Solve Gantt Chart Problem

I finally solved the Gantt Chart Problem. All thanks to Mr Wagio.
Basically, we just have to get rid the working time for the Christmas Eve and New Year Eve .

Commands

Traceroute Command

The traceroute command is used to discover the routes that packets actually take when traveling to their destination. The device (for example, a router or a PC) sends out a sequence of User Datagram Protocol (UDP) datagrams to an invalid port address at the remote host.

Show ip ospf database command

To display lists of information related to the OSPF database for a specific router

Show ip ospf neighbor command

Use the show ip ospf neighbor command to observe the neighbor data structure.

-Neighbor ID the router ID of the neighbor router. The router ID is the highest IP address or the highest ip address among loopback addresses

-The Pri field indicates the priority of the neighbor router. The router with the highest priority becomes the designated router (DR).

-The State field indicates the functional state of the neighbor router

-The Dead Time field indicates the amount of time remaining that the router waits to receive an OSPF hello packet from the neighbor before declaring the neighbor down

-The Address field indicates the IP address of the interface to which this neighbor is directly connected.

-The Interface field indicates the interface on which the OSPF neighbor has formed adjacency.

Debug IP Ospf Events

To display information on Open Shortest Path First (OSPF)-related events, such as adjacencies, flooding information, designated router selection, and shortest path first (SPF) calculation, use the debug ip ospf events command in privileged EXEC mode. To disable debugging output, use the no form of this command.

Configure OSPF between BR and RR

We configured the OSPF between BR and RR which authenticate area 0 with the message-digest key md5 password ospfsercret .

Still Cannot Ping Through !!!

Mr Wagio, after we change to crossover cable, the result is still the same, still cannot ping each other. We try to troubleshoot on the cable, we test it and the cable no problem ! Really dono what is the problem. The error is still the same ... Alot of ??????.

(This is the error again !)

uses of AUX port

AUX cable is black. AUX port is usually used to get dial-in access to the router.

For getting dial-in access to the router, you will need to connect a modem to the AUX port of the router using Cisco AUX cable. Then you will need to connect a telephone line to this modem. Once this is done, you can use any utility like Hyper Terminal to dial the number of the phone line and get console access to the router remotely.

Differences between PIX 6.3 and 7.2

I have discovered the differences in the PIX command between PIX version 6.3 and 7.2
Some of the commands which are affected are shown below

•no

•show

•clear

Some examples are

For example, a single no access-list <access-list name> removes the following

commands in PIX Version 6.3:

access-list myaccesslist extended permit tcp host 10.175.28.97 host
10.180.210.209 eq 37000

access-list myaccesslist extended permit tcp host 10.175.28.97 host
10.180.210.68 eq 37000

access-list myaccesslist extended permit tcp host 10.175.28.98 host
10.180.210.68 eq 37000

But in PIX Security appliance Version 7.0, the preceding commands are removed by

using either the clear configure access-list <access-list name> command or by the following:

no access-list myaccesslist extended permit tcp host 10.175.28.97 host
10.180.210.209 eq 37000

no access-list myaccesslist extended permit tcp host 10.175.28.97 host
10.180.210.68 eq 37000

no access-list myaccesslist extended permit tcp host 10.175.28.98 host
10.180.210.68 eq 37000


CHECKING PIX Version

pix# show running-config


Mode used to configure.

We have also discovered that most users uses the
ASDM mode to configure PIX instead of the CLI mode.

The ASDM mode contains a simple user interface, while
the CLI is more of a command line interface

Adaptive Security Device Manager (ASDM)uses.

Rapid Configuration:
Features such as in-line and drag-and-drop policy editing, auto
complete, configuration wizards, appliance software upgrades, and
online help enable trouble-free initial configuration and policy change
without issuing complex commands or worrying about syntax errors.
Powerful Diagnostics:
Features such as Packet Tracer, log-policy correlation, packet capture,
regular expression tester, and embedded log reference reduce
administrative overhead and increase operational efficiency.
Real-Time Monitoring:
Features such as device, firewall, content security, and IPS
dashboards; real-time graphing; and tabulated metrics enable rapid
response to security incidents and trend analysis.
Management Flexibility:
A lightweight and secure design enables remote management of multiple
security appliances while supporting a wide variety of operating
systems, including Microsoft Windows XP, Windows Vista, Windows 2003
Server, and MacOS X.
Command Line Interface (CLI)Right now we uses, the CLI mode to configure the PIX configuration.

The next objective is to understand the configuration of NAT and PAT in PIX.

What the Difference between Nagios-mysql and Nagios-pgsql?

Differences betwwen mysql and postgresql

Mysql:
- less features
- no transactions (transactions belong to oracle )
- use it for reading
- useless for Business critical appliactions
- Strange versioning 5.0.12 was beat 5.0.13 was offical release - do you know if you use a beta software

Postgresql
- more features
- stable
- more robust
- free for commercial use

But i still abit blur on the explanation, if can, can u explain to me what the difference ?

Re-drawn Physical Network Diagram

Mr Wagio, this is the updated Physical Network Diagram. Feel Free to take a look and give us comments. Thanks :D

Sample TACACS configuration for cisco router

In the router, you need to configure aaa authentication to enable the router querying the TACACS server for authentication data. As you might know, AAA stands for Authentication, Authorization, and Accounting. You should be able to do Authentication (Who are allowed to login), Authorization (What can he/she do when he/she logged in) and Accounting (What has he/she done during his login session).

Here is the sample configuration in the cisco router:

aaa new-model aaa authentication login default tacacs local

This configuration means, user's login session will authenticated first by Tacacs. If Tacacs failed, it will be authenticated agains the local user account. Remember username password command that you used during configuring PPP authentication.

After that you need to specify the tacacs servers:

tacacs-server host 10.6.101.101 tacacs-server key cisco

In the Linux server where the TACACS service is running, you need to look for the tacacs configuration file. Normally it is located in /etc/tac_plus (for tacacs+)

Sample configuration;

!--- This creates a superuser (such as one with administrator permissions) !--- who is granted all privileges by "default service = permit", and has a password !--- that allows for connections in any mode. user = Russ { global = cleartext 'bar' default service = permit }

Sample PIX version 7 configuration

Hi Zheng Le and Jun Yi, Here are the sample of PIX configuration. As you can see, it's pretty much like the cisco IOS command. Please build your research upon this :)

Look at Ethernet2. Comparable to the router IOS, normally you keyed in encapsulation dot1q 20 (vlan number). In pix, you just need to create a subinterface (ethernet2.20)
and put in the keyword vlan 2o, give the interface a name, security level and ip address.

--------------- sample config ----------------------------------

pixfirewall(config)#interface Ethernet0
pixfirewall(config-if)#ip address 188.10.20.65 255.255.255.248
pixfirewall(config-if)#nameif outside
pixfirewall(config-if)#no shutdown

pixfirewall(config-if)#interface Ethernet1
pixfirewall(config-if)#ip address 192.168.0.193 255.255.255.224
pixfirewall(config-if)#nameif DMZ
pixfirewall(config-if)#security-level 50
pixfirewall(config-if)#no shutdown

pixfirewall(config-if)#interface Ethernet2
pixfirewall(config-if)#no shutdown

pixfirewall(config-if)#interface Ethernet2.10
pixfirewall(config-subif)#vlan 10
pixfirewall(config-subif)#ip address 192.168.0.129 255.255.255.192
pixfirewall(config-subif)#nameif Servers
pixfirewall(config-subif)#security-level 75

pixfirewall(config-subif)#interface Ethernet2.20
pixfirewall(config-subif)#vlan 20
pixfirewall(config-subif)#ip address 192.168.0.1 255.255.255.192
pixfirewall(config-subif)#nameif OfficeA
pixfirewall(config-subif)#security-level 100

pixfirewall(config-subif)#interface Ethernet2.30
pixfirewall(config-subif)#vlan 30
pixfirewall(config-subif)#ip address 192.168.0.241 255.255.255.240
pixfirewall(config-subif)#nameif GuestWired
pixfirewall(config-subif)#security-level 25

pixfirewall(config-subif)#interface Ethernet2.40
pixfirewall(config-subif)#vlan 40
pixfirewall(config-subif)#ip address 192.168.0.225 255.255.255.240
pixfirewall(config-subif)#nameif GuestWireless
pixfirewall(config-subif)#security-level 25

pixfirewall(config-subif)#interface Ethernet2.50
pixfirewall(config-subif)#vlan 50
pixfirewall(config-subif)#ip address 192.168.0.65 255.255.255.192
pixfirewall(config-subif)#nameif OfficeWireless
pixfirewall(config-subif)#security-level 100

----------------------end of sample config ------------------------------

Logical Diagram Re- Drawn

PIX version 6.x and version 7.2

A recent we made is the keying of command into PIX. The command used at version 6 and version 7 are different. Therefore we came across errors such as

- Unrecognized command.
- Invalid input detected at '^' marker.

Certain commands used in version 6

- Ethernet port activation

the following command could not be excute as it is a Invalid input detected at '^' marker.

As for the solutions to obtain version 7 command, we search this websites

1 - http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/c1_72.html#wp2034121

2 - http://www.dslreports.com/faq/15785

Un-successful Ping resolved

The arrow on the right hand side shows the wrong connected (port 23)
The correct port to be connected is on the left hand side (port 3)


The reason why the ping from DMZ and Remote client doesn't work is because the connected PC is plugged to the wrong port in the switch. Therefore the client are in different vlan, this result ping as unsuccessfully as no trunking was done.

The PC used to ping was connected to port 23, which is under VLAN 10 used for Internet access.

The supposed port to be connect was port 3 which was VLAN 40. therfore the client connect to port 23 in VLAN 10 could not communicate with the gateway in VLAN 40.

Router Encapsulation dot1Q configuration!

Mr Wagio, if u happen like read this post, can u help me with the encapsulation thing. Coz, i'm stuck and i dono which ip addresses to put for which vlan !

Resolving "show vlan" status

Due to some error which we come across in the pass, we decided to clear all settings and configuration in the 2950 Switch.

We basically used this command "clear config all" followed by

Cat2950# write erase
Erasing the nvram filesystem will remove all files! Continue? [confirm]y[OK]
Erase of nvram: complete
Cat2950#
Cat2950# reload

After which we Delete the VLAN information from Flash or NVRAM, and reload the switch.

Next we key in the command to create the vlan database again.

Cat2950(vlan)# vtp transparent
Setting device to VTP transparent mode
Cat2950(vlan)# vlan 10 name Internet
VLAN 10 added:
Name: Internet
Cat2950(vlan)# vlan 20 name Security
VLAN 20 added:
Name: Security
Cat2950(vlan)#exit

VLSM calculation

The connection between (PIX) E0 and the (router BR) Fa0/0 does it need to have a calculation of additional 2 hosts?

The connection which branch out from PIX to E2 and E1, does it need to have separate calculation?

Thanks

NEVER SHOW VLAN !!!!

After i configure the vlan, when i type show vlan, those vlan that i previously add nv show !
but when i type "show run" it do show that the ports are assigned to each designated vlan !
MOST IMPORTANTLY.. the switch nv show green light.. it show orange light ! i type no shut for the port, but result still the same!

[guide] Syslog-ng guide and how to test it out

After you have finally installed syslog-ng successfully, you can test it out by configuring the router/switch to be syslog client.

Here is the guide on how to configure cisco router for the syslog

Syslog Configuration and Cisco Devices
Syslog reserves facilities "local0" through "local7" for log messages received from remote servers and network devices. Routers, switches, firewalls and load balancers each logging with a different facility can each have their own log files for easy troubleshooting. The following examples will show how to have a different log file for each class of device.
If you have a large data center, then you may also want to switch off all logging to /var/log/messages as suggested above for the home/SOHO environment. In all the network device configuration examples below we are logging to the remote Linux logging server 192.168.1.100 which we set up in the previous section.

Cisco Routers
By default Cisco routers send syslog messages to their logging server with a default facility of local7. We won't set the facility in this case, but we can tell the router to timestamp the messages and make the messages have the source IP address of the loopback interface.

service timestamps log datetime localtime
no logging console
no logging monitor
logging 192.168.1.100 <== your log server IP

Catalyst CAT Switches running CATOS
By default Cisco switches also send syslog messages to their logging server with a default facility of local7. We won't change this facility either, therefore making routers and switches log to the same file.

set logging server enable
set logging server 192.168.1.100 <== your log server IP
set logging level all 5
set logging server severity 6

If you have any problem with the configuration, please post it to the comment box.

[guide] To solve the issue on the previous 2 posts

To solve the problem on the linux debian linux keeps rebooting in VMware, please change the Harddisk type to Other Linux 2.6 kernel

For the second issue, syslog-ng can be easily installed via apt-get
Just issue this command:
apt-get install syslog-ng
You should get the whole package including their dependencies installed.

Latest Findings(1)

This is the problem, i'm facing, i can get the syslog-ng. I dl already, but i dono where to save the file so that the system can retrieve.

TRANSPORT LAYER SECURITY
After reading some Syslog-ng, found out smt.
The thing is TLS - Transport layer security protocol.
Syslog-ng have this protocol that
encrypt the communication. TLS also allows the mutual authentication of the host
and the server using X.509 certificates.
TLS basically protocol allows applications to communicate across a network in a way designed to prevent eavesdropping, tampering, and message forgering. TLS ensures that data that send through the traffic is safe.


Internet Engineering Task Force (IETF)

Support new protocol standard for syslog-ng

IETF is is a large open international community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. It is open to any interested individual.

The actual technical work of the IETF is done in its working groups, which are organized by topic into several areas (e.g., routing, transport, security, etc.). Much of the work is handled via mailing lists. The IETF holds meetings three times per year. They worked in a similar way like Wikipedia community.

Problem

Jobs Done

Mr Wagio, this is what we encountered. After we installed the linux debian, then it reboot and this issue keep appearing.