named “ArpRetryCount” with a value of “0?.
Configuring a port analyzer (port mirror) on the Juniper EX switch
Yes, it's been a while since my last update, so I'm going to make this one short and sweet. Lately I started messing around with Plex Media Center/Server and sharing my server with a couple of my friends. While I do have a good bit of bandwidth here at the house, my friends sure know how to suck that bandwidth dry. So, it's time to implement some traffic shaping here at the house.
In order to implement the traffic shaping, I need to know what the traffic looks like. For me to shape it, I need to know what it looks like, so I'm going to setup an analyzer. I have a specific media server that is separate from my lab rack. It's plugged into a little Cisco gigabit switch that has an LACP Lag bundle going back to my core EX3200-48T. To setup an analyzer is very simple...in fact, it's only 3 commands.
set ethernet-switching options analyzer plex–monitor input ingress interface ae0.0 set ethernet-switching options analyzer plex–monitor input egress interface ae0.0 set ethernet-switching options analyzer plex–monitor output interface xe-0/0/45.0
That's it. Now, let me explain what I did there.
To configure an analyzer called "plex-monitor" and specify the input (source) interfaces and the output interface, I need to configure the interface connected to my media server as input interfaces for the port-mirror analyzer. I want to see both ingress and egress traffic, so I tell it to do both.
[edit ethernet-switching-options] user@switch# set analyzer plex-monitor input ingress interface ae0.0 user@switch# set analyzer plex-monitor input egress interface ae0.0
Now, I configure the output analyzer interface for the analyzer. This will be the destination interface for the mirrored packets:
[edit ethernet-switching-options] user@switch# set analyzer plex-monitor output interface ge-0/0/45.0
That's it. Now, all the traffic going to that lag bundle (the server is the only thing plugged into that switch) will be mirrored to port ge-0/0/45. I can plug my Wireshark box into that port, get a good capture of the traffic, and set my traffic shaping accordingly. Can you guess what my next post is going to be about? 
QoS issues on Cisco 2960′s. (High CPU Utilization)
Recently I've run into two clients that were issues with the Cisco 2960G and 2960S switches. Both clients are using PoE versions of the switch for VoIP applications. They were noticing jitter, packet loss and poor call quality, even though QoS is configured on the switch. After a lot of troubleshooting on the voice side of the house, they came to me to see if I could find anything going on. In digging around in the first customer's network, I noticed that the CLI was pretty slow and did a quick "show processes cpu" and saw that the cpu utilization was around 80%. By sorting the processes, I saw that the Hulc LED process was taking up about 15%. A quick search of the Cisco Bug Toolkit brought up Bug ID CSCtg86211 (you need a CCO account to view), even though that's not 100% correct. It's the only one that explained what's going on.
I had the client open a TAC case and TAC wanted to fight with the client, telling them that the high CPU shouldn't have any effect on the switch performance (really!). I suggested that the client upgrade the switches to the latest version of IOS and once that was done, all the voice quality issues disappeared. Total CPU utilization dropped to below 20%, calls cleared up, everything was beautiful.
Last week, I got an email from one of our project managers asking if I could look into an issue that another client was having. If I hadn't known that this was a different client, I would have thought that she had cut and pasted the exact problems that the first client was having. When I found out that they were using 2960's, I immediately thought of this and sent the client a copy of thev bug report and told him to open a TAC case. This is the email I received from him:
I tested the CPU Utilization on all of our Cisco 2960Ss and they ranged between 68-99%. I have a test switch on the bench with nothing connected and it was running at 75%. I updated it with the new code and it dropped to the 20-35 % range. I am going to update some additional switches before I call Cisco. The first question they will probably ask is are you running the latest code.
He's right... Cisco will be wanting to know that. I know that once the new IOS is on the switch, it'll solve his problems. I just wanted to put this out there so you guys don't have to do all the searching that I did when/if you run across the same issues on your end.
Preparing for my JNCIA-EX
I think I'll have a little departure from my regular how-to's today. As you can see from the title of this post, I'm preparing to take my JNCIA-EX, or Juniper Networks Certified Internet Associate - Enterprise Switching. I'm sure you all know that I'm a born and bread Cisco kid. Hell, www.ciscokid.net actually points to this site! But I've been spending a lot of time working on Juniper gear lately and it's in my best interest to get some Juniper certs under my belt. Part of my preparation has been trying to stay out of my Cisco lab for a little while. I find that when I spend a lot of time playing with the Cisco gear, I instinctively try to use Cisco commands in a Juniper environment. So, if I don't get into the Cisco stuff for a little while, I'll train myself to think like a Juniper engineer!
Juniper has been a real pain in my ass lately. I absolutely love their hardware. It's some of the fastest gear I've ever worked on and I've never seen the kind of speed to the desktop on Cisco as I have seen on Juniper. It's just that I've spent so much of my career working on one thing that being thrown into something else is not fun. I thought it would be at first; learning something new would give me a challenge and be interesting. Well, it's hasn't been such a great honeymoon phase. The environment I'm working has some issues, and that's about all I'm going to say about it. I'll be going to Herndon, VA for a week to get the training I need to try to solve some of these issues, not to mention another week to attend a data center design class, and I hope that this training will bring me to the level that I can help these people.
I really wish I could speak my mind here and tell you guys about the problems I'm seeing and maybe get some ideas from my readers on how to fix some of this stuff, but I can't. I can't let out any info on the network and I won't talk good or bad about any particular hardware in public. Maybe one day I'll be able to put up a big post with a Visio to see if any of you guys can solve a problem. Hell, I just may create something and give away a prize to the first person to get the correct answer. If anyone has an idea, be sure to let me know!
ASA 8.3(2) is out, as is ASDM 6.3(3)
I got off my ass tonight and decided to update the ASA (yes, my licensing is correct!). I haven't had a chance to play with it a while lot (you can see it's only been up for 3 and a half hours), but it seems pretty cool. I sat down and read the release notes for 8.3(2) and there's a few things you should know. First off, you're going to need more memory. Well, if you look at mine, you can see I've maxed out what the thing will accept, so I'm perfectly safe; but chances are, you're not. Cisco has a nice table to let you know what your memory needs are. In fact, if you head over to this web page, you check out the release notes for both 8.3(1) and 8.3(2). You'll see the new features as well as caveats fixed with these versions. Now that I have informed all you guys about the upgrade, I'm going to start playing with it for a little bit before the sun comes up and kills me. Dammit! It's already 1am!
Port Forwarding on the Cisco ASA in 8.3 from the ASDM made easy
In my last post I taught you how to forward a port on the ASA 5505 running version 8.3 from the CLI. Some of you prefer to use the ASDM to do you changes, so I guess I'll show you how to do it from there. The ASDM is a bit of a learning curve for someone that's used to the CLI, and most CLI guys hate a GUI with a great passion. I can go either way. I use the ASDM to make some changes simply because I want to learn it and there's some guys coming into the field today that were taught on the GUI rather than a command line.
In this lesson I'm using ASDM version 6.3(1) and ASA version 8.3(1). Since we added a web server in the last post, let's make this one an FTP server. The FTP server's IP is the same as the web server, 10.9.8.7/24 and we're running over the standard FTP port, 21.
First off, we want to start up the ASDM and connect to the ASA. Once there, click on the 
button at the top of the screen, then the 
button near the bottom left, and finally select 
near the top left. You'll now be at a screen that looks something like this:
Click for larger version
Now we need to create a new object, so click on "Add" under Addresses, then "Network Object".
Now we need to fill out our new window. Once you fill out the name, IP address and description, you need to drop down the NAT box and fill it out. Click the "Add Automatic Address Translation Rules" box, leave the type as "static" and set the translated address as the outside interface.
We now need to go to the Advanced menu from the Add Network Object window and setup the port forwarding. The source will be inside, destination is outside. Protocol in this instance is TCP and our port is 21, both real and mapped.
Click "OK" twice and your object will be created as well as the port forward. Now we just need to add the access rule. On the left side of the screen, just above the NAT Rules is your Access Rules. From there we want to click "Add" and "Access Rule".
We need to create the rule on the outside interface, coming from any IP to the FTPServer using FTP as the service.
Once you click OK, your rule is added. You don't have to add a description like I did in the image above this one, I just did that for the hell of it. When you click "Apply" at the bottom of the screen, the ASDM will issue the commands to the ASA. I have preview turned on, so I can always see what commands are being sent to the device before they are actually sent. If you followed all the steps above and you have preview turned on, you'll see the following:
And you'll notice that those are the exact 4 commands that I gave in the last post about doing it from the CLI! Now you can forward any port you want from either the CLI or the ASDM!
On a side note, I know a lot of guys hate the ASDM. When I was writing this post and going through all of this I was kinda upset when I saw that I had 10 pictures for 4 lines of code. The good thing about the ASDM is that you have everything right there at your disposal and you really don't need to know the vernacular of IOS. The drawback is that it will take you longer to get things done at first, but once you get used to it, it can be just as fast.
Port Forwarding on the Cisco ASA in 8.3 from the CLI made easy
So it's been a month and a half since I posted an update, and it's 4:15 am right now. I can't sleep and I found out there's another networking blog out there using the same WP theme as me, so I figured I better put something up here since it was fresh in my mind. Well, now that the niceties are out of the way, let's get to work.
I recently added an ASA 5505 to my home network at the edge. Obviously, when I did, all of my port forwards went to hell because the ASA is now blocking everything. I run a web server on one of my servers here and I like to be able to access it because I keep a lot of tech manuals and other stuff on there. Well, I went about trying to set up port forwarding the old way and learned real quick that this pops up when I do:
ERROR: This syntax of nat command has been deprecated.
Please refer to "help nat" command for more details.
Yeah, that sucks. On the new version of the ASA OS, global has gone the way of the dodo. I did a bunch of searches on Google to figure it out and everything I ran across was very hard to decipher. That's why I'm writing this. You can setup a port forward in 4 quick and easy steps. Just change the things that are underlined to fit your network and you'll be just fine.
In this example, we want to be able to access a web server behind the firewall. We'll assume you are using the standard HTTP port, the web server's internal IP address is 10.9.8.7/24, and that you at least know what you're doing enough to be configuring an ASA in the first place. I'll give you the steps, then I'll explain.
Step 1: Create a new object group for you web server.
asa5505(config)# object network Webserver
Step 2: Add the IP of the web server to the network group.
asa5505(config-network-object)# host 10.9.8.7
Step 3: Forward the port via the NAT command.
asa5505(config-network-object)# nat (inside,outside) static interface service tcp www www
Step 4: Exit back to the root and add the access list
asa5505(config)# access-list outside_access_in permit tcp any object Webserver eq www
That's it! Now, let's explain what's going on here. Cisco has started moving more and more towards use of object groups in their configs. It makes things easier, especially when you have a situation where you have 20 web servers behind the firewall and you want to add 1 more in. Rather than having to rewrite a whole bunch of ACL's, you just add the IP of the new web server into the object group and everything is done for you. After you create the object group (in this instance a network object, you can also create service objects), you add the IP of the specific object (or objects) that you want to point to. So here our web server is 10.9.8.7. If you want to send port 80 to more than 1 IP on your internal network, just add more IP's to that object group.
Now is the fun part. While we're in the object group, we need to NAT port 80 only to that specific object group, hence you're still at "asa5505(config-network-object)#" prompt. Now type "end" to get back to the regular config terminal and we need to open that port in the ACL. Yes, www = 80. You can type either one and you get the same result. If I have to go through and explain NAT, how it works and why I enter in that specific command to forward the port, then there's a possibility that I'd need to send you an invoice for my time because we would be here for a while.
This works for ANY port forward. If you want to RDP into a machine, simply replace port 80 (all those www's you see up there) with 3389. There is one caveat. You can only do one port forward per object group. So let's say that our web server is also an FTP server and you want port 21 to forward as well as port 80. You're going to have to create a whole new object group (object network FTPServer), put the same IP in the group (host 10.9.8.7), do the nat command again (nat (inside,outside) static interface service tcp ftp ftp), exit back to the root of config, and add the access list (access-list outside_access_in permit tcp any object FTPServer eq ftp).
This should get you up and running with you port forwards in no time flat. It is a bit of a pain in the ass to have to create a new object group for every port you want to forward, and maybe there's someone out there that's reading this right now thinking "dude, you don't have to create more than one group! You can just do...". Well, you need to enlighten the world with this knowledge and post it in the comments section. And if you're too scared to do so, shoot me an email to greg(at)gregledet(dot)net.
I'd also like to thank Stefan Fouant for an excellent class today on JUNOS Switching. I learned a lot in his class and you can learn a lot from his website. Check it out and tell him Greg sent ya!
Oil Spill ROV cameras
I've put all the ROV cameras in one place.
How to get past the new isoHunt Lite and get to the old original site
If you are a torrent hound like some people, you have probably noticed that on April 5th, isoHunt changed the site for US users. This REALLY sucks because it basically takes away your filtering capabilities and the ability to view the comments on the files. The thing is, isoHunt is my favorite .torrent search engine and I want my old isoHunt back!!! Well, if you're like me and you want the old isoHunt back, here's how you can do it. This also works on TorrentBox.com and any other site that blocks US users.
1. First off, you should already have a copy of Firefox installed on your computer. If you are only using IE, you have problems that I can't solve in a simple blog post. Go get Firefox and get it installed. If you have it installed already, go to step 2.
2. We need to download a Firefox Add-on called FoxyProxy. You can find it at http://foxyproxy.mozdev.org/ or you can skip straight to it by clicking here. Add FoxyProxy to Firefox. You'll need to restart Firefox after you install it.
3. You'll notice at the bottom right corner of Firefox that FoxyProxy is Disabled. It'll look like this: 
Go ahead and click on that or you can go to Tools -> FoxyProxy Standard and it will open the next window (click for bigger version):
4. Now we need to add some proxies. I like to use xroxy.com to find my proxies. One reason I like it is because you can setup the proxies with a single click. I'll show you how to do both. We need to find a proxy to use that will get us past the isoHunt lite and to the main site. To do this you can use proxies all over the globe. For this how-to, I'll use a proxy in Canada. I suggest that you try out various proxies until you find one that works best for you. I've used proxies in Canada, the UK, and many other countries, it just so happens, that Canada seems to be the fastest for me.
5. At xroxy.com you need to click on "By Country" or click the picture below:
6. Click "Canada" in the list on that page to bring up the list of all Canadian proxies. Once there, there's 2 ways of setting up a proxy in FoxyProxy, manually or automatically. For the auto setup, just click the FoxyProxy icon next to the proxy: 
.
7. To setup a proxy manually, there's many different how-to's out there that can be found in the help section of FoxyProxy's website. There's one with screenshots for an older version of FoxyProxy, and there's one written by FoxyProxy on how to configure the software.
8. Once you have the proxy setup, you need to tell the software how to use it. For the sake of simplicity, you can simply right click on the "FoxyProxy:Disabled" and tell it "Use proxy 'XROXY Proxy' for all URLs". You can also setup patterns for that proxy to use.
9. To setup patterns, double click the XROXY Proxy from the main screen in FoxyProxy. Click on the URL Patterns tab and Add New Pattern. When the screen comes up, enter the following:
Type the URL EXACTLY like I did with the /* behind it to use as a wildcard. If you don't do this, only the main page of isoHunt will go through the proxy and all the search pages will kick back the Lite version. Click OK and you'll have setup the pattern. Now you can tell FoxyProxy to "Use proxies based on their pre-defined patterns and priorities". Once you do that, all traffic going to isoHunt will pass through the proxy and all other traffic will go straight to the internet without going through a proxy.
Once you're back to the main isoHunt site, you're good to go. I highly suggest using µTorrent as your client and I would definitely download PeerBlock to use block unwanted traffic. Once you have PeerBlock installed, you can get your lists from iBlockList.com to stop all those evil people that you don't want accessing your network. If you want to surf anonymously, you can download Tor, but that will really slow you down. Onion routers like Tor will bounce your traffic all over the world before it finally makes it out to the cloud.
That should be all you need to know to get back to the main site of isoHunt. We really shouldn't have to take such measures simply to view a website. We need to support net neutrality and tell our lawmakers that we will NOT be censored, and if they do, we will simply find a way around them.
P.S. For all those Canadians living in the US and would like to watch shows like Canada's Worst Driver but can't, you can use this same method. Make sure you use a Canadian proxy.
Slipping past cell phone voice mail greetings
I hate people that put long drawn-out voice mail greetings on their cell phones. In fact, very few things will cause me to just hang up the phone and not leave an important voice mail more than that. That's why I've done a bunch of searches and decided to tell you guys (and leave it here for my future reference) just how to skip past the greetings. I have a friend of mine, we'll call him "Mary" that has a greeting in which he'll tell you his life story, website, and read "War and Peace" before it ends. I VERY rarely leave him a voice mail because I don't want to sit through that long ass greeting, not to mention eat up an extra minute on my cell phone. Now I don't have to!
Verizon: press *
Sprint: press 1
T-Mobile or AT&T: press #
Of course, you need to know what carrier the person you are calling is using. The way I figure out is simply trial and error until I hit the right one. I timed Mary's once (he's on Verizon) and if I would have left a message, I would have been into the 3rd minute of the call and eating up my shared minutes. After his long ass greeting, Verizon gives all the options (including giving a fax options!) of crap you can do. I'm not sitting through that crap. Now as soon as I hear that voice mail pick up, I slam a * into the phone and I'm done.
What I would like to see is people to put this info at the beginning of the greeting. Something like "Hi, this is Greg. Please press * to skip this greeting". That would go a long way and I'm willing to bet more people would be willing to leave voice mail for you if you did.
Categories
- How To's (10)
- Hurricanes (60)
- Networking (44)
- Other stuff (14)
Blogroll
- Adventures in Open Source
- Bejoy's Site
- Charlie Moreno Web Design
- Fark.com
- Greenhat security
- GregoryLedet.com
- JefTek.com
- Packet Life
- Shannon Bray
- Shortest Path First
Social Networking
Recent Comments
- friv on Windows IP conflict when there is no conflict
- Friv on Windows IP conflict when there is no conflict
- Greg Ledet on Create a Bitcoin/Litecoin ticker with your Raspberry Pi!
- dc602 on Create a Bitcoin/Litecoin ticker with your Raspberry Pi!
- friv on Windows IP conflict when there is no conflict
Meta
Certifications
