GNS3 - Specifying interfaces for links.

For some bizarre reason, GNS3 doesn't by default let you choose which interface to use when use the link tool to join devices.

To fix this, go to Edit -> Preferences -> General -> [GUI Settings]

Then check [x] Always use manual mode when adding links.

Oh - and then restart (yes - annoying if you're in the middle of a lab - you remembered to select "save to nvram" when you created the project right?).
Done.

Xen Desktop Minimum Cost Deployment Guide

Ok.

Let's say you're a small business and you need VDI for your staff when they're out of the office / working from home.

Let's face it - Citrix is the established name in this area.

Having said that, they're a bit of a closed book when it comes to purchasing software and licenses and the only way you seem to be able to get it setup is by paying a contractor to set it up for you out the nose.

Well this guide is for those contractors.

Rather than making your customers pay for all sorts of Virtualisation server licensing, there's a cheaper way (in terms of licensing and overall for the customer) to do this, which means more money for you in professional services :)

There's an older verison of Xen Desktop called Xen Desktop 5 Express which is free for 10 users.

That's pretty cool.

There's three main requirements if you want to implement an on-network version of this for free.

Firstly, you need to have a Citrix Xen Virtual Server to run it on, a Windows 2K8 Server and then enough resources to host a bunch of Win 7 guests.

To setup external access, you need some type of SSL-VPN server to provide users with secure but high-speed access to the Citrix VDI service (IPSEC will be WAAAAY too slow).

Anyway, we'll get to the external access bit later.

In all this - there's one thing they don't tell you.

If you want to use VMWare as your Virtualisation platform, you need to use the licensed version of ESX as Xen Desktop requires vCentre when running on VMWares technology.

vCenter iteslf is licensed (and quite expensive) and doesn't work with the free version of ESX.

So - what's your best bet?

It's actually SIGNIFICANTLY cheaper to buy a separate physical server for your Xen Desktop environment and run the free Xen Server on it.

I priced the cost of ESX (licensed) + vCenter Essentials (as at 17/08/13) and that was at least $3000.

The best alternative is to buy a physically separate server for ~$1000 (for a Dell Xeon based unit) and bang the free version of Xen Server on there.

The other alternative is to run Xen Server as a nested host on ESXi but performance will probably suck.

Anyway, that's the best option for a live real world environment for your clients.

To test this in a lab however you can take the nested xen server option.

Requirements for a basic Xen VDI deployment:

• 2 * Win 2K8 VMs and a Win 7 Pro (or better - AD membership required) VM and then as many VMs as users you will have.

One of the 2k8's runs AD, the other is an AD member and runs all the Citrix server components.

You then have a Win 7 template VM which is used as the base for all the Citrix VDI VMs.

Step 1) Create ESXi guest for Xen Server

Step 2) Enable "vhv" for esxi Xen Server Guest

Step 3) Install Xen Server on VMWare Guest

Step 4) Install 2K8 AD DC.

Step 5) Install 2K8 member and Xen Desktop Server.

Step 6) Install Win7 on guest VM and install any apps you want the VDIs to have.

primary win server required (ad dc)
have to run win 7 vdi install twice (fails first time) - run again after first reboot
account logged in as is one used for xen desktop server config so use a domain admin account
xen desktop 2k8 server storage increased to 48gb
each time you make a vdi it consumes the same amount of storage as the master.

win 7 x32 client used

dhcp configured on dc

xen desktop virtual agent installed as local machine admin (non-domain account)

virtual desktop agent threw no errors using this method.

private and domain firewalls disabled on all servers and workstations

Edit->Preferences->General->[GUI Settings]


Check [x] Always use manual mode when adding links

running xen desktop studio had to add xenlab.local\xenadmin as local admin

install of xen desktop was created using local admin account on 2k8 xendesktop server

domain admin xenadmin was added as local admin on win7 machine before running quick deploy on xendesktop server

when running quick deploy logged on as domain xenadmin received error account permissions not good enough
had to supply local admin account creds (appears account used to install has permission and others don't)

BGP and Source Based Route Maps

Ahem. Yes - it's probably high time I stop being so distracted and put some networking related articles up.

Well, until my focus drifts again, here's an article on how to source based route maps for BGP instances.

Scenario:

Let's say you've got two pairs of routers with each pair at a different company.

We'll be running iBGP between routers at the same company and eBGP between companies.

Different service providers are used for connectivity as follows:

Now let's say that we want to route a couple of /24 subnets over link A and B however we want to route traffic for some particular hosts within those 4 * /24 subnets over link A only.

This is initially pretty easy.

Step 1) Define interfaces
Company_A_DC1
hostname A1
interface fa 0/0
ip address 172.16.0.1 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.9 255.255.255.248
no shut
exit

Company_A_DC2
conf term
hostname A2
interface fa 0/0
ip address 172.16.0.17 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.10 255.255.255.248
no shut
exit

Company_B_DC1
conf term
hostname B1
interface fa 0/0
ip address 172.16.0.2 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.25 255.255.255.248
no shut
exit

Company_B_DC2
conf term
hostname B1
interface fa 0/0
ip address 172.16.0.18 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.26 255.255.255.248
no shut
exit

Step 2) Define eBGP and iBGP Peers
A1
router bgp 64512
neighbor 172.16.0.2 remote-as 64513
neighbor 172.16.0.10 remote-as 64512
neighbor 172.16.0.10 next-hop self
no auto-summary
exit

B1
router bgp 64513
neighbor 172.16.0.1 remote-as 64512
neighbor 172.16.0.26 remote-as 64513
no auto-summary
exit

A2
router bgp 64512
neighbor 172.16.0.18 remote-as 64513
neighbor 172.16.0.9 remote-as 64512
neighbor 172.16.0.9 next-hop self
no auto-summary
exit

B2
router bgp 64513
neighbor 172.16.0.17 remote-as 64512
neighbor 172.16.0.25 remote-as 64513
no auto-summary

exit

Step 3) Define Local Interfaces

A1
interface fa 2/0.1
encapsulation dot1q 1
ip address 10.0.50.254 255.255.255.0
no shut
exit
interface fa 2/0.2
encapsulation dot1q 2
ip address 10.0.100.254 255.255.255.0
no shut
interface fa 2/0
no shut


A2

interface fa 1/0.1
encapsulation dot1q 1
ip address 10.0.50.253 255.255.255.0
no shut
exit
interface fa 1/0.2
encapsulation dot1q 2
ip address 10.0.100.253 255.255.255.0
no shut
interface fa 1/0
no shut

B1
interface fa 2/0.1
encapsulation dot1q 1
ip address 192.168.100.254 255.255.255.0
no shut
exit
interface fa 2/0.2
encapsulation dot1q 2
ip address 192.168.200.254 255.255.255.0
no shut
interface fa 2/0
no shut

B2
interface fa 2/0.1
encapsulation dot1q 1
ip address 192.168.100.253 255.255.255.0
no shut
exit
interface fa 2/0.2
encapsulation dot1q 2
ip address 192.168.200.253 255.255.255.0
no shut
interface fa 2/0
no shut

Step 4) BGP Network Statements and How-To Advertise /32 Hosts in BGP

Ok - so now we've got our basic lab setup with BGP advertising some subnets at different locations.

Now we want to advertise the /24 subnet on both Company A DC1 and DC2 but then also put some more specific host routes on Company A DC1's router to make this the preferred entry point router for these specific hosts.

We can control which is the preferred entry point for the /32 host routes as they are more specific and should be more favoured by the external BGP AS's.

To advertise the /24's:

A1
router bgp 64512
network 10.0.100.0 mask 255.255.255.0
network 10.0.50.0 mask 255.255.255.0
exit

A2
router bgp 64512
network 10.0.100.0 mask 255.255.255.0
network 10.0.50.0 mask 255.255.255.0
exit

To advertise the /32's:
As the host IPs 10.0.50.1 and 10.0.50.20 are learnt from networks with a mask of 255.255.255.0, BGP won't enter them into the route table as the mask doesn't match.

To address this, create a static route for that IP as follows:
A1
ip route 10.0.50.1 255.255.255.255 fast 2/0
ip route 10.0.50.20 255.255.255.255 fast 2/0
exit

You can also use an IP as the next-hop for the static route, as long as it's the actual next-hop for that destination it doesn't matter :)

Now that the router is learning a /32 mask for this host, you can advertise this network in BGP:

A1
router bgp 64512
network 10.0.50.1 mask 255.255.255.255
network 10.0.50.20 mask 255.255.255.255
exit

Step 5) Controlling the Return Route Path

Ok - so now we're successfully making Company B routers take the route path via ISP A to reach Company A for 2 specific hosts.

Now, the aim of this scenario is to force all traffic in all directions for these two hosts over the one ISP link.

To do this we need to make sure that if the two source IPs 10.0.50.1 and 10.0.50.20 try to route out router A2 we force the traffic via A1.


We can do this by defining a route map on Company_A_DC2's router which matches a source IP of the /32 hosts defined with destination any and then uses the BGP route-map "Next-Hop" function to force traffic out Company_A_DC1's router.

First of all we need to create the route-map which specifies the IPs of the hosts we want to redirect:

route-map redirect_hosts permit 10
match ip address Host_IPs
set ip next-hop 172.16.0.9
exit

ip access-list extended Host_IPs
permit ip host 10.0.50.1 any
permit ip host 10.0.50.20 any

The significant part of the statement above is the any statement on the end of the access-list rule.

This signifies that this rule is to be applied to 10.0.50.1 and 10.0.50.20 as the source IP.
Without the any statement this rule would take effect in both directions and could cause major issues for the return path to the server from Company B.

Now we want to apply this to interface fa1/0 on A2 to force any traffic entering this interface over to router A1:

interface fastEthernet 1/0
ip policy route-map redirect_hosts

Congratulations :)

You've just forced BGP into doing something a little bit nasty.

Not exactly the recommended way of doing things but a good one to keep in your back pocket nonetheless.

Nested VM Hypervisor aka Enabling VT-x for Guests

To enable nested VT, add this line to the .vmx file of the ESXi virtual machine:

vhv.enable = "TRUE"

The easiest way to do this is download the .vmx file from the data store, edit it, and over-write the original.

Cop that IBM you W@nkers.

About time.

IBM has now been banned from bidding on any Qld State Government projects until they "address what the state says are IBM's project governance issues".

http://yro.slashdot.org/story/13/08/08/0225222/australian-state-bans-ibm-from-all-contracts-after-payroll-bungle

http://delimiter.com.au/2013/08/07/banned-qld-govt-outlaws-new-ibm-contracts/

Not really enough of a consequence in my opinion though.

How about:

"Until they pay back the money they stole (above standard market rate) and money taken for projects not delivered".

And then given them a 20 year ban on top of that out of spite anyway.

F#$%ers.

Fortinet Forticlient VPN on Windows 8 - how to make it work.

My work laptop recently received the Windows 8 treatment and all I can say is - wow - what was the point of that?

If you use the Fortinet VPN client, you'll instantly start raging because it doesn't work.

Here's the hot tip - to make it work, you have to manually enter the default port number (if that's what you use) of 10443 in the connection settings box.

It's already there and greyed out but apparently there was a glitch in the Matrix and this somehow became broken on Win 8...