The Cruft Of My Brain

I made another attempt at using VT-d for my cameras by going with Zoneminder under Linux. This actually worked and seemed to work ok but I really dislike Zoneminder! I tried Motion and kMotion instead and the good news is it works…for longer. I’m still having problems with kernel crashes after a day or two. It’s encouraging but I’m not sure I want to fuss with it anymore. Maybe I’ll try Zoneminder one more time just in case the kernel wants to behave.

Actually, it works but with limitations. No shock there. It turns out the PV-149 CCTV capture card I’m trying to pass through presents each channel as a separate Video and Audio device. What that means is I end up with 8 PCI devices that need to be extended. I’m running into a problem that might be specific to VMWare or VT-d where I can’t passthrough more than 6 PCI devices. This isn’t too big a deal as I don’t use the audio channels but I’m worried now that the missing audio is causing some BSOD’s. I’m still investigating.

Otherwise, vSphere is running pretty nice.

That’s a mouthful. I’ve been having a hard time figuring out how to successfully transfer images to the Standby ASA’s flash from the Active’s CLI. Finally figured it out. Here’s the syntax:

failover exec standby copy /noconfirm tftp://{ip address}/{file name} disk0:/{file name}

Without the /noconfirm it’ll fail. You also need a standby ip address on the interface facing the tftp server and I haven’t confirmed this but I think it might also need to be on the same subnet. I’m still having some trouble with a situation where the standby ASA would have to reach another subnet.

It’s now a month or so after the release of iOS4 and the Cisco Anyconnect Secure Mobile Client for iPhone is nowhere to be found. What’s up Cisco??? I want my Anyconnect!

And anyone believes they’ll actually ship the Cius? HA!

I previously posted about some luck I had getting IPSEC VPN to work from my iPhone to my IOS router/firewall. That post is now kind of useless because the source blog disappeared about a year ago. So, in order to make this useful again I’m posting my full IOS code (obfuscated for obvious reasons). Change the IP addresses and the group name and password and you should be good to go. This uses the new(ish) method in IOS of zone based firewall. It’s overly complex and really hard to parse for anything remotely complicated but it’s what I’m working with. You’ll notice I used the SDM for most of the config. Yep, I’m lame and I’m not afraid to admit it. All of that zone config typing would have been a pain in the butt! Also, be sure to use a pool that is different from your “inside” subnet. Won’t work otherwise. Also, it should be obvious but this config uses local users so you need to add at least one of those.

Keep in mind this will all change when iPhone OS4 comes out as it’s supposed to support SSL VPN’s. Finally. The IPSEC works perfectly fine for now though. I’ve not tested this on my iPad yet since I haven’t had it out of the house…and it’s not a 3G model. Don’t see why it wouldn’t work though.

And now the code:

aaa authentication login sdm_vpn_xauth_ml_2 local
aaa authorization network sdm_vpn_group_ml_2 local

ip access-list extended SDM_AH
remark SDM_ACL Category=1
permit ahp any any
ip access-list extended SDM_ESP
remark SDM_ACL Category=1
permit esp any any

Seems my original post about the AnyConnect Essentials license is still quite popular. So why not capitalize on that!

The license does work as advertised. It’s a replacement for the IPSEC based client that Cisco seems to have stopped development on. I’ve been using it in numerous situations and it works great!

I just have a funny situation though where my client was exploring alternatives to Cisco. We got pricing for a couple of competitors including Sonicwall and Juniper and let me tell you…whoo-boy! I guess the others haven’t felt compelled to follow Cisco’s lead and they are still charging ridiculous sums for the SSL VPN clients. Of course there were howls of protest about how their clients did so much more and that if you wanted the same level of functionality you had to pay for Cisco’s full SSL VPN solution. All true, but who cares????

I want a simple client based SSL VPN to replace the IPSEC clients of old. I don’t need all the fancy clientless stuff. I suspect that’s true for a lot of customers. Cisco’s pricing strategy for the AnyConnect Essentials is smart not just because they don’t want to continue to develop the IPSEC client but because it drives business away from their competitors.

Cisco, your choice in focus these days mostly pisses me off but this is a real winner. A small bright spot in an otherwise dreary path you’ve taken. Now, if you could find a way to ship ASA’s before the summer I’d be happy.

Say whaaaatttt???????? Ok, so you have a Checkpoint firewall with a whole lotta NATed addresses. The router won’t find these NATed addresses though unless you go through a painful procedure to enable proxy-arp on the Checkpoint or you have to add static host entries to the router pointing to the interface IP on the Checkpoint.

What year is this because I seem be in the 90′s.

I know some people really love Checkpoint but every exposure I’ve had has left me scratching my head wondering if they could have done things any more atypically.

So yes, Checkpoint administrators, have no fear. The router jockeys will fix your broken crap again.

I’ve been trying to figure out why a pair of Cisco IPS (AIP-SSM in this case) wouldn’t auto-update signature files or connect to the new Global Correlation feature. The management interfaces were located on a subnet that was between the firewall and the internal L3 switch. The internal LAN’s are on the other side of the switch.

I’ve known for a long time that Cisco ASA’s don’t support sending ICMP redirects. Because of this the IPS’s default gateway couldn’t be set to the FW interface. If I did that they would never be redirected to reach the internal networks. I’ve never had a problem with IOS doing ICMP redirects though, so the IPS’s have been using the switch VLAN interface as the default gateway. The switch sends ICMP redirects when the IPS needs to get out to the internet and the traffic goes direct to the firewall.

Except it doesn’t. I could swear it did at one time in the past. Either my memory is faulty or an image update on the IPS broke it. Now, it seems the IPS tosses ICMP redirects. My guess is it worries about man in the middle attacks and and ICMP redirect is a possible sign of that. So even though the switch is doing the correct thing the IPS disregards it.

Moved the IPS management interface to one of the internal LAN’s and all is happy now.

Zoneminder, argh. I’m not sure how much time I’ve put into getting Zoneminder to work but it’s a lot. There’s just something about it that confounds me, whether it’s because of the underlying OS or hardware problems…Zoneminder seems to be the typical open source linux app. Very capable, ugly as sin and exceedingly difficult to get working right, unless you are the geek “they” designed it for.

So, I’ve decided to punt. At some point getting something done becomes more important than playing and learning. I bought my PV149 card from BlueCherry some time ago and I check back in with them from time to time. They’ve long had a reference to Blue Iris as a Windows alternative. I’m trying it out and so far it couldn’t be easier to use. I’m a little concerned that it doesn’t handle load as well and is banging on the server pretty hard, but it seems to be getting by ok.

I’ll report back once I’ve played with the motion detection and the alerting system.

I’m mystified as to how Cisco.com can go down worldwide for 2+ hours during business hours and there is virtually nothing in the news about it. I managed to find this reference in the Register. Not surprising as the outage hit the UK in the middle of the day. I’ve not found any other comments.

How is it that the king of the networking world, preacher of all things BC/DR, can be down for 2+ hours and no one thinks it’s a big deal.

If nothing else, it sure would be nice to get a root cause analysis from Cisco so we can have a “teaching moment”. If there’s a scenario where arguably the most savvy networking company in the world can suffer a catastrophic failure of a high availability service, we would all be well served to understand the details.

And Cisco’s response about the dangerous power failure at the data center that I tweeted about? I’m not buying that. If that happened then it should have shut down and failed to the DR site. I can’t believe that Cisco has all of Cisco.com in a single data center.

This is like your parents telling you every day not to smoke and then you catch them puffing away one day.

What’s the deal Cisco???