BGP and Source Based Route Maps

Ahem. Yes - it's probably high time I stop being so distracted and put some networking related articles up.

Well, until my focus drifts again, here's an article on how to source based route maps for BGP instances.

Scenario:

Let's say you've got two pairs of routers with each pair at a different company.

We'll be running iBGP between routers at the same company and eBGP between companies.

Different service providers are used for connectivity as follows:

Now let's say that we want to route a couple of /24 subnets over link A and B however we want to route traffic for some particular hosts within those 4 * /24 subnets over link A only.

This is initially pretty easy.

Step 1) Define interfaces
Company_A_DC1
hostname A1
interface fa 0/0
ip address 172.16.0.1 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.9 255.255.255.248
no shut
exit

Company_A_DC2
conf term
hostname A2
interface fa 0/0
ip address 172.16.0.17 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.10 255.255.255.248
no shut
exit

Company_B_DC1
conf term
hostname B1
interface fa 0/0
ip address 172.16.0.2 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.25 255.255.255.248
no shut
exit

Company_B_DC2
conf term
hostname B1
interface fa 0/0
ip address 172.16.0.18 255.255.255.248
no shut
exit
interface fa 0/1
ip address 172.16.0.26 255.255.255.248
no shut
exit

Step 2) Define eBGP and iBGP Peers
A1
router bgp 64512
neighbor 172.16.0.2 remote-as 64513
neighbor 172.16.0.10 remote-as 64512
neighbor 172.16.0.10 next-hop self
no auto-summary
exit

B1
router bgp 64513
neighbor 172.16.0.1 remote-as 64512
neighbor 172.16.0.26 remote-as 64513
no auto-summary
exit

A2
router bgp 64512
neighbor 172.16.0.18 remote-as 64513
neighbor 172.16.0.9 remote-as 64512
neighbor 172.16.0.9 next-hop self
no auto-summary
exit

B2
router bgp 64513
neighbor 172.16.0.17 remote-as 64512
neighbor 172.16.0.25 remote-as 64513
no auto-summary

exit

Step 3) Define Local Interfaces

A1
interface fa 2/0.1
encapsulation dot1q 1
ip address 10.0.50.254 255.255.255.0
no shut
exit
interface fa 2/0.2
encapsulation dot1q 2
ip address 10.0.100.254 255.255.255.0
no shut
interface fa 2/0
no shut


A2

interface fa 1/0.1
encapsulation dot1q 1
ip address 10.0.50.253 255.255.255.0
no shut
exit
interface fa 1/0.2
encapsulation dot1q 2
ip address 10.0.100.253 255.255.255.0
no shut
interface fa 1/0
no shut

B1
interface fa 2/0.1
encapsulation dot1q 1
ip address 192.168.100.254 255.255.255.0
no shut
exit
interface fa 2/0.2
encapsulation dot1q 2
ip address 192.168.200.254 255.255.255.0
no shut
interface fa 2/0
no shut

B2
interface fa 2/0.1
encapsulation dot1q 1
ip address 192.168.100.253 255.255.255.0
no shut
exit
interface fa 2/0.2
encapsulation dot1q 2
ip address 192.168.200.253 255.255.255.0
no shut
interface fa 2/0
no shut

Step 4) BGP Network Statements and How-To Advertise /32 Hosts in BGP

Ok - so now we've got our basic lab setup with BGP advertising some subnets at different locations.

Now we want to advertise the /24 subnet on both Company A DC1 and DC2 but then also put some more specific host routes on Company A DC1's router to make this the preferred entry point router for these specific hosts.

We can control which is the preferred entry point for the /32 host routes as they are more specific and should be more favoured by the external BGP AS's.

To advertise the /24's:

A1
router bgp 64512
network 10.0.100.0 mask 255.255.255.0
network 10.0.50.0 mask 255.255.255.0
exit

A2
router bgp 64512
network 10.0.100.0 mask 255.255.255.0
network 10.0.50.0 mask 255.255.255.0
exit

To advertise the /32's:
As the host IPs 10.0.50.1 and 10.0.50.20 are learnt from networks with a mask of 255.255.255.0, BGP won't enter them into the route table as the mask doesn't match.

To address this, create a static route for that IP as follows:
A1
ip route 10.0.50.1 255.255.255.255 fast 2/0
ip route 10.0.50.20 255.255.255.255 fast 2/0
exit

You can also use an IP as the next-hop for the static route, as long as it's the actual next-hop for that destination it doesn't matter :)

Now that the router is learning a /32 mask for this host, you can advertise this network in BGP:

A1
router bgp 64512
network 10.0.50.1 mask 255.255.255.255
network 10.0.50.20 mask 255.255.255.255
exit

Step 5) Controlling the Return Route Path

Ok - so now we're successfully making Company B routers take the route path via ISP A to reach Company A for 2 specific hosts.

Now, the aim of this scenario is to force all traffic in all directions for these two hosts over the one ISP link.

To do this we need to make sure that if the two source IPs 10.0.50.1 and 10.0.50.20 try to route out router A2 we force the traffic via A1.


We can do this by defining a route map on Company_A_DC2's router which matches a source IP of the /32 hosts defined with destination any and then uses the BGP route-map "Next-Hop" function to force traffic out Company_A_DC1's router.

First of all we need to create the route-map which specifies the IPs of the hosts we want to redirect:

route-map redirect_hosts permit 10
match ip address Host_IPs
set ip next-hop 172.16.0.9
exit

ip access-list extended Host_IPs
permit ip host 10.0.50.1 any
permit ip host 10.0.50.20 any

The significant part of the statement above is the any statement on the end of the access-list rule.

This signifies that this rule is to be applied to 10.0.50.1 and 10.0.50.20 as the source IP.
Without the any statement this rule would take effect in both directions and could cause major issues for the return path to the server from Company B.

Now we want to apply this to interface fa1/0 on A2 to force any traffic entering this interface over to router A1:

interface fastEthernet 1/0
ip policy route-map redirect_hosts

Congratulations :)

You've just forced BGP into doing something a little bit nasty.

Not exactly the recommended way of doing things but a good one to keep in your back pocket nonetheless.

Nested VM Hypervisor aka Enabling VT-x for Guests

To enable nested VT, add this line to the .vmx file of the ESXi virtual machine:

vhv.enable = "TRUE"

The easiest way to do this is download the .vmx file from the data store, edit it, and over-write the original.

Cop that IBM you W@nkers.

About time.

IBM has now been banned from bidding on any Qld State Government projects until they "address what the state says are IBM's project governance issues".

http://yro.slashdot.org/story/13/08/08/0225222/australian-state-bans-ibm-from-all-contracts-after-payroll-bungle

http://delimiter.com.au/2013/08/07/banned-qld-govt-outlaws-new-ibm-contracts/

Not really enough of a consequence in my opinion though.

How about:

"Until they pay back the money they stole (above standard market rate) and money taken for projects not delivered".

And then given them a 20 year ban on top of that out of spite anyway.

F#$%ers.

Fortinet Forticlient VPN on Windows 8 - how to make it work.

My work laptop recently received the Windows 8 treatment and all I can say is - wow - what was the point of that?

If you use the Fortinet VPN client, you'll instantly start raging because it doesn't work.

Here's the hot tip - to make it work, you have to manually enter the default port number (if that's what you use) of 10443 in the connection settings box.

It's already there and greyed out but apparently there was a glitch in the Matrix and this somehow became broken on Win 8...

Samsung Tec Tiles. Necessary? No. But damn cool.

I'm constantly impressed by my Samsung i9305 (or S3 4G if you will) Android Smartphone.

Whether I'm firing up sudo commands within the terminal emulator to do some external access testing or using my Qi charger on my desk to power the sucker up again, I'm constantly impressed with what you can do with this unassuming looking device.

I was having a conversation with someone the other day along the lines of "wouldn't it be great if you could just get in your car and your phone would turn on its bluetooth radio automatically?".

While you're at it, why not fire up driving mode and either the music player or Google nav?

I said "yeah - I remember something about Samsung selling programmable NFC stickers" and the inner geek in me thought I'd better have a look...

After a bit of Googling around I found the stickers in question and remembered they were marketed as "Tec Tiles" by Samsung.

For the reasonable sum of approx. $3 a sticker I ordered a pack of 5 off eBay and am well chuffed.

The setup was literally as easy as install the app on your Android phone from the Play Store and select what you want the sticker to do.

You then "write" to the tag (will have to look into this as I suspect the phone actually just reads a sticker ID or something and associates that with commands in a database or something - or it could actually program the sticker - who knows?) and that's it!

I've now got a nifty little Samsung NFC sticker in my car that I simply tap my phone against and I'm in (what I like to call) driving mode.

Necessary? No.

But they're damn cool :)

Best HTPC Remote Control (Hand Held) Setup

It was a sad day when my official Microsoft MCE remote (1039 model - picture below) packed it in.

Official MCE Remote = Awesome.
Sadly no longer in production.

I'd gotten very used to this remote with its nicely functioning and highly responsive buttons and the way it "just worked".

As this remote is no longer in production (and there is no updated version) I was left with the option of getting the closest thing to an official MS remote which was the Happuage MCE Remote Kit which runs for about $50 in Australia or a cheap ebay generic kit which ran for about $20.

I ended up going with the ebay generic version which worked but was quite frustrating in that buttons didn't register properly and was very unresponsive (as in lots of delay) when buttons did actually register.

So - if you're new to the Media Centre game and want a good quality remote setup, what's your best option?

If I was doing it all again (or had to start from scratch right now), my recommendation would be to buy the cheap ebay MCE kit and throw away the remote but keep the USB IR receiver.

Next, go out (or stay in I guess these days...) and get yourself a Logitech 
Harmony remote.

There are various models ranging from $20 - $200 depending on the level of fanciness you feel you need :)

Cheap ebay Generic Kit =
bad remote performance but a
good way to obtain a USB IR receiver.

I purchased a bargain clearance model Harmony 200 for $15 from JB HiFi and am super impressed with it.

I simply signed up via myharmony.com to access the configuration service and fired up the browser based plugin which then let me start configuring up my remote.

I used the software to configure the primary profile (as you can see there are three profiles - tv, cable and DVD which can be mapped to any device you desire) as a Microsoft 1039 Media Centre remote and waited for the config to sync to the remote.

I then thought - it can't be that easy.

I walked into the lounge and pressed the power button and the HTPC woke up straight away.

Logitech Harmony. Get one. Now.

Am very impressed at this point.

I then proceeded to give all the other buttons a whirl and everything worked perfectly.

All commands were mapped as I expected and the buttons register first time every time.
As a bonus the interface is nice and responsive.

This is all using the original USB IR receiver from my Microsoft MCE remote kit (which is the same what's included in the ebay kit mind you).

I then took it a step further and loaded the profiles for my TV and Stereo Mini System on and was further impressed with the setup.

The only thing I had to do in addition to this was manually configure a button for use with the stereo mini system profile so that I could scroll through my input selects.

This was as simple as using the Logitech configuration software and pointing the original remote at the new remote, pressing the desired button and then dragging and dropping the newly learnt command to the relevant button in the configuration software.

The ultimate party piece is when you've setup the special "Watch TV" button at the very top left of the remote correctly.

By default this will turn on and off your media centre and TV simultaneously.
Spending 5 minutes more with the software will allow you to also make it include your stereo / amp in that process which is just awesome.


Very impressive stuff :)

Minix Neo X5 Mini Android Media Center

Finally.

An Android based media center device that is small, powerful and has a decent remote control and keyboard option.

Minix has just released the Neo X5 Mini and it looks bloody good.

Spec wise it's very similar to it's previous incarnation but got shrunk in the wash and now has a better remote.

The device is orderable from Deal Extreme for the very reasonable price of $89 (AU).

For that you get a tiny little media center that's capable of running XBMC with hardware acceleration (using the MX player trick), HDMI output, SPDIF output, 802.11n 2.4GHz support as well as 2 USB ports, an  ethernet port (think it's only 100mbps) and an SD slot.

Inside the SoC it packs a Rockchip RK3066 Dual-Core 1.6GHz processor (Cortex A9 architecture) and a Quad-Core Mali 400GPU.

That little GPU will more than take care of 1080p decoding :)

Full specs are available at the official Minix product page.

It comes with a small remote that is meant to better than the one included with the standard size Neo X5 and also supports the mini keyboard / wii-mote style thingy / accelerometer controller (available from Deal Extreme for $40 AU).

This pricing is not great at the moment due to the over-inflated US dollar (waiting for imminent crash...).

There's an XBMC release (Neon XAF build) compatible with the Neo X5 mini over at xbmcandroid.com including instructions.

I highly recommend changing the theme to Confluence :)

Check out the youtube clip below for a great full review and to see XBMC in action.