IPAM Tools

Results (chaotically organized) from a fresh online and community research on IPAM topic.

Asked questions: 

1) What do U want to use for IPAM? 

2) What do U use for IP Address Management?  

3) Honеstly ?

1) 

• phpipam (nice & easy, simple, partial multi tenant)
• racktables (too complex, verry good for DC servicing)
• infoblox (paid)
• nipap
• netdot (acceptable level of functionality and eye-look; will work for DC servicing; obsolete support?)
• solarwinds
• teemip
• ipplan

(Never heard before)

• gestioip
• bluecat
• open network admin (nice functionality / horrible interface )
• address commander

2)

• wiki(pedia)tables 
• redmine
• spreadsheets
• txt files

3)

• dns and dhcp -- coz I want 2b a hackerZ

• sticky notes (color coded) --  coz I'm professional
• dart target -- coz The Force is with me!
• custom or internally developed tools/applications -- coz ... толку си можем

Debian bonding/teaming (LACP)

Understanding the Bond Modes

Bond Mode 0 – Balance-rr
This method of NIC teaming is called ‘Round-Robin‘, hence the ‘RR‘ in the name. With this bond method, networks packets are rotated through each of the network interface cards that make up the bonded interface.
For example, a system with eth0, eth1, and eth2 all slaved to a bond0 interface. This interface, when enabled with bond mode 0, would send the first packet out eth0, the second packet out eth1, the third packet our eth2, and then start back at eth0 with the fourth packet. This is where the mode gets its ‘round-robin‘ name.

Bond Mode 1 – Active-Backup
With this bond method, only one network interface is active while the other interfaces in the bond simply wait for a failure in the link to the primary network interface card.

Bond Mode 2 – Balance XOR
In a balance XOR bond mode the bond will evaluate the source and destination mac addresses to determine which interface to send the network packets out. This method will pick the same interface for a given mac address and as a result is capable of load balancing and fault tolerance.

Bond Mode 3 – Broadcast
In this method the bond device will transmit data out all slave interfaces hence the ‘broadcast‘ name of this particular bonding method. There are very few uses for this method but it does provide a level of fault tolerance.

Bond Mode 4 – 802.3ad
This is a special bond method for link aggregation and does require special configuration on the switch to which this particular bonded interface connects. This method follows the IEEE standards for link aggregation and provides both fault tolerance and increased bandwidth.

Bond Mode 5 – Transmit Load Balancing
In TLB the bond will receive traffic on the slave interfaces as normal but when the system needs to send traffic, it will determine which interface is the best to transmit data on based upon the load/queue for each of the interfaces.

Bond Mode 6 – Adaptive Load Balancing
In ALB the bond will load balance similar to Bond Mode 5 but with the added ability to load receive balance as well.



Debian setup:


apt-get install ifenslave

cat /etc/network/interfaces 

auto bond0
iface bond0 inet static
address 10.0.0.80
gateway 10.0.0.1
broadcast 10.0.0.255
netmask 255.255.255.0
up /sbin/ifenslave bond0 eth1 eth2
down /sbin/ifenslave -d bond0 eth0 eth1

OR: 

cat /etc/network/interfaces 

auto eth0
    iface eth0 inet manual
    bond-master bond0

auto eth1
     iface eth1 inet manual
     bond-master bond0

auto bond0
     iface bond0 inet static
     address 10.0.0.80
     gateway 10.0.0.1
     netmask 255.255.255.0


bond-mode 802.3ad
bond-miimon 100
bond-lacp-rate 4
bond-slaves none

Cisco setup:

interface Port-channel2
 description LACP Channel for mk2
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1,2
 switchport mode trunk
 spanning-tree portfast trunk
!
interface GigabitEthernet1/0/23
 description mk2 eth0
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 2 mode active
!
interface GigabitEthernet1/0/24
 description mk2 eth1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 channel-group 2 mode active

Checking the Status of the bonded LACP interface

$ cat /proc/net/bonding/bond0

Ethernet Channel Bonding Driver: v3.1.1 (September 26, 2006)

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
Transmit Hash Policy: layer2 (0)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

802.3ad info
LACP rate: fast
Active Aggregator Info:
Aggregator ID: 1
Number of ports: 2
Actor Key: 17
Partner Key: 1
Partner Mac Address: 00:77:66:55:44:33

Slave Interface: eth0
MII Status: up
Link Failure Count: 0
Permanent HW addr: 00:99:98:97:96:95
Aggregator ID: 1

Slave Interface: eth1
MII Status: up
Link Failure Count: 0
Permanent HW addr: 00:88:87:86:85:84
Aggregator ID: 1

Junos Space password recovery.

Junos Space Netwrok Management platformVersion : 16.1R1.7 - trial version; virtual (ESX) appliance.

Installed by Juniper manual; after install I forgot for a while about this and week after I came back to  but ... I don't remember any passwords... so password change time.
[most are from official Juniper KB]

I. Reset admin user password (cli user; local user for centos on top of which OpenNMS live)
 
1. reboot
2. Press "e" on GRUB boot
2.1. if GRUB has password try default one: root/abc123
3. Append init=/bin/bash at the end of the kernel line.
   Remove console=ttys0,9600n8    (or any other console entries)
4. ESC to exit + "b" to boot
5. in bash remount as read/write:  mount -n -o remount,rw /.
6. passwd admin Admin user can use SSH login.
Try chage -l admin and if neccesary chage admin or chage -E "Jul 19, 2027" admin
7. init 0

 II Changing "super" password - user super is default user for WEB interface
1. ssh admin@IP.Of.Junos.Space
2. mysql -u jboss -pnetscreen build_db
3. mysql> update USER set password="ok89Nva6qHxytSHsP8AeLg==" where name="super";
This will reset the “super” password back to the default of juniper123
4. mysql> update USER set expiryDate="2027-07-19 16:27:45" where name="super";
A hack response to: "Your password has expired. Please contact your administrator." when trying to log into web with super/juniper123

III Changing the maintenance mode password

1.ssh admin@IP.Of.Junos.Space
2.htpasswd -sb /var/www/maintenance/maintPW maintenance password

MS Exchange 2010 create shared mailbox

via Power shell coz EMC GUI missed these click-objects

New-Mailbox -Name support -Alias support -OrganizationalUnit "eol.internal/Support Training" -Database "1StGroup" -UserPrincipalName support@eols.info -Shared

Add-MailboxPermission support -User "eol.internal/Users/Regular User 1" -AccessRights FullAccess

Add-ADPermission support -User "eol.internal/Users/Regular User 1" -ExtendedRights Send-As


We've created support@eols.info mailbox and assign FullAccess and Send-As permissions to MS AD User "Regular User 1"

SRX static DNS/host

I. Modify the /etc/hosts file:

    root@SRX> start shell

    root@SRX% vi /etc/hosts

    i -> 1.2.3.4 alabala

    wq


root@SRX> ping alabala
PING alabala (1.2.3.4): 56 data bytes

II. SRX static-host-mapping

root@SRX> set system static-host-mapping inet 1.2.3.4
root@SRX> set system static-host-mapping alias alabala

root@SRX>  ping alabala
PING alabala (1.2.3.4): 56 data bytes
64 bytes from 1.2.3.4: icmp_seq=0 ttl=57 time=31.675 ms
64 bytes from 1.2.3.4: icmp_seq=1 ttl=57 time=31.133 ms
64 bytes from 1.2.3.4: icmp_seq=2 ttl=57 time=31.152 ms

FTP service behind Firewall/NAT

Using FTP service behind Firewall/NAT box is a little bit tricky because of FTP protocol specificity.
In a normal days FTP client initiates a session to a server by opening a “command channel” connection to TCP port number 21 (where authentication and authorization magic is happen). After this a file transfer is requested by the client by sending a PORT command to the server. The server then attempts to initiate a “data channel” connection back to the client on TCP port number 20. FTP client's firewall data channel connection request from the server as unsolicited and drops the packets, causing the file transfer to fail or unable to list remote folders/files for example. Some firewall are smart enough to inspect this type of traffic and allow corresponding data-channel connections but this will not going to happen if we use FTP over SSL/TLS.
To avoid this issue, FTP also supports a “passive” operational mode in which the client initiates the data channel connection. Instead of using the PORT command, the client sends a PASV command on the command channel. The server responds with the TCP port number to which the client should connect to establish the data channel. These TCP port numbers are from higher range tcp 1024 - 65535. In this case what is happen when FTP server resides behind the Firewall/NAT box ?
FTP Client initiate a connection to FTP Server to tcp/21; Sends PASV command; FTP server responds with passive-ftp-port-ranges (5000-5500 for example); FTP Client trying to initiate a data connection to these new ports, and ... fails... because firewall/nat box on FTP server's side unable to find appropriate rules/sessions/flows for this kind of traffic. Once again - some smart firewalls  are using technology like traffic inspection (cisco ASA), application layer gateway (Juniper SSG/SRX), nat/protocol helpers (Linux) etc... but they are differ from version-to-version and very often they just don't work as expected.
So the best practice is to manually configure passive port-ranges and create appropriate Firewall/Port-Forwarding rules.
Example for MS IIS 7.5
IS  Manager - Connections - Mark server-level node - FTP Firewall Support (in the right panel) -
Data Channel Port Range & External IP Address of Firewall - Apply
Entering External IP Address is highly recommended (ot server level or per FTP site) to avoid errors like "ftp server sent unroutable address" because without this, FTP server will respond with their private IP address in a protocol header and will stun the ftp client.

net stop "Microsoft FTP Service" && net start "Microsoft FTP Service"

Pure-FTPd
in pure-ftpd.conf  file:
PassivePortRange 5000 5500
ForcePassiveIP

ProFTPd
PassivePorts 5000 5500 
MasqueradeAddress

Enable "smart firewall" feature 

CiscoASA9.1(config)# policy-map global_policyCiscoASA9.1(config-pmap)#  class inspection_defaultCiscoASA9.1(config-pmap-c)#  inspect ftp
CiscoASA9.1(config-pmap-c)# end



Juniper SRX :
set security alg ftp ?
  allow-mismatch-ip-address  Pass FTP packets with mismatched ip address headers and payload
  disable                                  Disable FTP ALG
  ftps-extension                       Enable secure FTP and FTP-ssl protocols
  line-break-extension             Enable CR+LF line termination


Mikrotik RouterOS 6.38.1
ip firewall service-port set ftp ports=21


Linux kernel 2.4.x and above 
modprobe ip_conntrack
modprobe ip_conntrack_ftp