Tuesday, 22 November 2011
Sysprep and Renaming a VM on VMware
Tuesday, 1 March 2011
Copy files between Cisco routers
ip tftp source-interface dialer1
(dialer1 being the external interface the external TFTP client will be grabbing the file from)
tftp-server flash:/yourfilename 24
(Where 24 is the access list with the IP of the remote TFTP client)
From the other router (this will act as the TFTP client):
copy tftp flash
enter remote router IP
enter source filename as /yourfilename
Sunday, 20 February 2011
Virtual Machine Resource Usage Notes
Not enough guest memory leads to high disk utilisation and poor performance
This is by far the most important resource for a virtual machine. You should never let the VM exceed its assigned physical memory otherwise performance of the VM in question, and also potentially other VMs sharing the same physical disk, will grind to a halt. I've noticed that if the guest VM starts to use virtual memory the physical disk utilisation on the host machine shoots up. The VM will max out the disk utilisation, starving any other VMs from timely read/write access to the disk.
Heavy disk utilisation outside of the VMs causes poor VM performance
If you carry out disk read/write operations outside of the VM environment, e.g. copying VMs to/from the disk your VMs are on in a Windows box running VMware Server, this can seriously affect the performance of the VMs on that disk. This is because a copy operation between 2 disks on the host system can grab the full bandwidth available between physical disks on the controller. Server 2008 resource monitor shows this quite nicely - go to the 'Disk' tab and expand the 'Disk Activity' section and look for the files you're copying. If you're copying between disks on the same system you might see read/write numbers in the region of 80,000,000 - 80MB a sec, which on my system is pretty close to the realistic full throughput the controller & disks can support. If this is affecting performance you can confirm by checking in the 'Storage' section and seeing the 'Disk Queue' value for your disk. I find this doesn't affect performance too much until it goes above 5-ish, once it gets to 10+ the VMs start to slow noticeably.
Too little memory and too much contention for access to the disk for multiple VMs
This is a nightmare scenario for VMs and when it happens the VMs will grind to a halt, sometimes event the host machine too, depending on where you store your VMs. If more than one of your VMs maxs out its physical mem and so starts to use virtual memory, both machines will be contending for very high read/write disk utilisation. This might be sustainable in the short term if it was just one machine but more than one then the contention for access to the disk kills the VMs.
Suggestions for a usable virtualisation setup
First and foremost, enough physical memory assigned per VM that the VMs never go above it
A maximum of 2-3 VMs per core seems to provide adequate performance, e.g. 6 VMs on a dual core runs ok, and 8 on a quad runs ok.
6-8 VMs per SATA 7200rpm disk seems to run ok, as long as that disk is only for those VMs, and any ISOs used by the VMs are on a separate disk.
Run your VMs on a dedicated disk - don't share this with anything else, especially the OS!
Avoid copy operations to/from the physical disk the VMs are on while the VMs are busy.
These notes relate specifically to a lab environment, where occasional performance degradation isn't a major problem. For an operational environment you should really be using an enterprise class virtualisation product such as VMware ESX & VMotion or similar and a SAN. That said, the same ideas discussed here apply in an operational enterprise setup.
Friday, 21 January 2011
Troubleshooting IPSec site to site VPN tunnels on Cisco
Check the peer IP addresses are the correct far end peer IP address:
on Cisco routers check
crypto map ipsectunnels 10 ipsec-isakmp
set peer
and
crypto isakmp key ****** address
On Cisco firewalls check
and
Check the IPsec transform sets match:
on Cisco routers check
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
NB: In the line above, 'ESP-3DES-SHA' is the name of the transform set you have created by using this command, and 'esp-3des esp-sha-hmac' are the actual ipsec methods allowed in the named transform set you have created. You later assign 'ESP-3DES-SHA' to a crypto map (see below)
and
crypto map ipsectunnels 10 ipsec-isakmp
set transform-set ESP-3DES-SHA
On Cisco firewalls check
and
Check the ISAKMP policies match:
on Cisco routers check
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
On Cisco firewalls check
Re-enter the shared-secret (to make sure it isnt a typo):
on Cisco routers check
crypto isakmp key ****** address
On Cisco firewalls check
and
NB: On Cisco firewalls, the shared-secret is blanked out with **** when you do a normal show run. Make sure you don't just copy the ***
Check the crypto map is correct and matches the far end:
on Cisco routers check
crypto map ipsectunnels 10 ipsec-isakmp
set peer
set security-association lifetime seconds 86400
set transform-set ESP-3DES-SHA
match address 155
In the above, note the match address 155 - this references an access-list, make sure the access lists, both full source and destination IP range AND subnet mask, match EXACTLY for both ends of the tunnel.
and
crypto map ipsectunnels
The above should be applied to the outbound interface of the router where packets should be encrypted - on an ADSL router this would be the dialer interface that has the public IP (assuming its a public ADSL line).
On Cisco firewalls check
and
If that is all ok, check the status of the tunnels:
Router#show crypto ipsec sa
Router#show crypto isakmp sa
Do an extended ping to force traffic down the tunnels in case your expected traffic isn't making it to the tunnel for some reason
Finnaly, have a look at the debug:
Router#debug crypto ipsec
Router#debug crypto isakmp
Monday, 17 January 2011
No debugging output seen on a terminal session
You can see what logging levels are set by using the show log command. Look for the Console logging: and Monitor logging: lines. If it does not say level debugging then you wont see any debug output for that output type.
To enable debug level output for the monitor, type:
Router(config)#logging monitor debug
The just enter
Router#term mon
and you should start seeing the debugging output (assuming you have turned debugging on for something!)
Thursday, 13 January 2011
Cisco IOS Naming Conventions (12.4)
The non 'T' train of 12.4 is there to provide the most stable releases. Maintenance deployment (MD) releases of 12.4 (non 'T') are the MD of the 12.3T train. This implies these are the most stable releases available. New releases constitute mostly software fixes
The 'T' train of 12.4 is there to provide new releases with the latest feature and hardware support. Early Deployment (ED) releases of 12.4T introduce new functionality that is not available in the 12.4 train. They also receive software fixes. There will be the occasional MD release of 12.4T
The release number (digits that follow 12.4, e.g. 12.4.xx) are unique across both 12.4 and 12.4T, e.g. 12.4.10a -> 12.4.11T1 -> 12.4.12a -> 12.4.12b -> 12.4.13T1
The rebuild letter follows the release number in the 12.4 train, e.g. 12.4.10b denotes the second rebuild of 12.4.10
The rebuild number follows the release number in the 12.4T train, e.g. 12.4.13T4 denotes the 4th rebuild of 12.4.13T4
In 12.4, 'Releases' include mostly software fixes, and occasionally minimal new feature support and minimal additional hardware support
In 12.4T, 'Releases' include software fixes, new features and additional hardware support
The rebuild designation (a letter for 12.4 and a number for 12.4T) shows that there has been a rebuild of the software to improve stability. The criteria on what changes are made in a rebuild are very strict.
In summary, choose a 12.4 (MD) with the highest release and rebuild letter for the most stable release available and choose 12.4T (ED) with the highest release and rebuild number for the IOS with the latest features and hardware support.
For full details of the IOS naming conventions, see the following link:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Wednesday, 12 January 2011
Debugging Cisco ADSL
debug atm events
to see the atm training process. This should show a detailed output as the atm interface comes up
Use
debug ppp auth
to view the dialer auth process. It should be clear from the output if the username/pass is bad
Use
sh dsl int atm0
to view detailed info on the DSL interface atm0. Look out for a very low (close to 1dB) or negative Noise Margin. This is difference between the maximum acceptable noise for ADSL profile assigned by the carrier and the actual noise on the line. The number shown is the actual noise subtracted from the maximum acceptable noise, so a positive number is good.
Friday, 7 January 2011
Some handy notes on Cisco IOS commands for Serial interface debugging
and
Router#debug serial event
and obviously...
Router#term mon
...if you're not on the console.
These will show the progress of the interface going up/down and the packet sequence between the router and the carriers NTE.
Some example debug messages you may see:
Jan 7 14:02:30: Serial0/1/0(out): StEnq, myseq 1, yourseen 0, DTE down
This line above represents the router sending a message to the NTE '...(out)...' and that the message is number 1 in the sequence '...myseq 1...' and that it has received zero messages back from the NTE '...yourseen 0...' and that it thinks the NTE is down '...DTE down'. The yourseen field will only increment when the router starts to receive packets from the carrier NTE.
Jan 7 14:24:29: Serial0/1/0(out): StEnq, myseq 209, yourseen 207, DTE up
Jan 7 14:24:29: Serial0/1/0(in): Status, myseq 209, pak size 14
Jan 7 14:24:39: Serial0/1/0(out): StEnq, myseq 210, yourseen 208, DTE up
Jan 7 14:24:39: Serial0/1/0(in): Status, myseq 210, pak size 14
The lines above show the normal output to expect when you enable debug serial event. You can see there is inbound and outbound traffic, and both the sent (myseq) and received (yourseen) packet counts are incrementing.
Finally, check out the following pages on the Cisco website for really detailed debugging info various serial interface types:
http://www.cisco.com/en/US/docs/internetworking/troubleshooting/guide/tr1915.html
http://www.cisco.com/en/US/tech/tk713/tk628/technologies_tech_note09186a00800a758d.shtml
Thursday, 6 January 2011
Editing access lists line by line on Cisco routers
Router#conf t
Router(config)#ip access-list ext
Now you are in access list editing mode. To get a quick look at your access lists:
Router(config-ext-nacl)#do show access-list
Output will look similar to the following:
10 permit tcp any host 192.168.1.1 established log
20 permit udp any host 192.168.1.1
30 permit ip host 10.10.10.10 host 192.168.250.250
Note the numbers next to each line for each access list. To remove one of the lines on your access list just type:
Router(config-ext-nacl)#no
You can also add a line to your access list. To insert a line between lines 20 and 30 above, just start your new line with 25 (or any other number between 20 and 30):
Router(config-ext-nacl)#25 permit udp any host 192.168.200.100
BT Business Broadband with Cisco 877 and first ping is dropped on Cisco 877 ADSL
The connection came with 5 useable public IPs which is really handy, however due to the weird way BT actually assign the IP addresses to the dialer interface, you can't just leave this on negotiate and expect it to get the IP address BT have assigned to the router. If you do you get a dynamic IP from BT which is a pain.
To work around this you need to create a loopback interface, e.g. loopback0, and configure this with your allocated IP range, e.g.:
interface loopback0
ip address 80.12.34.56 255.255.255.248
You then need to assign this loopback to the dialer interface:
interface dialer1
ip unnumbered loopback0
You also need to remember to NAT traffic using the IP address of the loopback0:
ip nat inside source list 10 interface loopback0 overload
That all seems to work pretty nicely however I did run into a problem where if I ping a public IP from the router itself or an attached client PC, the first ping is dropped. This is because the router is doing an ARP request on the public interface to try and find who has the public IP you are pinging, an while this is happening the first ping is dropped. To get round this you need to configure the following on the dialer interface:
no ip proxy-arp
This resolved my issue where the first packet was dropped when talking to any 'new' public IP. The issue also manifested itself as webpages taking a couple of extra seconds before the page started loading.
IP Phone (Mitel) drops traffic when the connected PC changes its network card speed
This is caused by the PC changing the NIC speed during bootup from 100Mbps to 10Mbps, which in turn causes the Mitel 5220 handset to change its network speed from 100Mbps to 10Mbps, and during this change voice packets are dropped (the user experiences silence).
On the Lenovo PC in question this issue can be resolved by either setting 'Shutdown Wake-on-LAN' to disabled in the properties of the network card on the Advanced tab, or by changing the 'WOL & Shutdown Link Speed' setting to 100Mbps (default is 10Mbps).
You can demonstrate the same issue by connecting any PC with a 10/100 NIC to the back of the Mitel 5220 phone and within Windows manually setting the speed of the network card to 10Mb. Obviously you need to be in a phone call on the Mitel handset at the time to notice the 2 second silence.
Wednesday, 28 July 2010
Excel file size much larger than the contents
In this instance I was using Excel 2007 and saving the doc as an Excel 97-2003 Workbook.
After some Googling I tried the following fixes, the last of which solved my problem:
Inspect the document
Prepare > Inspect Document > Inspect
This shows a list of hidden content including rows, columns and worksheets and if it find any, allows you to delete them.
Force everything on a sheet to be deleted
Press ctrl-a, right click anywhere in the selected worksheet and click 'Delete'
This was overkill for what I was trying to do as I needed to keep the content I could actually see, but it was really useful to go through a copy of my dodgy spreadsheet and clear every tab and once done the file was still huge, so there was still work to do...
Manually delete components in the file
Warning, this may destroy your data so make sure you have a backup of the file first!!!
Save the spreadsheet as an .xslx file. Rename the extension to .zip. Open the file in WinZIP. Look for an xl\externalLinks folder and delete any files in this. Close WinZIP and rename file back to .xlsx, open in Excel and allow Excel to repair the file.
This is great as it shows you exactly where bulky data is stored in the file. In my case WinZIP showed the xl\externalLinks folder contained some bulky data. I dropped one of the .XML files into Notepad and could immediately see that it the entire contents of a Cisco pricelist I'd pasted some content from! I would have only pasted a couple lines from this other spreadsheet so Excel must have brought the whole lot across for an unknown reason but decided not to acknowledge this anywhere. Once I delete the files in the xl\externalLinks folder and saved it as per my instructions above my file was back to a sensible size.
Saturday, 29 May 2010
Changing the IP address in CUCM 7.02
Environment Overview
CUCM version 7.02 running as a virtual machine on VMware Server 2.0. The virtual machine was moved to a different VMware server and subnet.
1) On the new VMware host server in VMware Infrastructure Web Access, go to the settings for the CUCM guest and change the network adapter connection to vmnet1 (hostonly)
2) On the VMware host server change the IP address and subnet of the vmnet1 network adapter to an IP address in the same subnet as the existing IP address of the CUCM. You don't need to set a default gateway on the network adapter.
3) Log into the CUCM via the CLI (I used the VMware Console to access the CLI) and change the default gateway to the new default gateway you want to use using the following command:
set network gateway gateway_ipaddress


The CUCM should now reboot.
6) Back on the the VMware host server in WMware Infrastructure Web Access, go to the settings for the CUCM guest and change the network connection back to vmnet0 (bridged).
7) Once the CUCM has rebooted you should now be able to access it via the new IP address. You can check the IP address has change via the CLI using the following command:
show tech network hosts
Wednesday, 31 March 2010
My Other Lab Location
While sporadically building my home lab setup (which has been mainly for my own personal development) I've also been adding to a lab I have setup at my workplace. I've had this lab in place since around 2007 for testing LCS 2005, OCS 2007 and OCS 2007 R2 integration with Mitel, Avaya and Cisco PBXs.
Summary of what the lab has done/can do, by PBX manufacturer:
Mitel 3300
OCS 2007 and OCS 2007 R2 Remote Call Control via Mitel Live Business Gateway (Linux and Windows versions)
Exchange 2007 UM for Mitel handsets homed on the Mitel 3300
Cisco Unified Call Manager (CUCM)
CUCIMOC integration with MOC on OCS 2007 (CUCM 7.0.2)
Interesting blog entries for CUCIMOC:
http://blog.misthos.com/2009/07/cisco-cucimoc.html
http://blog.misthos.com/2009/08/cisco-cucimoc-features.html
Exchange 2007 UM for Cisco handsets homed on the Cisco CUCM (CUCM 6.1.5)
Microsoft guide to configuring CUCM for Exchange 2007 UM:
http://www.microsoft.com/downloads/details.aspx?FamilyID=68B43D3C-7C84-4C2F-BFD7-98754970D70E&displaylang=en&displaylang=en
Avaya Communications Manager
OCS 2007 Remote Call Control via Avaya AES server
Avaya Softphone integration with MOC on OCS 2007
OCS 2007 R2 Documentation and Setup
There isn't much point in going into too much detail on the OCS install as it is relatively straightforward AS LONG AS YOU FOLLOW THE DOCUMENTATION!
I've setup a number of LCS, OCS07 and OCS07 R2 implementations in the past and the one thing that is critical is to follow the step by step docs from Microsoft if you want a functional setup. If you attempt a Next, Next, Finish approach then it will only take up more time in the future as you have to fiddle around trying to fix things.
Anyway, preaching over, click this link for the Microsoft documentation pack for Office Communications Server 2007 R2, updated Dec 2009.
http://www.microsoft.com/downloads/details.aspx?familyid=E9F86F96-AA09-4DCA-9088-F64B4F01C703&displaylang=en
Communications_Server_2007_R2_Documentation.zip contains the whole doc pack in one zip file.
Saturday, 19 December 2009
Troubleshooting a dodgy PSU and finally building the servers
My initial thought was that it could be memory related so I swapped this out but the issue continued. One thing that was notable was the fact that the issue would go away if the PC was powered off for 5 minutes +, which made me think it could be something overheating - I checked the CPU and GPU coolers and these were fine. The 'something overheating' analysis also fitted in with the PC powering off after playing Bioshock for a while as this game is pretty demanding on the PC.
In the end I narrowed it down to the PSU - I took out the graphics card and used the onboard VGA to rebuild the PC on a spare HDD and it powered off and on again during the XP setup. I still had the old factory fitted Dell PSU so swapped out the OCZ 600W PSU for this and started XP installing again and it didn't power off again - bingo! Just got to ship the PSU back to Ebuyer for an RMA now.
Back to the original task...
The 2x2Gb mem arrived and I made the schoolboy error of forgetting the 4Gb limit on XP 32bit, so I rebuilt the PC with XP 64bit and it happily recognised the 4Gb and made all of it available. I also installed a second HDD I had spare with the aim of using this as the VM drive. I installed VMware Server 2.0 and built a DC with Windows Server 2008 64bit. The lab at this point consisted of a single server with the following spec:
- Windows Server 2008 64bit SP1
- Active Directory
- DNS (AD integrated)
- 1Gb RAM initially, reduced to 512Mb to free up mem for the other servers
- Single CPU core
I built the DC in the normal way - added the AD role then ran DCPROMO.
I decided that all VMs should only use a single core so to leave some processing power for the OS so the PC is still usable - may be flawed logic so I need to check this out in more detail.
Once the DC was fully updated and activated I started another Server 2008 64bit build - this next VM was to be Exchange 2007. This time however, after applying updates but before setting a static IP and joining to the domain, I shut down the VM and took a copy of the folder containing all the VM files. My plan was to use sysprep to reset the SID, etc on the VM to make provisioning of VMs quicker - I'll talk about this in the next post.
Saturday, 5 December 2009
Home Lab Setup
Soo, I've decided to build my own lab at home...
Home Lab Infrastructure Build
The brief for the lab is pretty straight forward:
- Be able to run 32- and 64-bit guest OS (OCS 2007 R2 - all roles, Exchange 2007 and 2010)
- Low power consumption so I can have it running 24/7 and not be killing too many polar bears
- With the above in mind, as many spindles as possible per host machine
- As much RAM as poss per host machine
- As cheap as possible
- Windows Server 2008 Hyper-V - Nope, would mean having to run Server 2008 as the host OS - not ideal for gaming
- VMware ESXi - Nope, can't use the box for anything else
- VMware Server - Yep, can continue to use the box for gaming and stuff
The Dell E520 has the following spec at the mo:
- Intel Core 2 1.86GHz 6300XFX GeForce 9800 GT (yep, not really critical for a virtual machine host)
- OCZ StealthXStream 600W PSU (had to get this for the graphics card)
- Hitachi DeskStar 7K160 7,200 RPM 160Gb SATA HDD
4Gb (2x2Gb) Crucial DDR2 800MHz PC-6400 Ballistix CL4 2.0V http://www.ebuyer.com/product/143844
Once this is up and running and I have a few VMs live I plan to benchmark the power consumption with an energy monitor similar to this: http://www.maplin.co.uk/Module.aspx?moduleno=38343
Based on the results of this I can work out if it will be more cost effective to rip out the 600W PSU and GeForce 9800 GT and put this into a new gaming machine and run the E520 purely as a virtualisation platform.

