Showing posts with label FreeBSD. Show all posts
Showing posts with label FreeBSD. Show all posts

Thursday, 31 January 2008

Multi Router Looking Glass

Objective: create a web interface for viewing routing tables and other routing commands.

I have chosen John Fraizer's Multi Router Looking Glass (a working example can be seen at RIPE's Routing Information Service page). The latest version of the software can be downloaded at: http://www.op-sec.us/mrlg/source/CURRENT/ .
Basically the software consists of a cgi script to place in your apache server cgi-bin and a couple of perl & bash scripts. There is also code to make fastping, an alternative to ping. I just used plain old ping in my setup.

CPAN Perl Module: First thing we need is the Perl "Network::Telent::Cisco" module to allow the main script to communicate via telnet to our network equipment. SSH is available via the "Network::SSH::Perl" module, however I will not cover this here.

Access your CPAN shell:

$ perl -MCPAN -e shell
cpan>


Note: If this is the first time you have run this command you will have to configure CPAN.

Now install "Network::Telnet::Cisco" module.

cpan> install Net::Telnet::Cisco



With this done all we need is a little file keeping to get our program into place. From our downloaded and extracted tar.gz folder issue the following commands:

cp index.cgi /usr/local/www/apache22/cgi-bin/
chmod +x /usr/local/www/apache22/cgi-bin/index.cgi
cp fping1 ztr ztraceroute /usr/local/bin
chmod +x /usr/local/bin/fping1 /usr/local/bin/ztr /usr/local/bin/ztraceroute
cp mrlg.conf.sample /etc/mrlg.conf


Note: These are for FreeBSD, your directory structure may vary.
Now, we need to edit fping1, ztr & ztraceroute to make sure all paths within these files are correct for your system. For FreeBSD I had to edit paths to bash & traceroute, also exchange fastping for ping and its's correct path.

mrlg.conf set up:
To get anything out of your index.cgi, ie. MRLG, you need to config /etc/mrlg.conf.
First, we have to tell MRLG the host details we will be running MRLG on.

## Set the URL for the location of the looking-glass....
$::url="http://10.1.1.3/cgi-bin/index.cgi";


Secondly, we can amend a router to the details of one of our local routers.


$::Routers{'Folkestone-AS2'} = {
comment => 'Cisco 2600 Series',
server => '10.1.1.2',
use_port => '23',
login_pass => 'cisco',
full_tables => '1',
cisco => '1',
debug => "0",
};



That is all we need to get an interface into our routers as demonstrated below.



The conf file has lots of settings not discussed here but which can be very useful so I would advise this be your first point of call if you decide to install MRLG.
Phil

Tuesday, 29 January 2008

comserv for OS X - Leopard


comserv for leopard
About a year ago I was using comserv on a BSD box hooked up to a Xyplex terminal access server. This gave me native access to the serial ports on the terminal server, so I could do a simple "cu -l /usr/local/comserv/dev/xport01" to connect to a router or switch or what have you.

I have been considering a MacBook, and one of the programs I would love to have would be comserv. I had a look around the pkg repositories but no luck! It was a case of rolling my own.

After a little bit of compiling and package hacking I have got a fully working OSX package: comserv.pkg

After a simple double click install, all that is needed is to:

sudo cp /usr/local/etc/comservd.conf.sample /usr/local/etc/comservd.conf

sudo vi /usr/local/etc/comservd.conf
ammend to your liking:

sudo vi /etc/hostconfig
append: COMSERVD=-YES-


and that is it, comservd starts up on reboot and gives you access to all those ports.
If you can't wait to reboot.
sudo SystemStarter start COMSERVD


comservd conf help is available under the installed man page. Even better 'pman' comservd. Also, it is complete with an uninstall.sh script.

enjoy

Monday, 7 January 2008

BGP Peer Groups on Quagga

Objective: To set up a "peer-group" on our Quagga router to limit advertisements within an Autonomous System.

Setup: Refer to previous post "Headless BSD Quagga Router" to get you started.

Under the running config on the quagga router I have formed the peer group 'localAS' for AS3 with the following command:

neighbor localAS remote-as 3


next I include the neighbors I wish to be in the peer-group:

neighbor 172.16.1.2 peer-group localAS
neighbor 192.68.1.1 peer-group localAS


It is the same as declaring a normal neighbor however I use the 'peer-group' option. The 'remote-as' option is not needed, as in the preceding command 'neighbor localAS remote-as 3' confirms which remote the peer-group is in.

Excerpt on BGP Technology from Cisco Systems:

The major benefit you achieve when you specify a BGP peer group is that a BGP peer group reduces the amount of system resources (CPU and memory) necessary in an update generation. A BGP peer group reduces the load on system resources by allowing the routing table to be checked only once, and updates to be replicated to all peer group members instead of being done individually for each peer in the peer group. Based on the number of peer group members, the number of prefixes in the table, and the number of prefixes advertised, this can significantly reduce the load.

BGP peer groups also simplifies the BGP configuration. Instead of configuring each neighbor with the same policy individually, a peer group allows you to group the policies which can be applied to individual peers thus making efficient update calculation along with simplified configuration.

..

Tuesday, 1 January 2008

grep trick

Small hint shown to me many years ago when enabling things in rc.conf.
If I want to startup ipfilter for example (trimmed to avoid wrapping).

bash-2.05b# cat /etc/defaults/rc.conf | grep ^ipfilter

Returns the following,
ipfilter_enable="NO" # Set to YES to enable ipfilter
ipfilter_program="/sbin/ipf" # where the ipfilter program lives
ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter,
ipfilter_flags="" # additional flags for ipfilter

If it looks like what you want then write it into your running rc.conf,

cat /etc/defaults/rc.conf | grep ^ipfilter >> /etc/rc.conf

Then you can edit to enable, add flags, etc. Cures the typos.

DAve
http://lists.freebsd.org/pipermail/freebsd-questions/2007-December/165704.html

Saturday, 29 December 2007

Headless BSD Quagga Router

Objective Get an old box running as a bgp router for lab exercises.

Install a minimum installation of FreeBSD. See previous post for installation media.
Of note, My "Hard Drive" I am using for installation, is a 1gb Compact Flash Card, so to reduce "writes" to this I have not partitioned a "swap" space.

Also regards a headless install don't forget when asked if there are any last configurations you need to preform choose yes and navigate to the "TTYs" menu item. From here you need to edit thr /etc/ttys file.

scroll down to serial terminals section and edit so you can log on via the first serial console:
# Serial terminals
# The 'dialup' keyword identifies dialin lines to login, fingerd etc.
ttyd0 "/usr/libexec/getty std.9600" xterm on secure

so on reboot we should be at a login prompt.

Quagga Installation:
FreeBSD2# pkg_add -r quagga
Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-6.2-release/Latest/quagga.tbz... Done.
Added group "quagga".
Added user "quagga".
FreeBSD2#

Quagga is installed but we need two config files written to operate as a BGP router.
These go in /usr/local/etc/quagga/ and are "zebra.conf"
!
! Zebra configuration saved from vty
! 2007/12/22 22:25:59
!
hostname zebraBSD1
password zebra
enable password zebra
log stdout
!
debug zebra events
!
interface fxp0
ip address 10.2.2.2/24
ipv6 nd suppress-ra
!
interface fxp1
ipv6 nd suppress-ra
!
interface fxp2
ipv6 nd suppress-ra
!
interface lo0
!
interface plip0
ipv6 nd suppress-ra
!
!
line vty
password zebra
!

and "bgpd.conf"
!
!zebra BGP conf file
!
router bgp 65001
!
line vty
password zebra
!

now run zebra and bgpd as daemons.
freebsd1# zebra -d
2007/12/29 19:12:39 ZEBRA: MESSAGE: ZEBRA_INTERFACE_ADDRESS_ADD 10.2.2.2/24 on fxp0
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
2007/12/29 19:12:39 ZEBRA: rib_queue_add_qnode: work queue added
freebsd1# bgpd -d
freebsd1#

To access Quagga/zebra:
freebsd1# telnet localhost 2601
Trying ::1...
Connected to localhost.
Escape character is '^]'.

Hello, this is Quagga (version 0.99.4).
Copyright 1996-2005 Kunihiro Ishiguro, et al.


User Access Verification

Password:
zebraBSD1> exit
Connection closed by foreign host.

To access Quagga/bgpd:
freebsd1# telnet localhost 2605
Trying ::1...
Connected to localhost.
Escape character is '^]'.

Hello, this is Quagga (version 0.99.4).
Copyright 1996-2005 Kunihiro Ishiguro, et al.


User Access Verification

Password:
zebraBSD1> exit
Connection closed by foreign host.
freebsd1#


but you probably thinking this is going to be a hassle having to telnet into each daemon. Well the good news is quagga ships with a "vtysh". This enables one login for all daemons.
FreeBSD2# vtysh

Hello, this is Quagga (version 0.99.4).
Copyright 1996-2005 Kunihiro Ishiguro, et al.

best of all you get your trace and ping commands back!
FreeBSD2.home# ping 172.16.1.2
PING 172.16.1.2 (172.16.1.2): 56 data bytes
64 bytes from 172.16.1.2: icmp_seq=0 ttl=253 time=25.635 ms
64 bytes from 172.16.1.2: icmp_seq=1 ttl=253 time=25.425 ms
64 bytes from 172.16.1.2: icmp_seq=2 ttl=253 time=25.575 ms
64 by^C
--- 172.16.1.2 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max/stddev = 25.399/25.509/25.635/0.099 ms
FreeBSD2.home# trace 172.16.1.2
traceroute to 172.16.1.2 (172.16.1.2), 64 hops max, 40 byte packets
1 172.99.1.2 (172.99.1.2) 1.365 ms 1.306 ms 1.283 ms
2 172.16.20.2 (172.16.20.2) 15.764 ms 15.719 ms 15.741 ms
3 172.16.1.2 (172.16.1.2) 16.314 ms * 16.326 ms
FreeBSD2.home#


now, vi /etc/rc.conf to enable zebra & routing daemons on startup.
freebsd1# vi /etc/rc.conf

quagga_enable="YES"
quagga_daemons="zebra bgpd"


oh, and if you really want to forward packets, you will also have to add the following to /etc/rc.conf to enable FreeBSD as a router.

gateway_enable="YES"


bada bing!

Friday, 28 December 2007

Headless FreeBSD Installation CD

Objective To create a bootable FreeBSD cd that will output to serial console. I had been previously creating headless BSD boot floppies however the preperarion & installation is quicker via cd.

on FreeBSD 5:
mdconfig -a -t vnode -f /path/to/image.iso -u 1

mount the device file.
mount -t cd9660 /dev/md1 /mnt/

on solaris:
mount 6.2-RELEASE-i386-bootonly.iso to a device file.
# lofiadm -a /export/home/philip/Desktop/6.2-RELEASE-i386-bootonly.iso /dev/lofi/1

mount the device file.
#mount -T hsfs /dev/lofi/1 /mnt

Once mounted: copy entire contents of cd to ~/Desktop/headlessBSD.
# cp -R /mnt /export/home/philip/Desktop/headlessBSD

edit loader.rc to output to serial port.
vi /export/home/philip/Desktop/headlessBSD/mnt/boot/loader.rc
"/export/home/philip/Desktop/headlessBSD/mnt/boot/loader.rc" [Read only] 17 lines, 389 characters
\ Loader.rc
\ $FreeBSD: src/sys/boot/i386/loader/loader.rc,v 1.4.2.1 2005/10/30 14:37:02 scottl Exp $
\
\ Set output to serial port
set console="comconsole"
\ Includes additional commands
include /boot/loader.4th

\ Reads and processes loader.conf variables
start

\ Tests for password -- executes autoboot first if a password was defined
check-password

\ Load in the boot menu
include /boot/beastie.4th

\ Start the boot menu
beastie-start

make an iso file from ammended headlessBSD folder. This will output headlessBSD.iso in home directory.
# mkisofs -U -no-emul-boot -b boot/cdboot -o /export/home/philip/headlessBSD.iso /export/home/philip/headlessBSD/mnt/
Warning: creating filesystem that does not conform to ISO-9660.
Size of boot image is 4 sectors -> No emulation
40.38% done, estimate finish Fri Dec 28 19:39:21 2007
80.77% done, estimate finish Fri Dec 28 19:39:22 2007
Total translation table size: 2048
Total rockridge attributes bytes: 0
Total directory bytes: 26624
Path table size(bytes): 68
Max brk space used 78000
12381 extents written (24 MB)


Burn ~/headlessBSD.iso to cd to create bootable headless BSD installation disc.