BGP Support on ASA

Lesson of the Day: BGP is not supported on ASA

Juniper SSG using ScreenOS are featured rich but it can also become internet facing device even if you need dual homing, as it supports BGP

Beside other feaures Cisco ASA with Linux kernell left behinf in routing protocol support. Till now BGP is still unsupported on ASA platform.

SSG support RIPv1/2, OSPF, BGP, Frame Relay, Multilink Frame Relay, PPP, Multilink PPP, HDLC and ASA only RIPv1/2, OSPF.

Repartition Cisco Flash

Repartition Flash

Well I have 2621XM in my hand; I need to enable IPsec VPN on it. Ooops it shows no option for Cypto isamkp. I need to upgrade to Security IOS. Before that I must figure out the version that fits in my little 32MB Flash. After a while I were able to find it, download it. Now TFTP server is ready to finsh the job and make the router ready tor VPN.

Copy tftp flash …………………

Oh I get error Error : Your flash is 16 MB you cannot copy 24 Mb IOS.

I check flash again

Router# show flash

The repartition process involves erasing Flash memory, so as per a document I found on a forum that

1- Reboot the router to run in ROM mode.

2- Change the config-register to 0x2101 and reload, using the following commands

Router#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Router(config) # config-register 0x2101

Router(config) # exit

Router # reload
Below is excerpting what I found on this document that is originally written for 25XX.

This will bring the router up in boot mode and Flash will be idle. You can not change the partition when the router is running under a full IOS from Flash. You will see a different router prompt, but enable passwords and most commands will remain the same.

3- Now Erase the flash using

Router # erase flash

4- Now repartition it to a single 32 MB flash using command,
Router # configure t

Router(config) # partition flash 1 32

Where 1 in above command denotes number of partition

5- Change the config register value again

Router(config) # config-register 0x2102

Router(config) # exit

Router # reload

Before reloading donot forget to copy new ios to the flash, else you should know how play with Xmodem on Saturday night (:

Work done!!! Now it 2:00 AM …Go to sleep now (:

Back It Up! By Omair Siddiqui

This article is already published and copied from CIO pakistan March 2009 edition This was also republished in network world

http://www.networkworld.com/news/2009/030609-back-it.html



Your business is only as redundant as the integrity of the data that you have stored on your servers. For companies that service customers in the cloud, if you can’t offer 99.9999% uptime and absolutely ensure data backup and restoration, you might as well not be in business.

There are a few issues at hand here. Not only must you ensure that the data is accurately and securely backed up whereby every packet and byte is accounted for, but you must also ensure that when the time comes, the data is “clean” enough to be plugged back into the system without a hiccup. It’s the hiccup that companies need to avoid which is why they look for ways to backup their data to begin with, however they aren’t always as proactive as the results they were expecting.

There has to be a process to acquire backups. Recent advancements in network and backup technologies have improved the performance, making it easier to backup data over the network. The traditional process which involves tape drives at branch servers, where an end-of-day-tape backup is usually taken and physically sent to the head office. This, by the way, is not what they were talking about when the term “data in transit” was discussed.

There are obvious problems with physically moving data – the unavailability of qualified technical resources to take properly handle the backups, verification of the backed up data before shipping it to the head office, risk of damaging the tape, data loss or theft during transportation; the list is quite endless. More importantly, because the backup in the current scenario, at least is done on an ad hoc basis, when the IT Administrator tries to sync the data into the data center, they find that it was not a successful backup to begin with. But most of these issues are usually revealed beyond the point of no return - when the restoration or a DR (Disaster Recovery) drill is performed.

By virtue of the technological advancements, there are solutions available which support a wide variety of operating systems and applications which can take optimized backups over WAN links.

The Solution
The solution in this case is actually a paradigm shift making use of modern data protection technologies to cope up with the ever increasing backup data vis a vis bandwidth. It uses fingerprint technology to distinguish unique file segments and maintain a check on all the redundant data in the remote sites. The solution that addresses these requirement includes a storage pool at each remote locations which then replicate the data over the WAN. These agents are thin software deployed in the remote servers. The software makes sure to send only new unique segments of file to a local storage pool, which automatically reduces the size of the transfer. It then becomes the job of the pool to check the uniqueness of the file across all local agents. It only replicates unique file segments to the main storage located in the centralized Data Center. This minimizes WAN bandwidth requirements and allows scalability because of the reduced storage capacity requirements.

A storage pool on the remote site optimizes the data over all the branch’s clients by identifying unique contents and storing the backup data locally. This shortens backup and restore tasks, and enables synchronization with central locations. Instead the files can be backed up over the WAN to a central storage.

The solution is also able to deal with one of the most important aspect of data security over the WAN by encrypting every file segment that it sends to the storage. The data in transit, as discussed earlier, comes to life in this segment of the solution whereby the data is encrypted before it is sent over the WAN to the storage, ensuring that the data is secure during the communication. This architecture eliminates the risk of accidental loss of tapes and unauthorized access of data, both in transit and at rest.

The solution has a very tangible return on investment. It is cost effective because the alternative would be to deploy separate tape drives, media, backup software, and technical support at each distinct site. There are then additional costs involved in the administration of each site and management of the off-site storage of the tape media. Since the solution removes the need for on-site tapes, the customers who have deployed this, have been able to justify their investment in a relatively short span of time.

Bank Islami – A Case Study
Innovative Integration recently deployed the solution at Bank Islami, ensuring that they had scalable, high performance data protection architecture for the bank’s Linux environment. Their environment includes more than 100 HP servers and a centralized pool of Network Appliance Storage. The problem the bank was having was to consolidate the data from its more than 100 branches across the major cities, located all over Pakistan. The institution was relying on a local data protection solution, built on an Open Source backup software. Almost all of the PCs and servers operated by the bank are running a SuSe Linux environment, which extended to the branch network as well.

Bank-Islami Setup at a Glance
“Each Bank Islami branch contains a file server which holds files from the specific branch users,” says Asad Alim, Head of Information Technology at Bank Islami. “At that time, there was no option other than to place a tape drive in each of the branches and use conventional scripts to perform the requisite backup.”

Using the traditional method, it could take up to a day to manage a recovery. As long as the tape was readable, it could always restore successfully providing the tapes were acquired from the remote location, locating the right tape containing the right block of information and then getting down to the restoration before having to send the tape back to the site. “Now none of this hassle is involved,” explains Asad.

Talking about bandwidth constraints Asad Alim commented that “We were concerned about the pressure the backup would put on the network, but despite of the 256Kbps bandwidth connectivity, the performance has proven to be stable”. Changes in data is first compressed at source and then sent across WAN to the central storage where it is decompressed and then stored in a duplicated fashion. It then employs an intelligent algorithm for data transfer. In case a backup fails during the process due to link failure or connectivity loss, the backup will resume from the point it was interrupted.

“The cost savings are a great endorsement but what is most important is that the branch data is now secure. You have to remember that in the past, we could never be 100% certain that we could restore a lost file. Now we are. With PureDisk, we are reducing our reliance on tapes for Disaster Recovery with secure replication of the data we backup,” says Asad Alim.
Please visit www.innovativeintegration.net for more details.

Cisco's Fast Ethernet Support

Well Cisco has huge database of its lively documentation. I guess they seriously require some solution for handling it. I have personally see many contradictory information on there site. They do update on one site but forget to synchronize on other locations. Few months back i have face a situation where a customer need 4 Ethernet port on 2801, to my surprise cisco router 1841 and 28XX do not support 2 port FE card and eventually i end up with giving two 1 port FE cards. Similar requirement arise and i again check website to make sure to cover any change happening. I found following link which says

http://www.cisco.com/en/US/partner/prod/collateral/routers/ps5854/prod_qas0900aecd80582015.html

Q. Is the 2-port HWIC supported on the Cisco 1800 and 2800 Series Integrated Services Routers?

A. No, the 2-port HWIC is supported only on the Cisco 3800 Series Integrated Services Routers. The Cisco 1841 can support only a single additional Fast Ethernet interface. The Cisco 2800 Series can support up to two additional interfaces, but this density must be attained using two 1-port HWICs

After making sure i presented my solution and inform the customer about cisco inabilty to support 2 port FE card. I were told that cisco do support 2 port FE card on 2801. As i had already double check so i were sure. I were surprise when i got the link

http://www.cisco.com/en/US/prod/collateral/routers/ps5854/product_data_sheet0900aecd80581fe6.html

Now what to do after searching a bit, i found that the cisco latest IOS start supporting it and eliminate the previous limitation. I were again surprised but can't to any thing about it. Cisco keep it up (:. You Rocks !!!

Redundancy when there is no redundancy

Redundancy is must!!!
Today one of my customer asked me whether 3750 support RPS(redundant power supply) !!! no worry man it do, i replied, but very soon i found it to be partially true. I have seen in datasheets about RPS but i decide to dig it deeper. Cisco is offering a separate 1 RU device 2300, its basically a redundant power system for internal power supply failure. It can support up to six device at a time (you need to plug the special cable to appliance to the router/switch) and at max can provide two active backups (if u purchase two power supply). One cable come with the bundle and you need to purchase spare if u need to backup other devices too. hmmm the appliance is not very cheap but i think its worthy it cost near about 3000 USD. the coolest thing you can even prioritize fail over, means say core switch has more priority then access layer so if both failed at same time it will backup core first.

What models did it support
Switches: 3750-E, 3560 E, 3750, 3560, 3550, 2960, 2950, CE 500 (Select models)

Router: 3825, 2851, 2821, 2811

The catch is you need to go for right power supply for example 700 Watt AC PS donot support support 3750E series but do support plain 3750 so watch it out first.

Part Number:

1- PWR-RPS2300 RPS 2300 chassis

2- C3K-PWR-750WAC Catalyst 3750-E/3560-E 750W AC power supply

3-C3K-PWR-1150WAC Catalyst 3750-E/3560-E 1150W AC power supply

4- CAB-RPS2300-E= Spare RPS Cable RPS 2300 Cat 3750E/3560E Switches

5-CAB-RPS2300= Spare RPS Cable for Cisco Redundant Power System 2300

FAQ

cisco extending 90 days warranty to life time for switches

As of right now cisco is leader in switching world. Juniper with introduction of there ESX switches are newbie in this industry. Nortel already in worst condition. But HP is consistent competitor of cisco in the switching world and already snatch a significant market share from cisco. Cisco is trying to give extras to beat to competition now a new announcement from cisco for extending its warranty

Effective May 1, 2009, Cisco is extending the warranty period for Cisco Catalyst 3750-E and Cisco Catalyst 3560-E series switches from the previously offered 90-day warranty to a limited lifetime warranty (LLW).

This is not the end in a seperate bullitein simlar announcement for 4500 series switch:
As of May 1, 2009, Cisco is offering a limited lifetime hardware warranty on the Cisco^® Catalyst^® 4500 E-Series and Cisco Catalyst 4500 Switches. This LLW is 5 year warranty in which cisco will make sure to ship the equipment within ten days of RMA request.

Similarly to better survive at access layer switching cisco has come up with LAN LITE image software of 2960 that offer prices that are almost equal to CE500. This was announced back in 2008
Details

Let us hope for some other better moves (: in the beneficiaries will be whom customer (:

Simple Setup for Dual Link ISP

I know a couple of customers that do run BGP just to ensure failover for there internet connectivity. The headache of running BGP with ISP can be saved by using few tricks, i shouldn't say it trick, rather its a feature of Cisco IOS.

A draw back of ehternet interface is that its status remain same regardless of far side interface status, this cause serious issues as for routing process as link remains up even the remote router ethernet interface fails to respond and thus the invalid route remain in routing table.

IP SLA can send echo packet to remote router and upon failure to receive ICMP reply can trigger the any specifed event like installing less prefered route to routing table and remove the old one below is the sample config of above topology
!
ip sla monitor 1 // Enter a number to reference our monitor
type echo protocol ipIcmpEcho 10.1.1.2 //10.1.1.2 is the ISP A IP i.e. Far side IP address of remote router)
timeout 500
frequency 3
ip sla monitor schedule 1 life forever start-time now // Scedule SLA to run forever
!
track 1 rtr 1 reachability // Creates tracked object 1 for RTR (Response time Reporter)
!
interface FastEthernet0/0
// Connection to ISP A
ip address 10.1.1.1 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1/0
// Connection to ISP B
ip address 10.2.1.1 255.255.255.0
duplex auto
speed auto
!
Now Time for routing (:
ip route 0.0.0.0 0.0.0.0 10.1.1.2 track 1 (Add primary route, installed if track 1 is successfully completed)
ip route 0.0.0.0 0.0.0.0 10.2.1.2 20 (Secondary route to ISP B, should activate if Link to ISP A fails) =====================================================================
State 1: ISP A is active
R0#sh ip route {Output ommited}
S* 0.0.0.0/0 [1/0] via 10.1.1.2

R0#sh ip route track-table
ip route 0.0.0.0 0.0.0.0 10.1.1.2 track 1 state is [up] ======================================================================
State 2: ISP A is inactive( I had shutdown R1 F0/0 to simulate it)
R0#sh ip route track-table
ip route 0.0.0.0 0.0.0.0 10.1.1.2 track 1 state is [down]
R0#sh ip route
S* 0.0.0.0/0 [20/0] via 10.2.1.2 (Notice routing table has installed new default route to ISP B) ======================================================================

Mine one is just starter for more details and digging it with NAT etc below are very good links
Reference: http://www.nil.com/ipcorner/SmallSiteMultiHoming/ http://www.blindhog.net/cisco-dual-internet-connections-without-bgp/