GregLedet.net That dude writing stuff about that thing.

7Jul/177

IPv6, Time Warner / Spectrum, and the Juniper SRX.

I've had an IPv6 tunnel from HE.net for quite some time now. Back when I was running the ASA 5505 as my edge, I had to put a router behind it to create the tunnel. Then, when I replaced the ASA with an SRX 220 back in December 2015, I was able to build the tunnel natively on the SRX. Since that time, Time Warner has gotten around to providing IPv6 in my area and I've tried a couple different times to get it working with no luck. Now, I've finally decided that I wasn't going to stop working on it until I got it working, and I've done just that, so it's time to tell you guys how to do it yourself.

First a few caveats... Obviously, Time Warner (now Spectrum) needs to provide IPv6 in your area and that your modem supports it. I don't remember how I found out that they finally had it here, but it was probably a fellow network engineer at TWC that told me. Second, realize that you're going to have to reboot the SRX, so you're going to lose connectivity for a bit. The reason you'll need to reboot is that we need to enable IPv6 flow mode, otherwise the SRX will just drop IPv6 traffic. Let's start with that...

Obviously, ssh into the SRX and enter config mode. Then enter the following command:

set security forwarding-options family inet6 mode flow-based

Then you'll need to reboot with "request system reboot". Once it comes back up, you're ready to move on.

Your ge-0/0/0.0 interface probably looks something this at present:

greg@SRX220H# show interfaces ge-0/0/0.0

description "Uplink to Cable Modem";

family inet {

    dhcp;

}

We're going to need to change the dhcp daemon that you're using on that interface because if we were to continue on with what's coming, you'd get an error. Then we're going to add the ipv6 dhcpv6-client config to the same interface. Here's your commands:

delete interfaces ge-0/0/0 unit 0 family inet dhcp
set interfaces ge-0/0/0 unit 0 family inet dhcp-client
set interfaces ge-0/0/0 unit 0 family inet6 dad-disable
set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client client-type statefull
set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client client-ia-type ia-na
set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client client-ia-type ia-pd
set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client lient-identifier duid-type duid-ll
set interfaces ge-0/0/0 unit 0 family inet6 dhcpv6-client update-router-advertisement interface vlan.0

Now we need to set our firewall to allow some traffic:

set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic system-services dhcpv6
set security zones security-zone untrust interfaces ge-0/0/0.0 host-inbound-traffic protocols router-discovery

That should be pretty self explanatory. You need to allow dhcpv6 through the firewall for all this to work, and we're going to use router-discovery to figure things out. Once you commit that, the SRX should ask TWC for an IPv6 address. Let's check to see if we got one...

greg@SRX220H# run show dhcpv6 client binding

IP/prefix                       Expires     State      ClientType    Interface       Client DUID

2607:fcc8:ffc0:5:14c9:b140:XXXX:XXXX/128 600553 BOUND  STATEFUL      ge-0/0/0.0      LL0x3-54:e0:32:ec:XX:XX

2605:a000:XXXX:XXXX::/64        600553      BOUND      STATEFUL      ge-0/0/0.0      LL0x3-54:e0:32:ec:XX:XX

It looks like we have an address! Now, we need to add a route... we'll find our next hop by running the previous command and adding detail:

greg@SRX220H# run show dhcpv6 client binding detail

Client Interface: ge-0/0/0.0

     Hardware Address:             54:e0:32:ec:XX:XX

     State:                        BOUND(DHCPV6_CLIENT_STATE_BOUND)

     ClientType:                   STATEFUL

     Lease Expires:                2017-07-14 08:01:52 EDT

     Lease Expires in:             600551 seconds

     Lease Start:                  2017-07-07 08:01:52 EDT

     Bind Type:                    IA_NA IA_PD

     Client DUID:                  LL0x3-54:e0:32:ec:XX:XX

     Rapid Commit:                 Off

     Server Ip Address:            fe80::201:5cff:fe78:XXXX

     Client IP Address:            2607:fcc8:ffc0:5:14c9:b140:XXXX:XXXX/128

     Client IP Prefix:             2605:a000:XXXX:XXXX::/64

DHCP options:

    Name: server-identifier, Value: LL_TIME0x1-0x1d7c50b0-00:50:56:XX:XX:XX

Yes, the lease started about an hour before I posted this. I was so excited that I had to post immediately! Anyway, we're looking for that Server IP Address. Once we have that, let's add a static route to it.

set routing-options rib inet6.0 static route ::/0 qualified-next-hop fe80::201:5cff:fe78:XXXX interface ge-0/0/0.0

The qualified-next-hop is going to give you a lot more control over a standard next-hop. Commit the config. Once everything is committed, it's time to test, so we'll ping Google's DNS server.

# run ping 2001:4860:4860::8888

You should get a response. IPv6 is now working! W00T! In order to get your network clients talking to the internet on IPv6, you'll have to configure them to use IPv6. As you can see up above in the dhcpv6 client binding detail, there's a "Client IP Prefix". That's the prefix assigned to you. If you do a "run show interfaces vlan.0 terse", you'll see that it now has an inet6 address that looks like 2605:a000:XXXX:XXXX:1::1/80. That's going to be your IPv6 router / gateway address. You can statically assign IP's by just counting up from that last ::1, so assign 2605:a000:XXXX:XXXX:1::2/80 to your workstation and try to ping 2001:4860:4860::8888. If you get a response, you're good to go.

So, that's the commands I had to enter to get IPv6 working on my SRX. YMMV depending on TWC's configuration in your area, but this should get you pretty damn close.

19Jan/160

Upgrading the gaming rig, for what feels like the 4173rd time.

I've been working on a plan to upgrade my gaming rig lately, especially since I had a 4790K come available with the upgrade of the FreeNAS box. For Christmas, I got a pair of Gigabyte R9-390X's to upgrade my dual HD7970's. I've been running 32GB of RAM in my 4770K box for quite a while now, so there was nowhere to go from there. The plan was to replace the Gigabyte Z87X-OC and i7-4770K with the ASRock Z97 Extreme6 and i7-4790K from the FreeNAS box. The Z97 board has a PCI 3.0 x4 M.2 slot on it, so I wanted to get the speed increase from using it in addition to everything else. But, here's the problem...

The LGA1150 processors, which means ALL the Haswell processors not considered "Enthusiast / High End"; so the Core i3, i5, and i7s with a 4XXX model number or a G3XXX model number; only have 16 PCIe lanes. The Core i7-5820K (6 core) has 28 lanes and the 5930K (6 core) and 5960X (8 core) both have 40 lanes. Now, let's do some math on what I wanted to go into that computer:

  • Two R9-390x's - 32 Lanes
  • M.2 4x - 4 Lanes
  • Thunderbolt 2 AIC - 4 lanes

Well, I'm no mathematician, but I know 40 lanes when I see them. That only left me one option if I wanted to stick with Haswell, and that's to go with the 5930K. The 5960X is still a $1000 processor and I just wasn't going to drop that kind of coin on a CPU. So, today I went ahead and placed the order and here's the new specs for the new gaming rig:

  • Intel Core i7-5930K CPU
  • Corsair H110i GTX Liquid CPU Cooler
  • ASRock X99 Extreme6/3.1 Motherboard
  • 32GB Corsair Dominator Platinum DDR4-2666 (4 x 8GB)
  • 2x Gigabyte R9-390X 8GB
  • ASRock Thunderbolt 2 AIC
  • Samsung 950 PRO 512 GB M.2 4x SSD
  • Samsung 850 EVO 1TB SATA6 SSD
  • Corsair Obsidian 750D Full Tower Chassis
  • Corsair AX1200i PSU
  • Corsair Professional Blue Individually Sleeved PSU cables
  • 5x Corsair SP140 Blue LED Case Fans (2 front, 2 on the radiator, 1 rear)
  • Corsair Link Commander Mini
  • 2x Corsair RGB Light kit

No spinning platters in this baby! We're going ALL SSD. Spinning platters are for the NAS. The motherboard has dual gigabit NICs, and my network devices all support link aggregation, so I'll be able to get 2 gigabit network access to the NAS, and that should be more than enough for pulling documents or anything else I need off of it. All this will be displayed on my current triple AOC i2769Vm 27" monitors, which give me nearly 6 linear feet of monitor space. Yes, they are only 1080, but I'm not quite ready to dump out the money for three 27" 4K monitors and they don't make ultra-wide curved monitors big enough for me yet.

Today's order was for the CPU, motherboard, and RAM. Everything else is already here. I'm hoping that everything will be here by the end of the week and I'll be able to finish the build this weekend, so I can finish working on the FreeNAS / Plex Automation series.

Here's a sneak peek of what it'll look like. I was mounting the lights and fans in the case last night, and since the X99 Extreme6 and the Z97 Extreme6 look nearly identical, it'll give you an idea of what we'll be dealing with when it's all said and done.

IMG_5327

Filed under: Computers No Comments
22Dec/150

Home NAS Refresh

I think that, in this day and age, everyone should have a NAS at their house. For those of you that don't know what I'm talking about, NAS stands for 'Network Attached Storage'. A NAS is handy for storing all sorts of things, primarily backups of your computers and your media. In my case, I have a lot of movies and TV shows for my various media players. I also have a ton of photos and videos from over the years, as well as from my drones. Having a large NAS means that I don't have delete anything. My NAS also acts as a server for various other things that I'll get into in another post.

For your NAS to be effective, it needs to have lots of space and have enough room to expand. You also need to have an effective operating system running the NAS. For this build, I'm going to use FreeNAS. I had been planning to build this thing for a while, but didn't get around to finally getting everything setup and running until July 31, 2015. Since then it's been running pretty stable, but I used an Intel G3220 and 8GB of RAM when I first put it together and I've outgrown that processor and RAM, so it's time for an upgrade. Here's the hardware list of everything that's going into the machine:

  • Intel Core i7-4790K CPU
  • ASRock Z97 EXTREME6 ATX LGA1150 Motherboard
  • G.Skill Ripjaws X Series 32GB (4 x 8GB) DDR3-1600 Memory
  • 6x WD Red 3TB 3.5" 5400RPM HDD
  • Rosewill R​SV-L4412 -​ 4U Rackmo​unt Server​ C​hassis, 12​ SATA / SA​S Hot-swap​ Drives
  • EVGA SuperNOVA 1000G2 1000W 80+ Gold Certified Fully-Modular ATX Power Supply

The only thing that's carrying over from the previous build are the 6 WD Red 3TB hard drives and the actual FreeNAS install. I was going to just upgrade the CPU and the RAM, but some pins got bent on the ASUS Z87-A motherboard I had, so it needed to get upgraded too. I also figured that while I was at it, I'd put it in a nice rackmount chassis too.

The build went rather smooth. I pulled the hardware out of the old mid-tower case and moved it into the rackmount chassis. I had originally planned on using some M.2 SSDs for boot drives, but ran into some issues. First, the drives I bought weren't compatible with the Ultra M.2 slot on the motherboard. Secondly, the other M.2 slot ate two of my SATA ports on the motherboard. Because I didn't bother to read the manual, it took me quite a while to figure out why those two drives weren't being seen by the BIOS. Ultimately, I got everything put together and all 6 drives were being recognized. FreeNAS booted right up without any issues. I'll probably pick up an Ultra M.2 SSD in the future to use as L2ARC since it's so freaking FAST.

More info will be posted soon on how I'm going to automate my media collection and sharing.

20Feb/130

Windows IP conflict when there is no conflict

Just had an interesting problem with a customer that seems a bit obscure, so I figured I would write it down to help someone else. All of the other solutions to this issue focus solely on there being a problem on the Windows side, which may not necessarily be the case.

Situation: customer is setting up a Windows 2008 R2 server in a VMware cluster, on a VLAN that is sitting behind a firewall. The firewall is is the gateway for the VLAN (say 192.168.34.1). When configuring the network interface on the server, picking ANY IP address in the 192.168.34.0/24 network results in the error message “Windows had detected an IP address conflict”. This happens even if there are no other devices on the VLAN aside from the firewall.

The issue? There was a static (identity) NAT entry in the Cisco ASA firewall for 192.168.34.0/24. By default, Cisco firewalls will proxy ARP for NAT entries.

  • (8.3(1), 8.3(2), and 8.4(1)) The default behavior for identity NAT has proxy ARP disabled. You cannot configure this setting.
  • (8.4(2) and later) The default behavior for identity NAT has proxy ARP enabled, matching other static NAT rules. You can disable proxy ARP if desired.

This is desirable behavior for a firewall on the edge of the network because the upstream router needs to know where to send traffic for NAT’ed hosts. For internal firewalls this can cause issues, especially with 8.4 code where you need to setup identity NAT to exempt devices from NAT.

The solution? Add “no-proxy-arp” to the end of your identity NAT statements:

nat (inside,outside) source static obj_Internal obj_Internal no-proxy-arp route-lookup

The other (less desirable) solution is to disable the ARP-checking functionality in Windows, but this means it won’t be able to detect a legitimate IP conflict. You can do this through a quick registry hack: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, create a DWORD named “ArpRetryCount” with a value of “0?.

9Feb/124

New App! Square Fee Calculator

I recently signed up for the Square service to accept credit cards on my iPhone. They have two different ways of charging fees: 2.75% per transaction when you swipe the card using their reader or 3.5% + %0.15 per transaction if you enter the card number manually. Since I've already written mobile fee calculators for both PayPal and Etsy, I decided to use the same code and make one for Square. All 3 are designed to fit perfectly on an iPhone screen and since they are very lightweight, they run pretty quick. If you use any of these services, these calculators will come in very handy!

PayPal Fee Calculator
Etsy Fee Calculator
Square Fee Calculator

4Aug/100

How to enable AHCI/RAID mode in Windows 7 without reinstalling

I recently got a wild hair up my ass to add a RAID to my desktop. My desktop is a Gateway FX6840-23 and it came with a 1TB drive. I bought an identical drive and thought that I'd put then in RAID 0 for the increased performance, seeing as my Experience Index was only 5.9 due to a slow HDD (all other indexes were in the mid-7's, and the drive is a 7200 RPM unit).

Digging around the BIOS I saw that the SATA controller was using AHCI mode. I cloned my current drive to another 1TB drive I had (yeah, I have 3 -1TB drives, a 500GB, and a 1.5 TB), rebooting into the BIOS and changed it to RAID. After a reboot, I hit ctrl-I and entered the RAID utility. I built the RAID and rebooted. Well, to put it nicely, I got a BSOD. I tried various things for the next 3 hours, including using Windows 7's extended partition utility, doing a complete restore to factory on the extended partition, and everything. After I did the restore, I saw that the HDD performance hadn't changed.

Well, I haven't messed with RAID before on a desktop, so this was a learning experience. After some Google searches, I put the computer back in AHCI mode and booted to the clone. This worked just fine. I went to Gateway's website and downloaded the RAID drivers.

I noticed that the driver was named iaStorV.sys, so I did a search for it and found it already installed in the Windows\System32\Drivers folder. I did a registry search for it and found it in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorV. This made me happy!

Some more Googling later and I figured out that if I changed the REG_DWORD from 3 to 0 that it would enable things to work. I rebooted the computer, went back into the BIOS and changed the SATA controller to use RAID, pointed it to boot from the clone, and it booted right up! No BSOD, no hiccups, no nothing!

This should work going from IDE mode as well. I tried to clone the clone to the RAID, but Acronis didn't like that too much, so I'm doing a full backup of the clone (I needed to do it anyway) and I'm going to try to restore it with the Acronis Resuce media. It's already midnight, and this is one of those things that I'm not going to be able to put down until I'm done with it. Oh well, I guess it's time to get back to work! Good luck getting your stuff working!

   
Seo wordpress plugin by www.seowizard.org.