Tuesday, November 19, 2013

how to integrate Juno space with SRX cluster


to integrate SRX cluster to Juno space is not straight forward. you have a couple of solutions

1. bidirectional NAT on backup router is best solution, source nat your Juno space server to an ip in same subnet as both Fxp0.0 destination NAT two ip to both fxp0.0 as well. ( yourJuno space is isolate with cluster management IPs)

2. backup route
never use backup route 0.0.0.0/0, please use specified ip as following, please remember, backup-router is only working for standby node, not working with active node, for active node you can use static route, but you might have problem if your cluster works as your main router in your network, all traffic to Juno space server will be affect via this cluster. you might need use static route base on source IP to fix the connection between other devices to Juno space.

groups {
    node0 {
         ...
            backup-router 192.168.1.254 destination 172.16.1.1/32;
            ...
    }
    node1 {
            ...
            backup-router 192.168.1.254 destination 172.16.1.1/32;
            ...
    }

routing-options {
    static {
        route 172.16.1.1/24 {
            next-hop 192.168.1.254;
            retain;
            no-readvertise;
        }
        route 172.16.1.1/24 {
            next-hop 192.168.1.254;;
            retain;
            no-readvertise;
        }
    }
}

please stay away from c2960-lanbasek9-mz.150-2.SE4.bin

when you upgrade your Cisco switches please stay away from c2960-lanbasek9-mz.150-2.SE4.bin
some memory leak issue with that IOS, you will lose management function and console login, power recycle is the the only solution, please go to c2960-lanbasek9-mz.150-2.SE5.bin.

my 2960G box with c2960-lanbasek9-mz.150-2.SE5.bin is working well so far after 1 week running

a week later:
Processor Pool Total:   22308940 Used:   17780540 Free:    4528400
      I/O Pool Total:    4194304 Used:    2370432 Free:    1823872
Driver te Pool Total:    1048576 Used:         40 Free:    1048536

 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
   0   0   23952480    7400780   13583992          0          0 *Init*
   0   0  257652368  249016528    1294992    4394643    1973474 *Dead*
   0   0          0          0     525600          0          0 *MallocLite*
  63   0     368228    2885616     377788          0          0 EEM ED ND
 150   0     530624     150712     374176          0          0 Auth Manager

a week ago:

Processor Pool Total:   22308940 Used:   17782724 Free:    4526216
      I/O Pool Total:    4194304 Used:    2426304 Free:    1768000
Driver te Pool Total:    1048576 Used:         40 Free:    1048536

 PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
   0   0   23952480    7400780   13798056          0          0 *Init*
   0   0   17531824   16289416    1257068    4394643    1973474 *Dead*
   0   0          0          0     394440          0          0 *MallocLite*
  63   0     368228       5940     377788          0          0 EEM ED ND
 150   0     416140      54596     374052          0          0 Auth Manager

slow web site browsing with Bluecoat SG proxy

when you put your bluecoat proxy  SG as inline transparent mode, you have chance getting in trouble:
slow browsing speed with some website, takes 1 minutes to load a homepage, here is some information about this issue

1. you might use private ip as your management ip
2. you might or might not have ip configured on passthrough interfaces
3. when you put that server ip in static bypass list of proxy services, everything looks good

you can capture the packets when you have problem, you might see some packet from your management ip to the website,

you can check the setting of proxy
you need select the checkbox otherwise the browsing won't work

reflect client ip
   reflect client's source IP when connecting to servers


for the slow issue, what you can do: 
1.configure a valid public IP with Wan Port.
2.set you internet gateway as the default gateway
3. install static route for your management traffic.

Friday, September 20, 2013

please stay away from ASA 5500 version 8.4.6

when you want to upgrade your ASA os version, you can use 8.4.5 or brand new 8.4.7, please avoid 8.4.6, too many bugs and really troubled me, the good thing is I just used it on my testing box.

what I experienced:
1. you can connect to VPN but the network is working working, show debug error license exceed limit
2. your 2 factor authentication might not working after upgrade, you meed recreate the VPN profile
3. your CSD policy might messed, need reconfig.


I am so glad did not upgrade my production box.

Thursday, September 5, 2013

ASA clientless VPN portal bookmark working with DFS

in the windows infrastructure such as you company domain name is abc.com  you can use \\abc\folder\folder to access dfs file, but is not working with ASA clientless vpn portal bookmark, you might get " can't contact drive" or similar error message

here is the solution:
if you have singer file server you can use first two solutions, for multiple file server you need use the third one.

1. you can use the hostname of the fileserver,   server01/folder/folder
2. use full dns  server01.abc.com/folder/folder
3. use name as abc.com/folder/folder

Monday, August 26, 2013

change the web filtering of SRX in NSM

if you want to add URL in white list of NSM, it might take a long time to find out where is it, even when you have central policy management:

object manager-UTM-Misc-URL Category

Thursday, August 8, 2013

dhcp relay configuration of Juniper SRX

our topology is DHCP server and DHCP client connect to same physical interface and different vlans.  before you want to configure DHCP agent on SRX, you need make sure routing between the DHCP server and subnet of DHCP scope is working, mean you can ping the dhcp server with the source ip of the scope.

To configure an SRX Series device as a relay agent to forward incoming requests from BOOTP or DHCP clients to a BOOTP or DHCP server:
  1. Provide a description for the relay service. In this example, "Global DHCP relay service" is the descriptive text.
    user@host# set forwarding-options helpers bootp description "Global DHCP relay service"
  2. Specify the IP address of the server to which requests are forwarded. In this example, the IP address is 192.18.24.38.
    user@host# set forwarding-options helpers bootp server 192.18.24.38
  3. Specify the maximum number of hops allowed per packet. In this example, the hop count is 4.( options)
    user@host# set forwarding-options helpers bootp maximum-hop-count 4
  4. Specify the interface bootp requests will be received on.
    user@host# set forwarding-options helpers bootp interface fe-0/0/7.0 or vlan.xxx
  5. Specify DHCP as an allowed inbound service for each interface that is associated with DHCP. In the following example, DHCP is configured as an inbound service for fe-0/0/7 and fe-0/0/8.
user@host# set security zones security-zone trust interfaces fe-0/0/7 host-inbound-traffic system-services dhcp
user@host# set security zones security-zone untrust interfaces fe-0/0/8 host-inbound-traffic system-services dhcp
note: you might have global setting of the host-inbound-traffic apply on all interface, skip this if you have, otherwise, it will overwrite the global setting.

6.  (this is based on the client and server on different security zone) Make sure that you have a security policy that allows the session from the DHCP server to the DHCP client apart for the policy from trust to untrust.
                   
             user@host# set security zones security-zone untrust address-book address DHCP-server 192.18.24.38
user@host# set security policies from-zone trust to-zone untrust policy DHCP-request match source- address any
user@host# set security policies from-zone trust to-zone untrust policy DHCP-request match destination-address DHCP-server
user@host# set security policies from-zone trust to-zone untrust policy DHCP-request match application any
user@host# set security policies from-zone trust to-zone untrust policy DHCP-request then permit
user@host# set security policies from-zone untrust to-zone trust policy DHCP-reply match source-address DHCP-server
user@host# set security policies from-zone untrust to-zone trust policy DHCP-reply match destination-address any
user@host# set security policies from-zone untrust to-zone trust policy DHCP-reply match application any
user@host# set security policies from-zone untrust to-zone trust policy DHCP-reply then permit

Verification

 To verify that the DHCP relay configuration, use the following operational mode command:
user@host> show system services dhcp relay-statistics

How to use Telus Actionec T3200M as a wireless Access point

when you install Telus Internet, they will offer you a modem + router + wireless device Actionec T3200M, a lot of users still want to use th...