Networking on sigtar.com

bye bye http - hello letsencrypt

Thu, 11 Oct 2018 00:00:00 +1300

I’ve been a fan of HTTP and caching since my dial-up modem.

Skip to today where google returns HTTPS sites higher in its search results. Its could also be possible that you cannot trust a man in the middle HTTP cache any longer either right? :)

SSL certs have traditionally been expensive, but say welcome to lets encrypt which provides a free way of securing all of your websites. If you haven’t heard of it check it out here - https://letsencrypt.org/

pc engine - pfsense as router / firewall

Thu, 26 Feb 2015 00:00:00 +1300

Just built a pfsense router on a pc engine to replace my aging 7390 fritzbox…. Very very awesome and fast!

Perfect for UFB (ultra fast broadband) here in New Zealand - FTTH has arrived :)

I’m currently running these services on it (2 x 1GHZ cpu, 4GB RAM, 16GB msata SSD);

dhcpd - DHCP server
miniupnpd - UPnP server
ntpd - NTP server
squid - Transparent Proxy & Reverse Proxy
snort - IDS (Intrusion Detection System) / IPS (Intrusion Prevention System)
ssd - SSH server
unbound - DNS Server
ipsec - IPsec VPN (site to site VPN)
openvpn - Open VPN (client VPN)

Check these links for some great advise…

ERROR: No forward-proxy ports configured

Tue, 11 Feb 2014 00:00:00 +1300

I had the above issue after a squid upgrade and after changing from http_port 3128 transparent to http_port 3128 intercept.

Add “http_port 8080” line to squid.config to avoid this message, if you are not already using that port.

The changes in security require that a separate port be setup for forwarding proxy requests

nginx - and gzip

Mon, 10 Feb 2014 00:00:00 +1300

i only have vdsl at home and host my website via it… the following graphs shows when nginx started serving faster than the vdsl connection could handle (which is about 9Mbits)

ngnix with cache enabled, gzip enabled and set to 6

http://loadimpact.com/load-test/sigtar.com-6a246200e28f354c64582cf2c0b6ce46

ngnix with cache enabled, gzip enabled and set to 9 (maximum)

http://loadimpact.com/load-test/sigtar.com-1422b3e7250c4e3acb7868177f2b2056

ngnix with cache disabled, gzip enabled and set to 9 (maximum)

http://loadimpact.com/load-test/sigtar.com-19561e7422e24f35fb557c662d20beac

nginx - setup as reverse proxy

Sat, 08 Feb 2014 00:00:00 +1300

Previously to take down this wordpress site all you needed to do was hold down F5 for about 20 seconds then the site would take about 5 mins to recover.

There were a few factors causing this and quite a few different methods to solving the problem. Wordpress itself is run on php / apache, apache has an evasive mod which can block certain IPs depending on the defined abusive behavior (typical DDOS attack). Since i like to run a few websites behind a single IP i looked at fixing the issue closer to the perimeter….

use nmap to port scan / find free IPS

Fri, 12 Jul 2013 00:00:00 +1200

I use angry IP scanner in windows, linux has a good util for port scanning an ip range called nmap;

Grab nmap from usual repositories

sudo nmap -sP 192.168.9.0/24 (will show hosts up and resolve mac addresses to vendors)

sudo nmap -v -sT 192.168.9.0/24 (will show hosts up and the various open ports)

sudo nmap -v -sT 192.168.9.104 (will show particular host and the various open ports)

Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-12 11:48 NZST Initiating ARP Ping Scan at 11:48 Scanning 192.168.9.104 [1 port] Completed ARP Ping Scan at 11:48, 0.00s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 11:48 Completed Parallel DNS resolution of 1 host. at 11:48, 0.00s elapsed Initiating Connect Scan at 11:48 Scanning win2012-veeam.fritz.box (192.168.9.104) [1000 ports] Discovered open port 111/tcp on 192.168.9.104 Discovered open port 445/tcp on 192.168.9.104 Discovered open port 3389/tcp on 192.168.9.104 Discovered open port 135/tcp on 192.168.9.104 Discovered open port 139/tcp on 192.168.9.104 Discovered open port 49155/tcp on 192.168.9.104 Discovered open port 1063/tcp on 192.168.9.104 Discovered open port 2049/tcp on 192.168.9.104 Discovered open port 3260/tcp on 192.168.9.104 Completed Connect Scan at 11:48, 4.21s elapsed (1000 total ports) Nmap scan report for win2012-veeam.fritz.box (192.168.9.104) Host is up (0.00059s latency). Not shown: 991 filtered ports PORT STATE SERVICE 111/tcp open rpcbind 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1063/tcp open kyoceranetdev 2049/tcp open nfs 3260/tcp open iscsi 3389/tcp open ms-wbt-server 49155/tcp open unknown MAC Address: 00:50:56:9C:68:FA (VMware)

nsswitch.conf SMF config

Thu, 11 Jul 2013 00:00:00 +1200

# svccfg svc:> select dns/client svc:/network/dns/client> setprop config/search = astring: \ (“us.company.com” “eu.company.com” “companya.com” “companyb.com” “company.com” ) svc:/network/dns/client> setprop config/nameserver = net_address: \ ( 138.2.202.15 138.2.202.25 ) svc:/network/dns/client> select dns/client:default svc:/network/dns/client:default> refresh svc:/network/dns/client:default> validate svc:/network/dns/client:default> select name-service/switch svc:/system/name-service/switch> setprop config/host = astring: “files dns” svc:/system/name-service/switch> select system/name-service/switch:default svc:/system/name-service/switch:default> refresh svc:/system/name-service/switch:default> validate svc:/system/name-service/switch:default> # svcadm enable dns/client # svcadm refresh name-service/switch # grep host /etc/nsswitch.conf hosts: files dns # cat /etc/resolv.conf # # opyright (c) 2011, Oracle and/or its affiliates. All rights reserved. #

zfs share for Time machine backups

Thu, 11 Jul 2013 00:00:00 +1200

I’ve tried using a share for time machine before, but due to the nature of how time machine works it eventually consumed all the spare space that is available on that particular share.

bring on zfs quotas… (my drive on my mini mac is 100GB, so 200GB should be enough for a few variations)

zfs set quota=200G unprotected/timemachine

This adds a artificial limit to your zfs filesystem, making sure that time machine does not consume more than 200 gigabytes of space.

HP Gen 8 servers and networking issues - TG3 driver

Mon, 11 Feb 2013 00:00:00 +1300

There is a bug in the tg3 driver on the ESXi hosts (1gbit broadcom cards in the new hosts). If the network card is put under load and netqueue is enabled it will sometimes decide to drop all traffic. Essentially i’ve disabled netqueue and the problems have gone away…. as per this vm kb :

http://kb.vmware.com/kb/2035701

The isues will present themselves as log entires like so;

2012-11-19T18:58:52.137Z cpu17:4155)<6>tg3 : vmnic8: RX NetQ allocated on 1 2012-11-19T18:58:52.138Z cpu17:4155)<6>tg3 : vmnic8: NetQ set RX Filter: 1 [00:50:56:71:46:87 0] 2012-11-19T18:58:52.138Z cpu17:4155)<6>tg3 : vmnic7: RX NetQ allocated on 1 2012-11-19T18:58:52.138Z cpu17:4155)<6>tg3 : vmnic7: NetQ set RX Filter: 1 [00:50:56:71:46:87 0] 2012-11-19T18:59:12.139Z cpu21:4155)<6>tg3 : vmnic4: NetQ remove RX filter: 1 2012-11-19T18:59:12.139Z cpu21:4155)<6>tg3 : vmnic4: Free NetQ RX Queue: 1 2012-11-19T18:59:22.137Z cpu24:4155)<6>tg3 : vmnic4: RX NetQ allocated on 1 2012-11-19T18:59:22.138Z cpu24:4155)<6>tg3 : vmnic4: NetQ set RX Filter: 1 [00:50:56:71:46:87 0] 2012-11-19T18:59:42.138Z cpu21:4155)<6>tg3 : vmnic7: NetQ remove RX filter: 1 2012-11-19T18:59:42.138Z cpu21:4155)<6>tg3 : vmnic7: Free NetQ RX Queue: 1 2012-11-19T18:59:42.140Z cpu21:4155)<6>tg3 : vmnic4: NetQ remove RX filter: 1 2012-11-19T18:59:42.140Z cpu21:4155)<6>tg3 : vmnic4: Free NetQ RX Queue: 1 2012-11-19T19:00:02.139Z cpu28:4155)<6>tg3 : vmnic8: NetQ remove RX filter: 1

vmware - copy networking port groups to another host

Mon, 04 Feb 2013 00:00:00 +1300

You might be able to do this via “host profiles” but if you do not have the licensing for it, this is the alternative. Very handy if you have over 50 or so port groups. It can be re-run to add to additional hosts as needed.

Install powercli, run the following to obtain your current list of virtual port groups off existing host;

Get-VirtualPortGroup -VirtualSwitch vSwitch0 -VMHost esx-01

Grab the output and place into CSV file or copy straght into Excel…

When Is A Trunk Not A Trunk?

Fri, 01 Feb 2013 00:00:00 +1300

Very good article here - http://networkingnerd.net/2011/02/02/when-is-a-trunk-not-a-trunk/

Particuly like setting of Native vLAN and tagged networks over an HP trunk;

So, if HP refers to an uplink carrying multiple VLANs are a tagged port, then does HP have a “trunk”? In fact they do. In HPvania, a trunk is a logical construct that aggregates multiple ports into one logical link. For those of you that might be out there scratching your heads about this one, this means that when you “trunk” a group of ports on an HP switch, you are creating one LACP link from up to four individual ports. This kind of configuration should look like this:

squid - reverse proxy

Mon, 14 Jan 2013 00:00:00 +1300

Great guide here - http://www.classhelper.org/articles/reverse-proxy-server-squid-debian/installing-squid-proxy-server.shtml

I’ve modified slightly for Ubuntu, but almost identical.

apt-get install squid cp /etc/squid3/squid.conf /etc/squid3/squid.bak rm /etc/squid3/squid.conf nano /etc/squid/squid.conf

http_port 80 defaultsite=www.yoursite.com vhost forwarded_for on refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 cache_peer 192.168.0.13 parent 80 0 no-query no-digest originserver name=web1 acl sites_web1 dstdomain www.yoursite.com yoursite.com cache_peer_access web1 allow sites_web1 cache_peer 192.168.0.14 parent 80 0 no-query no-digest originserver name=web2 acl sites_web2 dstdomain www.anothersite.com anothersite.com cache_peer_access web2 allow sites_web2 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 443 # https acl Safe_ports port 1025-65535 # unregistered ports acl CONNECT method CONNECT http_access allow sites_web1 http_access allow sites_web2 http_access allow manager all http_access allow manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports #http_access deny all access_log /var/log/squid3/access.log cache_mgr support@yoursite.com

HP Flex 10 - Setup on VMWare

Tue, 16 Oct 2012 00:00:00 +1300

Some really good info at this site : http://kennethvanditmarsch.wordpress.com/2009/11/04/understanding-hp-flex-10-mappings-with-vmware/

A bit more around his finding during some tests : http://kennethvanditmarsch.wordpress.com/2009/12/04/testing-scenarios-vmware-hp-c-class-infrastructure/

opensolaris - setting up dhcp

Tue, 16 Oct 2012 00:00:00 +1300

You’ll need these two packages installed;

SUNWdhcs, SUNWdhcm

First ensure that the DHCP service is running. Go into the “services” gui and tick the box to enable the DHCP server.

now from commandline run…

dhcpmgr

From edit menu choose “network wizard”, step through the wizard (defautls are o.k i you have a fixed IP already assigned to your opensolaris box)
From edit menu choose “address wizard”

If you step through the wizard (the following is an example of what i have choosen)

Using netsh to create a transparent proxy

Tue, 16 Oct 2012 00:00:00 +1300

There are some good windows web proxies about. The only problem with them is they sometimes dont natively act as a transparent proxy. i.e. typically you’ll need to set your client machines to a specific IP and port.

I’ve used squid historically when setting up transparent proxies (mainly since it actually has a transparent mode) and this has worked well. Recently i thought i’d have a go at some of the windows solutions to see how they pan out.

Wan Acceleration Appliances

Tue, 16 Oct 2012 00:00:00 +1300

There are some really good products out there in the market at the moment…

Exinda - low cost, really good QOS / prioitisation and visibility. Falls short on acceleration (at the moment) Riverbed - One of the key players in the acceleration market. Optimized algorithms for specific traffic. Silver Peak - Relatively new, work well as a capture all acceleration device with QOS / prioritisation included.

One to watch - traffic squeezer. I’m always a fan of open source getting into new technologies, and this project seems to be a good start. Its still early days but I’m hopeful this will take off and become a contender in the future ahead.

LACP - HP vs Cisco

Wed, 14 Mar 2012 00:00:00 +1300

Great article on setting up connection between HP & Cisco….

http://evilrouters.net/2011/08/12/configure-lacp-between-hp-procurve-and-cisco-catalyst-switches/

Cisco VTP on HP Switches?

Tue, 07 Feb 2012 00:00:00 +1300

Want to propergate vLan information across multiple switches?

Easy in the Cisco world… Just use VTP - configure a server switch and your away… (it also has its risks if you introduce another server switch with a lower ID)

What does HP have? – GVRP (MVRP newer iteration).

http://en.wikipedia.org/wiki/Multiple_Registration_Protocol

Multiple VLAN Registration Protocol (MVRP), which replaced GARP VLAN Registration Protocol (GVRP), is a standards-based Layer 2 network protocol, for automatic configuration of VLAN information on switches. It was defined in the 802.1ak amendment to 802.1Q-2005.

HP Blade Switch - enable crossover

Tue, 31 Jan 2012 00:00:00 +1300

HP GbE2c Ethernet Blade Switch for HP c-Class BladeSystem User Guide Click here to view the “HP GbE2c Ethernet Blade Switch for HP c-Class BladeSystem User Guide” (http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c00701541/c00701541.pdf) HP GbE2c Layer 2/3 Ethernet Blade Switch for c-Class BladeSystem User Guide Click here to go to the “HP GbE2c Layer 2/3 Ethernet Blade Switch for c-Class BladeSystem User Guide” (http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c00865010/c00865010.pdf)

http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00700745/c00700745.pdf

Crosslinks

http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00816246/c00816246.pdf

P4000 / Lefthand and Windows DSM (MPIO)

Wed, 04 May 2011 00:00:00 +1200

Steps to setup MPIO round robin and DSM with P4000 / Lefthand nodes

This example is windows 2008 with 2 x 1gbit nics

Install HP DSM driver onto windows 2008 (this should also install MPIO feature on windows 2008)
Setup 2 x IP’s on windows host - storage subnet (used with MPIO)
1. Confirm you can ping target from both (enable one at a time - ensure there is no routing on your other nics)
Provision storage and allow server read / write access to windows server (via initiator name)
Open iSCSI on windows 2008
Put in IP of target in discovery tab
On first tab confirm that iSCSI drive is presented to host
Click “connect” - check both auto-connect and use MPIO
1. click advanced - chose MS iSCSI initiator, choose first IP and target IP. Click o.k. / o.k
2. click advanced - chose MS iSCSI initiator, choose second IP and target IP. Click o.k. / o.k
3. Repeat above per additional Nic
Confirm via “devices” that there is x (as many targets as nics) targets per disk
1. Within devices choose MPIO - change from vendor specific to “round robin”
  1. Note : read / write access to LUN is required when using “round robin” MPIO opposed to the default “vendor specific” which works with read only access. Else you will get an error - “not supported”
2. Repeat above per “device”
Confirm on Lefthand / P4000 CMC that the LUN has one connection per initiator Nic, and that each connection also has its DSM children (visible in CMC if working).

Confirm that the connection are as expected…

HP ProCurve 5400zl Switch Series - How to Enable Jumbo Frames?

Mon, 02 May 2011 00:00:00 +1200

I couldn’t find how to do this via the web GUI (hate the new 5400 web console - what happened to the performance graphs??) – anyhow this is the commands to do it via commandline…

5406zl-A# show vlan 200 Status and Counters - VLAN Information - Ports - VLAN 200 VLAN ID : 200 Name : VLAN200 Status : Port-based Voice : No Jumbo : No

5406zl-A# configure 5406zl-A(config)# vlan 200 jumbo 5406zl-A(config)# end 5406zl-A# sho vlan 200

How to test SMTP manually

Tue, 01 Feb 2011 00:00:00 +1300

http://support.microsoft.com/kb/323350

telnet 25 helo me mail from:email@domain.com rcpt to:youremail@yourdomain.com data

Type Subject:This is a test, and then press ENTER two times. Type Testing, and then press ENTER. Press ENTER, type a period (.), and then press ENTER.

quit

vmware and NLB (unicast vs multicast)

Fri, 10 Dec 2010 00:00:00 +1300

Thought I’d get a bit of clarification around this one. VMWare states –

VMware recommends that you use multicast mode, because unicast mode forces the physical switches on the LAN to broadcast all Network Load Balancing traffic to every machine on the LAN.

There are some issues which come to the surface if you are using unicast. Where possible we should always try to use a Multicast NLB as Unicast can cause some complications around vSwitch configurations. (requirement to change switch notifications to “No” – and seemingly break port id teaming). Detail below;

Celerra - Unable to create, refresh, or delete checkpoint of a replicated destination file system

Tue, 09 Nov 2010 00:00:00 +1300

I’ve been stuck with this error recently on a Celerra manager device : DpRequest_Max_VS_SuspendedCheckpointsReached

This can sometimes happen when a filesystem is held during a replication task. To check what filesystems are currently being replcated run the following command;

nas_replicate -info -all

Either wait until the replication has completed - check status. Or temporary stop the replication task (stop it from the source side if possible).

EMC Celerra Optimizations for VMware on NFS

Tue, 12 Oct 2010 00:00:00 +1300

go here http://blog.scottlowe.org/2010/01/31/emc-celerra-optimizations-for-vmware-on-nfs/

Turn on the uncached write mechanism for NFS file systems used as VMware datastores. This can have a significant performance improvement for VMDKs on NFS but isn’t the default setting. From the Control Station, you can use this command to turn on the uncached write mechanism: server_mount <data mover name> -option <options>,**uncached** <file system name> <mount point> Be sure to review pages 99 through 101 of the VMware on Celerra best practices document for more information on the uncached write mechanism and any considerations for its use.

vmware and load balancing NFS trunks

Wed, 22 Sep 2010 00:00:00 +1200

Straight from the post below, this is the best way (currently) to load balance your NFS datastores… No MPIO magic here unfortunately.

http://communities.vmware.com/message/1466595#1466595

Basically you can setup IP alias on the NFS side and then setup multiple connections (using a unique IP) per datastore on each ESX host. This works well if you are using a team of nics running IP-hash load balancing…

Static EtherChannel.

My setup is as follows:

ESXi 4.0 U1, Cisco 3750 Switches, and NetApp NFS on the storage side.

I have a total of 8 nics. I divided the nics into 3 groups.

2 nics on vSwitch0 for Mgmt & vMotion 3 nics on vSwitch1 for VM’s (Multiple port groups (3 VLANS)) 3 nics on vSwitch2 for IP Storage (Mostly NFS, a little iSCSI) (One vSwitch3 I also have a VM port group for iSCSI access from within the VM)

Since I have 3 nics on my IPStorage port group I needed a way to be able to utilize all three nics and not have the server just use one for ingress and egress traffic. This was done by:

Setting up a static EtherChannel on the cisco switch (Port Channel). Configuring the cisco switch to IP Hash Configure the vSwitch to “Route based on IP Hash” as well.

The next part is to create multiple datastores on the NFS device. Each of my NFS datastores is about 500GB in size. Reason for this is that my larger luns are iSCSI and are access directly from the VM using the MS iSCSI initiator from the VM itself. My NetApp NAS has an address of, let say, 192.168.1.50. So all my data stores are accessible by utilizing the address of “\\192.168.1.50\NFS-Store#”. This will not be useful as the esx box and the cisco switch will always use the same nic/port to access the nas device. This is due to the algorithm (IP HASH) to decide what link it’ll go over. So to resolve the issue, I added IP aliases to the NFS box. NetApp allows to have multiple Ip addresses pointing to the same NFS export, I suspect EMC would do the same. So, I added 2 aliases 51 & 52. Now my NFS datastores are accessible by using Ip address 192.168.1.50,.51, & .52.

So I went ahead and added the datastores to the ESX box using the multiple IP addresses:

Datastore1 = \\192.168.1.50\NFS-Store1 Datastore2 = \\192.168.1.51\NFS-Store2 Datastore3 = \\192.168.1.52\NFS-Store3

If you have more datastores it’ll just repeat: Datastore4 = \\192.168.1.50\NFS-Store4 and so on…

Since having multiple datastores and address to each, the 3 nics on the ESX box dedicated to IP Storage get utilized. It does not aggregate the bandwidth but it does use all three to send and recieve packets. So the fastest speed you will get is 1Gbit, theoretically, each way for traffic but, it is better than trying to cram all the traffic over 1 nic.

I also enabled Jumbo Frames on the vSwitch as well as the vmNic for IP-Stroage. (need the best performance!) I should mention that your NFS storage device should have EtherChannel setup on it as well. Otherwise, you’ll be on the same boat just on the other end of it.

Hope it helps!

Larry B.

I should mention that you should not use different addresses to access the same NFS share (datastore). It is not supported and may cause you issues.

vmware - hp procurve lacp / trunk

Tue, 21 Sep 2010 00:00:00 +1200

Cisco’s Etherchannel and HP’s LACP are very similar – probably why I assumed both are supported by vmware. But as per below – it is not the case.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1004048

From a procurve perspective the differences between a “trunk” and “static lacp” trunk is the total bandwidth per connection. A typical end point on a “trunk” trunk can transmit various connections down both pipes, but only receive down one – sometimes refered to as TLB (transmit load balancing). In vmwares case when you are using a “trunk” trunk you will have ip hash set as a load balancer, effectively meaning a different nic will be used on the vmware side for each connection a virtual machine makes.

monitoring changed blocks (CBT) for replication of vmware virtual machines

Tue, 17 Aug 2010 00:00:00 +1200

Check this link for a great script to monitor changes made to a virtual machine via the vmware CBT API. This is perfect for finding culprit machines that are generating a lot of replication traffic if you are replicating over a WAN.

http://www.vmguru.com/index.php/articles-mainmenu-62/scripting/105-using-powershell-to-track-block-change-sizes-over-time

If you have some disks on a virtual machine you don’t want this script to capture then just set them as independent disks (so no snapshots can take place). This is handy if you have your windows page file on a separate disk that you don’t want to be measured as a part of the CBT changes.

vmware srm - replicating over a wan - optimizations

Tue, 17 Aug 2010 00:00:00 +1200

I’ve been working through a SRM setup and have been looking at ways to optimize the amount of traffic that is sent over the WAN. The first obvious move is to move your vmware swap files off the replicated LUNS.

Another way is to reduce the sync window. i.e. how often is yoru replication technology trying to keep the source and destination in sync? – Increasing this window can sometimes help you out. But that all depends on your delta’s.

vyatta as a virtual router

Sun, 25 Jul 2010 00:00:00 +1200

Some very nice examples by Gene on how to setup vyatta as a router on this page;

http://www.sonoracomm.com/support/19-inet-support/233-vyatta-cable

Masquerade Natting;

set service nat rule 10 source address 192.168.77.0/24 set service nat rule 10 outbound-interface eth0 set service nat rule 10 type masquerade

set service nat rule 20 source address 10.200.88.0/24 set service nat rule 20 outbound-interface eth0 set service nat rule 20 type masquerade

Essentially every thing leaving from these two networks will be natted via the eth0 interface. i.e. they will be using the same IP as eth0 for their requests.

opensolaris - default route

Tue, 11 May 2010 00:00:00 +1200

type the following to check your default routes…

netstat -rn

Jumbo Frames on your vSphere ESXi box

Tue, 02 Mar 2010 00:00:00 +1300

Continuing on from this /2010/02/04/vsphere-and-multipathing-iscsi/

you may want to implement jumbo frames to your iSCSI backend…

Enable jumbo frames on your iSCSI target and switches then complete the following on the ESXi hosts (iSCSI initiators)…

This to list your current switch details and port group names…

esxcfg-vswitch -l

The following to allow jumbo frames onto your vswtich (insert your vSwich in following)

esxcfg-vswtich -m 9000 vSwitch0

Then create your kernel port groups that you want to use for iscsi, my commands looked like this… (repeat for each iscsi kernel port you have) – note : DO NOT ADD ANY VMKERNEL(s) from the GUI, instead use the steps below

vSphere and Multipathing iSCSI

Thu, 04 Feb 2010 00:00:00 +1300

This is just a quick reference to create a multiplathing iSCSI setup…

Create two virtual kernel switches, one called “iSCSI-1” and the other called “iSCSI-2” (and so on if you have more nics)

Then per kernel portgroup ensure that only one of the nics is active. For the “iSCSI-1” portgroup configure it to override the virtual switch settings and move nic 0 to active and nic 1 to unused. For the “iSCSI-2” portgroup configure it to override the virtual switch settings and move nic 1 to active and nic 0 to unused.

OpenSolaris - iSCSI

Fri, 13 Nov 2009 00:00:00 +1300

Want iSCSI in opensolaris?

Grab SUNWiscsitgt via package manager.

enable the server via svcadm;

svcadm enable iscsitgt

create your zfs iscsi pool; (this command will limit iscsi drive to 500GB in size)

zfs create -V 500G tank/iscsi

set isci on via zfs command;

zfs set shareiscsi=on tank/iscsi

check that target is up and running;

iscsitadm list target -v

Done. Should be able to connect via ip from another machine. I have not covered CHAP or any client side configuration. Assumed isolated LAN.

Opensolaris - Samba and Network browsing

Sun, 06 Sep 2009 00:00:00 +1200

If you’ve setup samba (rather than the builtin cifs/smb) chances are that you can only browse to your samba shares directly on IP only.

If you want your box “network browseable” you’ll need to load nmbd.

You can find a really good write up on modifiying the SMF for samba to autostart the required service here : http://wikis.sun.com/display/BigAdmin/Enabling+Browsing+with+Samba+in+Solaris+10+Update+4

import this file samba.xml

run these commands;

# svcadm disable samba
# svccfg import samba.xml
# svccfg delete svc:/network/samba:default
# svcadm refresh samba:smbd
# svcadm refresh samba:nmbd
# svcadm enable samba:smbd
# svcadm enable samba:nmbd

ESX - network utilization

Sat, 22 Aug 2009 00:00:00 +1200

One of the best articles i have found on this subject is here : http://blog.scottlowe.org/2008/07/16/understanding-nic-utilization-in-vmware-esx/

There is some additional information here on setting up an etherchannel on the cisco side : http://blog.scottlowe.org/2006/12/04/esx-server-nic-teaming-and-vlan-trunking/

This can be handy if you need a single VM to use both physical nics in a load-balanced manner - both outbound and inbound. Of course its not really that simple though. This will really only add a benefit if the VM is communicating to multiple destinations (using ip hash - a single destination from a single VM with one IP will always be limited to the same physical nic).

zfs compression and latency

Wed, 19 Aug 2009 00:00:00 +1200

Since im using ZFS as storage via NFS for my some of my vmware environments i need to ensure that latency on my disk is reduced where ever possible.

There is alot of talk about ZFS compression being “faster” than a non-compressed pool due to less physical data being pulled off the drives. This of course depends on the system powering ZFS, but i wanted to run some tests specifically on latency. Throughput is fine in some situations, but latency is a killer when it comes to lots of small reads and writes (in the case of hosting virtual machines)

opensolaris - network teaming

Mon, 03 Aug 2009 00:00:00 +1200

Otherwise known as trunking or link aggregation. I believe it is the best way to get that additional boost out of your network server while providing a bit of redundancy on link failure. here is how to do it…

Official docs on the process here… http://docs.sun.com/app/docs/doc/819-6990/gdysn?a=view and some good bits here http://blogs.sun.com/nickyv/entry/link_aggregation_jumpstart_post_install

dladm (data link admin) is the tool for the job. List the links you currently have…

dladm show-link

First shut down the links you are currently using.. (you will have to do this on the console)

selinux - opening additional ports / or disabling

Tue, 28 Jul 2009 00:00:00 +1200

If you are having problems starting apache on a non-standard port you might find that the problem is related to selinux.

Type this command to check to see what http ports are currently allowed; (remove filter to show all rules)

semanage port -l|grep http

To add another port type the following (with the port you wish to add etc);

semanage port -a -t http_port_t -p tcp 81

If you want to disable selinux completely then go into /etc/selinux/config and set selinux=disabled. Save then reboot.

opensolaris - smbd issues?

Mon, 27 Jul 2009 00:00:00 +1200

Hmm… i’ve been having problems since the 2009.06 (snv_111b) update with cifs.

Cant pin it exactly as it could be “load” related… hmmm.

found this ? http://opensolaris.org/jive/thread.jspa?threadID=107681 this also may be a clue.. http://opensolaris.org/jive/thread.jspa?threadID=92472&tstart=75

imapd ? might have to go back to 2008.11

You might get better performance if you enable oplocks but there are known issues with it but you can do it just to see if you see any difference:

svccfg -s smb/server setprop smbd/oplock_enable=boolean: true

fedora 11 - LAMP install

Thu, 23 Jul 2009 00:00:00 +1200

Setting up LAMP on fedora 11… First install the required modules.

yum install -y httpd.i586 mysql.i586 mysql-server.i586 php.i586 php-mysql.i586 php-gd.i586

Next i’m copying my web source from another linux machine. I’ve run these commands from the destination machine…

cd /var/www/html

rsync -ave ssh 192.168.9.10:/var/www/html/ .

Now my mysql data…

cd /var/lib/mysql

rsync -ave ssh 192.168.9.10:/var/lib/mysql/ .

Accept the certificate and enter the source root password. Next fire up the services… I usually just go into “setup” then “system services” and enable both httpd and mysqld

Opensolaris : Citrix XenServer / ESX - Hooking into ZFS

Wed, 22 Jul 2009 00:00:00 +1200

To share your zfs pool via NFS (that works with Citrix Xen / ESX) to a host called “esxhost”;

zfs set sharenfs=rw,nosuid,root=esxhost tank/nfs

Note : You MUST have a resolvable name from the opensolaris box. i.e. you should be able to ping it. I have tried with ip’s only and it will fail. I have edited the /etc/hosts file to include the following line for my config;

opensolaris - jumbo frames

Sun, 12 Jul 2009 00:00:00 +1200

If your keen on enabling jumbo frames in opensolaris this is the way…

http://docs.sun.com/app/docs/doc/819-6990/gdyqk?l=en&a=view

# dladm show-phys

LINK MEDIA STATE SPEED DUPLEX DEVICE

net0 ether up 100Mb full bge0

itops1 ether up 100Mb full qfe3

web1 ether up 100Mb full bge1

# dladm show-linkprop -p mtu web1

LINK PROPERTY VALUE DEFAULT POSSIBLE

web1 mtu 1500 1500 –

# ifconfig web1 unplumb

# dladm set-linkprop -p mtu=9000 web1

# ifconfig web1 plumb 10.10.1.2/24 up

Using W2k3 R2 / W2k8 server as a NFS share for vmware

Sun, 12 Jul 2009 00:00:00 +1200

This is something i do in the lab so all of my vm’s are able to access iso’s etc (very handy for quick builds). Quite handy doing it through windows since its easiey enough to setup a windows network share to the same location and update various files via that.

This site has some good clear instructions : http://vmetc.com/2008/02/19/create-a-nfs-share-for-vm-iso-files-with-windows-2003-server-r2/

On the Windows 2003 Server make sure “Microsoft Services for NFS” in installed. If not you need to add it under Add/Remove Programs, Windows Components, Other Network File and Print Services
Next go to folder you want to share and right-click on it and select Properties
Click on the NFS Sharing tab and select “Share this Folder”
Enter a Share Name, check “Anonymous Access”
In VirtualCenter, select your ESX server and click the “Configuration” tab and then select “Storage”
Click on “Add Storage” and select “Network File System” as the storage type
Enter the Windows Server name, the folder (share) name and a descriptive Datastore Name
Done. Now you can map CD iso’s to your various vm’s.

VirtualBox - Dup on ping

Mon, 22 Jun 2009 00:00:00 +1200

I’ve had this with certain kernels (2009.06) on opensolaris. Seems there is some incompatibility between some kernels and the opensolaris virtualbox network emulation. This only seems to effect linux virtual guests.

When you try to ping an address you get something like this…

[root@VA-DHCPWEB ~]# ping 192.168.9.15 PING 192.168.9.15 (192.168.9.15) 56(84) bytes of data. 64 bytes from 192.168.9.15: icmp_seq=1 ttl=128 time=1.85 ms 64 bytes from 192.168.9.15: icmp_seq=1 ttl=127 time=1.88 ms (DUP!)

Cisco - adding a static route to router

Wed, 17 Jun 2009 00:00:00 +1200

To show what routes your cisco router currently has loaded type the following command (from the enable prompt) ;

show ip route

To add any new static routes you need to use the following command (from the config terminal prompt) ;

ip route 10.10.20.0 255.255.255.0 192.168.100.1

the syntax as above is ip route network netmask gateway

Cisco - MLS (QoS) on a switch

Fri, 12 Jun 2009 00:00:00 +1200

If you find alot of MLS entries in your running-config file you may have QoS enabled. Within the lab i dont require QoS (Quality of Service) to be enabled so have disabled it via this command (config t);

no mls qos

Note: this was a 2960G switch.

Remember to save running config to startup config. Done.

A good reference page here…

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_37_ey/configuration/guide/swqos.html#wp1021247

Cisco - Stop console messages

Wed, 10 Jun 2009 00:00:00 +1200

Sometimes when logged into a router or switch via the null modem (console port) the console messages make it hard to see the commands you are trying to run.

There is a way to turn off the messages on the console session. Log on to your switch router, enter into configuration terminal mode then type…

no logging console

Done

Squid - optimizing cache hits

Wed, 10 Jun 2009 00:00:00 +1200

The first place to look for increasing your hit ratio is the refresh_pattern parameter within the squid.conf file.

Note: the following applies to squid 3.0 and higher only….

I have found a really good page here http://linux.com/archive/feature/153221 that explains some good setups if you with to increase your cache hits…

refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90% 432000 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i \.index.(html|htm)$ 0 40% 10080 refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320 refresh_pattern . 0 40% 40320

DHCP Client - Error 5: Access is denied.

Thu, 04 Jun 2009 00:00:00 +1200

I’ve had this on a few windows 2003 machines, where the “DHCP client” service refuses to start and prompts with an access denied window.

Unsure of the cause at this point (it may be a security patch), but here is the fix…

Give the local “network service” account full rights to the following registry key;

hkey_local_machine\system\currentcontrolset\services\dhcp

Now try starting the service, should work. In some cases you may also need to add the rights to the following key..

Opensolaris : SMF and Squid

Sat, 16 May 2009 00:00:00 +1200

Decided to create a SMF manifest for squid so that it autostarts on boot.

Command to start squid : /usr/squid/sbin/squid

Command to stop squid : /usr/squid/sbin/squid -k shutdown

This site has a good starter on SMF creation : http://blogs.sun.com/observatory/entry/mouting_windows_shares_at_startup

I’ve taken a copy of the /var/svc/manifest/network/smb/server.xml file for my squid manifest and placed it at /var/svc/manifest/network/squid/squid.xml

Import the XML using this command;

svccfg import /var/svc/manifest/network/squid/squid.xml

Update: i’ve stopped this work as i missed the fact that squid already comes with a SMF manifest! :) No idea how i missed that one. You can enable via ;

svcadm enable svc:/network/http:squid

This is the manifest for the above service;

Opensolaris - configuring squid as a transparent proxy

Wed, 22 Apr 2009 00:00:00 +1200

I used to have a virtual machine that acted as a transparent proxy, but as of late thought i’d move squid onto my host box (opensolaris). This way hopefully increasing the amount of free ram available to the host while also taking advantage of ZFS etc…

So this is a very brief guide on how to configure your opensolaris 2008.11 box as a transparent proxy. Essentially meaning if you set the solaris box as the default gateway all web traffic will be cached as it goes through it before it goes onto your dls router or outside connection.

squid - your transparent proxy friend

Fri, 10 Apr 2009 00:00:00 +1200

Still my favourite light and fast web proxy is Squid. Its very easy to setup and get running on almost all flavours of linux. You can find it here http://www.squid-cache.org/ but will probably find it in your local package manager…

This is for more my own reference… as i don’t think too many people have the need for a transparent proxy. You only need one NIC configured on your VM / machine as its most probably on the same subnet as your dsl etc…

Router on a stick - Adding VLANs to a cisco router

Tue, 24 Mar 2009 00:00:00 +1300

Telnet to your cisco router, enable then go into config t. Passwords may be required depending on how it has been configured…

config t

Ensure that ip routing has been enabled…

ip routing

To create the VLAN adapter you’ll need to run the following commands to create a “router on a stick”… Note: the .2 after the interface name creates a virtual adapter on the interface.

interface FastEthernet1/1.2 description “VM Host Network” encapsulation dot1Q 2 ip address 172.25.2.1 255.255.255.0

Windows / Linux - File Migration Tools

Sat, 21 Feb 2009 00:00:00 +1300

In Windows i use robocopy…

This is the syntax to copy from one location to another… (i like how robocopy uses UNC paths)

robocopy \\192.168.9.70\videos \\192.168.9.101\videos /e /r:2 /w:10 /sec robocopy \\192.168.9.70\software \\192.168.9.101\software /e /r:2 /w:10 /sec

Note: i always copy instead of the move. Run multiple times before switch over to shorten time for final sync. Always use the /SEC to copy over the NTFS permissions. I have had problems with the non X010 version of robocopy not copying NTFS permissions across. Check NTFS permissions before removing the source files. You can update files NTFS permissions with /SECFIX switch if required.

Linux - routing examples

Fri, 20 Feb 2009 00:00:00 +1300

set ip_forward to 1 to enable routing between nics. type ‘route’ to insure both networks are routed as expected (connected route added with nic)

Setup a script with the following (CHMOD 0755 the script so it executes)

iptables -F (clears previous iptables stuff) iptables -P INPUT DROP (will set default policy to DROP all INPUT packets - Incoming to local NICs) iptables -P OUTPUT DROP (will set default policy to DROP all OUTPUT packets - Outgoing to local NICs) iptables -P FORWARD DROP (will set default policy to DROP all FORWARDed packets - Routed via local NICs)

Windows - Port forwarding

Thu, 19 Feb 2009 00:00:00 +1300

Just wanted to note here that there is a tool for windows to ‘port forward’ Its a command MS ships that enables IPv6 to work on IPv4, but can be used as a port redirector…. so as long as you have IPv6 support on your box, you can do this.

syntax as follows;

netsh interface portproxy add v4tov4 listenport=443 connectaddress=targetmachine connectport=3389

so the machine above listens on 443 and redirects traffic to 3389 on targetmachine.

OpenSolaris cifs/smb server - configuring ACL’s on shares - Part 2

Sun, 15 Feb 2009 00:00:00 +1300

I have done most of the explaining in another post on how the permissions work with a zfs cifs share - link here.

In this post I’m going to show an example of how to add multiple groups / users to a specific folder. Which then recursively adds its ACL’’s to any child objects. Its essentially like the other commands i used, but with an extra line per user or group you want to configure;

OpenSolaris cifs/smb server - configuring ACL's on shares

Sat, 14 Feb 2009 00:00:00 +1300

O.k. from this point I’m assuming you have created your zfs shares via the zfs command and renamed appropriately like so….. (if you havent setup cifs yet then check read this)

zfs set sharesmb=on protected/backup

zfs set sharesmb=name=backup protected/backup

Now to check your current shares type…

sharemgr show

zfs

zfs/protected/backup backup=/protected/backup

zfs/protected/photos photos=/protected/photos

Now its time to look at NFSv4 ACL’s. This page has a great explanation of ACL’s and how to set things up. http://cuddletech.com/blog/pivot/entry.php?id=939

OpenSolaris - Migrating from samba to cifs

Fri, 13 Feb 2009 00:00:00 +1300

OpenSolaris 2008.11 has a cifs/smb server built into the kernel. From what i have been reading (and discovering) this is a much more efficient and faster way to get your files out into the network.

Previously i have run a dedicated samba service to share my files as I’ve come from various linux distros which require it. Seems i should be doing things differently on OpenSolaris.

The dedicated samba service is called;

OpenSolaris - RTL8111/8168B issues

Thu, 12 Feb 2009 00:00:00 +1300

I’ve got an integrated RTL8111 nic which seemed to work fine under opensolaris 2008.11. But if the nic was put under load for a various length of time it seemed to just drop off the network.

At first i thought it was my SMB service dying, but after a quick ping i relised i had lost the entire TCP/IP stack on that particular card. Hmm…

It does come back online if you are patient and wait for about 5mins or so.

Linux - Add DHCP and DNS

Wed, 11 Feb 2009 00:00:00 +1300

How to install DHCP and DNS on Fedora / Centos / Redhat box;

yum -y install dhcp.i386 bind.i386

Set services to auto start using ntsysv – services are called “dhcpd” and “named”.

How to configure dhcp;

nano /etc/dhcpd.conf — configure as per sample provided. The sample is usually located in the same directory. service dhcpd restart - should start without problem if done correctly

Note: dhcp range has to be on the same network as your adapter. You can run dhcpd from the command line to diagnose any issues.

OpenSolaris - Manual Network DNS issue

Wed, 11 Feb 2009 00:00:00 +1300

If you have tried to setup a manual IP on your opensolaris box you may find that DNS is not working as you would expect in some cases. nslookup resolves the name to an ip, but pinging doesnt make it to the box…

How to fix;

Edit your /etc/nsswitch.conf file and add the word “dns” to the hosts and ipnodes lines If you make a backup of /etc/nsswitch.conf you can also just copy /etc/nsswitch.dns over it…

Linux - Wireless networking

Tue, 10 Feb 2009 00:00:00 +1300

if your card is natively supported type ;

iwconfig

iwlist scanning – should also show you the wireless networks that are in range (will work if driver is loaded)

you should see wlan0 if all is good; (grab your wireless details)

iwconfig wlan0 mode managed (should already be in this mode)

there are some cool options here like “secondary” mode which the node acts as a backup master/repeater. “Repeater” - the node forwards packets between other wire-less nodes

Corporate Firewall - SSH and port 443 goodness

Sun, 08 Feb 2009 00:00:00 +1300

Things you’ll need; (basic instructions) SSH - either Linux or Open SSH for windows (set this up first and ensure its working!). I have only used Linux, so i do not know the details of setting up a Open SSH box on windows (good luck).

Router with pinhole or port forwarding abilities. – forward your external 443 port to internal 22 on your SSH box

Putty.exe - use this to test your SSH connection locally (you should be able to connect on port 22 locally or 443 externally)

Remotely Enable Remote Desktop

Thu, 05 Feb 2009 00:00:00 +1300

I work in a lab environment, so most of the windows XP machines i enable remote desktop for easy access. All new machines have remote desktop enabled via group policy.

The GP is located here; (link were appropriate in AD structure)

Computer Configuration, Administrative Templates, Windows Components, Terminal Services, – > Allows users to connect remotely using Terminal Services setting. Enable this.

If you don’t have a domain or don’t have group policy implemented you can still enable remote desktop via the reg command in XP. Here is an example;

Cisco - Switch Reference

Tue, 03 Feb 2009 00:00:00 +1300

Setting up a trunk between switches

Enable Switch to enable mode Configure Terminal Enter global configuration mode

Interface FastEthernet0/1 Entering interface configuration for port 0/1. This is where you pick the port you want to trunk.

Switchport mode trunk Set port to trunking mode.

Switchport trunk encapsulation dot1q Set trunk type to 802.1q. If your switch only supports either ISL or 802.1q, this command does not exist because there is nothing to specify. This command only works when you can choose between the two.

Linux - mapping to a windows share (SMB)

Tue, 03 Feb 2009 00:00:00 +1300

As per below. First you will need to install samba client.

In Fedora / Centos …

yum -y samba-client

then use the mount command to mount the share to a directory…

mount -t cifs -n //192.168.9.70/software /mnt/sharename -o username=guest,password=

It will be similar in other distros. Remember to create the /mnt/sharename directory before trying to mount any share to the directory. Directories are created like so;

mkdir /mnt/sharename