Safar Safarov's Blog

SysKEY – Your Key to Information Systems

Safar Safarov — Tue, 25 Oct 2011 21:41:07 +0000

Dear Friends,

effective October 24, 2011 a new “SysKEY” Internet Project was opened by me.

It will be the biggest portal for IT News, Reviews, Configuration Tips, “How To”s, Videos, Software Shares, Experience Exchange and much more.

I will proceed with articles and configuration examples on both websites – SysKEY and here.

Be the first to subscribe to the new project.

Check it at http://www.syskey.info

Please post your comments and suggestions, it will be a great value for me to make SysKEY more interesting and useful.

Hope to see you there.

Best Regards,
Safar Safarov.

Live Record in Call Manager Express

Safar Safarov — Tue, 20 Sep 2011 06:12:32 +0000

Live Record is a feature supported in Cisco Unified Call Manager Express. When initiated, via a configured soft key, this feature essentially grants end users the capability to record an active call. Once the recording is complete, the end user will receive a message-waiting indicator on their phone indicating there is a new voicemail message available. This recording will then be accessible via the end user’s assigned Cisco Unity Express voicemail box.

STEP 1. Enabling Live Record

The live record feature is a global setting that is supported for two-party calls or ad-hoc conferencing. You must assign live record an ephone-dn that forwards to the designated voicemail pilot for CUE. You will then enable it within telephony-service and CUE.

CUCME(config)#ephone-dn 5 CUCME(config-ephone-dn)#number 250 no-reg CUCME(config-ephone-dn)#call-forward all 260


CUCME(config)#telephony-service

CUCME(config-telephony)#live-record 250

CUE(config)#voicemail live-record pilot-number 250

STEP 2. Enabling the Phone for Live Record

In order to give an IP Phone access to the Live Record feature, you must create a new ephone-template assigning the Live Record soft key in the “connected” state. You should only assign the new ephone-template to the ephones that will be granted access to this feature.

CUCME(config)#ephone-template 1 CUCME(config-ephone-template)#softkeys connected LiveRcd Hold Endcall Trnsfer Confrn

CUCME(config)#ephone 5 CUCME(config-ephone)ephone-template 1

You are now ready to test and verify your configuration. During an active call, press the LiveRcd soft key. You should hear an entrance tone when your current call is joined with the live record feature. This beep will continue during the time live record is active as a reminder. You can adjust the duration (in milliseconds) and interval (in seconds) of the beep within CUE.

CUE(config)#voicemail live-record beep duration 50 CUE(config)#voicemail live-record beep interval 30

To cancel recording press the LiveRcd softkey again or EndCall. Once the recording is completed the MWI will illuminate indicating a new voicemail message. You can then log into voicemail and review and manage the recording the same as any other voicemail message.

LiveRcd behaves as a two-party ad-hoc conference call when paired up to record a call. In the event you need to record a call that is already active with two or more parties, you will need to configure CUCME for ad-hoc hardware conferencing.

Dynamic Failover on Cisco Routers

Safar Safarov — Sat, 05 Feb 2011 22:31:03 +0000

While it is possible to put two routes in place with the secondary having a higher metric, this may not always work. In the event of a failure that does not bring down the physical interface on the router the primary route is not removed. There is also the situation where the primary interface takes too long to change status. The way around these limitations is simple – IP SLA:

STEP 1. Configure an ip sla (previously known as Response Time Reporter – rtr) object pinging the next-hop router (172.16.0.1) on primary link (FastEthernet 0/0). The polling frequency you specify (in seconds) depends on the reliability requirements, but anything below a few seconds would place unnecessary burden on the next-hop router (as you might not be the only one tracking its availability). Threshold sets the rising threshold that generates a reaction event and stores history information for the Cisco IOS IP SLAs operation.

R1(config)#ip sla 1 R1(config-ip-sla)#icmp-echo 172.16.0.1 source-interface FastEthernet 0/0 R1(config-ip-sla-echo)#threshold 100 R1(config-ip-sla-echo)#timeout 200 R1(config-ip-sla-echo)#frequency 3 R1(config)#ip sla schedule 1 life forever start-time now

STEP 2. Create a track object monitoring the reachability of the SLA target. As you probably don’t want to respond to a single lost ICMP packet, you should use the delay option of the track object to specify how long the next-hop router should remain unreachable before it’s declared to be lost (the down delay should be approximately three times the SLA polling frequency and the up delay should be even longer).

R1(config)#track 1 ip sla 1 reachability R1(config-track)#delay down 10 up 20

STEP 3. After configuring the track object, attach it to the primary static default route to ensure that the default route is removed if the next-hop router is not reachable.

R1(config)#ip route 0.0.0.0 0.0.0.0 FastEthernet 0/0 track 1 R1(config)#ip route 0.0.0.0 0.0.0.0 FastEthernet 0/1 10

Notes:
You cannot change the parameters of a SLA object once you’ve scheduled it. To change the target IP address, timeouts, threshold or polling frequency, you need to delete the SLA object and recreate it.

When calculating the up delay, remember that a router can temporarily respond to pings during the bootstrap process.

Enabling root SSH login on an ESX host

Safar Safarov — Sun, 16 Jan 2011 12:42:33 +0000

SSH is disabled by default for the root account on an ESX host. That is, the actual sshd service does not allow root logins. Non-root users are able to login with SSH. This is another layer of protection in addition to the host firewall.

1. To enable root login for SSH and SCP clients if you have physical access to the ESX host:
STEP 1. Login to the console of your ESX host as the root user.
STEP 2. Edit the configuration file for SSH with the following command:

nano /etc/ssh/sshd_config

STEP 3. Find the line that starts with ‘PermitRootLogin’ and change the ‘no’ to ‘yes’. You can find this line about 2 pages down from the top. Save the file by first pressing ‘Ctrl-O’ and then Enter. Exit with ‘Ctrl-X’.
STEP 4. Restart the sshd service with the command:

service sshd restart
OR
/etc/init.d/sshd restart

2. To enable root login for SSH and SCP clients if you have network access only to the ESX host:
STEP 1. Connect to the ESX host with VMware Infrastructure (VI) or vSphere Client.
STEP 2. Create a new temporary user by going to ‘Local Users & Groups’ tab. Make sure to check ‘Grand shell access to this user’ checkbox and add the user to the ‘root’ group.
STEP 3. Connect to the ESX host over the network using a SSH Client and login as the new temporary user.
STEP 4. Switch user to root by typing the following command:

su -

STEP 5. Type root account password.
STEP 6. Edit the configuration file for SSH with the following command:

nano /etc/ssh/sshd_config

STEP 7. Find the line that starts with ‘PermitRootLogin’ and change the ‘no’ to ‘yes’. You can find this line about 2 pages down from the top. Save the file by first pressing ‘Ctrl-O’ and then Enter. Exit with ‘Ctrl-X’.
STEP 8. Restart the sshd service with the command:

service sshd restart
OR
/etc/init.d/sshd restart

NOTE: Each SSH connection to an ESX host uses additional Service Console resources. Use caution when using scripts or third party software that create multiple SSH sessions to the ESX Service Console. Excessive use of SSH on an ESX machine may cause the service console to exhibit symptoms of memory exhaustion.

Automate backup with Cisco IOS’ kron

Safar Safarov — Sun, 12 Dec 2010 10:11:57 +0000

Let’s say you want to automatically back up your router’s running configuration (in RAM) to the startup configuration (in NVRAM) every Monday night at 10 P.M. You might want to make sure that the system is preserving router changes, even if the router losses power and even if someone forgets to save his or her changes.

The new IOS command scheduler makes this a relatively easy task. Here’s how you can use kron to accomplish this.

First, create a kron policy-list. Essentially, this policy list serves as your ‘script’, which lists what you want the router to run at a scheduled time. Here’s an example:

Router(config)#kron policy-list backup Router(config-kron-policy)#cli write Router(config-kron-policy)#exit

Next, create a kron occurrence, in which you tell the router when and how often you want to run this policy list (i.e., group of commands). Here’s an example:

Router(config)#kron occurrence backup at 22:00 Mon recurring Router(config-kron-occurrence)#policy-list backup

This code sets up your backup job to run every Monday night at 10 P.M. (22:00 in military time).

Finally, verify that you’ve entered everything correctly by using the show command.

Router#show kron schedule


Kron Occurrence Schedule

backup inactive, will run again in 2 days 22:03:46 at 22:00 on Mon

Router#show running-configuration (truncated) kron occurrence backup at 22:00 Mon recurring policy-list backup ! kron policy-list backup cli write (truncated)

Notes:
You might be wondering why I used the write command instead of the copy running-configuration startup-configuration commands. While the copy run start command is interactive, the write command is not. In other words, write doesn’t prompt to verify what you want to do. It’s important to remember that the Cisco IOS Command Scheduler doesn’t allow any interactive commands.

You might be wondering if you could use kron to reboot the router. While it’s a good idea to use the command scheduler if you want to reboot your router on a regularly scheduled basis, you can perform a one-time delayed reboot using reload at with less complexity.

Additional uses for kron include clearing an interface on a daily schedule, clearing the internal log, and showing the routing table at set intervals and sending it to a log.

In some cases, you may want to log the failure or success of your commands. To do so, you can use the debug command. For example, to view all kron debugging, use debug kron all. (You can also use more specific kron debug commands.)

Once you’ve enabled debugging, send logging output to the router’s system buffer or to a syslog server. In that log, you’ll find the command output and whether the commands succeeded or failed.

Backup on FTP config example:
ip ftp source-interface loopback 0 ip ftp username ftp_username ip ftp password ftp_password file prompt quiet ! kron policy-list backup cli copy running-config ftp://10.20.30.40 ! kron occurrence daily-backup at 0:30 recurring policy-list backup

How to Limit Network Traffic with a Cisco Router

Safar Safarov — Fri, 21 May 2010 18:28:50 +0000

If you are a network administrator or in charge of your company’s network, there are times that your network may be getting a lot of network traffic hits. To prevent overloading of your network and to remove unwanted or unnecessary traffic, you can perform a process that would limit the rate of network traffic, also known as Committed Access Rate (CAR). You can effectively manage your network by ensuring that the inbound unwanted traffic will not impact the important traffic from getting through. As a requirement, you should be familiar with basic Cisco networking commands to be able to do this function, as well as be familiar with networking in general.

STEP 1. Enable CEF (Cisco Express Forwarding) on the Cisco router. Most routers have CEF disabled by default except on the 7 series routers. The codes to enter the commands on the global configuration mode are as follows:

Router(config)#ip cef

STEP 2. Create an ACL (Access Control List) to define the traffic you want to perform rate limiting on. Use the acl command (config-acl) from a configuration mode. Enter a number between 1 to 99 to define the ACL description or syntax. For specific codes to use, please refer to the link for ACL Codes Configuration Commands in Resources.

STEP 3. Configure the committed access rate (CAR) policies by entering the rate-limit command, using the access control list as your reference. Reference the proper direction and bandwidth amounts on the interface closest to the source traffic. Type in command as follows:

rate-limit {input | output} [access-group [rate-limit] acl-index] bps burst-normal burst-max conform-action action exceed-action action

STEP 4. Understand what each syntax description stand for based on Cisco’s definitions, where the ‘input’ applies a committed access rate traffic policy to packets received on the interface. ‘Output’ applies the committed access rate traffic policy to packets sent on the interface. ‘Access Group’ applies the committed access rate traffic policy to the specified access control list, this syntax is optional. ‘Rate-limit’, an optional syntax, where the access control list is the rate-limit access list. Another optional entry is “acl-index”, which is the access list number and “bps” stands for the average bits per second. ‘Burst normal’ is the normal burst size in bytes and the ‘burst-max’ is the excess burst size in bytes. ‘Conform-action’ is a command to take packets in reference to the rate limit; while ‘action’ is the action to take on packets specified by some keywords, such as ‘continue’ and ‘drop’. Finally, ‘exceed-action’ is the action to take on packets in excess of the rate limit.

STEP 5. Double-check the entries carefully and monitor the network traffic. Make the necessary changes as needed.

RIP in Cisco Routers

Safar Safarov — Sun, 18 Apr 2010 21:52:30 +0000

When would you need this: When you need to implement a routing protocol for a small network and you need the configuration to be simple. Routing Information Protocol is the simplest that it can get.

STEP 1. The first thing to do is to enable the RIP protocol on the router with the ‘router rip’ command:

Router(config)#router rip

STEP 2. Identify the networks to be advertised using the ‘network XXX.XXX.XXX.XXX’ command. Using this command, you need to identify only the networks that are directly connected to the router:

Router(config-router)#network 192.168.0.0

And remember to write only the supernet if you have a group of subnets. For example, if you have the following subnets connected to the router (172.16.0.0, 172.16.1.0, and 172.16.2.0). You can put them all in single ‘network’ command like this:

Router(config-router)#network 172.16.0.0

You can notice that only three subnets of the supernet are connected to the router, and despite that, we wrote the supernet in the ‘network’ command. The router is intelligent enough to figure it out.

STEP 3. If you need to adjust the timers (update, invalid, holddown, and flush timers) use the ‘timers basic’ command. All the four parameters of this command; update, invalid, holddwon, and flush timer consequently, are in seconds:

Router(config-router)#timers basic 30 180 180 240

The example above is set with the default values of the RIP timers. Remember to keep the relativity of the timer values. Always keep it n 6n 6n 8n. If, for example, you set the update timer to 40, you need to make the other timers 240 240 320 consequently.

STEP 4. You will need to stop the updates from being broadcasted to the internet. For this purpose, use the ‘passive interface’ command. This command prevents the interface from forwarding any RIP broadcasts, but keeps the interface listening to what others are saying in RIP:

Router(config-router)#passive-interface Fa0/0

STEP 5. RIP, by nature, sends updates as broadcast. If the router is connected through non-broadcast networks (like FrameRelay), you will need to tell RIP to send the updates on this network as unicast. This is achieved by the ‘neighbor’ command:

Router(config-router)#neighbor XXX.XXX.XXX.XXX

where,
XXX.XXX.XXX.XXX is the IP address of the neighbor.

STEP 6. Cisco’s implementation of RIP Version 2 supports authentication, key management, route summarization, classless interdomain routing (CIDR), and variable-length subnet masks (VLSMs). By default, the software receives RIP Version 1 and Version 2 packets, but sends only Version 1 packets. You can configure the software to receive and send only Version 1 packets. Alternatively, you can configure the software to receive and send only Version 2 packets. To do so, use the ‘version’ command:

Router(config-router)#version 2

And if you like to stick to version one, just replace the 2 in the command above with 1.

Furthermore, you can control the versions of the updates sent and received on each interface to have more flexibility in support both versions. This is achieved by the ‘ip rip send version’ and ‘ip rip receive version’ commands:

Router(config-if)#ip rip send version 2 Router(config-if)#ip rip receive version 1

STEP 7. Check the RIP configuration using the following commands:

Router#show ip route Router#show ip protocols Router#debug ip rip

Cisco Router as a DHCP Client

Safar Safarov — Sun, 18 Apr 2010 09:41:14 +0000

This is done using a single command:

Router(config-if)#ip address dhcp

Some service providers might ask you to use a client-id and/or a hostname of their own choice. This can be done by adding the following parameters to the command above:

Router(config-if)#ip address dhcp client-id INTNAME hostname HOST

where,
INTNAME is the interface name that will be used for the client-id;
HOST is the hostname that will be used for the DHCP binding. This hostname can be different from the one that was set for the router in the global configuration.

You can use both of these parameters, one of them, or none of them.

Cisco Router as a DHCP Server

Safar Safarov — Sat, 17 Apr 2010 15:44:48 +0000

STEP 1. Define the DHCP address pool:

Router(config)#ip dhcp pool POOLNAME Router(dhcp-config)#network XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY

where,
XXX.XXX.XXX.XXX is the network address to be used by the DHCP pool;
YYY.YYY.YYY.YYY is the subnet mask for the network.
You can replace the subnet mask by a (/PREFIX) to provide the subnet mask.

STEP 2. Configure the parameters to be sent to the client:

Router(dhcp-config)#dns-server XXX.XXX.XXX.XXX

To provide the DNS server IP address.

Router(dhcp-config)#default-router XXX.XXX.XXX.XXX

To provide the IP address of the default gateway.

Router(dhcp-config)#domain-name NAME

To provide the name of the domain of the network (if in a domain environment).

Router(dhcp-config)#netbios-name-server XXX.XXX.XXX.XXX

To provide the IP address of the NetBIOS name server.

Router(dhcp-config)#lease DAYS HOURS MINUTES

To define the lease time of the addresses given to the client.

There is a large group of settings that you can configure to be sent to the clients, and I have only mentioned the most frequently used.

STEP 3. Configure the IP addresses to be excluded from the pool. This is usually done to avoid the conflicts caused by the DHCP with servers and printers. Remember to give ALL servers and network printers static IP addresses in the same range of the DHCP pool. And then exclude these addresses from the pool to avoid conflicts:

Router(config)#ip dhcp excluded-address XXX.XXX.XXX.XXX

Use the command in the previous form to excluded a single address. You can repeat it as much as you see fit for the IP addresses you want to exclude. Or:

Router(config)#ip dhcp excluded-address YYY.YYY.YYY.YYY ZZZ.ZZZ.ZZZ.ZZZ

where,
YYY.YYY.YYY.YYY is the start of the range to be excluded from the pool;
ZZZ.ZZZ.ZZZ.ZZZ is the end of the range.
This way you can exclude a range or ranges of IP addresses and reserve them for static addresses use.

STEP 4. Enable the DHCP service in the router:

Router(config)#service dhcp

To disable it use:

Router(config)#no service dhcp

Usually the DHCP service is enabled by default on your router.

STEP 5. Use the following commands to check the DHCP operation on the router:

Router#show ip dhcp binding

This command shows the current bindings of addresses given to clients

Router#show ip dhcp server statistics

This command show the DHCP server statistics.

Router#debug ip dhcp server

This debug command is used to troubleshoot DHCP issues.

Implementation Notes:
NOTE 1. If you have a DHCP server other than the router, and you would like to let the router to forward the DHCP requests from a certain LAN to the DHCP server laying outside that LAN, go to the Ethernet interface that does not have the DHCP server and type the following command:

Router(config-if)#ip helper-address XXX.XXX.XXX.XXX

where,
XXX.XXX.XXX.XXX is the IP address of the server laying outside this LAN.

NOTE 2. You can create a DHCP database agent that stores the DHCP binding database. A DHCP database agent is any host, for example, an FTP, TFTP, or RCP server that stores the DHCP bindings database. You can configure multiple DHCP database agents and you can configure the interval between database updates and transfers for each agent. To configure a database agent and database agent parameters, use the following command in global configuration mode:

Router(config)#ip dhcp database url [timeout seconds | write-delay seconds]

An example url is this:

ftp://user:password@192.168.0.3/router-dhcp

If you choose not to configure a DHCP database agent, disable the recording of DHCP address conflicts on the DHCP server. To disable DHCP address conflict logging, use the following command in global configuration mode:

Router(config)#no ip dhcp conflict logging

NOTE 3. DHCP service uses port 67 and 68. So, if you are using a firewall, remember to open these ports.

STEP 4. To clear DHCP server variables, use the following commands as needed:

Router#clear ip dhcp binding *

If you want to clear a certain binding not all of them, replace the * in the previous command with the IP address to be cleared.

Router#clear ip dhcp server statistics

How to make Windows XP act as a router

Safar Safarov — Tue, 16 Mar 2010 19:38:35 +0000

Do you aware that enabling IP forwarding using Windows XP Professional will make it as a simple router, so that you can have 2-3 different networks at home and those computers manage to talk to each other from different network. The router is needed to send/receive the traffic from one network to another network or access Internet. The benefit is you don’t have to buy additional router and so can save some money. This approach is not so common practiced in Windows XP, but it works.

As an example, let say you have 7 computers and 2 network switches, and need to create 2 networks that can access Internet, so how to do it? Some more information, one of the computers is equipped with 3 network cards and one of the network cards is connected to cable/DSL modem to access Internet, so this computer will act as a router!

Configure the network cards on the router with following information.

Network Card A (connect to network A): IP: 10.10.10.1 Netmask: 255.255.255.0 Gateway: [leave it blank]


Network Card B (connect to network B ):

IP: 192.168.20.1

Netmask: 255.255.255.0

Gateway: [leave it blank]

Network Card C (connect to Internet via cable/dsl connection)This information will be based on the Internet connection service which you have subscribed.IP: 192.168.1.1 Netmask: 255.255.255.0 Gateway: 192.168.1.1

Configure all the computers in network A with following information:

Network A IP: 10.10.10.2-254 Netmask: 255.255.255.0 Gateway: 10.10.10.1

Configure all the computers in network B with following information:

Network B IP: 192.168.20.2-254 Netmask: 255.255.255.0 Gateway: 192.168.20.1

Ok. So it’s time to configure Windows XP act as a router:

STEP 1. Go to ‘Start’ and click ‘Run’, then type in ‘regedit’ to run Registry Editor.
STEP 2. Registry Editor window will appear. Browse for the following registry key at the left hand side window:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

STEP 3. Right click ‘IPEnableRouter’ registry object, and click ‘Modify’. The ‘IPEnableRouter’ window will appear. Type ’1′ as value data and click ‘OK’.
STEP 4. Close the Registry Editor and reboot the computer. After rebooting, all the computers should be able to access Internet and also share the file/printer between network A and B.