Networking on

Time and Date Concepts and Configuration

Mon, 19 Oct 2026 11:31:13 +0200

relevant terminology

NTP internet server

Public time servers that can be used as time sources by anyone.

NTP server

== the server that provides time to the enterprise NTP clients usually connects to an internet time server

NTP peer

An NTP node that receives time from an NTP server When it loses its connection to the NTP server, it requests time from the other available NTP peer(s).

Firewalls

Thu, 30 Jul 2026 21:31:13 +0200

firewall integration in Cisco ACI

(do a blog search for “service_insertion”)

firewalls in Linux

The default host-based firewall in RHEL allows all outgoing connections and blocks all incoming ones, except those explicitely permitted.

The firewall daemon is called firewalld. To interact with it, use the firewall-cmd tool. The firewalld daemon translates the instructions of firewall-cmd into policies that use the syntax of the kernel’s netfilter and nftables.

firewall rules

A rule dictates that a service is allowed to be accessed by an inbound connection. A firewalld service is added with firewall-cmd --add-service or removed with firewall-cmd --remove-service.

Domain Name Resolution

Wed, 29 Jul 2026 21:31:13 +0200

name resolution in Linux

Name resolution in Linux is a pipeline of verification jobs, not a single file: a process consults the Name Service Switch, which has a configuration file at /etc/nsswitchconf. This file contains a list of entries. Each entry describes a database and the list of sources to refer to in the order of their appearance in the entry.

An entry is written in this format: DatabaseName NameService1 [Status=Action] NameService2

Packet capture

Fri, 24 Jul 2026 21:31:13 +0200

packet capture on Junos operational mode

Packet capture in real time on an interface is performed with the monitor command:

lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
  <[Enter]>            Execute this command
  absolute-sequence    Display absolute TCP sequence numbers
  brief                Display brief output
  count                Number of packets to receive (0..1000000 packets)
  detail               Display detailed output
  extensive            Display extensive output
  layer2-headers       Display link-level header on each dump line
  matching             Expression for headers of receive packets to match
  no-domain-names      Don't display domain portion of hostnames
  no-promiscuous       Don't put interface into promiscuous mode
  no-resolve           Don't attempt to print addresses symbolically
  no-timestamp         Don't print timestamp on each dump line
  print-ascii          Display packets in ASCII when displaying in hexadecimal format
  print-hex            Display packets in hexadecimal format
  read-file            Read packets from a given file
  resolve-timeout      Period of time to wait for each name resolution (seconds)
  size                 Amount of each packet to receive (bytes)
  write-file           Write packets to specified file
  |                    Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap 
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes

^C
297 packets received by filter
0 packets dropped by kernel

lab@vSRX>

lab@vSRX> file list 

/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /

lab@vSRX>

Then I open the freeBSD CLI and open the pcap file using tcpdump:

System Logging

Tue, 21 Jul 2026 21:31:13 +0200

Definition

Syslogs contain subsets of information on faults, events, audit & session data, all related the monitored objects. Not all logs depict errors. Syslog can include audit and event logs.

Syslog Facilities

Any program or process capable of generating syslogs.

Syslog Severities

aka syslog severity levels or syslog priorities. The describe different levels of importance. Example of syslog severities: emergency, alert, critical, informational, warnings.

How Linux implements logging

rsyslogd

Verify the version of rsyslogd deployed on a RHEL machine:

Junos Generated Routes

Fri, 17 Jul 2026 07:31:13 +0200

Topology

graph LR
net1(LAN1_172.17.99.0/24) 
net1 <--> R1
R1 <--> |WAN1_10.10.10.8/30|R4

Configuration and Interpretations

Desired outcome: I want to configure a generated route on R1 for the prefix 172.17.99.0. Currently, the prefix 172.17.99.0/24 is directly attached to ge-0/0/6. I want to make R1 advertise the generated route 172.17.96.0/19 toward its BGP neighbor R4 only when R1 receives the BGP route 10.22.1.0/26 from R4 (which is configured as an aggregate route on R4) and successfully imports it from BGP into inet.0. On R1, at the moment there is only one contributing route for the generated route, which is 17.17.99.0/24.

Junos Aggregate Routes

Thu, 16 Jul 2026 21:31:13 +0200

Topology

graph LR
net1(LAN1_172.17.99.0/24) 
net1 <--> R1
R1 <--> |WAN1_10.10.10.8/30|R4

Configuration and Analysis

The default next hop of an aggregate route is reject:

root@R4> show configuration routing-options rib inet.0 aggregate 
defaults {
    preference 189;
}
route 10.22.1.0/26;

root@R4> 
root@R4> show route protocol aggregate 

inet.0: 15 destinations, 17 routes (15 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.22.1.0/26       *[Aggregate/189] 00:00:58
                       Reject

inet6.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)

root@R4> 
root@R4> show route 10.22.1.0/26 exact detail 

inet.0: 15 destinations, 17 routes (15 active, 0 holddown, 0 hidden)
10.22.1.0/26 (1 entry, 1 announced)
        *Aggregate Preference: 189
                Next hop type: Reject, Next hop index: 0
                Address: 0x77c5434
                Next-hop reference count: 2
                Kernel Table Id: 0
                State: <Active Int Ext>
                Local AS:    22 
                Age: 7:22 
                Validation State: unverified 
                Task: Aggregate
                Announcement bits (2): 0-KRT 5-Resolve tree 3 
                AS path: I  (LocalAgg)
                Flags:                  Depth: 0        Active
                AS path list:
                AS path: I Refcount: 2
                Contributing Routes (2):
                        10.22.1.0/27 proto Direct
                        10.22.1.32/27 proto Static
                Thread: junos-main 

root@R4>

#LessonLearned The contributing routes may be of different routing protocols or pseudoprotocols.

Static Routing in Junos

Sun, 07 Jun 2026 21:31:13 +0200

Next Hop Values

On R2, verify that there is a BGP route to 1.1.1.1.

user1@R2>
user1@R2> show route 1.1.1.1

inet.0: 15 destinations, 15 routes (15 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.1/32         *[BGP/170] 5d 13:58:29, localpref 100
                      AS path: 17 17 17 17 I, validation-state: unverified
                    >  to 10.10.10.1 via ge-0/0/1.0

On R1, configure static route to 10.22.1.32/27 with next-hop 10.10.10.2, preference 6. The ping from R1’s loopback to R2’s 10.22.1.34 interface must succeed. How RIB looks like, when a static route is configured with a next hop set to the IP address of the directly-attached host:

Configuring, verifying and troubleshooting BGP on Junos

Fri, 05 Jun 2026 21:31:13 +0200

verifying sent and received routes to and from a BGP neighbor

The show route advertising-protocol bgp and show route receive-protocol bgp were my quick way to verify which NLRIs are sent and received with a particular BGP neighbor.

Too much relying on the output of show route advertising-protocol bgp and show route receive-protocol bgp without paying attention to the BGP neighor in the command slowly led me to assume the absence of NLRI exchange between the BGP peers, when the output of those commands is empty. The following example depicts the configuration of iBGP using route reflector technology to build a VXLAN overlay for a leaf-spine topology. Each spine acts as a route reflector to its own client group:

Cisco CIMC

Wed, 03 Jun 2026 21:31:13 +0200

Defining CIMC

CIMC is the management interface of the server hardware that underlies the APIC software.

CIMC software != APIC software.

CIMC Console Connectivity

Method 1: Connecting To The Serial Console Port Directly

Connect your laptop to the console port of the APIC server (usually the RJ-45 port at the far right). Use baud rate of 115200 (or configure that as speed under the async interface, if you’re connecting to CIMC through terminal services)

Troubleshooting Junos

Tue, 02 Jun 2026 21:31:13 +0200

Notes from a Juniper Junos troubleshooting course

Packets reaching the irb interface trigger a routing lookup.

When using vMX, typically in a lab, then there should be two VMs: one for the control plane and one for the forwarding plane, named something like vmx1-vcp and vmx1-vfp respectively.

When pinging the IP address of an aggregate Ethernet interface, the ICMP Echo Reply packets are duplicated:

lab@vEX> ping 172.16.200.2 count 3    
PING 172.16.200.2 (172.16.200.2): 56 data bytes
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.034 ms
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.209 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.251 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.295 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.346 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.387 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.418 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.448 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.641 ms
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.688 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.711 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.717 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.871 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.883 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.919 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.923 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=2 ttl=63 time=2.626 ms

--- 172.16.200.2 ping statistics ---
3 packets transmitted, 3 packets received, +14 duplicates, 0% packet loss
round-trip min/avg/max/stddev = 2.626/3.492/3.923/0.343 ms

lab@vEX>

The ‘hot swappable’ and ‘hot pluggable’ are chassis capabilities and are not the same.

Junos firewall filters

Sun, 03 May 2026 21:31:13 +0200

Definition

Firewall filters in Juniper Junos are stateless packet filters that act pretty much like the access lists in Cisco IOS, IOS XE and NX-OS. Once configured, they must be assigned in the input or output direction of one or more interfaces to become effective.

Example scenario: preventing ping packets to be initiated from one direction while allowing the other direction

Topology

R1:ge-0/0/5(.1) <— 10.10.7.0/30 —> (.2)ge-0.0.1:R5

Configuration

On R5:

OSPF

Sat, 02 May 2026 21:31:13 +0200

OSPF in Junos

lab@vSRX> show configuration interfaces ge-0/0/2 
unit 0 {
    family inet {
        address 192.168.11.2/24;
    }
}

lab@vSRX> show configuration protocols ospf 
area 0.0.0.0 {
    interface ge-0/0/2.0;
}

lab@vSRX>

lab@vSRX> show ospf interface 
Interface           State   Area            DR ID           BDR ID          Nbrs
ge-0/0/2.0          BDR     0.0.0.0         192.168.1.1     192.168.31.1       1

lab@vSRX>

lab@vSRX> show ospf neighbor 
Address          Interface              State           ID               Pri  Dead
192.168.11.1     ge-0/0/2.0             Full            192.168.1.1      128    39

lab@vSRX>


lab@vSRX> show route protocol ospf  

inet.0: 24 destinations, 38 routes (24 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.1.1/32     *[OSPF/10] 01:58:32, metric 1
                    >  to 192.168.11.1 via ge-0/0/2.0
224.0.0.5/32       *[OSPF/10] 01:58:42, metric 1
                       MultiRecv

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

lab@vSRX>

MTU mismatch


lab@vSRX> show ospf neighbor 
Address          Interface              State           ID               Pri  Dead
192.168.11.1     ge-0/0/2.0             ExStart         192.168.1.1      128    35

lab@vSRX>

lab@vSRX> show interfaces ge-0/0/2 | match mtu 
  Link-level type: Ethernet, MTU: 1400, LAN-PHY mode, Link-mode: Full-duplex, Speed: 10Gbps,
    Protocol inet, MTU: 1386

lab@vSRX> show configuration interfaces ge-0/0/2 | display inheritance 
##
## '1400' was inherited from group 'group1'
##
mtu 1400;
unit 0 {
    family inet {
        ##
        ## 'no-neighbor-learn' was inherited from group 'group1'
        ##
        no-neighbor-learn;
        address 192.168.11.2/24 {
            arp 192.168.11.1 mac 00:50:56:a9:50:92;
        }
    }
}

lab@vSRX>

lab@vMX-2> show interfaces ge-0/0/2 | match mtu 
  Link-level type: Ethernet, MTU: 1514, MRU: 1522, LAN-PHY mode, Speed: 1000mbps, BPDU Error: None,
    Protocol inet, MTU: 1500
    Protocol multiservice, MTU: Unlimited

lab@vMX-2> 

lab@vMX-2> show configuration interfaces ge-0/0/2 | display inheritance 
description "vr1 to vsrx1";
unit 0 {
    family inet {
        address 192.168.11.1/24;
    }
}

lab@vMX-2>

The solution in this case is to change the MTU value of the physical interface on either side of the link:

Server Hardware and Cisco UCS

Thu, 30 Apr 2026 21:31:13 +0200

replacing UCS B-series blade servers that are managed by UCSM requires their decommission and deletion from the inventory of UCSM first. The new blade servers must be commissioned with UCSM.

Note: CIMC vs UCSM and Intersight

When a UCS C-series rackmount server is managed by UCSM, it can no longer be managed by CIMC.
Only UCS C-series rackmount servers that are in standalone mode can be managed through CIMC.

Register a UCS C-series rackmount server in UCSM

A new UCS C-series rackmount server comes pre-configured to integrate with UCSM through the connection to the FIs. Once the UCS C-series server is cabled to the FIs, I wait for some minutes and I will see the server pop up in the UCSM page:

Firewall Manual Stitching in ACI

Sun, 14 Sep 2025 21:31:13 +0200

aka Network Stitching. This is the manual method to insert L4-7 services; VLANs, EPGs and bridge domains are manually created, and EPGs are manually assigned to the L4-7 device interfaces, statically with Static Path Binding or dynamically with a VMM domain. If we have to insert more than one L4-7 device, repeat the above process as much as there are devices to integrate.

L4-7 device vs L4-7 Device

An L4-7 device in the manual stitching context is one firewall, one ADC, etc. A L4-7 Device in Service Graphs is the Logical Device, which might contain one or more Concrete Devices.

How to Steer Traffic to a Firewall Using ACI L4-7 Service Insertion

Sat, 13 Sep 2025 21:31:13 +0200

If I configure the IP default gateways of the (Provider, Consumer) pair on ACI and attach an L4-7 Device to ACI, IP routing traffic involving the (Provider, Consumer) pair will bypass the Service Device due to routing in ACI itself. To circumvent that, there are three known methods to force traffic toward the L4-7 Device.

Method 1: NAT on the L4-7 Device

Method 2: SGR (no NAT on the L4-7 Device)

Method 3: VRF Sandwich and L3Outs

No NAT on the L4-7 Device.

ACI L4-7 Logical Device

Fri, 12 Sep 2025 21:31:13 +0200

L4-7 Device == L4-7 Cluster Device == Logical Device. This is where we inform ACI about our firewall, ADC, etc. ACI considers service devices as part of application design. That is why we place their functions in EPG pairs or ESG pairs. The L4-7 Device == the Cluster Device == Logical Device: the ACI logical representation of one or more Concrete Devices that perform the same Service Type. Re-use of a L4-7 Device is possible, whether using its same Cluster interfaces or additional ones.

ACI L4-7 Cluster Interfaces

Thu, 11 Sep 2025 21:31:13 +0200

is the logical interfaces of a L4-7 Device Cluster Device. We distinguish Provider Cluster Interfaces and Consumer Cluster Interfaces. The ACI administrator must define them under the Create L4-7 Device page.

Consumer-Side Interface

The Cluster Interface that will attach directly (or indirectly, in case this is not the first L4-7 Device in the Service Graph Template) to the Consumer-side BD.

Provider-Side Interface

The Cluster Interface that will attach directly (or indirectly, in case this is not the first L4-7 Device in the Service Graph Template) to the Provider-side BD. Any Cluster Device will appear as a draggable element when creating a Service Graph Template. ❗ ACI does not detect duplicate IP addresses when two Cluster Devices have the same management IP address or VIP.

Common Concepts For Cisco ACI Standard Service Graphs and Service Graph Redirects

Fri, 21 Feb 2025 21:31:13 +0200

These are common concepts for Standard Service Graphs and Service Graph Redirects. Service Graph with L4-7 Device in Go-To mode == L3 Service Graph. L4-7 Device in Go-To mode and the SGT has PBR enabled == L3 PBR Node.

Concepts

L4-7 Service Graph

A Service Graph requires the existence of one or more [[ACI Contracts|Contract]]s between a (Provider, Consumer) pair, whether they are EPGs or ESGs. Service Graphs are extensions of ACI Contracts; They leverage the concept of Provider EPG and Consumer EPG. Instead of manual stitching of L4-7 services, ACI can manage service devices just like it manages network policies, including automatic provisioning and removal of services when needed. Service Graph is a concept. requires the Service Graph Template

Configuring PKI

Sun, 09 Feb 2025 21:31:13 +0200

Technology	Definitions
CSR	Certificate Signing Request

Certificates

Issuing a Digital Certificate

Certificate server, Certificate Authority. The entities that want the CA to issue a digital certificate for them must send their public key, their IP address and their FQDN to the CA. The CA replies with a digital certificate, aka identity certificate, aka public key certificate which means ‘I certify that the entity named in this certificate own the public key mentioned in this digital certificate.’ The digital certificate does not last forever; It has a validity period. The digital certificate is a file with the extension .cer.

ACI and Active-Active Firewall Cluster in Single-Pod and Multi-Pod Designs

Sun, 05 Jan 2025 21:31:13 +0200

ACI Single Pod, Active-Active Firewall Cluster in Go-To Mode

L4-7 Device Config

A single Concrete Device, one or more Concrete Device Interfaces and one or more Cluster Interfaces, depending on the physical topology. See the document Service Graph Design Guide for ACI 5.2 and Later, page=55.

ACI Multi-Pod, Active-Active Firewall Cluster in Go-To Mode

Stretched Active-Active Firewall Cluster in Go-To Mode, in ACI Multi-Pod Designs

Designing cluster nodes in more than one data center is supported by ACI Multi-Pod. Each ACI pod has one or more firewalls in the active role. See the document ACI Multi-Pod and Service Node Integration, page=5.

ACI L4-7 Service Insertion - Active-Standby Firewalls with Standard Service Graphs (SSG) in ACI Multi-Site Designs

Thu, 28 Nov 2024 21:31:13 +0200

Stretched HA Firewall

Cisco supports a stretched Active-Standby firewall system if:

ACI operates in layer 2,
the firewall operates as the IP default gateway for the endpoints or the firewall operates in Transparent mode or the active and standby nodes are connected with an L3Out.

Independent HA Firewalls

If I have to deploy Active-Standby Firewalls, Cisco recommends to deploy them as independent HA firewalls in the ACI sites (i.e. not across the intersite link)

ACI L4-7 Service Insertion of an Active-Standby Firewall in Go-To Mode in an ACI Single-Pod Design

Sat, 02 Nov 2024 21:31:13 +0200

One concrete device per firewall –> 2 concrete devices under the L4-7 device.

If I have a two-arm firewall design: For all Concrete Devices within a L4-7 Device I must map all Concrete Interfaces of the same direction to the Cluster Interfaces ( #PersoNote symmetrical interface mapping):

add one Cluster Interface for the Consumer side and associate it with all Consumer-side interfaces of all [[#Concrete Device]]s,
add one Cluster Interface for the Provider side and associate it with all Provider-side interfaces of all [[#Concrete Device]]s.

If I have a one-arm firewall design: add one Cluster Interface that includes both Concrete Interfaces of the firewalls. #verifyThis

ACI L4-7 Service Insertion_Failover Traffic Management

Thu, 24 Oct 2024 21:31:13 +0200

Failover traffic is not managed by L4-7 Service Graphs

See the document ACI Service Graph Design Guide for ACI 5.2 and Later.pdf, page=50.

With the ‘out-of-band’ method

Use the dedicated firewall failover link ports and firewall stateful failover link ports, or designate some ports for that role; Failover traffic and stateful failover traffic are said to be managed ‘out-of-band’

With the ‘in-band’ method

i.e. use the physical network of the data traffic for failover and stateful failover traffic too. When the firewall is attached to ACI, the physical network path of firewall traffic is the ACI fabric.

ACI Multi-Site and Active-Standby Firewall Clusters with Service Graph Redirect

Thu, 24 Oct 2024 21:31:13 +0200

Technology in Nexus Dashboard Orchestrator	Equivalent on APIC
define a Service Service Device Cluster	L4-7 Device, SGT

EPG-to-EPG PBR contract in ACI multi-site with independent HA-firewalls: I must define the BD subnet also under the consumer EPG and set the no Gateway SVI flag.

Contract Enforcement vs PBR Contract Enforcement vs PBR Policy Enforcement Contract enforcement == zoning rules are deployed to a leaf X. So leaf X takes action on the contract-matched traffic based on the deployed zoning rules. Leaf X is determined according to the Contract Policy Enforcement Locations table in the document ACI Contract Guide White Paper, page=20.

ACI L4-7 Service Insertion: Service Graph Mgmt Modes

Wed, 23 Oct 2024 21:31:13 +0200

There are three ways to manage L4-7 services when we use service graphs. So if no service graph is inserted, we do not talk about these management modes!

[!Abstract] Unless otherwise specified, when Service Graphs are mentioned, then I am referring to the Unmanaged Mode.

Service Graph in Managed Mode (deprecated concept)

aka Service Policy mode: horizontal integration; requires a Device Package.

Device Package

adding a Device Package

ACI L4-7 Service Insertion: Service Graph with PBR

Mon, 21 Oct 2024 21:31:13 +0200

[!TLDR] Personal Observation I find few sources discussing standard SG and more literature discussing SGR. It seems to me that Cisco is pushing toward SG with PBR whenever a design involves L4-7 Service Devices.

aka Service Graph with Policy-Based Redirect, Service Graph Redirect. I call it SGR. One-Node SGR: Service Graph with one PBR Node.

Concept of a multi-node Service Graph

the concept of node in the terms ‘single-node SG’ or ‘multi-node SG’ refers to the L4-7 Devices in the SG. So, the term ‘multi-node Service Graph’ refers to a Service Graph with multiple L4-7 Devices, where each L4-7 Device could be:

ACI Multi-Pod and Active-Standby Firewall in Routed Mode

Thu, 29 Aug 2024 21:31:13 +0200

Stretched Active/Standby Firewall

I must define an ACI L4-7 Device with two Concrete Devices; One for the Active node and one for the Standby node. See ACI Multi-Pod and Service Node Integration, page=5. The active firewall is in pod A, the standby firewall is in pod B. Support east-west and north-south traffic flows. No risk of asymmetric traffic flows because there is only one active firewall at a time.

Impact of traffic hair-pinning

Hair-pinning is a sub-optimal yet not avoidable traffic pattern. Beware of the latency impact of any hair-pinning traffic between pods due to traffic traversing the active firewall. The worst-case occurs when:

VMware vSphere Networking Concepts

Wed, 24 Apr 2024 21:31:13 +0200

In VMware, a good practice is to configure ESXi hosts in a cluster, then present the LUNs to the ESXi cluster. A VMware datastore is a LUN that has been formatted with a filesystem like VMFS. A VMware VM can access the datastore but has no awareness of the underlying LUN or its constituing storage disks. Any protocol that carries the SCSI Command descriptor Block (like FC, FCoE, iSCSI, SAS) uses the LUN concept. A successor to SCSI is NVMe. When I configure a new datastore in a vCenter datacenter, I am presented by a menu to choose a ESXi from. (sc) This is because vCenter simply does not have direct access to the storage devices; it asks that selected ESXi server (can be seen as a ’temporary agent’) to access the storage devices ot its behalf, format the access storage as VMFS disks and make them available in the datastore to many ESXi hosts. This action is only required once during the configuration of the datastore. This interaction takes place on the management vmkernel of the ESXi host. Later when I attach the datastore to the ESXI hosts, they will be able to access the VMFS disks directly, and they will access the storage devices.

Cisco ACI L4-7 Service Insertion: Standard Service Graphs with Firewall in Go-To Mode

Tue, 23 Apr 2024 21:31:13 +0200

#QA SSG with L4-7 Device in Go-To mode: in which situations do we need only layer-2 BDs attached to the Device? Layer-3 BDs? one Layer-2 and one Layer-3 BD? what is the recommended design? Go-To mode == Routed mode When NAT needed on the L4-7 Device: use Service Graph in Go-To mode with NAT. another ‘sub-mode’ is an L3Out between the L4-7 Device and ACI. With both NAT sub-mode and L3Out sub-mode:

NSX-T Concepts

Mon, 08 Apr 2024 21:31:13 +0200

VMware NSX-T does not support VXLAN!

NSX-T Segments

a VM is connected to a segment.

is a layer-2 domain.
invokes a transport zone.
once the transport zone configured, you can no longer edit it later.
VLAN-based segments are equivalent to VLAN IDs
VLAN-based segments are not permitted to connect to Tier-0 or Tier-1 gateways.

Edge Uplink Segments

require VLAN transport zones. A single Edge Uplink segment can be used more than once.

Inserting firewall packet inspection services in Cisco ACI data paths without offloading the gateway service off the fabric

Wed, 13 Mar 2024 21:31:13 +0200

PBR in two-arm design, the PBR Node Interfaces are in the same VRF

#QA In the SGR in Go-To in Two-arm design, how does IP routing on the firewall scale when we have dozens of (Provider, Consumer) pairs? #QA How cumbersome is the management of the static IP routes related to the SGR on the service device? #QA Is BD2 the IP default gateway for EPG Web endpoints? #QA Which component takes the role of IP default gateway of the firewall: BD1 or FW-Out BD?

ACI Bridge Domains

Mon, 05 Feb 2024 21:31:13 +0200

Bridge Domains and Subnets

A bridge domain can be configured with an IP subnet; it is then called a layer-3 bridge domain. The BD subnet is aka ACI internal subnet.

The IP address that we configure under the bridge domain is the IP default gateway of the IP subnet. The IP address is configured using a CIDR notation.

Subnets configured under bridge domains are added to the leaf’s routing table as static routes.

NX-OS boot sequence stuck in loader prompt

Sun, 04 Feb 2024 21:31:13 +0200

Path in Cisco Documentation

cisco.com/go/support –> Switches –> Nexus 9000 –> Troubleshooting Guides –> (select NX-OS release) –> “Cisco Nexus 9000 Series NX-OS Troubleshooting Guide, Release …” –> Troubleshooting Installations, Upgrades and Reboots –> Chapter Contents –> Troubleshooting Software System Reboots –> Recovery from the loader> Prompt.

Assumption 1: NX-OS File in Bootflash

Loader> dir
<you see for example nxos.9.3.13.bin NX-OS file in the bootflash>
Loader> boot nxos.9.3.13.bin

The system should boot the image. When you get the normal prompt, make sure to set the bootvariable to that NX-OS image:

SSH

Wed, 20 Dec 2023 21:31:13 +0200

SSH on Cisco devices

SSH Terminal-Line Access Feature

replaces reverse Telnet feature that was typically configured on terminal services routers.

provides secure console access for servers physically connected to a terminal services router.

introduces the concept of ‘rotary’.

Remember that each physical Async port has an associated logical line to it.

Each router line (not the Async ports) must be configured with a unique rotary number.

Number of rotaries == number of lines

Basic MPLS L3 VPN Concepts

Mon, 12 Jun 2023 21:31:13 +0200

VPN Advantage

A VPN is a network where private network services are provided to one or more customers over a public network, Internet, or a private network.

A VPN consists of one or more VPN tunnels!

VPN connects sites of a same customer together. A set of “policies” determine which sites communicate with each other and which not;

In one scenario, the customer itself defines and implements them, in collaboration with the SP. The customer may for example want to force traffic from site S1 to traverse site S2, because the latter has a firewall installation.

Cisco Videosurveillance Typo

Thu, 11 Dec 2014 16:11:01 +0200

While performing routine configuration on a Cisco router, I encountered a funny typo. Try to find it by yourself. Hint: it’s in the last line.

Scheduling a VMware Exam

Mon, 06 Jan 2014 16:19:15 +0200

There’s an info on the Internet that says it’s possible to pass Vmware VCA certs for free. It’s been a while now and Vmware retired this offer.

However, there are some folks that say they could get around and pass without spending a penny. They say it’s a matter of combining promo codes.

I’ve been trying all the codes. Pearson Vue warned me that they’re going to shut down my account if I do another attempt.

Uploading IOS image with Cisco LMS

Fri, 13 Dec 2013 16:33:48 +0200

In this tutorial we’ll learn :

How to push an IOS image into a switch flash disk, using Cisco LMS,
How to verify that the IOS image has been loaded correctly

Pushing the IOS image

On the LMS home page, click on the Resource Manager Essentials link.
Click on Software Distribution
Choose a distribution method. By default, I use “by device”. That’s the simplest one
Check the device for which you want to upgrade the IOS and click Next

VMware Datacenter Virtualization VCA-DCV

Sun, 17 Nov 2013 16:48:22 +0200

Today I successfully passed the exam. I got a score of 420. Alhamdulillah.

How I studied for the exam: I watched the Vmware E-learning fundamental videos, took notes, reviewed them with a big mind map, then registered and sat for it. I sat studying in many small sessions.

It’s great to sit for an exam and pass it from home :) it’s also great to see there are other folks out there who are sharing the same experience.

Remaining PoE on a Cisco Catalyst Switch

Mon, 14 Oct 2013 16:52:38 +0200

Players: Catalyst switch with PoE support, Cisco IP phones Script: We want to check whether there still is enough amount of PoE energy, on a Catalyst switch. Solution: do a “show power inline”, check the “Remaining” column.

Registering MGCP Gateways

Fri, 27 Sep 2013 17:20:16 +0200

Situation I tried to register my MGCP gateway to my CUCM, but everytime I did a “show ccm-manager”, it displays the following: Troubleshooting I first thought about an issue about DNS on CUCM. I remembered that, during the CUCM installation, I put CUCM somewhere. So I went to every corner of CUCM admin pages, where I could find the “CUCM” keyword. I changed some settings in Entreprise Parameters. I even tried to change the hostname under the CUCM CLI mode: Then, I examined what’s happening at the router level, with “debug mgcp events”. I noticed this line:

Reading List for the Cisco CIPT1 Exam

Thu, 26 Sep 2013 17:14:44 +0200

Studying for Cisco certifications not enough with only official Cisco Press books. We got to supplement our reading with other documents. for CIP1 exam, I decided to heavily rely on reading from the screen. Why? because a network engineer does not often have the luxury to print all the documents he works with.

Documents I’m reading to supplement my CIPT1 studies:

IOS 15.2M&T configuration guides
Configuring H.323 gateways
Cisco Unified Communications Manager Session Management Edition Deployment Guide Release 8.x, page 13
H.323 Slow Start and Fast Start
Cisco IOS Voice Command Reference, S Commands
Media Termination Points

Cisco CIPT1 Student Guide

Thu, 26 Sep 2013 17:09:47 +0200

For example, let’s take Call Survivability. In the Student Guide, it says that call survivability is maintaining the RTP stream between two IP endpoints when the CUCM fails. However, the foundation Guide and I agree that call survivability involves TDM-to-IP-calls too.

Another exemple: does MGCP support call survivability? the Student Guide says no. Maybe it was supported in a later release, you’ll probably say. Read the following line: “Media Gateway Control Protocol has supported call survivability (call preservation) since it was introduced on the gateway routers, but H.323 gateways did not support this feature until Cisco IOS 12.4(9T)”.

CUCM, VMware and GNS3

Thu, 19 Sep 2013 19:13:12 +0200

I found some interesting blogs about this topic:

Notes:

Router IOS should support voice. I’m using 12.4 Advanced Entreprise IOS version,
Vmware network adapter: set to “host only” mode. Remember that during the installation of CUCM on Vmware, we set the network adapter to “bridged”, so it can connect to Internet and contact an NTP server,
After adding the cloud component in GNS3, you may find that no adapter is seen under NIO Ethernet. GNS3 mentions that it needs “Administrator or root access”. Solution: close GNS3, right click and choose “run as administrator”. Then you’ll see the list of adapters under NIO Ethernet.

Install CUCM on VMware

Tue, 17 Sep 2013 20:36:48 +0200

I struggled a couple of weeks before I came across a great post about installing CUCM on a vmware workstation. I needed this for CIPT1 labs.

Strangely, the website has been taken down due to a hacking attempt.

Well, everything seemed to work fine until the NTP configuration step. Here, I’ve discovered that , when configuring NTP server, make sure your guest machine can connect to the internet and check the public NTP server. So if you have a computer firewall, disable it.

How to Reload Your Cisco Router While Asleep

Sat, 14 Sep 2013 21:31:13 +0200

There are times when you want to schedule a router reload, but you don’t want to stay late or come to the office during weekends. “Reload at” is your friend.

How to reload your router at a predefined time

You want to reload your router (or switch) at 7pm, but at the same time, you’ll be having a coffee with your friend and you don’t want to have this discussion: “- Sorry guys, I have a router to reboot. I’ll be back in 30mn.

Managing Endpoints and Endusers with CME

Sun, 27 Jan 2013 21:31:13 +0200

Preparing router to act as a CME:

configure ip address on interface.
Configure the source address, the IP address to which ip phones will register:
specify the maximum number of phones that CME can handle. This will affect the router performance:
configure the maximum number of ephone-dns: Later, I will change these values because my router lacked memory resources. To verify the aforementioned settings: Let’s create our first ephone-dn: At this point, my router displayed an error message indicating a lack of memory. I increased its memory size in GNS3: After a reload, things went ok I also reduced the max-ephone and max-dn values: Now we can add ephone-dns without problems: When I create a dual-line ephone-dn, two “sub-ephone-dn” are created: To verify ephone-dns: another way to verify it: Notice that there are two channels for ephone-dn 2, which is a dual-line ephone-dn.

Adding a secondary line to a dual-line ephone-dn:

Cisco Switching Notes

Thu, 09 Feb 2012 21:31:13 +0200

a 3750 can act as a layer3 switch by adding the “ip routing” command.
It can automatically route between locally created vlans because it considers them as connected interfaces (given that the SVIs are created).
on a device, there are 3 types of traffic: control, management, end user.
Control traffic such as CDP, DTP, PAgP goes through vlan1 between Cisco switches, even if you clear it from trunks.
By default, native vlan traffic is untagged. But there’s a Cisco command that tells the switch to tag all vlans.
by default, native vlan = vlan1. If we set the native vlan to vlan100, then vlan100 frames will be untagged on trunks, and vlan1 frames will be tagged.
SMI: Standard Multilayer Image
EMI: Enhanced Multilayer Image
if switch is acting L2, then we should set a Default Gateway on it to make the management vlan reachable remote ; if it is acting L3, it will have routes instead.
switch and Management vlan
the management IP address must be reachable from remote
best practice: use a same subnet to manage all network devices
on L2 SW: only one SVI is up at a time

Cisco Auto Qos Configuration

Mon, 08 Aug 2011 21:31:13 +0200

First, let’s see if QoS is enabled on the switch: QoS is disabled. We should enable it on global configuration level: If we want to display QoS settings for an interface, we do a show mls qos interface command: At this stage we still did not define trust boundaries. That’s why Trust State and Trust Mode say “not trusted”. And we did not specify whether we’ll trust a device or not. To define trust boundary with auto-qos, we either trust all CoS values coming on the switch interface or we trust CoS values only if an ip phone is connected to the switch port. With auto qos voip trust, we tell the switch to trust CoS on each packet coming on the switch interface: If we want to further limit trust boundary, we can tell the switch to trust CoS values only if a Cisco ip phone is detected on the port: Finally, on a 3550 switch, show auto qos and show auto qos interface give the same output:

TSHOOT Exam Strategy Notes

Sun, 22 May 2011 21:31:13 +0200

I gathered these notes to mentally prepare my Troubleshooting methodology on the exam day:

Follow the path
divide and conquer
Move the problem
Bottom up
Top down After watching Kevin Wallace Bull’s Eye videos and INE Tshoot Exam Demo video, the best method is to use a combination of Divide and Conquer-Bottom up/Top Down-Follow the path. There’s not really one single method that will lead to finding where the problem lies.

This is a collection of possible troubleshooting tips I collected over my studies. They are organized by OSI layer:

IPSec VPN Notes

Fri, 06 May 2011 21:51:08 +0200

Steps to create IPSEC VPN:

define ISAKMP Policies
define ISAKMP preshared key (if authentication method is Pre-share)
define IPSEC Transform Sets
define IPSEC security associations
define interesting traffic through Proxy Identity (or crypto ACL)
link crypto ACL and IPSEC TS with a Crypto Map
put the crypto map under the Internet-facing interface

configuring IPSEC VPN between R2 and R3 There was a problem at first. Debug command helped see the error: We look back at the configuration on both R2 and R3 and discover that “set transform-set” is missing on R3:

Dot1x and AAA Notes

Fri, 06 May 2011 21:31:13 +0200

dot1x

dot1x can work with DHCP address assignment
only EAPOL is allowed before a port is authorized
Vlan Assignment (by a RADIUS server) depends on the result of dot1x authentication
RADIUS server- the dot1x authentication server- is the one which verifies the identity of the client connected to a dot1x port

AAA

there are named method lists (simply method lists)
once AAA is enabled, the default method list is applied to console, VTY access, enable mode…

Loop Guard on Cisco IOS

Sun, 19 Sep 2010 21:31:13 +0200

Enabling Loop Guard on an interface level does not enable it for the whole system. In fact, a “show spanning-tree summary total” is a bit misleading in this case.

To configure loop guard on an interface:

“loop guard default” is disabled because we haven’t issued a “spanning-tree loopguard default”. Easy:

QoS Configuration and Verification on Cisco IOS

Fri, 10 Sep 2010 21:31:13 +0200

verify that QoS is enabled:

Enable QoS:

At this stage, all interfaces are by default untrusted. This means that any frame with a priority value will be remarked as CoS/IP Precedence/DSCP value = 0.

Trust CoS values of incoming frames. Useful for trunks:

Trust CoS values only if an attached Cisco ip phone exists (conditional trust):

At this stage, the trust boundary moves to the IP phone. Any priority value of any attached PC frames is untrused, thus remarked with priority 0.

Multicast PIM-SM

Fri, 21 Aug 2009 21:31:13 +0200

PIM-SM requires the following components: a Rendez-vous Point, shared trees, source trees.

PIM Register and Register Stop messages

PIM register messages are sent by a PIM router to the Rendez-vous Point when it [the PIM router] receives multicast traffic from a streaming source.

PIM RP sends a PIM register stop message to signal to the PIM router that it [the RP] has received the PIM register message.

Incoming Interfaces vs Outgoing Interface List

Incoming Interface

The PIM router’s interface that receives – or is supposed to receive – multicast traffic from the multicast source.

Introduction to multicast communication

Thu, 20 Aug 2009 21:31:13 +0200

Reminder Of The Communication Models

client/server behind-NAT devices Point-to-point Hybrid Unicast Multicast

Multicast concepts

Multicast clients must join multicast groups in order to receive multicast traffic.

IP host: an IP endpoint that is connected to a multicast router.
Multicast router: a router that supports multicast protocols such as PIM and IGMP.
upstream router
downstream router
multicast group
nulticast (source, group) pair
multicast group membership
interested node
Host Membership Query
Host Membership Query
Host Membership Report
random report delay timer
shared tree
source-rooted spanning tree
Multicast Distribution Tree
parent link
child link
active branches
multicast leaf router: is connected to leaf sub-networks
Leaf sub-network: some have group members, some do not.
DVMRP

Advantages of Multicast Communication

Routers process one packet instead of many (in case of multiple unicast transmissions) Routers do not have to determine the destination address to send the packet to, in contrast to unicast transmission. Reduced usage of resources: router CPU and memory, network bandwidth.

HSRP Interface Tracking

Sun, 16 Aug 2009 21:31:13 +0200

In this lab, I learned the following:

configuring a HSRP group on physical interfaces,
testing how a PC can reach a remote subnet through a redundant gateway, by configuring its default gateway as the HSRP virtual address,
testing how the second router becomes Active,
testing interface tracking.

For interface tracking, at first, I thought there was a problem with the lab. Topology: configure interface tracking and a decrement value: When I shut down ser0/0 on R2, I expected R2 to become Standby router. But reality bites: Then I checked on R3. R3 is still Standby, not Active ! So what’s wrong? Here’s what Cisco says: How Object Tracking Affects the Priority of an HSRP Router

Cisco BSCI Exam

Fri, 27 Feb 2009 21:31:13 +0200

Score is 822. Passing score was 790. It came after four days of reviewing IPv6, Route maps, BGP,… In the beginning of the test I was taking enough time to read and answer the questions. However I lost much time in my first lab simulation. The scenarion wasn’t clear to me. And each time I had to click on the console button to reach a router. And I was not seeing changes in the routing table so it confused me a lot. I began to worry about my score. And I got my second lab simulation. And immediately after, the third. I told to myself: “man, what did I do to Cisco to treat me this way?” So I had almost 38 minutes to do the third lab sim and 32 questions ! Besides, the test supervisor was tearing papers on her desk. And the other guy in the room was complaining about the bug in his exam. I was going to scream. At the end, I was almost flipping through the questions. I finished the test. The test supervisor told me “congratulations!”.