HiddenOne

It seems that those of us studying for our CCNP certification have some decisions to make. For some time rumors have been floating around about an update to the CCNP exam (currently version 5.0). About one week ago, information that looked to be targeted to Cisco Network Academy partners was leaked. This information seems to substantiate the rumors that have been floating around.

Without getting into too many specifics (since Cisco has not made an official statement regarding the changes) it looks like CCNP 6.0 will bring some major changes. The current information shows that the BCMSN and BCSI exams will be replaced by applicable switching and routing exams. Further information seems to indicate that the ISCW and ONT exams will not be replaced. Finally, it appears that an exam geared towards troubleshooting will be added.

There is much discussion on what these changes will do to the perceived value of the CCNP certification. Others are concerned that they will be stuck with outdated study material if they only begin their studies now. History has shown that there will probably be some sort of phase-in period where both the new and old exam content will be available.

Personally, I have decided to purchase some training material anyway and continue my studies. My decisions were fueled by two major factors. First, the electronic training I purchased came with free updates. As the content of the CCNP exams changes, I will be entitled to free updates to the training material. The most important reason I choose to continue my studies is for personal advancement.

The ultimate goal of my study efforts is to obtain my CCNP certification. However, during this time I also want to build my networking knowledge and skills in order to advance myself both personally and professionally. If I study and learn a topic that is not covered on the new exams, I will still have knowledge of the topic that will no doubt come in handy at some point in my career. In my opinion, this is sometimes lost when studying for any professional certification. Many people find themselves studying just to pass the exam rather then also focusing on their personal advancement.

The underlying goal at work this month is to get some much needed insight and auditing abilities into our network. I have looked at Rancid before, and after doing some research I finally decided to take the plunge and implement it into our network.

The steps below assume that you are running Ubuntu Server 8.04.3 LTS i386 with a standard LAMP installation. They may work with other Debian based distributions, but your mileage may vary. For this installation I will be using Rancid version 2.3.2, which is the current stable release at the time that I wrote this article. I encourage you to check the Shrubbery web site and get the latest release that is available. Additionally, this article will go into a bit more detail about using Rancid with various HP Procurve equipment.

It would be a lie to say I figured out all of these steps on my own. Some of it was trial and error, other information I found in various places on the Internet. Tweets from Jeremy over at Evil Routers gave me the needed insight on editing the hrancid file to support some of the newer Procurve equipment.

Rancid Installation

After your base LAMP system is installed, you need to install some packages that are required to install and run rancid. You can combine these commands into one line, but I broke them out into two lines to show that the second line begins the actual Rancid dependencies.

apt-get install gcc make libc6-dev
apt-get install expect cvs

Next, create a user that will run Rancid. This user’s home directory will be used as the install path and CVS repository for Rancid. For simplicity’s sake I have used the user name “rancid”, but you can use anything.

adduser –home /home/rancid rancid

Download the latest rancid source archive using wget.

wget ftp://ftp.shrubbery.net/pub/rancid/rancid-2.3.2.tar.gz

Copy the archive to /usr/src and extract the contents.

cp rancid-2.3.2.tar.gz /usr/src
cd /usr/src
tar xvfz rancid-2.3.2.tar.gz
cd rancid-2.3.2

Configure and install Rancid. Note that we are providing arguments for specific installation directories.

./configure -prefix=/home/rancid -localstatedir=/home/rancid/var/rancid
make install

Since the previous commands were issued by the root user, we need to change ownership of /home/rancid back to the rancid user.

chown -R rancid:rancid /home/rancid

Rancid Configuration

Edit /home/rancid/etc/rancid.conf and look for the following line (which is probably commented out):

LIST_OF_GROUPS=”"

There will probably be text between the quotes which you will delete. The group names you provide will be your CVS groups, and will translate into folders when viewing the repository with CVSweb. In my case I choose to create a group for each building I manage. Once everything is running, each building’s folder will contain the network devices in that building as well as their configuration files. Below is an example of a list of groups. Each group is seperated from the previous group name with a space.

LIST_OF_GROUPS=”Philadelphia Boston Miami Burbank”

Edit the /home/rancid/.cloginrc file. This contains the login information for your switches. If you use AAA/Radius to authenticate users that manager network equipment, your job is easy. All you have to do is provide a username and password for every device like so:

add user * {ranciduser}
add password * {ranciduserpassword}
add autoenable * 1

The first two lines are self-explanatory. The asterisk is a wild card meaning all or every device. The last line tells Rancid that the authentication information provided automatically drops the user into enable mode.

Since the cloginrc file contains passwords, you want to change its permissions to ensure only the rancid user can access this file.

chmod 600 .cloginrc
chown rancid:rancid .cloginrc

Now we run the rancid-cvs command, which will create the CVS groups based on the “LIST_OF_GROUPS” we created earlier. It is important that you run this command as the rancid user.

su – rancid
/home/rancid/bin/rancid-cvs

Next, edit the router.db files for each group. There is a seperate router.db file for each group. The groups are located in the /home/rancid/var/rancid directory (each group has its own folder). The router.db files tell rancid the IP address or hostname of the device, the device manufacturer, and the status of the device. For example

192.168.1.2:hp:up

If you use a hostname instead of an IP address, be sure the server running Rancid is able to resolve the hostnames. For newer HP Procurve devices, you will set the manufacturer to “hp”. This works for 5400zl and 8200zl models as well as older model stackables (3400, 2524, etc). If you have a switch that was manufactured by Foundry, such as the Procurve 9308, set the manufacturer to “foundry”. Rancid will only process the device if the status is set to “up”. Any other status will cause the device to be skipped.

Edit hrancid File

The newer Procurve models no longer support the “show system-information” command, instead this command has been changed to “show system”. Luckily this command is specific enough that when it is issued on older switches that still use “show system-information”, it translates properly. In order to support the newer switches, we need to edit the “hrancid” file located in /home/rancid/bin. Once you have the file open, look for the following block of code:

@commandtable = (
{‘show version’                 => ‘ShowVersion’},
{‘show flash’                   => ‘ShowFlash’},
{‘show system-information’      => ‘ShowSystem’},
{‘show system information’      => ‘ShowSystem’},
{‘show module’                  => ‘ShowModule’},
{‘show stack’                   => ‘ShowStack’},
{‘write term’                   => ‘WriteTerm’}
);

You need to change “show system-information” to “show system”. The “show system information” line does not need to be modified.

Run Rancid

Now we will run Rancid for the first time. Again, we are going to need to do this as the rancid user. Be patient, as this command can take some time to complete if you have a large number of devices.

su – rancid
/home/rancid/bin/rancid-run

Install & Configure CVSweb

CVSweb will provide a web interface where you can view the configuration files for your network devices in addition to performing diffs on the files to see what has changed. Installing CVSweb is simple.

apt-get install cvsweb

After the installation is complete, edit the /etc/cvsweb/cvsweb.conf file to point CVSweb to your Rancid CVS repository.

@CVSrepositories = (
#’local’ => ['Local Repository', '/var/lib/cvs'],
‘MNSD’ => ['MNSD Devices', '/home/rancid/var/rancid/CVS'],
);

I usually comment out the “local” line with a pound, just to make navigation a bit easier (since in my case the local repository is not used.

Create a link to in the www directory that points to the location of the CVSweb icons.

ln -s /usr/share/cvsweb /var/www/cvsweb

You can now access your repository using the following URL: http://YOUR_SERVER/cgi-bin/cvsweb

Rancid Automation

Now that everything is working properly, we want to make sure Rancid runs automatically every so often. We will do this by editing the /etc/crontab file and adding the following lines.

1 12,23 * * *    rancid    /home/rancid/bin/rancid-run
50 23 * * *    rancid    /usr/bin/find /home/rancid/var/rancid/logs -type f -mtime +2 -exec rm {} \;

The first line runs Rancid at 12:00 PM and 12:00 AM. Carefully choose your intervals, because the number of devices you are running Rancid against and the size of the config on each device will increase the run time. The second line periodically clears the configuration differ log files.

There you have it! You should now have a working version of Rancid!

At work we recently converted from a network monitoring package that was provided by our switching vendor, to Orion Network Performance Monitor from Solarwinds. Shortly after installing and configuring Orion, I configured a Linux server running Rancid for configuration management. In my eyes, both Orion and Rancid fall under the network monitoring/management category, so I wanted to make accessing both as easy as possible.

Orion allows you to create and add custom links to your menu bars, but adding a typical link is a bit “clunky” since the link either takes the user away from the Orion page or opens in a new window. The steps below describe how to create a custom link that will retain the Orion header and menu barat the top of the page. This has made navigating between the two much easier and has eliminated the need for me to have both Orion and Rancid open in separate browser tabs.

Creating a Custom Link

First, make sure you log into Orion with credentials that have administrator access. After you do that, click the “Admin” link that appears in the Orion menu bar.

On the admin page, click the “Customize Menu Bars” link under the Customize section.

On the “Customize Menu Bars” page, I choose to edit the admin menu bar by clicking the “Edit” button under the menu bar. If you want different groups of users to see this link, you may have to edit different or multiple menu bars.

On the edit menu bar page, click the “Add” button that appears towards the bottom of the page.

This will open the dialog box shown below.

Fill in the name and description fields as you see fit. Next, uncheck the “Open in a New Window” option box. In the URL field type the following:

http://YOUR_SERVER/Orion/External.aspx?Title=Rancid&URL=

After the “URL=” argument, type the URL of the web page you wish the link to display. When you are finished, click the “OK” button.

Back on the edit menu bar page, you will notice your new link in the “Available Items” list. Click and drag the link from this list to the “Selected Items” list.

When finished, click the “Submit” button and enjoy the fruits of your 30 seconds of labor!

This is a very simple process, but it came in handy for me and makes day to day management a bit easier.

There are many tools that can make the life of a network administrator easier. The following is a list of programs that I use on a daily basis to make management of the network easier. As a bonus, all of these programs are available free of charge.

A few of these tools I use mainly for organization, as I am anal retentive about being organized and making commonly used information easily accessible. You may find some of these tools more or less useful depending on your habits.

KeePass – This a great tool to organize and securely store password information. It has multiple methods of authentication, including password and key based. KeePass allows you to create groups as well as nested groups to easily organize information. The entire database is also searchable to further make accessing information easier. The included password generator can help you come up with passwords other than the usual P@$$word!

Wireshark  - Wireshark is a popular traffic capture program. A traffic capture program comes in handy when issues arise and you need to see communication information between hosts. It has helped my countless times when troubleshooting port authentication issues. Wireshark has a plethora of other features that can aide in finding the cause of any issues.

Tftpd32 - You’re going to need a TFTP server as some point in your career. It may be to upload a new software image, backup a config, or some other reason. Tftpd32 takes your run of the mill TFTP server and adds a few more features including: Tftp Client, DHCP server, and Syslog server. Even with these features, the program remains light and quick.

Network Stumbler - If you’re using the bars displayed in the Windows wireless connection manager to determine wireless signal strength, you’re not getting an accurate picture. Net Sumbler will give you a real-time graph of the signal to noise ratio. It will also provide various other pieces of information about the wireless networks it discovers.

PuTTY Connection Manager - PuTTY has been my personal choice for managing network devices from the terminal (Console, Telnet, etc). PuTTY CM is a separate piece of software that uses PuTTY for connections to devices. The biggest advantage of PuTTY CM, for me, is the ability to build a database of Telnet/SSH configurations to network devices. This allows me to quickly connect to a device and automate various tasks at login.