Category Archives: Network Engineering

All Technology Stuff

Moved !

My blog (http://blog.howardtang.com) and my photo blog (http://photo.howardtang.com) have been moved away from iiNet to my NBN home connection. Up time could be a problem as I still haven’t purchased a UPS for my system.

There are a few benefits moving the blog and photos blog back to my home server.

– save $60 a month VPS hosting fee
– able to provide IPv6 addresses to my blog
– able to back up my server anytime I want (And I can switch it off anytime I want)
– able to provide more bandwidth than hosting with iiNet! (40Mbps upload rate with NBN)

Stay tuned, I will let you know when IPv6 is setup!

NBN via Exetel

I have signed up a 100M/40M service using Exetel as the ISP. The download speed is very good, in my speed test, I get 91Mbps download and 38kbps upload.

Well, since I get a static IP address from Exetel, I am going to move my VPS from iinet to a physical server at home and run at home 24×7 with UPS backup.

Instead of paying $50 a month for iiNet, I think with the NBN connection, my server can run at a much lower cost and I back it up whenever I like.

A Cisco ASA firewall will be put in place to add additional security in my home network.

Screen Shot 2013-07-28 at 11.03.27 AM

My Cisco router freaks me out!

Recently, I have bought a cisco 887 ADSL router for home use. I can than setup SSLVPN, ipv6 tunnel, IOS IPS, zone base firewall, etc. It is really for my lab use to get myself familiar with the Cisco IOS again after passing my CCIE Routing and Switching 2 years ago.

One of the main reason of using a Cisco Router at home is the VPN connectivity which allow me to connect back to my Lab from work. May be you will ask, why don’t setup a Lab at work? well, GNS3 is resource greedy, and the laptop provided by work is not good enough to even just simulate one single router on GNS3.

To cut the long story short, I have setup AAA authentication with the Cisco ISE NFR kit. All the authentication for VPN and access to the router are done by the Cisco ISE. All of a sudden, I couldn’t login to my router this morning with my username and password! I have been trying over 1 hour.

I jumped on the Cisco ISE remotely and cannot see any authentication request during the period of failed login attempts and then I checked the log..

Here I found the problem of why I cannot login to my router.

May 9 10:18:49 AST: %AAA-3-ACCT_LOW_MEM_UID_FAIL: AAA unable to create UID for incoming calls due to insufficient processor memory
May 9 10:28:44 AST: %AAA-3-ACCT_LOW_PROC_MEM_TRASH: AAA unable to handle accounting requests due to insufficient processor memory and could be trashing the queued accounting records

This is a Cisco 887 router which I have paid to upgrade to Advanced IP Services. Cisco advertises this router is feature rich, you can use this with IPS, Firewall, VPN termination, etc. However, I don’t have much feature enabled on the router, it has already created problem. What if this router is going to be put in a branch with 10 – 20 users ?

ISE + ASA Home Lab Part 1

Yesterday I have written my plan of setting up a Lab at home to get familiar with the Cisco ISE and ASA (I heard that is going to be in CCIE security test…). Today I have some screen shot and have proved that the basic stuff works.

First of all, follow the links I posted yesterday for the ASA 8.4(2) run on GNS3 first. The next step is to setup a topology in GNS3. I haven’t completed the full lab, but this is what I have done today.

GNS Setup

C1 is the host computer running ADSM GUI to configure the ASA.

C2 is the Virtual Machine running Cisco ISE NFR 1.1.1.

C2 setting map to VMnet1

I setup an Inside interface with ip address in the same subnet as the ISE.

ASA Inside : 10.100.64.100
ISE : 10.100.64.70

I have done some ping test to make sure the connectivity are good. Then I add the ASA in the network device list on the ISE.

adding GNS3-ASA to ISE

The next step is add the AAA server in the ASA. Once this step is completed, I used a “test” username and password to test the radius authentication with ISE from the ASA.

test radius connection with ISE

As I haven’t setup anything on the ISE, I have expected the authentication will be failed. Now we can check the log on the ISE to see if it has captured the fail login.

The fail login was logged

I am happy to the result today. I am going to build a remote VPN lab by using ISE when I have time again. Enjoy!

Creating an ISE, ASA Lab at home without buying any hardware

I created a Lab to simulate a client’s situation yesterday on a ASA using GNS3 simulator. Suddenly, I want to create a Lab using the ability to connect GNS3 to a virtual machine. I am not sure if this will work, but I would like to write down the step here and share to everyone who have time to experiment this..

What you need (at least I believe what you need to have….)
– A powerful PC which you can run a few VMs
– A ISE VM
– A GNS3 installed on the host PC (prefer Windows OS, as all the guides are based on windows 7)

Using the ability to connects real device from GNS3, (in this case will be GNS3 connecting VM machines and host machines), enabling ip routing on the windows and allowing multiple VM networks to communicates…. I am hoping to do the following……

I have the Cisco ISE 1.0 NFR (Which I have upgraded to 1.1.2 by following the steps from Cisco Web Site). You can find my previous post about the Cisco ISE and the upgrade. The Cisco ISE is running in a VM. Now, what I need is the GNS3 and ASA. You can follow the steps from this link to setup an ASA in GNS3.

http://www.xerunetworks.com/2012/02/cisco-asa-84-on-gns3/

Once you have done that, follow the link below to create connection between the ASA in the GNS3 and other real machines. You can get the idea from this link and have it connected to your VM machine interface.

http://www.xerunetworks.com/2012/03/connect-gns3-network-to-real-networks-other-gns3-network/

The next step, I will be following the cisco support forum able setting up the “VPN inline Posture using iPEP ISE and Cisco ASA”.

https://supportforums.cisco.com/docs/DOC-24412

Double NAT on ASA 8.4 ? Thanks for GNS3

Yesterday, I received a task at work to resolve an VPN issue. It wasn’t a straight forward solution. The client want to create a new internet link via a new ASA firewall to connect to a pptp sitting inside of the network. The default route is still going to their old internet link. One suggestion is to create a double nat environment, but how? Thanks for GNS3, I have created a lab using GNS3 with ASA and Cisco 7200 to simulate the situation and was able to find a solution.

So what need to be done is to create double NAT on the ASA, in this way, I don’t have to change the default route.

Simple Network Diagram

C1 is the VPN Client, R1 is the ISP router, ASA is the firewall, R2 is the Core Switch and R3 is the PPTP server.

here are the interface configurations:
R1 G1/0 : 222.111.111.1
R1 G2/0 : 233.111.111.254
C1 : 233.111.111.5
ASA: G1/0 : 222.111.111.2 (Ouside)
ASA: G2/0 : 192.168.2.1 (Inside)
ASA NAT POOL : 192.168.11.1 – 192.168.11.254
R2: G1/0 : 192.168.2.2
R2: G2/0 : 192.168.10.1
R3: G1/0 : 192.168.10.18 (PPTP SERVER)
R3: VPN POOL : 192.168.5.1 – 195.168.5.254

R1 Configuration

int gi1/0
ip add 222.111.111.1 255.255.255.252
int gi2/0
ip add 233.111.111.254 255.255.255.0

R2 Configuration

int gi1/0
ip add 192.168.2.2 255.255.255.252
int gi2/0
ip add 192.168.10.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.2.1

R3 Configuration

int gi1/0
ip add 192.168.10.18 255.255.255.0

ip route 0.0.0.0 0.0.0.0 192.168.10.1

aaa new-model

aaa authentication login VPNAUTHEN local
aaa authorization network VPNAUTHOR local

vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
l2tp tunnel timeout no-session 15

interface Virtual-Template1
ip address 192.168.5.1 255.255.255.0
peer default ip address pool vpnpool
no keepalive
ppp authentication pap chap ms-chap ms-chap-v2
!
ip local pool vpnpool 192.168.5.2 192.168.5.255

ASA

interface GigabitEthernet0
nameif Outside
security-level 0
ip address 222.111.111.2 255.255.255.252
!
interface GigabitEthernet1
nameif Inside
security-level 100
ip address 192.168.2.1 255.255.255.252
!
object network pptp_inside
host 192.168.10.18
object network NAT_POOL
range 192.168.11.1 192.168.11.254
object service pptp
service tcp destination eq pptp
object network Inside-network
subnet 192.168.0.0 255.255.0.0
access-list Outside_access_in extended permit ip any any
access-list Inside_access_in extended permit ip any any
nat (Outside,Inside) source dynamic any NAT_POOL destination static interface pptp_inside service pptp pptp
access-group Outside_access_in in interface Outside
access-group Inside_access_in in interface Inside
route Outside 0.0.0.0 0.0.0.0 222.111.111.1 1
route Inside 192.168.0.0 255.255.0.0 192.168.2.2 1
!
policy-map global-policy
class class-default
inspect pptp
set connection advanced-options tcp-state-bypass
!
service-policy global-policy global

What I want to achieve is from VPN Client (0.0.0.0) to connect (222.111.111.2), it will be translated to (192.168.11.x) and connect to 192.168.10.18. PPTP will be able to setup, while it won’t be affect people connect via the existing internet link.

Deploying 2 Cisco ISE Nodes using the ISE NFR Kit

If you have read my previous post, I have successfully upgraded the ISE 1.0MR to ISE 1.1.1. using the Cisco Installation and Upgrade Guide. According to the Cisco ISE deployment guide, we should able to deploy a secondary node as long as your have the license on the Primary node.
Continue reading

Upgrade my desktop to i7 3930K

The Quad 2 core 2600 CPU with 8 Gb of memory is no longer good enough for me. With Cisco CCIE Voice study, I would like to setup some CISCO Voice related Lab at home. It may not a completed lab, but at least I would like to test some Cisco products so I can well prepared before I really need to work on some of its newest software.

As you may have seen my previous post about the Cisco ISE which runs on a VM. I was trying to have 2 ISE running as a primary and secondary node. However, due to lack of memory and CPU power, it runs very slow on the Quad2core system.

To learn new technology, you just have to invest time and money, without working on a real product, you will never know how it really work. Just like people tell you how to drive, you think you know how to drive, but you haven’t really driven a car, do you think you can drive it when you first jump into it?

Continue reading

Upgrade Cisco ISE 1.0MR NFR to 1.1.1

There is a document that comes with the ISE USB. It is an instruction about how to setup the Cisco Identity Services Engine (ISE) Not-For-Resale partner bundle in an ESXi lab environment and how you can upgrade it from 1.0MR to 1.1. The newest version on Cisco is 1.1.1, so I have followed the instruction and went from 1.0MR to 1.1.1 (aka 1.1MR).

The default VM setting on the ISE 1.0MR is 1 processor and 2GB ram. The ip address of the ISE is 10.10.10.70 and default gateway is 10.10.10.1. Using the predefined username and password given in the document, you will able to get into the CLI as well as the web GUI. (provided your have your virtual network adapter setup correctly for your hosted computer to talk to the virtual machine). In my case, I run the VM on my Hackintoch which using VMware Fusion 3. I have changed the VM setting to 2 processors and 4GB of ram.

To upgrade the ISE NFR form 1.0MR to 1.1.1, the first step is to download the update file from Cisco website. You will need your CCO account to obtain the update software. The file I have downloaded is ise-appbundle-1.1.1.268.i386.gz.

On my Hackintosh, I have enabled the web share and put the downloaded file in the web directory. After that, I log in the ISE by using SSH 10.10.10.70. The CLI of the ISE is similar to the Cisco IOS command, you can do show run to see the running configuration. To prepare for the upgrade, there are some configuration that you need to put in.

ISE/admin# conf t
ISE/admin (config)# repository iseupgrade
ISE/admin (config)# url http://10.10.10.1
ISE/admin (config)# end
ISE/admin# application upgrade ise-appbundle-1.1.1.268.i386.gz iseupgrade

After the install is complete, ISE will reboot. You can use this command “show version” to check the ISE version after the upgrade. It should be showing 1.1.1.268.

The next thing I am going to try is to setup 2 nodes using this NFR kit.