Is it still worth getting in 2020? Or are there better cards with an Intel chip if you just want a cheap but decent 1xNIC?
Sunday, March 15, 2020
Massive sudden ping and lag spikes problem
Hello, for a week or so i have been getting sudden lag spikes while playing videogames, having your character teleporting is not the best thing you would like to experience. My ping is at a stable 40ms on average but it all of a sudden started jumping up to 300, 500, even 4000 one time. This occurs every 20 seconds for a second or two. Any suggestions for fixing this? It is a real annoyance.
Ansible / Ansible Tower devs, a moment of your time please?
Hey guys,
I have been working on a team that primarily focuses on design/sustaining/compliance on a large MSO network, where I have built web apps for hardware configurators, python scripts for SSH and SNMP related activities, and other general utilities to help the front line engineers deploy and maintain our customer network. I’m able to do so because prior to learning to code, I was a network engineer right along side them, so I can quickly help solve their everyday “this is a lot of clicks over and over” type work. So while I am not a classically trained developer, I have quickly made a name for myself as a devops kind of guy, and I loved that tract for the last two years. I wish I would have stayed out of the lime light...
Due to my success with it, they voluntold me I am being transferred away from my engineering team, to a team that is a more formal development team, and while some have engineering experience, it’s more at the data center type level, automating VM turn ups, cookie cutter switches, firewalls, and the like, and almost exclusively with Ansible and Ansible Tower.
They insist on Ansible being the answer to all of my network scripting needs going forward. I know zero about it, so what do you guys recommend as good resources to get up to speed? What questions should I be asking them, or countering them with, prior to assimilation lol. My work is nearly 100% Nokia SROS, MPLS, layer 2, and it seems they do have a SROS Ansible “module”. Any advice and guidance would be helpful!
Juniper SRX port forwarding some but not all.
Model: srx210h
JUNOS Software Release [10.4R4.5] (can't get newer software sadly)
Hey all, I am having an issue that is upsetting me.. as I have spent a lot of time trying to figure it out. I am attempting to forward a couple of ports to a host. I am attempting to translate them. One is 2222 to 22. This seems to work JUST fine. I can see the session when using
show security flow session destination-port 2222
but... I am also attempting to forward 32323 to 30003.
no sessions.. no bueno.
I have confirmed that the port is open on the server, as I am using it locally. in fact, I am using it from the trusted zone, as you can see from the config, the server is in the neutral_zone.
Any help, comments, suggestions would be appreciated. Thank you.
There is some extra config in there right now 'cause of troubleshooting, but nothing besides the SSH translation works.. or has ever worked.
I'm stumped.
Oh, I have also tested with that deny policy in untrust deactivated JUST in case, still to no avail.
Thanks in advance, Champions!
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
rule-set neutral_zone-to-untrust {
from zone neutral_zone;
to zone untrust;
rule source-nat-rule2 {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
destination {
pool dnat-192_168_30_75_ssh {
address 192.168.30.75/32 port 22;
}
pool dnat-192_168_30_75_minecraft {
address 192.168.30.75/32 port 25565;
}
pool dnat-192_168_30_75_plex {
address 192.168.30.75/32 port 32400;
}
pool dnat-192_168_30_75_minecraftsb2 {
address 192.168.30.75/32 port 25571;
}
pool dnat-192_168_30_75_MC_SF3 {
address 192.168.30.75/32 port 30003;
}
rule-set dst-nat {
from zone untrust;
rule rule1 {
match {
destination-address WAN ADDRESS/32;
destination-port 2222;
}
then {
destination-nat pool dnat-192_168_30_75_ssh;
}
}
rule rule2 {
match {
destination-address WAN ADDRESS/32;
destination-port 25565;
}
then {
destination-nat pool dnat-192_168_30_75_minecraft;
}
}
rule rule3 {
match {
destination-address WAN ADDRESS/32;
destination-port 32400;
}
then {
destination-nat pool dnat-192_168_30_75_plex;
}
}
rule rule4 {
match {
destination-address WAN ADDRESS/32;
destination-port 25571;
}
then {
destination-nat pool dnat-192_168_30_75_minecraftsb2;
}
}
rule rule5 {
match {
destination-address WAN ADDRESS/32;
destination-port 32323;
}
then {
destination-nat pool dnat-192_168_30_75_MC_SF3;
}
}
}
}
proxy-arp {
interface ge-0/0/1.0 {
address {
WAN ADDRESS/32;
}
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
zones {
security-zone trust {
address-book {
address home_LAN 192.168.25.0/24;
}
interfaces {
vlan.2500 {
host-inbound-traffic {
system-services {
dhcp;
ssh;
ping;
}
}
}
}
}
security-zone untrust {
address-book {
address weird_address 37.46.128.26/32;
}
screen untrust-screen;
interfaces {
ge-0/0/1.0 {
host-inbound-traffic {
system-services {
dhcp;
}
}
}
}
}
security-zone neutral_zone {
address-book {
address neutral_zone 192.168.30.0/24;
address warbird 192.168.30.75/32;
}
interfaces {
vlan.3000 {
host-inbound-traffic {
system-services {
ssh;
ping;
dhcp;
}
}
}
}
}
}
policies {
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone trust to-zone neutral_zone {
policy trust_to_neutral_zone {
match {
source-address home_LAN;
destination-address neutral_zone;
application any;
}
then {
permit;
}
}
}
from-zone neutral_zone to-zone trust {
policy neutral_zone_to_trust {
match {
source-address neutral_zone;
destination-address home_LAN;
application any;
}
then {
deny;
}
}
}
from-zone neutral_zone to-zone untrust {
policy neutral_zone-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone neutral_zone to-zone neutral_zone {
policy neutral_zone_to_neutral_zone {
match {
source-address neutral_zone;
destination-address neutral_zone;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone neutral_zone {
inactive: policy untrust-to-neutral_zone_deny {
match {
source-address weird_address;
destination-address any;
application any;
}
then {
deny;
}
}
policy untrust-to-neutral_zone_allow {
match {
source-address any;
destination-address warbird;
application [ junos-ssh plex minecraft-30003 minecraft-32323 ];
}
then {
permit;
}
}
}
from-zone trust to-zone trust {
policy trust_to_trust {
match {
source-address home_LAN;
destination-address home_LAN;
application any;
}
then {
permit;
}
}
}
}
alg {
ftp ftps-extension;
}
Cisco ISE Upgrade fail - Certificate Expired
I ran into an issue during the Upgrade and URT in Cisco ISE (Secondary), it failed on two expired certificates that were in the Trusted section. I removed one, but the other one was undeletable. I ended up calling Cisco TAC, and they were able to delete it via the shell prompt and recreate the default system certificate in the primary node.
I logged in the ISE Website; all looked good no expired certificates YAY. I tried the process again, and the same error occurred. Its almost like it is still stuck in the Node even though none of the certs are expired (Systems and Trust Certificates). How can this be if it was deleted?
I ended up recreating the default cert in the secondary node to see if it will clear the issue and still the same problem. Yes, I rebooted the secondary server. Any idea about this?
I want to upgrade from V2.2 to V2.6 - Two Nodes Primary/Secondary.
ERROR Trust Cert Validation The certificate has expired. Trust certificate with friendly name 'Default self-signed server certificate' is invalid: The certificate has expired. % Error: One or more trust certificates are invalid (see above), please re-import valid CA Certificate(s) before continuing. Upgrade cannot continue. - Failed
Connecting Dell F10 Switches Traffic Issue
Hello, having a strange issue when connecting a pair of Dell 3048 switches in a VLTi, with a port channel to another pair of Dell S55 switches. There is a Cisco ASA connected to the S55s for outside routing.
I have the exact same setup currently working fine. Except the 3048s are in a stack. There is a live issue with one of the devices, so management insisted I swap them out instead of fixing. But I am using a VLTi so in the future I can manage them separately.
When I swap over the Port-Channel uplinks, that all comes up fine. However, something on the S55 appears to stop any traffic on the networks connected to the Cisco. There is literally no log entry to confirm anything is wrong. I have noticed the S55 port for the Cisco connection is configured like the below. Its still odd that this works in the current config, but it is literally the only odd config I can see. Any ideas on what could be wrong? Many thanks.
!
interface GigabitEthernet 0/35
no ip address
switchport
switchport mode private-vlan trunk
flowcontrol rx on tx on
spanning-tree rstp edge-port
no shutdown
!
Network Help/Retransmitted Packet Count 17-18k using iperf3
After the wonderful video put out by SpaceInvader using Iperf3 I gave it a shot. I only have my one server so I pinged a public Iperf server to get my WAN results. and after running it twice my speeds look like they should (250mbps up/down). However the RETR tab averages between 1400-2700 per interval. Is this a normal result? Should I worry about this? If so how to i troubleshoot and investigate further?
ER10X as L3 Switch?
Hi all. I've got a spare edge router kicking around and was wondering if one could configure it as a layer 3 switch to speed some traffic of my current deployment.
Currently system is deployed as follows: Building 1 -> nanostation -> building 2 -> nanostation -> building 3.
The objective is to place a L3 Switch at building 3 so inter vlan traffic does not need to route back to building 1 and then back to building 3 over the slow nanostations.
Any advice is much appreciated.
Inspect Encrypted Traffic on Firewalls
Hello All,
Firewalls with full Threat licensing is useless without SSL encryption, you can't inspect encrypted traffic. But you see some vendors like Juniper saying the statement which is unclear like:
Juniper Networks provides Intrusion Detection and Prevention (IDP) SSL inspection that uses the SSL protocol suite consisting of different SSL versions, ciphers, and key exchange methods. Combined with the Application Identification feature, the SSL Inspection feature enables SRX Series devices to inspect HTTP traffic encrypted in SSL on any port. The following SSL protocols are supported:
- SSLv2
- SSLv3
- TLS
I saw multiple companies that have an IPS before or after the Perimeter firewall that is doing the decryption. Isn't useless?
We know that encrypted internet traffic reached higher than 90%, almost all traffic is encrypted.
My question is why do companies position security solutions like Anti-Malware in a location where encrypted traffic is passing. Isn't that wrong?
Any thoughts?
How to show OSPF Intra routes metric calculation in database?
Hi All,
I would like to ask, how to identify the metric calculation for intra area routes using show ip ospf database command?
Example:
R6 (C1) 155.1.9.0/24 -| | - R1 R7(C100) In this case, I have modified the ospf cost on the interface facing R7.
R1# sh ip ospf interface brief Interface PID Area IP Address/Mask Cost State Nbrs F/C Lo0 1 0 150.1.1.1/32 1 LOOP 0/0 Gi1/0.146 1 0 155.1.146.1/24 1 DROTH 2/2 Gi1/0.13 1 0 155.1.13.1/24 100 BDR 1/1 <--- R7 My question:
- How R1 can we identify the best path from subnet sent by R6 and R7 ? What show commands to see the comparison between calculation via R6 and Via R7?
- Should this subnet have 2 entries on ospf database ? since R6 and R7 is sending that route?
R1#sh ip ospf database internal OSPF Router with ID (150.1.1.1) (Process ID 1) Stub Link States (Area 0) Link ID ADV Router Age Seq# Checksum Mask 150.1.1.1 150.1.1.1 388 0x0 0x0009AB /32 150.1.2.2 150.1.2.2 1242 0x0 0x00E6C9 /32 150.1.3.3 150.1.3.3 1167 0x0 0x00C4E7 /32 150.1.4.4 150.1.4.4 1166 0x0 0x00A206 /32 150.1.5.5 150.1.5.5 1155 0x0 0x008024 /32 150.1.6.6 150.1.6.6 1202 0x0 0x005E42 /32 150.1.7.7 150.1.7.7 1166 0x0 0x003C60 /32 150.1.8.8 150.1.8.8 1163 0x0 0x001A7E /32 150.1.9.9 150.1.9.9 1149 0x0 0x00F79C /32 150.1.10.10 150.1.10.10 1165 0x0 0x00D5BA /32 155.1.5.255 150.1.5.5 1155 0x0 0x007133 /24 155.1.7.255 150.1.7.7 1166 0x0 0x00415D /24 155.1.8.255 150.1.8.8 1163 0x0 0x002972 /24 155.1.9.255 150.1.9.9 1149 0x0 0x001187 /24 <------ Subnet 155.1.10.255 150.1.10.10 1165 0x0 0x00F89C /24 155.1.13.255 150.1.1.1 9164 0x0 0x004D57 /24 155.1.23.255 150.1.3.3 6985 0x0 0x00C4D1 /24 155.1.37.255 150.1.3.3 6985 0x0 0x002A5E /24 155.1.67.255 150.1.6.6 6986 0x0 0x00B7AC /24 155.1.146.255 150.1.1.1 9165 0x0 0x00908E /24 Router Link States (Area 0) Link ID ADV Router Age Seq# Checksum Link count 150.1.1.1 150.1.1.1 389 0x80000007 0x001D06 3 150.1.2.2 150.1.2.2 1245 0x80000006 0x008659 2 150.1.3.3 150.1.3.3 1169 0x80000007 0x002DAC 4 150.1.4.4 150.1.4.4 1168 0x80000006 0x0086AD 3 150.1.5.5 150.1.5.5 1158 0x80000006 0x00AC80 4 150.1.6.6 150.1.6.6 1204 0x80000007 0x008A6F 3 150.1.7.7 150.1.7.7 1173 0x80000006 0x00C868 5 150.1.8.8 150.1.8.8 1167 0x80000007 0x009BFC 4 150.1.9.9 150.1.9.9 1153 0x80000006 0x00315C 3 150.1.10.10 150.1.10.10 1170 0x80000006 0x007ECD 3 Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 155.1.13.2 150.1.3.3 1169 0x80000004 0x00872F 155.1.23.2 150.1.3.3 1169 0x80000004 0x003476 155.1.37.2 150.1.7.7 1173 0x80000004 0x00CCBD 155.1.45.2 150.1.5.5 1159 0x80000004 0x008305 155.1.58.2 150.1.8.8 1168 0x80000004 0x00214C 155.1.67.2 150.1.7.7 1174 0x80000004 0x00D293 155.1.79.2 150.1.9.9 1154 0x80000004 0x0075DA 155.1.108.2 150.1.10.10 1170 0x80000004 0x0056D6 155.1.146.3 150.1.6.6 1205 0x80000005 0x004837 R1#sh ip ospf database router 150.1.9.9 internal OSPF Router with ID (150.1.1.1) (Process ID 1) Router Link States (Area 0) Distance: 3 Path: 155.1.146.3, GigabitEthernet1/0.146, parent: 2/155.1.79.2/150.1.9.9 <--- Single link Only?????????????????? Now in min table Table index: 18 min 43 sec LS age: 1399 Options: (No TOS-capability, DC) LS Type: Router Links Link State ID: 150.1.9.9 Advertising Router: 150.1.9.9 LS Seq Number: 80000006 Checksum: 0x315C Length: 60 Number of Links: 3 Link connected to: a Stub Network (Link ID) Network/subnet number: 150.1.9.9 (Link Data) Network Mask: 255.255.255.255 Number of MTID metrics: 0 TOS 0 Metrics: 1 Link connected to: a Transit Network (Link ID) Designated Router address: 155.1.79.2 (Link Data) Router Interface address: 155.1.79.2 Number of MTID metrics: 0 TOS 0 Metrics: 1 Link connected to: a Stub Network (Link ID) Network/subnet number: 155.1.9.0 (Link Data) Network Mask: 255.255.255.0 Number of MTID metrics: 0 TOS 0 Metrics: 1
Please let me know if you need more output.
Thanks,
Subscribe to:
Posts (Atom)