Thursday, May 21, 2009

[Juniper] How to simulate JUNOS w/ FreeBSD & VirtualBox on MacBook or Linux

How to simulate JUNOS w/ FreeBSD & VirtualBox on MacBook or Linux
Requiements:
JUNOS: jinstall-8.5R1.4-domestic-signed.tgz
FreeBSD: 4.10-RELEASE-i386-miniinst.iso
VirtualBox
Socat (install via macports, apt-get) <-- By default olive disable standard output, only management with serial port console

Credit:
h**p://brokenpipes.blogspot.com
h**p://www.packetmischief.ca/juniper/olive/
h**p://spirit.sheridanc.on.ca/help/virtualbox/Network_Between_VirtualBox_Machines.html

1. VirtualBox
1.1 Create VM
Name JuniperOlive
Operating system: BSD
Version: FreeBSD
1.2 Memory size 256M
1.3 Create new harddisk
- Dynamic expanding storage
- Location
- Size 3G
1.4 Config detail
1.4.1 Audio disabled
1.4.2 Network
- Adapter 1
-Adapter type: Intel PRO/1000MT Desktop
-Attached to: NAT
- Adapter 2
-Adapter type: Intel PRO/1000MT Desktop
-Attached to: Internal Network
-Name: intf_R1_R2
- Adpater 3
-Adapter type: Intel PRO/1000MT Desktop
-Attached to: Internal Network
-Name: intf_R1_R3
1.5 Serial Ports
Enable ports 1
Port number: COM1
Port mode: Host Pipe
Check Create Pipe
Path: /tmp/olive1
2. Install FreeBSD
2.1 Boot freebsd cd
2.2 Skip kernel configuration
2.3 Choose standard install
2.4 Fdisk, Press A, then Q
2.5 select: install a standard MBR
2.6 Create partitions, Press C

/ FS 500M
SWAP 500M
/config FS 100M
/var FS
Finish press Q.
2.7 Choose Distributions = Exit
2.8 Install media CD/DVD
2.9 Config Ethernet: Yes
2.10 Network Interface
2.8.1 select em0 for DHCP, no ipv6
2.8.2 enter hostname: olive, then OK
2.8.3 select NO any requested
2.8.4 Set root password YES, Add user & group= Exit
2.11 Exit from install

2. Install JUNOS software
2.1 Boot freebsd and login with root
#cd /var/tmp
#ftp x.x.x.x <-- get junos software
get jinstall-8.5R1.4-domestic-signed.tgz
#mkdir jinst-signed
#cd jinst-signed
#tar xvfz ../jinstall-8.5R1.4-domestic-signed.tgz
#mkdir jinst
#cd jinst
#tar xvfz ../jinstall-8.3R1.4-domestic.tgz
#mkdir pkgtools
#cd pkgtools
#tar xvfz ../pkgtools.tgz
#cd bin
#cp /usr/bin/true checkpic
#cd ..
#tar zcvf ../pkgtools.tgz *
#cd ..
#rm -rf pkgtools
#tar zcvf /var/tmp/jinstall-8.3R1.4-domestic-signed-olive.tgz *
#rm /dev/wd0c && ln -s /dev/ad0c /dev/wd0c
#mkdir /var/etc
#touch /var/etc/master.passwd
#touch /var/etc/group
#touch /var/etc/inetd.conf
! install JUNOS
#pkg_add /var/tmp/jinstall-8.3R1.4-domestic-signed-olive.tgz
! reboot to continue



3. VirtualBox clone VDI for Backup & for R2 R3 ..
On MacBook

$ cd Library/VirtualBox/VDI/
$ VBoxManage clonehd JuniperOlive.vdi JuniperOlive_R1.vdi
VirtualBox Command Line Management Interface Version 2.2.2
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Clone hard disk created in format 'VDI'. UUID: 564eefe7-350f-42a3-bfd2-bb967d2f998e
3.1 New VM name JuniperOlive_R2, JuniperOlive_R3 and select harddisk from clone
3.2 Config VirtualBox JuniperOlive_R2, JuniperOlive_R3 details same JuniperOlive_R1
- Set Serial ports path different from R1, such as path: /tmp/olive2, /tmp/olive3

4. Start Olive
on macbook open new terminal
$socat -d -d /tmp/olive1 pty <-- Create new PTY. Example /dev/ttys001
$minicom -o -s <-- console and setup select port /dev/ttys001
5. Finish



Friday, May 15, 2009

[Cisco] QoS for GRE tunnel

เราต้องการ implement QOS บน tunnel interface เนื่องจาก traffic วิ่งอยู่บน tunnel

pre-config บน physical และ tunnel ปกติครับ

ip access-list extended data
permit ip any host 2.2.2.22
ip access-list extended voice
permit ip any host 2.2.2.2
!
ip route 0.0.0.0 0.0.0.0 Tunnel0


policy-map QOS
class voice
priority 128
class data
bandwidth 1024

int tu0
service-policy output QOS <== เมื่อเราป้อน service-policy บน interface tunnel จะเห็น warnning ว่าไม่สามารถ support
Class Based Weighted Fair Queueing not supported on interface Tunnel0



ปกติถ้ามีการ implement QOS บน physical interface เราจะไม่สามารถ classify packet ได้เพราะมันถูก encasulation ด้วย tunnel ไปแล้ว
แต่ถ้าไป implement บน tunnel ก็จะติดfeature บางอย่างบน tunnel interface


วิธีแก้ดังนี้


Solution:
Reference: h**p://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008017405e.shtml



class-map match-all data
match access-group name data
class-map match-all map-voice
match ip precedence 2
class-map match-all map-data
match ip precedence 6
class-map match-all voice
match access-group name voice
!
!
policy-map QOS
class map-voice
priority 128
class map-data
bandwidth 1024
policy-map QOS-tunnel
class voice
set ip precedence 2
class data
set ip precedence 6

int tu0
qos pre-classify
service-policy output QOS-tunnel
int s1/0
service-policy output QOS



Verify:

AS1_PE1#sh int tu0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.0.0.1/24
MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 192.168.12.1 (Serial1/0), destination 192.168.12.2, fastswitch TTL 255
Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
Tunnel TTL 255
Checksumming of packets disabled, fast tunneling enabled
Last input 00:05:26, output 00:05:26, output hang never
Last clearing of "show interface" counters 00:20:05
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo (QOS pre-classification) <=================== qos pre-classify
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
140 packets input, 24080 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
140 packets output, 17360 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out


! Before test send voice packet

AS1_PE1#sh policy-map int tu0
Tunnel0

Service-policy output: QOS-tunnel

Class-map: voice (match-all)
0 packets, 0 bytes <==== 0 packet
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name voice
QoS Set
ip precedence 2
Packets marked 0

Class-map: data (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name data
QoS Set
ip precedence 6
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
AS1_PE1#sh policy-map int s1/0
Serial1/0

Service-policy output: QOS

Class-map: map-voice (match-all)
10 packets, 1280 bytes <===== 10 packet
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 2
Queueing
Strict Priority
Output Queue: Conversation 264
Bandwidth 128 (kbps) Burst 3200 (Bytes)
(pkts matched/bytes matched) 10/1280
(total drops/bytes drops) 0/0

Class-map: map-data (match-all)
20 packets, 2560 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 6
Queueing
Output Queue: Conversation 265
Bandwidth 1024 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20/2560
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
54 packets, 3736 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any


! After test send voice 100 packet
AS1_PE1#ping 2.2.2.2 so lo0 re 100

Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 4/16/44 ms
AS1_PE1#sh policy-map int tu0
Tunnel0

Service-policy output: QOS-tunnel

Class-map: voice (match-all)
100 packets, 10000 bytes <--- match voice 100 packet
5 minute offered rate 2000 bps, drop rate 0 bps
Match: access-group name voice
QoS Set
ip precedence 2
Packets marked 100

Class-map: data (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name data
QoS Set
ip precedence 6
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
AS1_PE1#sh policy-map int s1/0
Serial1/0

Service-policy output: QOS

Class-map: map-voice (match-all)
110 packets, 14080 bytes <===== voice increase 100 packet
5 minute offered rate 2000 bps, drop rate 0 bps
Match: ip precedence 2
Queueing
Strict Priority
Output Queue: Conversation 264
Bandwidth 128 (kbps) Burst 3200 (Bytes)
(pkts matched/bytes matched) 110/14080
(total drops/bytes drops) 0/0

Class-map: map-data (match-all)
20 packets, 2560 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 6
Queueing
Output Queue: Conversation 265
Bandwidth 1024 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20/2560
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
61 packets, 4209 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any