寫寫筆記

公司新買的Juniper EX2200一直出現Alerm的告警，進到Web畫面後出現是Management Ethernet Down，查了一下解決方式 root@EX2200-2> show chassis alarms 1 alarms currently active Alarm time               Class  Description 2014-03-13 09:44:37 UTC  Major  Management Ethernet Link Down {master:0} root@EX2200-2> configure Entering configuration mode {master:0}[edit] root@EX2200-2# set chassis alarm management-ethernet link-down ignore {master:0}[edit] root@EX2200-2# commit configuration check succeeds commit complete {master:0}[edit] root@EX2200-2# exit Exiting configuration mode {master:0} root@EX2200-2> show chassis alarms No alarms currently active 參考資料

Brocade ICX6430 Switch 啟用 DHCP Snooping 假設我的DHCP Server接在24 Port，其他Port不允許有DHCP Server ICX6430-24 Switch> enable No password has been assigned yet... ICX6430-24 Switch# configure terminal ICX6430-24 Switch(config)# ip dhcp snooping vlan 1 ICX6430-24 Switch(config)# interface ethernet 1/1/24 ICX6430-24 Switch(config-if-e1000-1/1/24)# dhcp snooping trust 預設Spanning Tree是開啟的,我把Port 9與Port 11接成Loop ICX6430-24 Switch# show span STP instance owned by VLAN 1 Global STP (IEEE 802.1D) Parameters:      Root             Root Root   Prio Max He- Ho- Fwd Last    Chg Bridge       ID              Cost Port   rity Age llo ld  dly Chang   cnt Address                                   Hex  sec sec sec sec sec      8000cc4e2434dda0 0    Root ...

兩個Cisco 2950 Switch , 第一台與第二台的Port 1 與 Port 2 對連，設定EtherChannel 第一台Switch up# configure terminal Enter configuration commands, one per line.  End with CNTL/Z. up(config)# interface range fastEthernet 0/1 - 2 up(config-if-range)# no ip address up(config-if-range)# channel-group 1 mode desirable Creating a port-channel interface Port-channel 1 第二台Switch down# configure terminal Enter configuration commands, one per line.  End with CNTL/Z. down(config)# interface range fastEthernet 0/1 - 2 down(config-if-range)# no ip address down(config-if-range)# channel-group 1 mode desirable Creating a port-channel interface Port-channel 1 down(config-if-range)# 00:34:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down 00:34:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down 00:34:33: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up 00:34:...

啟動DHCP Snooping 假設我的DHCP Server接在24 Port，其他Port不允許有DHCP Server C3750(config)# ip dhcp snooping C3750(config)# ip dhcp snooping vlan 1 C3750(config)# interface gigabitEthernet 2/0/24 C3750(config-if)# ip dhcp snooping trust C3750(config-if)# do show ip dhcp snooping Switch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 1 DHCP snooping is operational on following VLANs: 1 DHCP snooping is configured on the following L3 Interfaces: Insertion of option 82 is enabled    circuit-id default format: vlan-mod-port    remote-id: 0016.9d99.3e80 (MAC) Option 82 on untrusted port is not allowed Verification of hwaddr field is enabled Verification of giaddr field is enabled DHCP snooping trust/rate is configured on the following Interfaces: Interface                  Trusted    Allow option    Rate limit (pps) -----------------------    -------   ...

沒用過HP的Switch，指令跟Cisco完全不同，花了一些時間熟悉~ 1.啟動Spanning-Tree，預設沒有開啟 (黑色粗體是我敲的指令) <HP> system-view System View: return to User View with Ctrl+Z. [HP] stp enable [HP] %Apr 26 12:03:59:826 2000 HP MSTP/6/MSTP_ENABLE: STP is now enabled on the device. %Apr 26 12:03:59:918 2000 HP MSTP/6/MSTP_FORWARDING: Instance 0's GigabitEthernet1/0/17 has been set to forwarding state. %Apr 26 12:04:00:068 2000 HP MSTP/6/MSTP_DETECTED_TC: Instance 0's GigabitEthernet1/0/17 detected a topology change. #Apr 26 12:04:00:208 2000 HP MSTP/1/PFWD: hwPortMstiStateForwarding: Instance 0's Port 0.9437200 has been set to forwarding state! 2.DHCP Snooping   (黑色粗體是我敲的指令) 假設我的DHCP Server接在24 Port，其他Port不允許有DHCP Server <HP> system-view System View: return to User View with Ctrl+Z. [HP] dhcp-snooping  DHCP Snooping is enabled. [HP] interface GigabitEthernet 1/0/24 [HP-GigabitEthernet1/0/24 ]dhcp-snooping trust 若是沒有Port 設成dhcp-snooping trust,那麼這台Switch就沒有Client可以從DHCP Serv...

先做一下記錄~ http://sysadmin.blog.51cto.com/83876/304152 http://blogat.centilin.com/everything_it/network/routing-and-switching/svi-vs-routed-ports/ http://packetlife.net/blog/2011/jan/24/convergence-delays-svi-vs-routed-interface/

CDP 1.CDP會有安全性的疑慮,建議非必要還是關掉! 2.Data Link Layer, Multicast S2950# show cdp neighbors Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge                   S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID Switch           Fas 0/8            145          S I      WS-C3750G- Gig 1/0/9 S2950# show cdp entry Switch ------------------------- Device ID: Switch Entry address(es):   IP address: 192.168.1.150 Platform: cisco WS-C3750G-24T,  Capabilities: Switch IGMP Interface: FastEthernet0/8,  Port ID (outgoing port): GigabitEthernet1/0/9 Holdtime : 131 sec Version : Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version 12.2(55)SE9, RELEASE SO     ...

手上的Cisco 2950 Switch設了密碼，猜了半天也進不去，重開後按Ctrl+Break也無反應，還在懷疑是不是線壞掉的時候，Google了一下.....原來Switch密碼還原和Router完全不同 1. 按住Switch上的Mode鍵，並將Switch開機 2.此時Switch會出現以下訊息，紅字為輸入的文字 C2950 Boot Loader (C2950-HBOOT-M) Version 12.1(11r)EA1, RELEASE SOFTWARE (fc1) Compiled Mon 22-Jul-02 18:57 by antonino WS-C2950-24 starting... Base ethernet MAC Address: 00:0a:8a:c0:52:80 Xmodem file system is available. The system has been interrupted prior to initializing the flash filesystem.  The following commands will initialize the flash filesystem, and finish loading the operating system software:     flash_init     load_helper     boot switch: flash_init Initializing Flash... flashfs[0]: 326 files, 5 directories flashfs[0]: 0 orphaned files, 0 orphaned directories flashfs[0]: Total bytes: 7741440 flashfs[0]: Bytes used: 5598208 flashfs[0]: Bytes available: 2143232 flashfs[0]: flashfs fsck took 8 seconds. ...done initializing...

剛裝好ESXi 5.1發現時間一直不對,後來找到這篇可以變更時間 http://communities.vmware.com/message/1989143 雖然我是用PC在測Vmware ESXi,不過效能怎麼會那麼差,點有想不透.... 只有跑Win2008與Win2003而已.....

環境如下: Tacacs的相關設定: 1. 請先確定Router可以Ping到Tacacs Server 2. 2811設定如下 RA(config)#aaa new-model RA(config)#aaa authentication enable default group tacacs+ local (若Tacacs Server連絡不到,則會改由Local Database做驗證) RA(config)#tacacs-server host 10.1.1.2 key cisco RA(config)#username ccna1 password cisco1 3. 再次登入後,則會詢問相關帳號,密碼 RA> RA>enable Username: Password: RA# 4. Telnet 改用Tacacs Server做驗證 RA(config)#aaa authentication login tt group tacacs+ local RA(config)#line vty 0 4 RA(config-line)#password ccaa RA(config-line)#login authentication tt

剛裝好的Windows Server 2008，在命令提示字元中，中文會顯示問號 進到控制台／地區及語言／系統管理，點選變更系統地區設定，把非Unicode程式的語言改為中文(繁體，台灣)，中文就會顯示正常！

IE 8大約16MB http://windows.microsoft.com/zh-TW/internet-explorer/downloads/ie IE 7大約14MB http://www.microsoft.com/zh-tw/download/details.aspx?id=2

原來Windows 8 上面有專用的管理工具，我目前正在安裝中，準備使用相關的功能! http://www.microsoft.com/zh-tw/download/details.aspx?id=28972

同事告知Windows AD的帳號被鎖住，我從Windows AD中解開被鎖住的帳號後，順便看了安全性稽核的Log，發現一堆User帳號被鎖住(如下圖) 解開被鎖住的一堆帳號後，還是陸續出現帳號被鎖住，於是我又點入該事件，看到有一個IP在搞鬼 找到搞鬼的電腦，在他的電腦輸入 Netstat -n，會發現他持續在掃網段的IP，而且Port 都是445(網路芳鄰)，我的解決方式如下： 1. Trend的iClean掃毒，結果問題仍然沒解 2. 安裝公司的Symantec Endpoint，結果有掃到病毒，掃瞄內容如下圖 在 Symantec的網站 可以看出他是利用Windows RPC的漏洞進行攻擊，而同事的電腦沒上更新，Firewall又是關閉狀態，才會中毒... 重開機後解決這個問題，再請使用者安裝SP3，再執行Windows Update......

同事詢問WinRAR的備份指令，需求如下: 1.從 C:\Program Files\tmp備份到D:\tmp 2.檔名則為日期+時間 3.把備份好的原始檔砍掉 內容如下： echo off set pp="C:\Program Files\tmp\" "C:\Program Files\WinRAR\RAR.exe" a -df -agyyyymmddhhmm d:\tmp\ %pp%  因為我習慣備份的時候還會留下Log，所以我又給了他下面的批次檔 echo off set pp="C:\Program Files\tmp\" set xx=%date:~0,4%%date:~5,2%%date:~8,2%   echo  =====%date%  %time%===== > %xx%.log "C:\Program Files\WinRAR\RAR.exe" a -agyyyymmddhhmm d:\tmp\ %pp% >> %xx%.log echo  =====%date%  %time%===== >> %xx%.log 有點時間又研究了公司備份時用的ROBOCOPY指令，所以改寫公司備份的批次檔 echo off set x=%date:~0,4%%date:~5,2%%date:~8,2% set y=%date:~11,3% set pp=\\10.0.1.250/d$\mailbackup\ robocopy  D:\lotus \\10.0.1.250\mailbackup\%y%\  /e  /xo  /purge /log:%pp%log_%y%.txt 內容為把D:\Lotus 備份到網路上的10.0.1.250主機的Mailbakcup目錄，並且以星期為週期，也就是我只會存七天內的備份，另外/Log則是要新增Log檔，這個指令好用多了....... ROBOCOPY　詳細的內容可以 參考這裡

上星期五從公司Server寄出一封信到Gmail被退信,本來不以為意,今天發現Mail Server Queue住了一堆要寄到Gmail的信件 查了一下Mail Server的Log (我們公司是用Notes) ================================================================== 2012/03/19 上午 08:40:16  Router: No messages transferred to GMAIL.COM (host GMAIL.COM) via SMTP: The server is not responding. The server may be down or you may be experiencing network problems. Contact your system administrator if this problem persists. 2012/03/19 上午 08:40:21  Router: Failed to connect to SMTP host GMAIL.COM because The server is not responding. The server may be down or you may be experiencing network problems. Contact your system administrator if this problem persists. ================================================================== Mail Server的主機上 Tracert Route Gmail的IP也沒問題,所以就懷疑Firewall在作怪 在Cisco ASA的Log中發現有一些奇怪的Log,而這些Source IP是Google的IP,Port是80或443 ================================================================== 2 Mar 19 2012 10:50:04 106001 74.125.31.121 80 ...

802.1Q Trunking *Trunk不屬於任何VLAN,可以承載所有VLAN *兩端設備 Native VLAN要相同() *Trunk Port不能使用Port-Security |Dest|SRC|Len/Etype|Data(46-1500)|FCS|   Ethernet Frame |Dest|SRC| Tag |Len/Etype|Data(46-1500)| FCS(重新演算) | 802.1Q Frame Tag=   | EtherType(0x8100) | PRI | Token Ring Encapsulation  F lag | VLAN ID | Tag=  |----------- 16Bit-------- | 3Bit | -------------------1Bit---------------- | ----12Bit-- | (總共4Byte) Native VLAN (Native VLAN-->Untagged) *預設為VLAN 1，只能有一個Native VLAN *所有資料到Trunk都會加Tag，只有Native Vlan不加Tag *802.1Q 才有 -------------------------------------------------------------------------------------------- 查看介面Trunk的相關資訊 這個範例是兩台2950的Port 1對接 SW1# show interfaces fa 0/1 switchport Name: Fa0/1 Switchport: Enabled Administrative Mode:  dynamic desirable Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking...

老闆出國兩個禮拜，一大早寄信告知不能寄信，提醒他使用非公司網路寄信要驗證，順便給他一張國外ISP業者的SMTP Server清單 http://www.host45.com/resources/ispsmtps.php 希望他一切順利 ^^

STP Port的狀態 Forwarding 可以收發Data Frames 可以收發BBPDUs Blocking 不 可以收發Data Frames 可以收發BBPDUs Disabled 未參與STP的運作 Broadcast storms Multiple frame transmission MAC Database instability --------------------------------------------------- Spanning-Tree 預防LOOP協定 , 標準為802.1D --------------------------------------------------- 角色選擇 1.先選擇Root Bridge(Bridge ID較低者),剩下的則為Nonroot Bridge *若平手比Base Mac,可用Show version指令查詢 *只有Root Bridge會發BPDU 2.每一台Nonroot Bridge一定要選出一個Root Port RP為離Root Bridge的最佳路徑 RP狀態為Forwarding 選擇方式為: 　*Tootal Path Cost: (Path Cost:10G=2,1G=4,100M=19,10M=100) 　*Port ID    3.每個Segment(兩個Switch Port對接的線路)要選出一個Designated Port DP 發送BPDU DP狀態為Forwarding 選擇方式為: 　*Sending Path Cost 　*Bridge ID 　*Port ID 4.剩下的則為Nondesignated Port NDP為其他未指派角色的Ports NDP狀態為Blocking --------------------------------------------------- BPDU(Bridge Protocol Data Unit) 預設每2秒傳送 Bridge ID=Bridge Priority(預設32768),MAC Address(Base Mac Address) --------------...

==基礎設定== Switch> enable Switch# configure terminal Enter configuration commands, one per line.  End with CNTL/Z. sw02(config)# hostname sw02 sw02(config)# line console 0 sw02(config-line)# exec-timeout 0 sw02(config-line)# logging synchronous sw02(config-line)# exit sw02(config)# no ip domain-lookup sw02(config)# interface vlan 1 sw02(config-if)# ip address 10.0.1.106 255.255.255.0 sw02(config-if)# no shutdown 00:19:32: %LINK-3-UPDOWN: Interface Vlan1, changed state to up 00:19:33: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to up sw02(config-if)# exit sw02(config)# line console 0 sw02(config-line)# password cisco sw02(config-line)# login sw02(config-line)# exit sw02(config)# enable password cisco sw02(config)# enable secret cisco3 sw02(config)# username ciscouser password ciscopassword sw02(config)# ip domain-name www.cisco.com sw02(config)# crypto key generate rsa The name for the keys will be: sw02.www.cisco.com Choose th...