Masood Ahmad Shah

How NBAR actually classifies the traffic flows?

jahil — Sat, 15 Nov 2008 15:22:00 GMT

I still love Cisco. My one true love. It hurts with you :)

Anyways lets start with Layer 7 traffic filtring on Cisco router. NBAR protocol classification feature has long supported enhanced HTTP URL matching features. However, Cisco documentation site never provided a detailed description of the pattern language used for URL matching; neither has it explained how the engine matches client/server data streams. In this post I will give an overview of how NBAR works with URL filtering.
When you apply a policy-map that contains a class with “match protocol” statement, the system starts NBAR classification engine on the interface. Any packet, be it ingress or ingress, passes the NBAR inspection engine provided that it passes the basic filters like matching the port number assigned to the protocol. You can change the port map using the global command ip nbar port-map [protocol].

When the engine sees a TCP SYN packet for the matching session, it starts the internal state machine, trying to parse the packet flow. Every new packet in the flow (in any direction) is inspected. Note that the NBAR does not classify a flow instantly. It may take some packet exchange until the engine determines that the flow matches specified criteria. As soon as there is enough information about the flow to classify it, the engine “tags” the bi-directional flow with the corresponding class value and reports this decision to the policy-map. Note that this classification applies in both directions – that is to the packets belonging to the flow and heading either ingress or egress.

Consider the example below. In this scenario, Fa0/0 is the outside interface, facing the internet. User’s traffic flows out of this interface.

class-map match-all TEST
match protocol http url "*.(t?xt|ocx|ex[ea])”
!
policy-map TEST
class TEST
drop
!
interface FastEthernet0/0
ip address 1.1.1.1 255.255.255.30
service-policy input TEST

However, as soon as user opens the URL matching the class-map specification, the engine will classify the flow as matching the class “TEST”. After this, all returning packets (server to client) for this flow will be dropped by the policy map.

Default Media MTU

jahil — Sat, 18 Oct 2008 18:11:00 GMT

Can you calculate the media MTU?

The default media MTU is calculated as follows:

Default media MTU = Default IP MTU + encapsulation overhead

Encapsulation Overhead by Encapsulation Type

Interface Encapsulation Encapsulation Overhead (Bytes)

ATM PVC 12

Cisco HDLC 4

Ethernet Version 2 14

Ethernet 802.3 17

802.1Q/Ethernet Version 2 18

802.1Q/Ethernet 802.3 21

Ethernet SNAP 22

802.1Q/Ethernet SNAP 26

Frame Relay 4

Point-to-Point Protocol 4

Interface Encapsulation	Encapsulation Overhead (Bytes)
ATM PVC	12
Cisco HDLC	4
Ethernet Version 2	14
Ethernet 802.3	17
802.1Q/Ethernet Version 2	18
802.1Q/Ethernet 802.3	21
Ethernet SNAP	22
802.1Q/Ethernet SNAP	26
Frame Relay	4
Point-to-Point Protocol	4

L2VPN Taxonomy

jahil — Wed, 17 Sep 2008 18:22:00 GMT

JUNOS Candidate Configuration and Explicit Commits

jahil — Sun, 14 Sep 2008 14:58:00 GMT

One of my longtime gripes about IOS is that when you type a new statement to the CLI and hit return, the statement immediately becomes active on the router. For someone as mistake-prone as me, this is a big risk. And given that the majority of network problems are due to human error rather than hardware and software failures, it is a risk for everyone.

This can also be a problem when you’re making extensive configuration changes. Having those changes take effect one statement at a time can introduce all sorts of transient conditions.

The Candidate Configuration and Explicit Commits:

This leads, in contrast, to one of my favorite JUNOS features: When you make a configuration change, the change does not take effect immediately. Instead, it goes into a candidate configuration file. You can make as many configuration additions, deletions, and changes as you like, and none of them become active on the router until you enter a commit command. That command causes the candidate configuration to become the active configuration.

The candidate configuration and explicit commit help tremendously in reducing the number of simple human errors that plague day-to-day network operations. You can make all your changes, check them as many times as you like during the configuration process, and only commit them when you are ready and are sure the changed configuration looks right.

Scripting and Customization in JUNOS

jahil — Mon, 08 Sep 2008 10:47:00 GMT

JUNOS software (Juniper's) is a highly useful nework operating system for any network engineer to achieve goals. In JUNOS, there are times when you can enter all the individual lines of a configuration correctly, and the configuration can still be wrong. That is, the combination of commands do not work correctly together or there's something missing among the lines.

In the following example, I set up a very simple BGP configuration. First, I move from the top of the hierarchy to a BGP peering group that I’ve named External_Peer. I didn't have to use the set command to create this group; just by moving to that level, the group is created for me. Next, I specify a neighbor at 172.16.1.5. Then I specify that the neighboring autonomous system for the group is 65500. Finally, I specify that an export policy named External_Peer_Policy is used to modify or filter routes sent (exported) to the neighbor. When I’m done, I return to the top of the configuration hierarchy.

At each configuration line JUNOS accepts the entries, indicating that I have not made any mistakes (extraordinary for me) :)

jahil@junos# edit protocols bgp group External_Peer

[edit protocols bgp group External_Peer]
jahil@junos# set neighbor 172.16.1.5

[edit protocols bgp group External_Peer]
jahil@junos# set peer-as 65502

[edit protocols bgp group External_Peer]
jahil@junos# set export External_Peer_Policy

[edit protocols bgp group External_Peer]
jahil@junos# top

[edit]
jahil@junos#

But then when I try to commit the configuration, JUNOS objects:

jahil@junos# commit
error: Policy error: Policy External_Peer_Policy referenced but not defined

[edit protocols bgp group External_Peer]
'export'
BGP: export list not applied
error: configuration check-out failed

[edit]
jahil@junos#

It’s telling me that the export policy I referenced in my BGP configuration does not exist anywhere in the configuration. (It should be found somewhere under the [edit policy-options] level).

When the commit command is invoked, JUNOS runs a set of scripts that examine the candidate configuration. If some situation is found, like the one I just showed you, in which the various lines of the configuration do not work together, the commit fails and an error message is displayed explaining why the commit failed.

By the way, you can use the commit check command to tell JUNOS to run the scripts against the candidate configuration without attempting a commit. That’s very useful if you’re adding a bunch of new statements to the configuration and want the scripts to occasionally check your work as you go.

Recover BGP password (Juniper JUNOS)

jahil — Wed, 27 Aug 2008 08:53:00 GMT

# Get a root shell:

jahil@junos> start shell

% su - root

Password:

jahil@jahil%

# View the contents of /var/etc/keyadmin.conf

jahil@jahil% less /var/etc/keyadmin.conf

tcp 179 0.0.0.0 10.0.0.1 md5 instance default 0x6162636431323334

tcp 179 :: 2001:DB8:1::1 md5 instance default 0x313233717765727479

# Run the following command on a system with Perl :

jahil@jahil:~>perl -e 'print "Hex: ";$_=<>;print "MD5: ";s/(\w\w)/\1:/g;for (split(/:/)) {printf "%s", chr(hex($_))};print "\n"'

Hex: 0x6162636431323334

MD5: abcd1234

jahil@jahil:~>perl -e 'print "Hex: ";$_=<>;print "MD5: ";s/(\w\w)/\1:/g;for (split(/:/)) {printf "%s", chr(hex($_))};print "\n"'

Hex: 0x313233717765727479

MD5: 123qwerty

That's it! Many thanks for the person who provided me this code and to the person who developed it :)

The beauty of Juniper JUNOS

jahil — Fri, 01 Aug 2008 16:22:00 GMT

I'm actually a Cisco/Unix geek. But I'm working on some giant Juniper routers now a days. The beauty of Juniper router opearting system (JUNOS) is, indeed, based on FreeBSD. Upgrading opearting system is my favorite things, because I love impressive new features. I come from a unix background where such a thing is easily allowed. I'm gonna write a way how to fill USB devices with Junos software.

In Next Generation RE, upgrade from USB devices is available. You must have at least RE-A-1000 or RE-A-2000 to perform upgrade from USB devices.

Below is the simple manual:

The device name is /dev/rda0 instead of /dev/rad3.
jahil@jahil> start shell

Log into directory where the install media file is (ie: /var/tmp/)
jahil@jahil% cd <directory>

Issue the following commands:
jahil@jahil% dd if=/dev/zero of=/dev/rda0 count=20 ; initialize the media
jahil@jahil% dd if=install-media-9.1R2.4-export of=/dev/rda0 bs=64k ;

Finished

Create a direct shortcut to Network Connections (Windows Vista)

jahil — Mon, 28 Jul 2008 09:52:00 GMT

The new Network and Sharing Center in Windows Vista is great for the average Windows user but can be a huge headache for advanced users. When I need to make a change to my network settings I don't want to be forced to go through the networking interface for the average non-technical users. I want to go right to the settings screen and make the change.

I am a big fan of the old Windows XP network approach where I could modify all of the network settings and connect to wireless network from the Network Connections screen. In Windows Vista, the Network Connections screen still exists, but you have to go through the Network and Sharing Center screen first. Using a very useful explorer trick I discovered when playing with "::" and explorer class IDs, you can create a shortcut that will take you directly to the Network Connections screen.

Right click on the desktop and select New and then Shortcut.
In the location box, copy and paste explorer.exe ::{7007ACC7-3202-11D1-AAD2-00805FC1270E} and hit Next.
Type in Network Connections or whatever as the name and Finish.

JNCIS-M Certification Cleared

jahil — Mon, 21 Jul 2008 15:27:00 GMT

so finally cleared Juniper’s JNCIS-M exam today. I hope to finish JNCIP-M within next 3-4 week. Wish me all the luck :)

Juniper Router On The Stick Configuration (JUNOS)

jahil — Wed, 25 Jun 2008 19:57:00 GMT

Router JAHIL is directly connected to a VLAN-capable switch and needs to be configured to talk to AHMIQ on one subnet and NAKAMA on another over the same Fast Ethernet port. The first step in configuring VLANs is to enable VLAN tagging on the physical interface, as shown below:

[edit interfaces fe-0/0/1]
lab@JAHIL# set vlan-tagging

[edit interfaces fe-0/0/1]
lab@JAHIL# show
vlan-tagging;
speed 100m;
link-mode full-duplex;

[edit interfaces fe-0/0/1]
lab@JAHIL#

The next steps are to create the units, assign the units to the appropriate VLAN, and then configure the IP addresses in the units. Since the scenario has VLANs 20 and 30, we can use those numbers for simplicity, but the unit number, as we have discussed, is up to the network administrator. It does make sense, however, to give the unit number some kind of significance for ease of use.

[edit interfaces fe-0/0/1]
lab@JAHIL# set unit 20 vlan-id 20

[edit interfaces fe-0/0/1]
lab@JAHIL# set unit 20 family inet address 1.1.1.1/24

[edit interfaces fe-0/0/1]
lab@JAHIL# set unit 30 vlan-id 30 family inet address 2.2.2.2/24

[edit interfaces fe-0/0/1]
lab@JAHIL# show
vlan-tagging;
speed 100m;
link-mode full-duplex;
unit 20 {
    vlan-id 20;
    family inet {
        address 1.1.1.1/24;
    }
}
unit 30 {
    vlan-id 30;
    family inet {
        address 2.2.2.2/24;
    }
}

[edit interfaces fe-0/0/1]
lab@JAHIL#

Fast Ethernet 0/0/1 now has two logical units configured in VLANs on unit 20 and unit 30.

How to recover password on Juniper Router's

jahil — Wed, 18 Jun 2008 09:03:00 GMT

In the real world, you always have a chance to lose a password. Recovring root password can be done by booting Juniper router under a specific mode: Single-User-Mode

· From console, interrupt the boot routine:

Hit [Enter] to boot immediately, or any other key for command

prompt.

Booting [kernel] in 9 seconds...

< Press the space bar at this point >

· Enter into single-user mode:

Type '?' for a list of commands, 'help' for more detailed help.

ok boot -s

· Enter the shell:

· Mount the virtual file systems (for JUNOS 5.4 and above, it is not

necessary to mount the jbase package, however the other packages still need to be mounted):

NOTE: to go to multi-user operation, exit the single-user shell

(with ^D)

# cd /packages

# ./mount.jbase

Mounted jbase package on /dev/vn1...

# ./mount.jkernel

Mounted jkernel package on /dev/vn2...

# ./mount.jroute

Mounted jroute package on /dev/vn3...

· Enter recovery mode:

# /usr/libexec/ui/recovery-mode

· Enter configuration mode and either delete or change the root

authentication password:

root> configure

Entering configuration mode

[edit]

root# delete system root-authentication

· Commit the changes, and exit configuration mode

[edit]

root # commit

commit complete

[edit]

root@router# exit

Exiting configuration mode

root@router> exit

Exit recovery mode and enter "y" when prompted to reboot the system:

Reboot the system? [y/n] y

Terminated

The system now reboots and changes made to root authentication are activated.

Goosh.org Unix-like Shell For Google

jahil — Tue, 17 Jun 2008 10:55:00 GMT

goosh.org - the unofficial google shell. This google-interface behaves similar to a unix-shell.
You type commands and the results are shown on this page.

=> http://goosh.org

Cisco && Magic Question Mark (?)

jahil — Wed, 14 May 2008 18:57:00 GMT

In Cisco IOS, Every mode (user mode, privileged mode etc) has help system built in. You can use the magic question mark (?) in user mode as well as in sub-configuration mode.

What if you want to use question mark (?) in description or aspath-regex. :)

Well, to write a question mark in IOS, the escape sequence CTRL-V or ESC-Q must be entered first, otherwise the IOS parser will interpret the question mark as an attempt to invoke the context sensitive help.

JAHIL#conf t
Enter configuration commands, one per line. End with CNTL/Z.
JAHIL(config)#int
JAHIL(config)#interface gi3/0/0
JAHIL(config-if)#des
JAHIL(config-if)#description ?
LINE Up to 240 characters describing this interface

JAHIL(config-if)#description

You see, when you write ? this will bring you to the help menu. What if you really want to write description along with ?. You can use CTRL-V or ESC-Q.

JAHIL#conf t
Enter configuration commands, one per line. End with CNTL/Z.
JAHIL(config)#int
JAHIL(config)#interface gi3/0/0
JAHIL(config-if)#des
JAHIL(config-if)#description (now press CTRL-V or ESC-Q)
JAHIL(config-if)#description ?IGotIt (oh it worked)

You can use CTRL-V or ESC-Q whenever or wherever it's needed :)

Cisco URL Blocking/Filtering

jahil — Tue, 13 May 2008 20:58:00 GMT

NBAR can be used to apply application based filters such as blocking youtube.com traffic. To accomplish this we can categorize traffic based on the HTTP hostname. Next we will create a policy-map that matches the youtube.com class and drops the traffic. Lastly the policy is applied outbound to the Internet. Syntax-wise this would read:

JAHIL-Router#
class-map match-all YOUTUBE
match protocol http host "*youtube.com*"
!
policy-map DROP_YOUTUBE
class YOUTUBE
drop
!
interface FastEthernet0/0
description TO INTERNET
service-policy output DROP_YOUTUBE

How to Netflow with Csico 6500

jahil — Fri, 02 May 2008 12:53:00 GMT

The post has been written to answer Mr Drew's asked question.

The NetFlow table on the route processor (RP) captures statistics for flows routed in software and the NetFlow table on the PFC (and on each DFC) captures statistics for flows routed in hardware. In PFC3A mode, NetFlow collects statistics only for routed traffic. With other PFCs, you can configure NetFlow to collect statistics for both routed and bridged traffic.

mls netflow

(Enables NetFlow on the PFC for packets forwarded in hardware)

mls flow ip interface-full

(interface-full—The most-specific flow mask. The PFC creates and maintains a separate table entry for each IP flow on an interface. An interface-full entry includes the source IP address, destination IP address, protocol, and protocol ports.)

interface Vlan5
description Jahil-Flow-Test

ip route-cache flow

( Enables NetFlow for the specified interface. Netflow will collect statistics for packets for forwarded in software (RP) only.)

ip flow ingress

(Enables NetFlow for the specified interface. NetFlow will collect statistics for packets forwarded in hardware (PFC) or software (RP).)

no mls flow ipv6

( You can disable it for couple of years :)

If you want to enable NetFlow for ingress-bridged IP traffic in VLAN 5:

6500# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
6500(config)# ip flow ingress layer2-switched vlan 5

Note:

mls netflow captures all traffic that is hardware switched, so make sure to catch anything that is CPU routed turn on "ip route-cache flow" on all possible interfaces that flows may be coming inbound.
The flow mask determines the granularity of the statistics gathered, which controls the size of the NetFlow table. The less-specific flow masks result in fewer entries in the NetFlow table and the most-specific flow masks result in the most NetFlow entries.