HiddenOne

A while back I talked about building a VMware whitebox to run VMware ESX on inexpensive equipment. That was over a year ago and a few things have changed, so I figured an update was in order.

For the whitebox build I purchased a new motherboard, processor, and memory. This was based on the requirements that at the time ESX required a SAS chipset on the whitebox motherboard. Over the past year ESX’s support of SATA chipsets has improved, so you may be able to save some money on the motherboard. Below is a complete list of the hardware used in my build.

• Enclosure: Lian Li PC-V6000B ATX Mid Tower
• Processor: Intel Xenon X3230 Kentsfield (Quad Core)
• Motherboard: Asus P5BV-E/SAS
• Memory: 4 x Wintec AMPX 2GB DDR2-800
• Storage: Western Digital Caviar WD5000AAKS 500GB 7200 RPM 16MB Cache SATA-II
• Hard drive Enclosure: Athena Power BP-SATA3051B 5-bay hot-swap SATA backplane
• Power Supply: Enermax Noisetaker II EG425P-VE 420W
• Enclosure: Lian Li PC-V6000B ATX Mid-Tower

As you can probably tell, this used to be a file server that I built but decommissioned when a motherboard failure also took my data with it. One 500GB hard drive has been sufficient for both the ESXi installation and the storage of the all of the virtual machines (thin provisioning works very well).

Initially I installed Ubuntu 64-bit as the host operating system, with VMware Server running on top of that. Additionally I used GNS3 on the host to connect back to my lab equipment via the second NIC. Since then, VMware has made ESX (ESXi) freely available. I decided to install VMware ESXi 4.0 in place of the host OS, so that ESX can better manage allocation of the physical resources to each VM.

So far everything has been working out well. I have configured another Vswitch which connects to the second physical NIC and will be used to connect the VMs to the lab equipment. In the coming weeks, I will be creating a Linux VM and installing Dynagen to handle virtualization of some Cisco routers.

I hate to break the news to those of you with spindles filled with hundreds of blanks CD’s, but optical disc is dead! While this statement may be a bit dramatic, it holds true for me. Sure discs are still a means of cheap retail content delivery (Software, movies, etc), but for a network administrator even rewritable discs are a hassle.

The advent of the live CD has changed the game of even further. Once upon a time you might need one CD for every task that you might want to complete. Now you are able to cook your own live CD complete with all of the tools you need. Even with this ability, I recognize that there are some great live CDs out there that have a very complete set of network tools out of the box. I will discuss a few tools that make it much easier to take a typical ISO and “burn” it to a bootable USB drive.

Requirements

Before starting, keep in mind that in order for this entire process to work, the computer you intend to use the bootable USB drive with must support booting from such a device. Many older computers do not support this function. In some cases a BIOS upgrade may provide this functionality.

UNetbootin

UNetbootin is a utility for Windows and Linux that can take just about any ISO and write it to a USB drive in a bootable fashion. It has a nice feature where will can even automatically download the ISO for various Linux distributions before writing it to your USB drive.

Most users will use the second option, which will write an existing disk image (ISO or floppy/hard drive format) to the selected USB device.

I have personally used UNetbootin with many different ISOs and I have not run into any problems. This utility comes in handy for OS installs without a CD or otherwise using a live CD.

BootMyISOs

This is a Windows only utility used to make a USB drive bootable. Once BootMyISOs has done its part, all you have to do is copy the ISOs you want to the USB drive. This is great for replacing all of your old CDs with one bootable USB drive.

Make sure you refer to the linked page on Pen Drive Linux, since BootMyISOs only supports certain distributions/ISOs.

Happy booting!

Recently while sifting through some logs at work, I discovered some odd traffic coming from our DHCP server. The server appeared to be sending DNS updates to external DNS servers. This traffic never made it out of our network since our egress policy was not expecting to see DNS traffic from the DHCP server, so the packets were dropped.

So why was our DHCP server trying to send these update outside of our network? We have two DNS servers locally that should be receiving all of the DNS updates.

My first step was to check out our primary DNS server and double-check the reverse lookup zones. Below is a list of some of the zones I found (IP addresses have been changed to protect the innocent):

10.1.5.x
10.1.8.x
10.1.20.x

Spot the problem? These are very specific reverse lookup zones. Say we have a subnet that has usable addresses spanning from 10.1.5.1 to 10.1.6.254. When the leases from the 10.1.5.1 – 10.1.5.255 range have been handed out and leases from the 10.1.6 group of addresses begin to be served out, the DNS updates for the 10.1.6 addresses have nowhere to go. Essentially we had reverse lookup zones for a very specific set of addresses.

The solution was to create the proper reverse zone that would cover all of the subnets we use. The zone, or zones, that need to be created depend on the address space your organization uses internally. Since we use addresses in the class A 10.0.0.0 range, I needed to create a reverse zone named “10.in-addr.arpa.”. Below is a quick list of the common private address blocks and the reverse lookup zones they require.

After creating the proper zone for our internal IP scheme, the DNS updates for all of the DHCP leases started to appear in DNS. Additionally, the log entries stating that our DHCP server was sending updates to external DNS servers stopped.

A common mistake is to think that you only need the reverse lookup zone for the subnet you are using. For example, if someone is using the 192.168.2.0/24 subnet, they may think they only need the “2.168.192.in-addr.arpa.” reverse lookup zone. In fact they still need to create the “168.192.in-addr.arpa.” zone and let their DNS server handle the rest.

This may seem like a basic rule to most people, but not everyone knows about reverse lookup zones. In my case the current design was inherited. Honestly I may not have noticed the problem with the reverse lookup zones if I wasn’t sifting through logs.

The first thing I would like to do is clarify that this article discusses how to configure an 802.1q VLAN trunk between a Cisco switch and an HP Procurve switch. From here on out any references to trunking refer to an 802.1q tagged VLAN trunk. I am making that distinction now because in the Procurve world trunking refers to a feature similar to Cisco’s Etherchannel.

In a mixed vendor network, consisting of both Cisco and HP Procurve switches, it is important to keep traffic to and from multiple VLANs flowing. In any environment trunks, or tagged VLAN links, are an integral part of keeping that traffic moving. This can be a source of confusion since Cisco and HP handle the tagging of VLANs a bit differently. In my opinion Cisco handles 802.1q trunks in an easier to manage way; however the method used by Procurve switches is simple once you are familiar with the process.

The trunk between a Cisco and HP Procurve switch must be of the 802.1q variety. ISL trunks will not work because it is a Cisco proprietary encapsulation. I rarely see ISL in use these days, and I personally consider 802.1q the preferred method of encapsulation if for no other reason than its interoperability.

I will focus on the configuration of the trunks on each switch; if you need a refresher on how to configure VLANs on Cisco or Procurve switches consult the documentation for your switches. Once you have configured all of the needed VLANs it is time to configure the trunk on the Cisco switch using the following commands:

3550-02(config)#interface fa0/48
3550-02(config-if)#switchport mode trunk
3550-02(config-if)#switchport trunk allowed vlan all
3550-02(config-if)#no shutdown
3550-02(config-if)#exit

Here interface number 48 is the trunk port on the Cisco switch. After entering interface sub-configuration mode, the port mode is changed to “trunk” (the default is access). Next, it’s a good idea to set what VLANs you want to allow across the trunk. Here I used the “all” option, but for security reasons you may wish to specifically list the VLANs you use in your environment. Finally, you want to make sure the interface is not in a shutdown state because that would not allow the traffic to flow (ask me how I know)!

Procurve switches, much like their Cisco counterparts, can have a VLAN either tagged or untagged on any particular port. The configuration of this tagging varies a bit as shown in the configuration below.

HP ProCurve Switch 3400cl-24G(config)# vlan 4
HP ProCurve Switch 3400cl-24G(vlan-4)# tagged 24
HP ProCurve Switch 3400cl-24G(vlan-4)# exit

The “vlan 4” command drops you into VLAN sub-configuration mode. Here the “tagged 24” command is used to tell the switch to encapsulate any packets on port 24 that originate from VLAN 4. As may already be obvious, port 24 will be the trunk port on the HP switch. Below is the command that is used to accomplish the same for VLAN 5.

HP ProCurve Switch 3400cl-24G(config)# vlan 5
HP ProCurve Switch 3400cl-24G(vlan-5)# tagged 24
HP ProCurve Switch 3400cl-24G(vlan-5)# exit

The next step is to connect the trunk ports on each switch using the appropriate network cable. Issue the “show interfaces fa0/48 trunk” command on the Cisco switch to verify the trunk has been established. You should see output similar to what is displayed below.

3550-02#show interfaces fa0/48 trunk

Port        Mode             Encapsulation  Status        Native vlan
Fa0/48      on               802.1q                trunking   1

Port            Vlans allowed on trunk
Fa0/48      1-4094

Port            Vlans allowed and active in management domain
Fa0/48      1,4-5

Port            Vlans in spanning tree forwarding state and not pruned
Fa0/48      1,4-5

The key here is that you want the status to read “trunking”. This will indicate that the trunk has been successfully established.

Next test connectivity between two hosts that are in the same VLAN, but on different switches. In this case I assigned IP addresses directly to the VLAN interface on each switch. Here is the IP address layout I used.

Cisco 3550

• VLAN 4: 172.16.1.1/24
• VLAN 5: 172.16.2.1/24

HP 3400

• VLAN 4: 172.16.1.2/24
• VLAN 5: 172.16.2.2/24

Below is ping output from the Cisco switch  after issuing a ping command to both VLAN interfaces on the HP switch:

3550-02#ping 172.16.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

3550-02#ping 172.16.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/202/1000 ms

Now, here is the ping output from the HP switch after issuing a ping command to both of the VLAN interfaces on the Cisco switch.

HP ProCurve Switch 3400cl-24G# ping 172.16.1.1
172.16.1.1 is alive, time = 1 ms

HP ProCurve Switch 3400cl-24G# ping 172.16.2.1
172.16.2.1 is alive, time = 1 ms

As you can see, configuration of 802.1q trunks between Cisco and HP Procurve switches is not overly complicated. The key is to test connectivity to ensure that traffic is flowing as it should. In larger environments it could be a bit cumbersome to manage a large number of tagged VLANs on a Procurve switch. If things are not working, double check your config on both ends. Many times I find that it is easy to forget a tagged command on the HP side of things.