Cisco ASA Failover Tips and misc.

When setting up Failover on Cisco ASA try to follow the following rules & tips:

1) Do not use a crossover Ethernet cable or a fiber-optic patch cable to directly connect the two failover LAN interfaces if the firewalls are located close to each other:

Instead, each interface should connect to a switch port so that the link status is always up to one firewall interface if the other firewall interface fails. Otherwise, both units sense a link-down condition and assume that their own interfaces have a failure.

2) You should also prepare the switch ports where the LAN-based failover interfaces connect so that failover communication can begin almost immediately. You should enable Spanning Tree Protocol PortFast and disable trunking and EtherChannel negotiation. You can use the following IOS Software commands to configure the switch ports:

Switch# configure terminal
Switch(config)# interface type mod/num
! Enable PortFast for immediate traffic forwarding
Switch(config-if)# spanning-tree portfast
! Disable trunking by making it an access switch port
Switch(config-if)# switchport mode access
! Disable EtherChannel negotiation
Switch(config-if)# no channel-group

3) You can use one dedicated LAN interface (10/100 or Gigabit Ethernet) to carry both LAN-based failover and stateful failover information. The interface bandwidth must be large enough to carry the aggregate failover load.

However, it is always best to keep the LAN-based failover and stateful failover data streams on separate interfaces. The stateful failover data stream is usually much larger than the LAN-based failover because of the usually large number of connections that come and go. Therefore, you should set aside the fastest firewall interface that is available for stateful failover.

4) In addition, LAN-based failover messages must be able to travel between the two units without being lost or delayed. Otherwise, the loss of LAN-based failover messages indicates that one or both units have failed.

You can link the two stateful failover interfaces directly with a fiber-optic or crossover patch cord without connecting them to intermediate switches. However, neither firewall unit can determine which unit has had an interface failure, because the link status is lost on both units simultaneously.

The best-practice recommendations stress the need for an active device such as a switch to connect the stateful failover interfaces. If one unit loses an interface, a switch would keep the link status up for the other firewall unit.

5)In the case of FWSMs, they each have a 6-Gbps internal trunk link to the switch backplane. With their high performance, stateful failover information can easily burst up to the link bandwidth. Therefore, if two FWSMs are located in separate chassis, you should provide a stateful failover VLAN link of at least 6 Gbps. You can do this by aggregating Gigabit Ethernet links into a Gigabit EtherChannel.

6) All stateful failover updates are sent and received over the interface named if_name (stateful, for example). Stateful failover can share the same interface as LAN-based failover if needed. However, you should always try to keep stateful and LAN-based failover isolated on two separate interfaces set aside for these purposes.

VMWare ESXi secret console

VMWare's ESXi is a free version and lightweight version of the VMWares ESX platform. It supports most of the key features that ESX has but comes in appliance like package which doesn't let you configure anything more than just the basic hostname/IP settings. THIS IS NOT TRUE! Infact, ESXi is built from a similar linux variant as the ESX. This is a hidden secret feature.

To reach this secret console go through the following steps.
1) Get to the ESXi console (TUI - Text User interface)
2) Press Alt - F1
3) Enter "unsupported" and hit enter (You will not see any typed)
4) Login in with your root password
5) Congratulations! you have unlocked the secret console!

With this console you can enable ssh with the following steps
1) Login with the above steps
2) Edit the /etc/inetd.conf file
3) Uncomment the SSH session and save the file
4) ps |grep inetd (to get the PID)
5) kill -HUP (to reload the inetd process)
6) Login with your favourite ssh client!

PIX Firewall operating in one arm configuration

I have been befuddled once with setting the Cisco PIX/ASA in a one arm routing configuration. To picture below explains this:



Basically when you set the ASA as a default gateway, you are unable to have to ASA forward (or route) packets in and out of the same interface. This was the case in version 6.0 of the PIX OS. However with version 7.2(1) and later it can now be done via the command "same-security-traffic permit intra-interface".

A link with the how to can be found on the cisco website

Datacenter Capacity Planning

A lot needs to be considered when planning for a datacenter. Power, cooling, UPS, generators, rack space, cost. All these come into play.

Here are a few links to some vendor calculators I came across that has helped me.

DELL

HP

Displaying 32/64 rpms installed on a Redhat system

It's been a while since I've prepared an Oracle Linux server. Today I got handed a hot potato - "An Oracle Linux server with missing Libraries". This is often the case with oracles installer - It won't install without the proper libraries. What had happened was the previous sysadmin installed the 32bit versions of the libraries and Oracle was looking for the 64bit version. However, with Redhat's default rpm -qa command it often displays only the package but doesn't tell you the architecture of the package. Here's a neat command that would display the architecture of the installed package.

rpm -qa --queryformat "%{NAME}-%{VERSION}.%{RELEASE} (%{ARCH})\n"

Give this a try the next time you install a 64bit Redhat system.

iSCSI @ Home

iSCSI or internet SCSI is a standard for running SCSI over an ip based network. For people familiar with this technology it basically enables you to mount remote disks over your existing IP infrastructure.

Today I setup a simple iSCSI mount on Linux for my local windows desktop at home over my home network. Lets start with the basic terminology and requirements.

You need a Linux box with plenty of storage space, preferably with RAID and a decent network connection - 1G acting as your SAN. This will be your iSCSI target.

Then you need a Linux or Windows desktop to act as your mount point - The iSCSI initiator.

Here are some links on the web which explains this more in detail
Setting up iSCSI in 5 mins
Enterprise iSCSI for Linux
Microsoft iSCSI iniator

Building a simple iSCSI was as simple as following those links and instructions and downloading the appropriate files.

In my quick and dirty implementation I didn't have a high performance disk setup nor a proper LVM setup to export my devices. However, the Linux Enterprise iSCSI target supports exporting files as a virtual file/block device. So I simply created an empty 10G file as my iscsi mount by using dd.

dd if=/dev/zero of=/tmp/iscsi-file bs=1M count=10240

I then exported the /tmp/iscsi-file as LUN0 in the ietd.conf file. It's as simple as that!

Setting up the Windows iSCSI initiator was as simple as eating lettuce.

Next, I'll be posting about setting up the Linux iSCSI initiator as that is a bit more complicated and may require more troubleshooting steps.

##Update
Someone recommended me to a more powerful open source tool for SAN,NAS,iSCSI.
It's called openfiler. Seems like an awesome tool!

Vsftp chroot - Unable to follow symlinks!!

Today I setup vsftp for local user ftp access. I turned on 'chroot_local_user=YES' which essentially puts the ftp user into a chroot jail. But what happens when you want to access something outside of user's home directory?

What? Symlinks don't work?!

Here's the solution I found on the net: Link

Basically you have to mount the external directory into your current directory using the --bind option. That nice link in the article tells you how to do it and how to put it in your fstab file to make it permanent after a reboot!

Happy reading!