Today I would like to take note on blog about curl command line tool that allow to send and receive data from servers using URL and for scripts automation too.
It supports various internet protocols like http, https, ftp, ftps, scp, sftp.
Is used for file download, testing and website checking
curl -vvv https://www.google.it
Curl -vvv https://website User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
curl man page
These are ping and windows commands to show network interfaces and change packet size
ping -t app.livewebinar.com -f -l 1400
netsh interface ipv4 show interface
netsh interface ipv4 set subinterface <ID> mtu=1360 store=persistent
On Cisco switches you can review single port configuration
show running-config interface Gi4/0/13
In case you would like to reset single port configuration:
Config t
default interface GigabitEthernet 4/0/13
We faced, on several Cisco switches, this warning:
Mar 8 11:11:52.680: %PKI-4-TRUSTPOOL_EXPIRATION_WARNING: The Trustpool will expire in 20 days
Mar 8 11:11:52.680: %PKI-4-TRUSTPOOL_AUTO_UPDATE_DISABLED: Auto-trustpool update is disabled.
In Cisco IOS XE version 17.12.04, the auto-update feature for the PKI trustpool is enabled by default. This means the device will automatically download and update the trustpool bundle from Cisco's servers when necessary.
When the PKI trustpool is due
for an update—due to reasons like certificate expiration, reissuance, or the
addition of new trusted certificates—the system will:Cisco
This process ensures that the
device maintains an up-to-date set of trusted root certificates, which is
crucial for secure operations like HTTPS, VPNs, and Smart Licensing.
unfortunately, in our case, this configuration command was missing
crypto pki trustpool policy
cabundle url http://www.cisco.com/security/pki/trs/ios.p7b
revocation-check none
to manual import certificate you must launch, through config t, this command:
crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b
to avoid problems we launched this
to view certificate status this is command
show crypto pki trustpool policy
[other articles]
https://community.cisco.com/t5/switching/trustpool-expiration-on-3750-x/m-p/2423362#M286822
Other than using telnet with this syntax (it is required to install Telnet Client on device using add/remove program or alternative ways)
telnet IP/hostname port_number
telnet 192.168.100.2 443
otherwise you can utilize powershell too with this syntax
PS C:\> Test-NetConnection
or PS C:\> tnc
Example 1: Test ping connectivity
PS C:\> Test-NetConnection
Example 2: Test ping connectivity with detailed results
PS C:\> Test-NetConnection -Port 80 -InformationLevel "Detailed"
Example 3: Test TCP connectivity and display detailed results
PS C:\> Test-NetConnection -ComputerName ayampenyet.com -Port 443
Example 6: Perform route diagnostics to connect to a remote host with routing constraints
PS C:\> Test-NetConnection -ComputerName "www.contoso.com" -ConstrainInterface 5 -DiagnoseRouting -InformationLevel "Detailed"
more examples coud be found here
Here they are commands that are required to, on a Router/L3 Switch, enable DHCP service.
There are other settings but, this example, simple give you a general idea:
Switch# config t
Switch(config)#
Switch(config)# ip dhcp pool description_or_vlan_name
Switch(config-dhcp)# network lower_vlan_ip subnet
Switch(config-dhcp)# domain-name domain name
Switch(config-dhcp)# dns-server dns_server_1 dns_server_2
Switch(config-dhcp)# default-router default_gateway_ip
Switch(config-dhcp)# ip dhcp excluded-address lower_vlan_ip_range upper_vlan_ip_range
Switch(config-dhcp)# ip dhcp excluded-address lower_vlan_ip_range upper_vlan_ip_range
related articles:
I am taking note, on blog, about an interesting article that explain several ways used to limit bandwitch usage during file transfer.
From my side, GPO, related to QoS was decisevely useful.
https://woshub.com/limit-network-file-transfer-speed-windows/
On Cisco Network devices you could have necessity to show running configuration withouth breaks/pauses:
switches/router:
show terminal | in Length
terminal length 0
show run
show run brief
WLC
config paging disable
show run-config" to display the config.
Cisco ASA
Pager (saved)
terminal pager (telnet session not saved)
The default is 24 lines; 0 means no page limit.
1. Type "pager 0" in priviledged mode to set your terminal to display without any breaks.
2. Type "show run-config" to display the config.
3. Type "pager 20" in priviledged mode to set your terminal to display with breaks every 20 lines.
full article:
I am taking note on blog about websites and open ports necessary, sophos side, to work properly.
On old blog article I already mentioned several monitoring/security tools
I am highlighting Kiwi Syslog Server that permit to:
Freeware - SolarWinds All Free Network/System/Security/DB/clients monitoring tools
<==============>
About configuring Kiwi Syslog on Cisco devices, here it is a small guide/tutorial
Kiwi Syslog Server Getting Started Guide
About configuring Syslog, on Cisco ASA, you can review this guide:
ASA Syslog Configuration Example
<==============>
At the same time I would like to mention that PRTG (free up to 100 sensors) has possibility to use sensor acting as syslog server
https://www.solarwinds.com/kiwi-syslog-server/use-cases/network-troubleshooting
Here they are old PRTG blog articles
Server - PRTG Network Monitor Tool
Monitoring - PRTG monitors freeware version until 100 sensors
Here it is a basic article related to Radius protocol, I am taking note, on blog, for future purposes and, in case, it would be useful for seomeone
https://techgenix.com/radius-protocol-authentication-management-guide/
Here they are HowToForge tutorials related to Wireshark.
I am taking note on blog and share it in case for someone might be useful.
Overview of the Wireshark User Interface (GUI)
https://www.howtoforge.com/overview-of-wireshark-user-interface-gui/
How to use Wireshark for capturing and analyzing network packets
https://www.howtoforge.com/how-to-use-wireshark-for-capturing-and-analysing-packets/
Wireshark Remote Capturing
https://www.howtoforge.com/wireshark-remote-capturing
There are several ways on how backup Cisco switches (or other vendors name) can be done.
One of them is downloading TFTP client server
https://tftp.en.uptodown.com/windows
Launching it and deciding where saving configuration files.
Be aware taking note about client IP.
Later you need to connect to switches using any SSH clients (I warmly suggest using these clients:
https://www.alessandromazzanti.com/2018/11/freeware-solarwinds-software-free-tools.html
and execute below commands on switches:
Router#copy running-config tftp:
Address or name of remote host []? 64.104.207.171
Destination filename [ce_2-confg]? backup_cfg_for_my_router
!!
1030 bytes copied in 2.489 secs (395 bytes/sec)
CE_2#
Where:[original article]
Using Cisco Any Connect with AD users you may face that you account password is expired and you are unable to connect. To override problem you need to configure Cisco ASA to authenticate, to DC, indeed with normal LDAP standards (over 389 TCP port) using LDAPS (636 TCP port).
Your AD server must be able to authenticate via LDAPS (normally is not configured)
Here it is an article that explain how to do that
https://www.petenetlive.com/KB/Article/0001273
About LDAPS you can give a look to below article to have a major idea:
https://www.petenetlive.com/KB/Article/0000962
P.S. 1 for LDAP(s) testing purposes you can use ldp.exe DC utility Open utility:
C:\> ldp.exe
From Connection, select Connect.
Enter name of target domain controller.
Enter 636 as port number (this is the LDAPS port).
Click OK to confirm the connection works.
You're all done!
P.S. 2 consider that Citrix Netscaler requires LDAPs to permit users to change password when it is expired (otherwise user is blocked)
During these months we worked on Network redisign project and ESX server substitution.
We had two projects convergence due to entirely infrastructure renewal (making zero point for our company).
About DHCP relay, that is the ability to lease IP to different VLANs here it the theoretically and operative part:
Here it is a simple and straight article that guide you through SNMP custom community configuration on Cisco SF200 and other models like (Cisco Small Business devices)