Archive for the ‘Networking & Security’ Category

When experimenting with Cisco routers, it’s very nice to have a (small) lab environment to test things. Unfortunately, Cisco routers tend to be fairly expensive and noisy, especially if you need 5 or more of them. So I was looking for a cheaper and more flexible solution.

Dynamips is a Cisco router emulator which loads an official Cisco IOS-image and runs it on emulated hardware. It started out as an emulation of 7200 routers only, but now supports 3600 and 2600 series as well.

When you want more than a single router, you’ll need dynagen as well. Dynagen connects to a running dynamips instance and does some magic to get the (emulated) ethernet-ports connected to wherever you specify. The network-topology is created using plain text files. While this seems scary at first, the excellent tutorial covers every frequently used scenario.

Both tools are Open Source software and run on Linux and Windows (although it needs cygwin and doesn’t run as stable). The only catch is that you need real Cisco IOS images. The cisco.com site provides downloads only to selected users. Another way to get them is to copy them from a real router.

Continue reading ‘Emulating a router: dynamips’ »

One of the things I like about Vim is its support for syntax highlighting and folding. Especially when reviewing or editing config-files, the coloring is a true relieve. (Yes, I am aware that emacs can do this much better, nicer, easier and with a lot more Meta-Control sequences.)

Googling for a syntax file which would color the Cisco configuration files for me didn’t get me very far. So I decided to run my own. Here is the result:

(Public IPs in the screenshot are masked by 0’s)

Continue reading ‘Cisco config syntax highlighting in Gvim’ »

When configuring a bunch of devices (switches, routers or even computers), most of the configuration will be identical. The Konsole program of KDE has a nice feature which sends the keyboard input to all open tabs. By simply telnet-ing or ssh-ing into the devices and activating this feature, I can quickly configure them all at once.

At work, using my Windows laptop, I have been looking for a feature like this. After some googling I found PuttyCS. It’s a standalone application which emulates this behaviour: It sends emulated keypresses to all (or a subset of) open putty sessions.

Configuring 8 blade-switches with PuttyCS is a breeze: just open all the putty sessions and start typing in PuttyCS!

To deal with loops in switched networks, the Spanning Tree Protocol was developed. For a description of how STP works, see the Wikipedia page on the subject; in short, it disables certain ports on certain switches to break loops. So far so good.

When using VLANs, there are several alternatives:

  • Use a Common Spanning Tree: i.e. use the same topology for all VLANs.
  • Use Per Vlan Spanning Tree: i.e. run a separate STP instance for each VLAN.
  • Use Multiple Spanning Tree: This is the IEEE standard and is a compromise.

In MST, VLANs can be mapped to instances. All VLANs mapped to the same instance share the same Spanning Tree. This allows some flexibility by using multiple instances, without the CPU problems of running a single instance for each and every VLAN.

Now consider the following situation:

This diagram uses only 2 VLANs: a data VLAN, drawn in blue, and a management VLAN, in red. The data VLAN is used to connect the Left and Right switch together, along with the attached servers. The management VLAN is only used to manage the switches.

When implementing this on Cisco switches (I tried it on Catalyst 3750s), everything works as expected. The two servers can talk to each other, both switches are manageable.

When implementing this on HP ProCurve switches (I tried it on 5400s, 2610s and 2810s), this does not work: Depending on the MAC-addresses of the switches, either the servers cannot talk to each other or one of both switches is disconnected from the management station…

Continue reading ‘HP ProCurve: MST misbehaves’ »