Monday, 26 August 2013
Cisco IOS, The World’s leading Network Infrastructure Software
Cisco IOS (originally Internetwork Operating System) is the software used on the vast majority of Cisco Systems routers and current Cisco network switches. (Earlier switches ran CatOS.)
IOS is a package of routing, switching, internetworking and telecommunications functions tightly integrated with a multitasking operating system.
The IOS CLI provides a fixed set of multiple-word commands — the set available is determined by the “mode” and the privilege level of the current user. “Global configuration mode” provides commands to change the system’s configuration, and “interface configuration mode” provides commands to change the configuration of a specific interface. All commands are assigned a privilege level, from 0 to 15, and can only be accessed by users with the necessary privilege. Through the CLI, the commands available to each privilege level can be defined.
Cisco IOS is versioned using three numbers and some letters, in the general form a.b(c.d)e, where:
a is the major version number.
b is the minor version number.
c is the release number, which begins at one and increments as new releases in the same a.b train are released.
d (omitted from general releases) is the interim build number.
e (zero, one or two letters) is the release train identifier, such as none (which designates the mainline, see below), T (for Technology), E (for Enterprise), S (for Service provider), XA as a special functionality train, XB as a different special functionality train, etc.
Most Cisco products that run IOS also have one or more “feature sets” or “packages”, typically eight packages for Cisco routers and five packages for Cisco network switches. For example, Cisco IOS releases meant for use on Catalyst switches are available as “standard” versions (providing only basic IP routing), “enhanced” versions, which provide full IPv4 routing support, and “advanced IP services” versions, which provide the enhanced features as well as IPv6 support.
Each individual package corresponds to one service category, such as IP data, Converged voice and data, Security and VPN. More info visit White Paper: Cisco IOS and NX-OS Software Reference Guide
A&Q about Cisco IOS (from Yahoo Answer)
Q: Help needed to upgrade my cisco switch ios?
I have connected my switch via console cable, I have set up a tftp server on my PC when I try to update the ios it keeps timing out.
A: First, your computer with the tftp server and the switch need to be connected via the network. When the switch pulls the image, it’s not through the console cable, but rather an ethernet port.
Second, your new IOS image needs to be in the correct folder on your local hard drive so the tftp server can reach the file and serve it to clients that ask. This varies greatly by tftp server, so I can’t give you clear directions for how to do this.
Third, your switch needs an IP address assigned to a vlan interface. Typically, vlan 1 is used, but more advanced users can use a different one. The configuration usually looks like:
configure terminal
interface vlan 1
ip address w.x.y.z 255.255.255.0
no shut
end
To do a little troubleshooting, try pinging your computer from the switch and then ping the switch from your computer. Due to firewalls, this may or may not work, but it’s a good tool.
Lastly, once you are sure that connectivity is in place, you issue the command “copy tftp flash” from the switch. The switch will ask you the IP address of the tftp server, then the filename, and then it will probably ask you if you want to erase the flash. You should usually press “enter” to confirm “yes” to erase the flash, otherwise you’ll run out of room in the memory. If you do not receive the question to erase the flash, that means there is a connectivity issue.
Hope this helps.
Source(s): http://www.cisco.com/en/US/products/hw/switches/ps700
Q: How I can install IOS into cisco switch 3560 series?
In my cisco switch 3560 series hasn’t IOS system and I cann’t into priveleged EXEC mode. “enable” function cann’t run!
A: The first thing you need to do is recover the password so you can “enable” privileged mode – you need to “break” as the switch is about to load…
1/ Put the new IOS onto a tftp server (if you don’t have one, google for “tftp server free download”).
2/ Get the switch onto the same network as your tftp server.
3/ decide if you have enough room in either flash or RAM (depending on your switch) and
copy tftp flash
What’s the Order of Operations for Cisco IOS?
What’s the order in which IOS processes the running config between the following items?
ACL
Distrubute list,
Route map
Routing Protocol
Routing
What im looking for is the packet flow when it arrives thru an interface for better understanding?
Does it go to acl first then nat then routing logic then routing table…?
or
Is it something like…this is the running config…if something doesnt work check these areas: ACL Dist list Route map, Routing protocol routing table, etc, not necessarily in a particular order
What’s the way a CCIE thinks?”
—Q from the Cisco Learning Network
The Cisco IOS order of operations plays an important role in how a router processes traffic. The order of operations tells the router how to process traffic according to the configuration of different router features.
If you’re simply using the most basic features of the router, chances are good that you’ll never have to think about the order of operations. However, when configuring features such as Network Address Translation (NAT), Quality of Service (QoS), and encryption, it’s essential to understand the order of operations in order to configure these features successfully.
Using the Cisco IOS actually involves two different orders of operations tables: the NAT Order of Operations and the QoS Order of Operations. Let’s take a look at each.
NAT Order of Operations
Before you can understand the NAT Order of Operations list, you first need to understand NAT. In its most basic form, NAT translates one IP address to another IP address.
When the router uses this order of operations, it takes the inbound packet, starting at the top and moves down the list. If the packet is from a NAT inside-designated interface, it uses the inside-to-outside list. If the packet is from an outside-to-inside interface, it uses that list.
Here’s the order of operations for the inside-to-outside list:
- If IPSec, then check input access list
- Decryption—for Cisco Encryption Technology (CET) or IPSec
- Check input access list
- Check input rate limits
- Input accounting
- Policy routing
- Routing
- Redirect to Web cache
- NAT inside to outside (local to global translation)
- Crypto (check map and mark for encryption)
- Check output access list
- Inspect context-based access control (CBAC)
- TCP intercept
- Encryption
Here’s the order of operations for the outside-to-inside list:
- If IPSec, then check input access list
- Decryption—for CET or IPSec
- Check input access list
- Check input rate limits
- Input accounting
- NAT outside to inside (global to local translation)
- Policy routing
- Routing
- Redirect to Web cache
- Crypto (check map and mark for encryption)
- Check output access list
- Inspect CBAC
- TCP intercept
- Encryption
More details in a larger diagram
Let’s say that you have an IP packet coming in from an outside-to-inside interface. When translating that packet, you want to use an access control list to block traffic from certain IP addresses. Which IP address should you put in the ACL—the IP address before the packet’s translation (i.e., the public IP address), or the IP address after the packet’s translation (i.e., the private address)?
By checking the order of operations, you can determine that the “NAT outside to inside” operation occurs after the “Check input access list” task. Therefore, you would use the public IP address in the ACL because the packet hasn’t gone through NAT.
On the other hand, what if you want to create a static route for traffic going through NAT? Should you use the public (outside) or private (inside) IP address? In this case, you would use the private (inside) IP address because the traffic has already gone through NAT when it gets to the “Routing” operation.
QoS Order of Operations
The Quality of Service (QoS) order of operations is another important list to know. Of course, this is only really important if you’re using QoS. But if you are, you need to be familiar with it.
Here’s the order of operations for inbound traffic to the router:
- QoS Policy Propagation through Border Gateway Protocol (BGP)—or QPPB
- Input common classification
- Input ACLs
- Input marking—class-based marking or Committed Access Rate (CAR)
- Input policing—through a class-based policer or CAR
- IPSec
- Cisco Express Forwarding (CEF) or Fast Switching
Here’s the order of operations for outbound traffic from the router:
- CEF or Fast Switching
- Output common classification
- Output ACLs
- Output marking
- Output policing—through a class-based policer or CAR
- Queueing—Class-Based Weighted Fair Queueing (CBWFQ) and Low Latency Queueing (LLQ))—and Weighted Random Early Detection (WRED)
Being familiar with the order of operations is vital when it comes to understanding how the traffic within a router is flowing and how to control that traffic. In my experience, the NAT order of operations is most important when you’re using any combination of NAT, crypto, ACLs, routing, or other features on the list.
Without a proper understanding of the order of operations, you can spend an entire week troubleshooting a basic NAT and ACL combination—without any luck. Knowing about the order of operations can really make a difference.
Top 10 Cisco IOS Configuration Mistakes
There are a number of common mistakes that are made while learning something about Cisco IOS. In this article it covers the largest of these misconfiguration. This list is of course subjective, but it should provide a good reference for those learning Cisco IOS.
Cisco IOS Configuration Mistakes You May Commonly Make
1. Password Verification
One easily made mistake comes with the way that passwords are configured with IOS. Unlike almost every other password configuration tool available, the password commands on IOS do not confirm the password being entered. Imagine getting a new piece of equipment configured and put into the field, then later when remote management is required, attempting to access the device only to learn that the password was entered incorrectly. In most cases, the only way to fix this is to have you or someone else physically on-site. Take care when configuring IOS passwords to ensure the password is entered correctly.
2. Wildcard Masks
Of the many people that learn IOS, a large number don’t quite understand the concept of a wildcard mask (or a mask generally). It can be difficult enough to learn the fundamentals of a simple subnet mask; add in access lists (ACL) and Open Shortest Path First (OSPF) configurations, and throw in wildcard masks. The thing to remember about wildcard masks is, like subnet masks, they are easier to grasp when using binary. A wildcard in binary is just the inverse of the subnet mask; e.g. the subnet mask 255.255.255.0 uses an inverse mask of 0.0.0.255.
3. Clock Rate vs Bandwidth
Another topic that is often the center of confusion when learning IOS is the difference between clock rate and bandwidth. While practically these two would seem to mean the same thing, but when configuring IOS they are used for two different tasks. The clock rate command is used to set the physical speed of an interface (typically serial interfaces). The bandwidth command is used to set the bandwidth of the interface as used by a couple of system processes, including interface statistics and routing protocol metrics. This command is not used in any way to affect the physical speed of an interface.
4. Telnet vs SSH
For those new to networking, they may not know the major difference between using Telnet or SSH (Secure Shell) to manage a device. For many IOS devices, Telnet is used as the default remote management method. The problem with this is that Telnet is not a secure management method — often IOS devices are placed into easily accessed networks and the use of Telnet makes the capture of management passwords very simple (as they are transmitted in cleartext). Always take the time to implement SSH on any production IOS device that is going to be accessed remotely.
5. Ethernet Duplex
It can be easy to overlook the Ethernet duplex setting since on many devices it is configured to be automatically selected. But when using devices that have been statically configured it is important to note that half and full duplex Ethernet connections are not compatible.
6. Process-ID vs. Autonomous System Number
When learning about dynamic routing protocols, there is a common mistake that is made between the configuration of OSPF and EIGRP. When configuring OSPF, a process-id is used to identify the routing process. This process-id is only locally significant. When configuring EIGRP, an autonomous system number (ASN) is used to identify the routing process. This ASN is globally significant and must match between configured EIGRP devices.
7. EIGRP Auto-Summary
When configuring EIGRP on IOS pre-15 it was the default for EIGRP auto-summary to be enabled. This can cause routing problems in networks where the IP addressing is not contiguous and/or hieratical. With the release of IOS 15 the default changed so that EIGRP auto-summary was disabled. If implementing EIGRP on IOS pre-15; ensure that the auto-summary is configured as expected on all devices.
8. Split Horizon
A problem that can often be seen by new network engineers on multipoint WAN networks is a problem that resulted from the default setting of split horizon. Split horizon is a loop prevention mechanism that is used by both RIP and EIGRP on WAN interfaces. Basically, what it does is restrict the advertisement of a network out the same interface on which it was learned — as long as the “best” route (for a specific network) exists out that same interface. The problem here lies in interfaces that connect to multiple remote devices: In this case, the setting of split horizon can prevent the advertisement of routes between devices out the same interface. For example, if R1 connects to R2 and R3 off of the serial0/0/0 interface; if R2 sends an advertisement to a network, R1 will not advertise this network to R3 because it sees the advertisement coming in the serial0/0/0 interface.
9. Simple Management Network Protocol (SNMP) Communities
A common security problem occurs when someone sets up the Simple Management Network Protocol (SNMP) with the default communities (public – Read/Only, private – Read/Write). The alteration of these default settings is essential to maintain the security of SNMP (versions 1 and 2c), as the community is the only real security feature built into these versions of the protocol.
10. Switchport Security
When configuring Switchport port-security, it is important to know that the default maximum number of hosts off of a switchport is 1. What this means is that the first host that sends traffic will be allowed and that all other hosts traffic will be dropped by default. Be sure to customize these default settings to the reader’s expectations before leaving your management session.
These are 10 of common misconfigurations that I’ve seen over the years. Hopefully this article will help prevent young network engineers from making these same mistakes when working on production equipment.
Wednesday, 14 August 2013
In the cloud, code doesn‘t need developers?
Platforms from companies such as OutSystems and Mendix have emerged in this development niche, and with them comes growing interest in codeless tools, says analyst David Norton of Gartner. "We're seeing SMBs who are trying to lower costs" by looking at high-productivity, model-driven environments, he says.
Also driving interest is frustration with IT and business units that want to handle their own development. An official at Software AG, which is a player in the codeless development market, concurs. "Businesses do not want to be dependent on IT to get everything done," says Pankaj Malviya, senior vice president and general manager of application PaaS at the company.
"I see a lot of interest and a fair amount of adoption," of codeless environments, says analyst John Rymer, of Forrester. He cites software vendors participating in the market ranging from Mendix to Salesforce.com and Microsoft with its SharePoint collaboration platform.
Mendix, OutSystems, and Software AG vie in codeless dev
Mendix bills its cloud-based platform as the app platform for the enterprise, or PaaS for the business user. "We help our customers dramatically cut down the time it takes to build new apps," says CEO Derek Roos.
"Instead of writing code, you basically model your app," he says. "It's a drag-and-drop-like interface." Application services are provided for building metadata-driven applications. Programs built in Mendix can be extended with Java or JavaScript.
OutSystems offers a visual, RAD (rapid application delivery) approach to development. With the OutSystems Platform, Java and .Net applications are generated. "This [system] has been built to build any style of complex apps," says David Holmes, vice president of marketing at OutSystems. Enterprise Web and mobile applications can be built, and reusable modules and components are featured.
Software AG moved into the codeless development space when it acquired cloud platform vendor LongJump this spring. The service has been rebranded AgileAppsLive. Visually developed, process-driven applications can be created without writing code, such as an employee onboarding system, Malviya says. These can be deployed in private or public clouds, on-premise or to mobile devices.
LongJump client Economic Modeling Specialists, which provides Web-based tools for looking at labor market data, has used the platform to fashion record-keeping applications. The company is moving over to AgileAppsLive. A junior developer has been designated to work with the platform, says David Wallace, project manager at Economic Modeling Specialists.
"We basically explain to him, 'Here's what we want to do, here's the kind of report we need,'" Wallace says. The developer then figures out database fields and can build workflows and automated triggers. "It has a workflow built into it."
LongJump enables building of forms-based business applications, Wallace says. "[It] has saved us a ton of money, a ton of time," he says. "It's just a flexible, prebuilt structure that really lets us fly."
Codeless approaches can be limiting
Still, these tools have their limitations -- particularly when it comes to integration. Integrating with mainframes via codeless platforms can be an issue, Norton notes, and a skill set has to be acquired. "The limitation of any high-productivity environment or model-driven environment is it needs a different set of skills [than] traditional language-based development like Java or .Net," Norton says. Application builders need to deal with abstraction and models.
While acknowledging that "codeless" development expands software building beyond just developers, Rymer sees the risk of vendor lock-in. "These are completely proprietary environments, most of which are provided by small vendors." He also rejects the term "codeless," saying, "These environments allow delivery of simple applications without writing code. But in the real world, there's usually some [code] somewhere in the project." He cited integration as a place where custom code is needed.
Java and .Net developers will not be losing their jobs over the codeless environments, Norton says, and there will always be a need for developers who could build something such as a complex billing system faster in Java than it could be done in Unified Modeling Language In some corporations, abstract- and model-based approaches to development do not fit in with the culture, according to Norton.
But productivity can be much greater with the codeless tools. Users can become productive in a matter of days, Norton says: "Once you get people trained up, their productivity can be eight to 12 times higher" than with standard development using Java or .Net.
Facebook Puts the Brakes on ‘The Hacker Way’
Before taking his company public last year, Facebook CEO Mark Zuckerberg warned Wall Street that his social network would follow “The Hacker Way,” an unconventional path built in part around the adage “move fast and break things.”
The idea was that Facebook would rather make mistakes than get left behind in fast-innovating Silicon Valley. But a year and a half after the “Hacker Way” manifesto, Facebook is breaking fewer things and moving more slowly — at least when it comes to individual features and products. It’s testing new tools more thoroughly prior to release and then parsing goodies out slowly to help smoke out even more problems.
Facebook’s move toward greater testing is a sign of maturation at the company, overseen by the 29-year-old Zuckerberg, and this should help Facebook as it seeks to build an ever more intimate relationship with its users, collecting data on their physical movements and offline shopping habits, trying to capture more of their web searches, and targeting them based on other websites they’ve visited.
In some regards, Facebook is moving faster than it ever has before. Since going public, it has launched a search engine, a mobile “apperating system,” a camera app, a pages app, a “poke” app, an app store, an ad exchange, an online store, a gift card, a video sharing system, at least two major news feed updates, and plenty more. The teenaged Zuckerberg, in full hacker glory as a Harvard underclassman, would have approved of the breakneck product release pace.
But while Facebook has more projects going in parallel, it has learned to take its time releasing each one. Take the News Feed revision released by the company earlier this week, which can resurface old but relevant content you’ve loaded but not looked at and which weighs content according to who you’ve interacted with most recently on Facebook. The changes were tested first on Facebook employees, who over the course of two weeks registered only a single complaint, and then on roughly 1 percent of the 700 million Facebook users who visit their news feeds every day.
All significant tweaks to News Feed get some sort of testing on a subset of Facebook users, usually for a week or two, according to engineering manager Lars Backstrom. This week, Facebook created a new blog to announce major changes to News Feed, part of an attempt to solicit still more feedback.
Even more extensive testing accompanied the release of Facebook’s Graph Search, which spent more than two years as an internal project, being refined, tested on employees, and even tested on users behind one-way glass. After it was announced publicly in January, Graph Search was made available to “a very small number of users,” as Zuckerberg put it.
Only this week did all English speaking U.S. users gain access. In the intervening months, Facebook engineers tweaked the system to account for unanticipated challenges, like people typing “pics of besties” rather than the more understandable “photos of my friends,” or typing “movies I dig” instead of “movies I like.”
At Graph Search’s launch, Zuckerberg even went so far as to brag about how slowly Graph Search would be deployed. “We’re going to start rolling it out very slowly,” he said, “and we’re going to incorporate data from how people use it and we’re going to make the product better before we roll it out very widely.”
Facebook’s love for pre-release testing has even grown to include advertising products. Facebook Exchange, a potentially creepy (if well precedented) product that shows users ads based on what outside websites they’ve recently visited, was in beta for three months prior to broader launch in September.
This sort of care should be a welcome change for Facebook users burned by the social network’s old familiar cycle of making big sweeping changes, whether to privacy standards or the Facebook interface or both, angering users, apologizing to those users, and partially reversing the original changes. It’s been a couple of years since Facebook went through one of those.
Not that Wall Street has fully appreciated Facebook’s caution. Analysts have been quick to note that while Facebook announced it was doubling its costs this year amid a hiring binge, it simultaneously warned that the payoff from new products like Graph Search and Facebook Home will come only in the years to come. As a result, Facebook spent more than a year trying simply to return its stock to the levels of its initial public offering. But investors may yet find that user trust pays very nice dividends over the long haul.
Apple seeks ban on Samsung phones in the US
Apple is trying to force Samsung Electronics's mobile devices off US store shelves a week after dodging an iPhone 4 ban by a rare White House veto.
The company will ask a US appeals court to block sales of Samsung models a California jury found violated patents for the iPhone's look and features . Later, a US trade agency is expected to say if it will halt some Samsung imports based on other Apple patent infringement claims.
For Cupertino, California-based Apple, making Samsung change or stop selling some smartphones and tablet computers is more important than money. The $1 billion verdict it won at trial last year equals less than two weeks' worth of iPhone sales and one-seventh of Samsung's second-quarter profit.
"Sometimes, the money's not enough," said Ray Van Dyke, a technology-patent lawyer with the Van Dyke Firm in Washington. "Between Apple and Samsung, it's about who's going to be the top dog. You want to shut them down. This is the club. You can beat them into submission with a club and maintain your top dog status."
Apple and Samsung together make almost half of all smartphones sold, with Samsung holding the title of world's biggest and the two companies vying to be No. 1 in the US.
The two companies are spending millions of dollars in legal fees battling across four continents.
The company will ask a US appeals court to block sales of Samsung models a California jury found violated patents for the iPhone's look and features . Later, a US trade agency is expected to say if it will halt some Samsung imports based on other Apple patent infringement claims.
For Cupertino, California-based Apple, making Samsung change or stop selling some smartphones and tablet computers is more important than money. The $1 billion verdict it won at trial last year equals less than two weeks' worth of iPhone sales and one-seventh of Samsung's second-quarter profit.
"Sometimes, the money's not enough," said Ray Van Dyke, a technology-patent lawyer with the Van Dyke Firm in Washington. "Between Apple and Samsung, it's about who's going to be the top dog. You want to shut them down. This is the club. You can beat them into submission with a club and maintain your top dog status."
Apple and Samsung together make almost half of all smartphones sold, with Samsung holding the title of world's biggest and the two companies vying to be No. 1 in the US.
The two companies are spending millions of dollars in legal fees battling across four continents.
Subscribe to:
Posts (Atom)