寫寫筆記

在官方的Firmware版本中沒有SNMP的功能，若需要開啟SNMP需要刷第三方的Firmware，我是安裝Asuswrt-Merlin的版本，更新方式也很簡單，與更新官方的版本相同，網站如下： http://asuswrt.lostrealm.ca/ 更新完成後除了有SNMP的功能外，也會多出一些不錯用的功能

目標: 讓VLAN100與VLAN200的電腦透過L3 Swtich做VLAN的Routing，並且可以互相存取資源與上網，另外再使用Windows Server 2012配發VLAN100,VLAN200的IP Firewall: 使用ASUS AP當Firewall，並設兩條Static Route Switch: Core Switch為Cisco 3750切VLAN 10,VLAN100,VLAN200，VLAN10為預設的VLAN，VLAN100為Sales，VLAN200為RD Edge Switch為Cisco 3750與2950，其中2950為VLAN100，3750為VLAN200，如果要By Port切VLAN也可以，這裡只是為了方便說明，所以Edge Switch都直接設為單一VLAN Core Switch的設定 原本我只想Show Running-config其中比較重要的設定，後來想想還是全部列出，用紅色標記重要的設定 Gi 1/0/1接2950 Gi 1/0/2接3750 Gi 1/0/24接Router Core-3750#show running-config Building configuration... Current configuration : 2436 bytes ! version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Core-3750 ! boot-start-marker boot-end-marker ! ! ! ! no aaa new-model switch 1 provision ws-c3750g-24t system mtu routing 1546 ip routing no ip domain-lookup ! ! ! ! ! ! ! ! spanning-tree mode pvst spanning-tree portfas...

設定系統密碼 使用SSH登入 關掉HTTP (no ip http server) 關掉不需要使用的Port 使用syslog 關掉CDP 增加Spanning的安全性(BPDU Guard,Root Guard...) 使用Port Security 使用802.1x驗證

目標： PC1為VLAN 66，PC2為VLAN 1，PC3為VLAN88 使用Router on a stick，讓VLAN裡的PC可以互通，同時也可以連到設在Switch VLAN1的IP ====Switch設定==== SW(config)#ip default-gateway 10.1.1.254 SW(config)#interface VLAN 1 SW(config-if)#ip address 10.1.1.1 255.255.255.0 SW(config-if)#no shutdown SW(config)#interface range fastEthernet 0/1-10 SW(config-if-range)#switchport access vlan 66 SW(config)#interface range fastEthernet 0/14-24 SW(config-if-range)#switchport access vlan 88 SW(config)#interface fastEthernet 0/12 SW(config-if)#switchport mode trunk SW(config-if)#^Z SW#show vlan brief VLAN Name                             Status    Ports ---- -------------------------------- --------- ------------------------------- 1    default                   ...

密碼猜了半天也進不去 CISCO2811> enable Password: Password: Password: % Bad secrets Reload手動重開機，然後按下 Ctrl+Break 鍵，強迫進入Rom Monitor CISCO2811>enable Password: Password: Password: % Bad secrets program load complete, entry point: 0x8000f000, size: 0x3ed1338 Self decompressing the image : ############# monitor: command "boot" aborted due to user interrupt rommon 2 > confreg 0x2142 rommon 3 > reset System Bootstrap, Version 12.1(3r)T2, RELEASE SOFTWARE (fc1) Copyright (c) 2000 by cisco Systems, Inc. Initializing memory for ECC .. c2811 processor with 524288 Kbytes of main memory Main memory is configured to 64 bit mode with ECC enabled Readonly ROMMON initialized program load complete, entry point: 0x8000f000, size: 0xc940 program load complete, entry point: 0x8000f000, size: 0xc940 program load complete, entry point: 0x8000f000, size: 0x3ed1338 Self decompressing the image : ############################...

目標: Port 0/8 有定只能讓3個指定的Mac-address通過,若有異常Mac-address該Port則會Shutdown,但10分鐘後會自行恢復! 會設Shutdown的原因一方便是讓使用者知道他使用非法設備連入,而自行恢復是不想讓自己太累...偷懶使用~~ 設定方式: 先看有沒有啟動Port-Security SW12-2950# show port-security Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action                 (Count)       (Count)          (Count) --------------------------------------------------------------------------- --------------------------------------------------------------------------- Total Addresses in System (excluding one mac per port)     : 0 Max Addresses limit in System (excluding one mac per port) : 1024 啟動Port-Security,並用使用Sticky紀錄Mac-Address SW12-2950#configure terminal Enter configuration commands, one per line.  End with CNTL/Z. SW12-2950(config)#interface fastEthernet 0/8 SW12-2950(config-if)# switchport mode access SW12-2950(config-if)# switchport por...

手上有ASUS AC66u與ASUS N12HP，本來是想用WIFI來連接MOD，但後來因為WDS不能加密(ASUS 官網提到只能用WEP加密)，所以就放棄了.... 建立WDS過程蠻簡單的，兩台在WDS的選項，互相加入對方的Mac-Address 把無線的頻道與加密方式設為相同，但重點是如果你跟我一樣使用AES加密，就會無法成功(如下圖) 所以最後我是設定Open System，連WEP都沒有的加密........ 雖然可以成功，但我應該還是不會用WDS因為太不安全了~ ASUS 官方建立WDS的方式

預設CISCO L2 Switch的Port介面都是啟用的，為了安全性的考量應該將沒有用的到介面關閉 1.shutdown 2.port-security 3.指定到某一無在使用的VLAN 3.設定switchport mode access，避免形成Trunk

設定介面安全防護機制，例如禁止員工私帶筆電到公司使用，在Switch介面上綁定Mac-Address 查看有無介面設定Port-Security SW12#show port-security Secure Port  MaxSecureAddr  CurrentAddr  SecurityViolation  Security Action                 (Count)       (Count)          (Count) --------------------------------------------------------------------------- --------------------------------------------------------------------------- Total Addresses in System (excluding one mac per port)     : 0 Max Addresses limit in System (excluding one mac per port) : 1024 SW12#configure terminal Enter configuration commands, one per line.  End with CNTL/Z. SW12(config)#interface fastEthernet 0/17 SW12(config-if)#switchport mode access SW12(config-if)#switchport port-security SW12(config-if)#switchport port-security maximum 1 SW12(config-if)#switchport port-security mac-address sticky SW12(config-if)#switchport port-security...

我有兩台Vigor 2920,環境如下: Vigor B 撥出 LAN:192.168.1.0/24 Vigor A 撥入 LAN:172.16.1.0/24 設定如下: Vigor B設定 Vigor A設定 詳細設定請參考官網 http://www.draytek.com/index.php?option=com_k2&view=item&id=2666&Itemid=264&lang=tw

在MS-DOS視窗下輸入: dism /online /enable-feature /featurename:SNMP Hyper-V 2012 R2 Hyper-V 2012也是一樣的語法 參考來源 http://petersitblog.blogspot.tw/2012/12/hyper-v-server-2012-enable-snmp.html

Cisco 2950 Switch在Show Logging時，前方是帶設備的開機時間 3w4d: %LINK-3-UPDOWN: Interface FastEthernet0/5, changed state to down 3w4d: %LINK-3-UPDOWN: Interface FastEthernet0/5, changed state to up 3w4d: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up 如果要帶事件發生的時間，可以輸入下面的指令 service timestamps log datetime show-timezone localtime Sep 17 02:53:54: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.249) Sep 17 03:02:12: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.150) Sep 17 03:04:40: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.150) Sep 17 11:07:07 TW: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (192.168.1.150) 參考資料

root@EX2200-113> show ethernet-switching table Ethernet-switching table: 147 entries, 143 learned, 0 persistent entries   VLAN              MAC address       Type         Age Interfaces   default           64:64:9b:34:TT:TT Static         - Router   vlan1             *                 Flood          - All-members   vlan1             ac:a0:16:91TT:TT Learn          0 ge-0/0/47.0   vlan10            *                 Flood          - All-members   vlan10            00:00:1c:d1:TT:TT Learn          0 ge-0/0/47.0   <---以下略過---> ...

Wiershark在抓封包的時候,一直抓到0x8899的Protocol，查了一下發現這個是Realtek用來偵測Loop的協定 因為我上層已經有開啟STP，所以我就下參數把該Mac-Address給Drop掉 2F-Switch(config)# mac address-table static 2828.5db3.cb39 vlan 1 drop 指令參考來源 註: 如果要新增某Mac-address也可以下這個指令 Switch(config)# mac-address-table static 1111.1111.1111 vlan 1 interface fastEthernet 0/1 Switch#show mac-address-table           Mac Address Table ------------------------------------------- Vlan    Mac Address       Type        Ports ----    -----------       --------    -----    1    1111.1111.1111    STATIC      Fa0/1

公司新買的Juniper EX2200一直出現Alerm的告警，進到Web畫面後出現是Management Ethernet Down，查了一下解決方式 root@EX2200-2> show chassis alarms 1 alarms currently active Alarm time               Class  Description 2014-03-13 09:44:37 UTC  Major  Management Ethernet Link Down {master:0} root@EX2200-2> configure Entering configuration mode {master:0}[edit] root@EX2200-2# set chassis alarm management-ethernet link-down ignore {master:0}[edit] root@EX2200-2# commit configuration check succeeds commit complete {master:0}[edit] root@EX2200-2# exit Exiting configuration mode {master:0} root@EX2200-2> show chassis alarms No alarms currently active 參考資料

Brocade ICX6430 Switch 啟用 DHCP Snooping 假設我的DHCP Server接在24 Port，其他Port不允許有DHCP Server ICX6430-24 Switch> enable No password has been assigned yet... ICX6430-24 Switch# configure terminal ICX6430-24 Switch(config)# ip dhcp snooping vlan 1 ICX6430-24 Switch(config)# interface ethernet 1/1/24 ICX6430-24 Switch(config-if-e1000-1/1/24)# dhcp snooping trust 預設Spanning Tree是開啟的,我把Port 9與Port 11接成Loop ICX6430-24 Switch# show span STP instance owned by VLAN 1 Global STP (IEEE 802.1D) Parameters:      Root             Root Root   Prio Max He- Ho- Fwd Last    Chg Bridge       ID              Cost Port   rity Age llo ld  dly Chang   cnt Address                                   Hex  sec sec sec sec sec      8000cc4e2434dda0 0    Root ...

兩個Cisco 2950 Switch , 第一台與第二台的Port 1 與 Port 2 對連，設定EtherChannel 第一台Switch up# configure terminal Enter configuration commands, one per line.  End with CNTL/Z. up(config)# interface range fastEthernet 0/1 - 2 up(config-if-range)# no ip address up(config-if-range)# channel-group 1 mode desirable Creating a port-channel interface Port-channel 1 第二台Switch down# configure terminal Enter configuration commands, one per line.  End with CNTL/Z. down(config)# interface range fastEthernet 0/1 - 2 down(config-if-range)# no ip address down(config-if-range)# channel-group 1 mode desirable Creating a port-channel interface Port-channel 1 down(config-if-range)# 00:34:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down 00:34:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down 00:34:33: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up 00:34:...

啟動DHCP Snooping 假設我的DHCP Server接在24 Port，其他Port不允許有DHCP Server C3750(config)# ip dhcp snooping C3750(config)# ip dhcp snooping vlan 1 C3750(config)# interface gigabitEthernet 2/0/24 C3750(config-if)# ip dhcp snooping trust C3750(config-if)# do show ip dhcp snooping Switch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 1 DHCP snooping is operational on following VLANs: 1 DHCP snooping is configured on the following L3 Interfaces: Insertion of option 82 is enabled    circuit-id default format: vlan-mod-port    remote-id: 0016.9d99.3e80 (MAC) Option 82 on untrusted port is not allowed Verification of hwaddr field is enabled Verification of giaddr field is enabled DHCP snooping trust/rate is configured on the following Interfaces: Interface                  Trusted    Allow option    Rate limit (pps) -----------------------    -------   ...

沒用過HP的Switch，指令跟Cisco完全不同，花了一些時間熟悉~ 1.啟動Spanning-Tree，預設沒有開啟 (黑色粗體是我敲的指令) <HP> system-view System View: return to User View with Ctrl+Z. [HP] stp enable [HP] %Apr 26 12:03:59:826 2000 HP MSTP/6/MSTP_ENABLE: STP is now enabled on the device. %Apr 26 12:03:59:918 2000 HP MSTP/6/MSTP_FORWARDING: Instance 0's GigabitEthernet1/0/17 has been set to forwarding state. %Apr 26 12:04:00:068 2000 HP MSTP/6/MSTP_DETECTED_TC: Instance 0's GigabitEthernet1/0/17 detected a topology change. #Apr 26 12:04:00:208 2000 HP MSTP/1/PFWD: hwPortMstiStateForwarding: Instance 0's Port 0.9437200 has been set to forwarding state! 2.DHCP Snooping   (黑色粗體是我敲的指令) 假設我的DHCP Server接在24 Port，其他Port不允許有DHCP Server <HP> system-view System View: return to User View with Ctrl+Z. [HP] dhcp-snooping  DHCP Snooping is enabled. [HP] interface GigabitEthernet 1/0/24 [HP-GigabitEthernet1/0/24 ]dhcp-snooping trust 若是沒有Port 設成dhcp-snooping trust,那麼這台Switch就沒有Client可以從DHCP Serv...