[Cisco] QoS for GRE tunnel

เราต้องการ implement QOS บน tunnel interface เนื่องจาก traffic วิ่งอยู่บน tunnel

pre-config บน physical และ tunnel ปกติครับ

ip access-list extended data
permit ip any host 2.2.2.22
ip access-list extended voice
permit ip any host 2.2.2.2
!
ip route 0.0.0.0 0.0.0.0 Tunnel0


policy-map QOS
class voice
priority 128
class data
bandwidth 1024

int tu0
service-policy output QOS <== เมื่อเราป้อน service-policy บน interface tunnel จะเห็น warnning ว่าไม่สามารถ support
Class Based Weighted Fair Queueing not supported on interface Tunnel0



ปกติถ้ามีการ implement QOS บน physical interface เราจะไม่สามารถ classify packet ได้เพราะมันถูก encasulation ด้วย tunnel ไปแล้ว
แต่ถ้าไป implement บน tunnel ก็จะติดfeature บางอย่างบน tunnel interface


วิธีแก้ดังนี้


Solution:
Reference: h**p://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008017405e.shtml



class-map match-all data
match access-group name data
class-map match-all map-voice
match ip precedence 2
class-map match-all map-data
match ip precedence 6
class-map match-all voice
match access-group name voice
!
!
policy-map QOS
class map-voice
priority 128
class map-data
bandwidth 1024
policy-map QOS-tunnel
class voice
set ip precedence 2
class data
set ip precedence 6

int tu0
qos pre-classify
service-policy output QOS-tunnel
int s1/0
service-policy output QOS



Verify:

AS1_PE1#sh int tu0
Tunnel0 is up, line protocol is up
Hardware is Tunnel
Internet address is 10.0.0.1/24
MTU 1514 bytes, BW 9 Kbit, DLY 500000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel source 192.168.12.1 (Serial1/0), destination 192.168.12.2, fastswitch TTL 255
Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled
Tunnel TTL 255
Checksumming of packets disabled, fast tunneling enabled
Last input 00:05:26, output 00:05:26, output hang never
Last clearing of "show interface" counters 00:20:05
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo (QOS pre-classification) <=================== qos pre-classify
Output queue: 0/0 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
140 packets input, 24080 bytes, 0 no buffer
Received 0 broadcasts (0 IP multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
140 packets output, 17360 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out


! Before test send voice packet

AS1_PE1#sh policy-map int tu0
Tunnel0

Service-policy output: QOS-tunnel

Class-map: voice (match-all)
0 packets, 0 bytes <==== 0 packet
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name voice
QoS Set
ip precedence 2
Packets marked 0

Class-map: data (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name data
QoS Set
ip precedence 6
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
AS1_PE1#sh policy-map int s1/0
Serial1/0

Service-policy output: QOS

Class-map: map-voice (match-all)
10 packets, 1280 bytes <===== 10 packet
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 2
Queueing
Strict Priority
Output Queue: Conversation 264
Bandwidth 128 (kbps) Burst 3200 (Bytes)
(pkts matched/bytes matched) 10/1280
(total drops/bytes drops) 0/0

Class-map: map-data (match-all)
20 packets, 2560 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 6
Queueing
Output Queue: Conversation 265
Bandwidth 1024 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20/2560
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
54 packets, 3736 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any


! After test send voice 100 packet
AS1_PE1#ping 2.2.2.2 so lo0 re 100

Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 4/16/44 ms
AS1_PE1#sh policy-map int tu0
Tunnel0

Service-policy output: QOS-tunnel

Class-map: voice (match-all)
100 packets, 10000 bytes <--- match voice 100 packet
5 minute offered rate 2000 bps, drop rate 0 bps
Match: access-group name voice
QoS Set
ip precedence 2
Packets marked 100

Class-map: data (match-all)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name data
QoS Set
ip precedence 6
Packets marked 0

Class-map: class-default (match-any)
0 packets, 0 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any
AS1_PE1#sh policy-map int s1/0
Serial1/0

Service-policy output: QOS

Class-map: map-voice (match-all)
110 packets, 14080 bytes <===== voice increase 100 packet
5 minute offered rate 2000 bps, drop rate 0 bps
Match: ip precedence 2
Queueing
Strict Priority
Output Queue: Conversation 264
Bandwidth 128 (kbps) Burst 3200 (Bytes)
(pkts matched/bytes matched) 110/14080
(total drops/bytes drops) 0/0

Class-map: map-data (match-all)
20 packets, 2560 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: ip precedence 6
Queueing
Output Queue: Conversation 265
Bandwidth 1024 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20/2560
(depth/total drops/no-buffer drops) 0/0/0

Class-map: class-default (match-any)
61 packets, 4209 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: any

[Linux] ทำ FTP caching

ต้องการทำ ftp caching ให้ install package frox
vi /etc/frox.conf
Listen 0.0.0.0
Port 2121
ResolvLoadHack wontresolve.doesntexist.abc
TcpOutgoingAddr 192.168.1.100
#^-- ifconfig eth0:1 inet 192.168.1.100 netmask 255.255.255.255 up
User frox
Group frox
WorkingDir /var/spool/frox
LogLevel 20
LogFile /var/spool/frox/frox-log
PidFile /var/run/frox.pid
APConv yes
BounceDefend yes
CacheModule local
CacheSize 10240
CacheAll yes
CacheOnFQDN yes
MaxForks 10
MaxForksPerHost 10
ACL Allow * - *

[Linux] Compile cacti-spine แล้ว error

ผมใช้ ubuntu 8.10 เวลาจะ compile cacti-spine เองมัน error
ubuntu@hybitz:~/cacti-spine-0.8.7a$ ./configure
configure: error: cannot run /bin/bash config/config.sub
วิธีแก้คือ

aclocal
autoheader
libtoolize --force
automake --add-missing
autoconf
./configure
make
make install

[Troubleshoot] show tcam ที่ apply interface

sh tcam count
sh platform software tcam interface vl10 acl in ip
sh platform software tcam interface vl10 acl out ip

[Certified] JNCIA-EX Logo

[Certified] CCDP Logo

[Cisco] ip nat outside source

[PC]<----------[R1]-----------------[R2]

PC = 192.168.2.2/24, no default gateway

[R2]
int lo0
ip add 20.0.0.1 255.255.255.255
int f0/0
ip add 192.168.1.2 255.255.255.0
ip route 10.0.0.1 255.255.255.0 192.168.1.1

[R1]
int f0/0
ip add 192.168.1.1 255.255.255.0
ip nat outside
int f0/1
ip add 192.168.2.1 255.255.255.0
ip nat inside
ip nat inside source static 192.168.2.2 10.0.0.1
ip nat outside source static 20.0.0.1 192.168.2.100 add-route <<<
ip route 0.0.0.0 0.0.0.0 192.168.1.2
ip route 20.0.0.0 255.255.255.0 192.168.1.2 <<<

#sh ip route
20.0.0.0/24 is subnetted, 1 subnets
S 20.0.0.0 [1/0] via 192.168.1.2
192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
S 192.168.1.10/32 [1/0] via 20.0.0.1
C 192.168.1.0/24 is directly connected, FastEthernet0/0
192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
S 192.168.2.10/32 [1/0] via 20.0.0.1
C 192.168.2.0/24 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 192.168.1.2
#sh ip nat tran
Pro Inside global Inside local Outside local Outside global
--- --- --- 192.168.2.10 20.0.0.1
--- 10.0.0.1 192.168.2.2 --- ---

[R2]
R2#ping 10.0.0.1 source lo0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
Packet sent with a source address of 20.0.0.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/15/28 ms

Tunning TCP window size ของ Windows

ผมลอง FTP ระหว่าง linux กับ XP ไป Siteเดียวกัน Link เดียวกัน ปรากฏว่าผล download ของ Linux ดีกว่า เลยต้องปวดหัว ดูจาก packet ก็น่าจะเกี่ยวกับ window size เลยไปถามพี่ google พี่แกก็เลยบอกมาว่าไปดูที่ h**p://rdweb.cns.vt.edu/public/notes/win2k-tcpip.htm ซึ่งหลังจาก tunning registry แล้วก็ Ok เลย

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]

The names/values I installed are:

GlobalMaxTcpWindowSize	REG_DWORD	131400 (decimal)
TcpWindowSize	REG_DWORD	131400 (decimal)
Tcp1323Opts	REG_DWORD	3

[Cisco] Cisco config DHCPv6

ipv6 dhcp pool DHCPv6POOL
dns-server 2001:FB0:1000:0:192:168:1:1
domain-name domain.co.th

interface GigabitEthernet0/1
des ## LAN ##
ipv6 address 2001:FB0:1::1/64
ipv6 nd other-config-flag
ipv6 dhcp server DHCPv6POOL

* client must support DHCPv6

[Cisco] Config Cisco Multipoint GRE tunnel

Dynamic GRE tunnels (point-to-multipoint)
[R1]--------------[R2]-----------------[R3]

[R1]
interface Loopback0
ip address 10.1.1.1 255.255.255.0
!
interface Loopback192
description ## private ip address ##
ip address 192.168.1.1 255.255.255.0
!
interface Tunnel1
ip address 172.16.0.1 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map multicast dynamic
ip nhrp network-id 99
no ip split-horizon
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 1
!
interface Serial1/0.12 point-to-point
ip address 10.3.12.1 255.255.255.0
frame-relay interface-dlci 102
!
router ospf 1
log-adjacency-changes
network 10.1.1.1 0.0.0.0 area 0
network 10.3.12.1 0.0.0.0 area 0
!
router rip
version 2
redistribute connected metric 2 route-map PRIVATE->RIP
network 172.16.0.0
no auto-summary
!
ip access-list standard PRIVATE_192
permit 192.168.1.0
!
!
route-map PRIVATE->RIP permit 10
match ip address PRIVATE_192

R1#sh ip route rip
10.0.0.0/8 is variably subnetted, 12 subnets, 2 masks
R 10.1.3.0/24 [120/2] via 172.16.0.3, 00:00:20, Tunnel1
R 10.1.2.0/24 [120/2] via 172.16.0.2, 00:00:06, Tunnel1
R 192.168.2.0/24 [120/2] via 172.16.0.2, 00:00:06, Tunnel1
R 192.168.3.0/24 [120/2] via 172.16.0.3, 00:00:20, Tunnel1

R1#sh ip route 192.168.3.1
Routing entry for 192.168.3.0/24
Known via "rip", distance 120, metric 2
Redistributing via rip
Last update from 172.16.0.3 on Tunnel1, 00:00:15 ago
Routing Descriptor Blocks:
* 172.16.0.3, from 172.16.0.3, 00:00:15 ago, via Tunnel1
Route metric is 2, traffic share count is 1

R1#ping 192.168.3.1 source 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/29/52 ms

!------------------------------------------------------------------------------------------------------
[R2]
interface Loopback0
ip address 10.1.2.2 255.255.255.0
!
interface Loopback192
description ### private ip address ###
ip address 192.168.2.1 255.255.255.0
!
interface Tunnel0
ip address 172.16.0.2 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map 172.16.0.1 10.1.1.1
ip nhrp map multicast 10.1.1.1
ip nhrp network-id 99
ip nhrp nhs 172.16.0.1
ip nhrp registration timeout 180
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 1
!
interface Serial1/0.12 point-to-point
ip address 10.3.12.2 255.255.255.0
frame-relay interface-dlci 201
!
interface Serial1/0.23 point-to-point
ip address 10.3.23.2 255.255.255.0
frame-relay interface-dlci 203
!
router ospf 1
log-adjacency-changes
network 10.1.2.2 0.0.0.0 area 0
network 10.3.12.2 0.0.0.0 area 0
network 10.3.23.2 0.0.0.0 area 0
!
router rip
version 2
redistribute connected metric 2 route-map PRIVATE->RIP
network 172.16.0.0
no auto-summary
!
ip access-list standard PRIVATE_192
permit 192.168.2.0
!
route-map PRIVATE->RIP permit 10
match ip address PRIVATE_192

R2# sh ip route rip
10.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
R 10.1.3.0/24 [120/3] via 172.16.0.3, 00:00:19, Tunnel0
R 192.168.1.0/24 [120/2] via 172.16.0.1, 00:00:19, Tunnel0
R 192.168.3.0/24 [120/3] via 172.16.0.3, 00:00:19, Tunnel0
!-------------------------------------------------------------------------------------------
[R3]
interface Loopback0
ip address 10.1.3.3 255.255.255.0
!
interface Loopback192
description ### private ip address ###
ip address 192.168.3.1 255.255.255.0
!
interface Tunnel0
ip address 172.16.0.3 255.255.255.0
no ip redirects
ip nhrp authentication CISCO
ip nhrp map 172.16.0.1 10.1.1.1
ip nhrp map multicast 10.1.1.1
ip nhrp network-id 99
ip nhrp nhs 172.16.0.1
ip nhrp registration timeout 180
tunnel source Loopback0
tunnel mode gre multipoint
tunnel key 1
!
interface Serial1/0.23 point-to-point
ip address 10.3.23.3 255.255.255.0
frame-relay interface-dlci 302
!
router ospf 1
log-adjacency-changes
network 10.1.3.3 0.0.0.0 area 0
network 10.3.23.3 0.0.0.0 area 0
!
router rip
version 2
redistribute connected metric 2 route-map PRIVATE->RIP
network 172.16.0.0
no auto-summary
!
ip access-list standard PRIVATE_192
permit 192.168.3.0
!
route-map PRIVATE->RIP permit 10
match ip address PRIVATE_192
!

R3#sh ip route rip
10.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
R 10.1.2.0/24 [120/3] via 172.16.0.2, 00:00:00, Tunnel0
R 192.168.1.0/24 [120/2] via 172.16.0.1, 00:00:00, Tunnel0
R 192.168.2.0/24 [120/3] via 172.16.0.2, 00:00:00, Tunnel0
!---------------------------------------------------------------------------------------------

[Cisco] Config TACACS+

aaa authentication login TACPLUS group tacacs+ local
aaa authentication login CONSOLE local group tacacs+ none
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec TACPLUS group tacacs+ local none
aaa authorization exec CONSOLE local none
aaa authorization commands 0 TACPLUS group tacacs+ local none
aaa authorization commands 0 CONSOLE local none
aaa authorization commands 1 TACPLUS group tacacs+ local none
aaa authorization commands 1 CONSOLE local none
aaa authorization commands 15 TACPLUS group tacacs+ local none
aaa authorization commands 15 CONSOLE local none
aaa accounting exec TACPLUS start-stop group tacacs+
aaa accounting exec CONSOLE start-stop group tacacs+
aaa accounting commands 0 TACPLUS start-stop group tacacs+
aaa accounting commands 1 TACPLUS start-stop group tacacs+
aaa accounting commands 1 CONSOLE start-stop group tacacs+
aaa accounting commands 15 TACPLUS start-stop group tacacs+
aaa accounting commands 15 CONSOLE start-stop group tacacs+

username admin privilege 15 password 0 admin

ip tacacs source-interface Loopback0
tacacs-server host 192.168.1.1
tacacs-server key CISCO

line con 0
authorization commands 0 CONSOLE
authorization commands 1 CONSOLE
authorization commands 15 CONSOLE
authorization exec CONSOLE
accounting commands 15 CONSOLE
accounting commands 1 CONSOLE
accounting exec CONSOLE
login authentication CONSOLE

line vty 0 4
authorization commands 0 TACPLUS
authorization commands 1 TACPLUS
authorization commands 15 TACPLUS
authorization exec TACPLUS
accounting commands 1 TACPLUS
accounting commands 15 TACPLUS
accounting exec TACPLUS
login authentication TACPLUS
!

[3Com] Configuration 3COM router 3030 connect ADSL

system-view
System View: return to User View with Ctrl+Z.
[Router]quit

disp current-configuration
#
#3Com Router Software V2.04
#
sysname Router
#
dialer-rule 1 ip permit
#
dhcp server ip-pool default
network 192.168.1.0 mask 255.255.255.0
gateway-list 192.168.1.1
dns-list 10.0.0.1 10.0.0.2
#
interface Dialer1
link-protocol ppp
ppp pap local-user username@domain password simple mypassword
mtu 1450
ip address ppp-negotiate
dialer user username@domain
dialer-group 1
dialer bundle 1
dialer timer idle 0
nat outbound 2000
#
interface Ethernet1/0
ip address 192.168.1.1 255.255.255.0
#
interface Atm2/0
pvc 0/100
map bridge Virtual-Ethernet1
#
interface Virtual-Ethernet1
pppoe-client dial-bundle-number 1
#
interface NULL0
#
acl number 2000
rule 1 permit source 192.168.1.0 0.0.0.255
#
ip route-static 0.0.0.0 0.0.0.0 Dialer 1 preference 60
#
user-interface con 0
user-interface vty 0 4
#
return

[Ubuntu] bootchart after tunning

[Ubuntu] tunning hardy 8.04 for my labtop

sudo vi /etc/fstab
UUID=fdb68ba3-e411-4a71-8cb4-ac4e117181de / reiserfs notail,relatime 0 1
change to
UUID=fdb68ba3-e411-4a71-8cb4-ac4e117181de / reiserfs notail,noatime,relatime 0 1

sudo vi /etc/sysctl.conf
vm.swappiness=0

sudo vi /etc/init.d/rc
CONCURRENCY=shell

sudo vi /boot/grub/menu.lst
# defoptions=quiet splash
change to
# defoptions=quiet splash elevator=cfq ramdisk_size=160000
And run
sudo update-grub

sudo apt-get install preload prelink bootchart

sudo vi /etc/default/prelink
PRELINKING=unknown
change to
PRELINKING=yes

when reboot, view images
/var/log/bootchart

Disable ipv6
sudo vi /etc/modprobe.d/aliases
#alias net-pf-10 ipv6
alias net-pf-10 off ipv6
alias net-pf-10 off
alias ipv6 off


if you want disable check filesystem (fsck)
sudo touch /fastboot

force check
sudo touch /forcefsck

!-------------------------------------------------------------------
vi fastboot

#! /bin/sh
### BEGIN INIT INFO
# Provides: fastboot
# Required-Start: networking
# Required-Stop: networking
# Should-Start:
# Should-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0
# Short-Description: create/delete file /fastboot .
### END INIT INFO

PATH=/sbin:/bin

. /lib/lsb/init-functions

do_start () {
log_begin_msg "Deleting /fastboot file ..."
rm -f /fastboot
}
do_stop () {
log_begin_msg "Creating /fastboot file ..."
touch /fastboot
}

case "$1" in
start)
do_start
;;
restart|reload|force-reload)
echo "Error: argument '$1' not supported" >&2
exit 3
;;
stop)
do_stop
;;
*)
echo "Usage: $0 start|stop" >&2
exit 3
;;
esac
!-------------------------------------------------------------------

sudo apt-get install sysv-rc-conf
cp fastboot /etc/init.d
sudo sysv-rc-conf
check level 2,3,4,5

[Perl] IP Spoofing ง่ายๆด้วย perl

ตัวอย่างส่ง udp packet โดย spoof source address เป็น 1.1.1.1 แล้วส่ง udp 514 ไปหา server 192.168.1.100

vi spoofing_syslog.pl
use Net::RawIP;
$n = Net::RawIP->new({
ip => {
saddr => '1.1.1.1',
daddr => '192.168.1.100',
},
udp => {
source => 514,
dest => 514,
data => "<28>Syslog: Spoofing source address",
},
});
$n->send;