Cisco - Dual WAN Internet with Failover (NAT & Routes)

In the past I had the need to implement failover between two connections to the Internet on the same router, at the time I implemented it using EEM Scripts which wasn’t the most elegant solution, so here I’m going to show you a  a better solution to do this.

Implementing the failover mechanism at first glance seems easier with one router than with two, but that is not the case, with two routers you can have them configured normally with the adition of VRRP/HSRP to do the failover between the routers.

With only one router you are going to have two aditional problems:

• Changing the route from the primary to the secondary Internet access
• Changing the NAT overload to the Interface towards the Secondary ISP / WAN (this was the part that I implemented with EEM scripts)

the first you can easily solve with a floating static route (secondary route) and a track / ip sla (to remove the primary route when the connectivity to the primary ISP is lost).

The second one is harder, you can have two NAT rules with two interfaces towards the two ISPs:

ip nat inside source 130 interface FastEthernet0/0 overload
ip nat inside source 131 interface FastEthernet1/0 overload

but selecting the one as the active one is the tricky part.

Even if the interface towards the primary ISP were to fail and become shutdown, the NAT rule remains active.

The cenario bellow has two different ISPs for for the WAN accesses, but its the sames as having two different connectivities via the same ISP (eg. Primary via Fiber Optic | Secondary via 4G)

Cenario

Logical View

Fisical View

You can download the lab fully implemented here:

• 2015.10.18_Dual WAN Internet with Failover (RT & NAT) (DONE)_v2.zip

it was implemented on GNS3 v1.2.1.

 

Configuration

 

PC1
====================================================
enable
conf t

hostname PC1

interface FastEthernet0/0
description *** Link to CPE1 ***
ip address 192.168.1.1 255.255.255.0
no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.1.254 name DefaultGW
 
do write
 
 
CPE1
====================================================
enable
conf t

hostname CPE1

interface FastEthernet0/0
description *** Link to ISP1 ***
ip address 11.0.0.2 255.255.255.252
ip nat outside
no shutdown
 
interface FastEthernet0/1
description *** Link to ISP2 ***
ip address 22.0.0.2 255.255.255.252
ip nat outside
no shutdown
 
interface FastEthernet1/0
no switchport
description *** Link to PC1 ***
ip address 192.168.1.254 255.255.255.0
ip nat inside
no shutdown

 
!-- Select the Route - via ISP1 or ISP2 -------------------
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! The first route makes all the traffic flow via
! ISP1, but this is conditioned to track 10, that
! detects the  connectivity to ISP1.
! If track 10 fails the route is removed from the
! routing table.
!
!
! The second route has an higher administrative
! distance (worst), and as long as the first rule
! is available this rule is never inserted on
! the routing table (aka floating static route)
!
! If the first route disapears because the track
! failed then the second route is inserted in the
! routing table, and all traffic will flow via ISP2
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

ip route 0.0.0.0 0.0.0.0 11.0.0.1 track 10 name Default-Primary
ip route 0.0.0.0 0.0.0.0 22.0.0.1 250 name Default-Secondary

ip sla 10
icmp-echo 11.0.0.1 source-interface FastEthernet0/0
frequency 5
ip sla schedule 10 life forever start-time now

track 10 ip sla 10 reachability
!show track brief
!show track 10

!-- Change the NAT Interface to Reflect the Active Route --
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! Changing the routes isn't enough, we also
! need to change the NAT rule, because each route
! implies a different exit interface.
!
! To select which NAT rule will be used for each
! route, we used route maps instead of an ACL
! to identify traffic (active the rule).
!
! These route maps match the LAN traffic, plus
! the current next hop to forward the traffic thus
! selecting the correct NAT rule for the current
! active route.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

ip nat inside source route-map RM-ISP1-PRIMARY interface FastEthernet0/0 overload
ip nat inside source route-map RM-ISP2-PRIMARY interface FastEthernet0/1 overload

access-list 130 remark *** Traffic for The Internet (NAT) ***
access-list 130 permit ip 192.168.1.0 0.0.0.255 any

route-map RM-ISP1-PRIMARY permit 10
match ip address 130
match interface FastEthernet0/0        !--> Match the exit interface of the route

route-map RM-ISP2-PRIMARY permit 10
match ip address 130
match interface FastEthernet0/1        !--> Match the exit interface of the route
!show route-map

!-- Simulate a Failure Along The Way ----------------------
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! To simulate the failure to see the topology
! changing to the secondary access, we are going
! to use a route to force the track/ip sla to fail.
!
! This route will force all the connectivity test
! traffic destined for ISP1(11.0.0.1) to go to NULL
! which is a black hole. Like this ISP1 will never
! get the icmp echos requests from the ip sla test
! or respond to it, thus simulating a connectivity
! failure towards ISP1
!
! NOTE: It takes a couple of seconds to change
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!-- Failure Sim + Debug/Tshoot --
do debug ip nat
ping 77.0.0.1
show ip route
!S*    0.0.0.0/0 [1/0] via 11.0.0.1

ip route 11.0.0.1 255.255.255.255 NULL0 name FailureSim

ping 77.0.0.1
show ip route
!S*    0.0.0.0/0 [250/0] via 22.0.0.1

! Both Pings will work but notice that the default
! route is diferent (diferent next hop)

!-- Restore to Normal Operation --
no ip route 11.0.0.1 255.255.255.255 NULL0 name FailureSim
do no debug all

ISP1-PRIMARY
====================================================
enable
conf t

hostname ISP1-PRIMARY

interface FastEthernet0/0
description *** Link to CPE1 ***
ip address 11.0.0.1 255.255.255.252
no shutdown

interface FastEthernet0/1
description *** Link to CPE2 ***
ip address 11.0.0.5 255.255.255.252
no shutdown
 
 
interface FastEthernet1/0
no switchport
description *** Link to ISP2 ***
ip address 22.0.0.6 255.255.255.252
no shutdown

    
ip route 77.0.0.0 255.255.255.248 11.0.0.6 name PublicIPs
ip route 22.0.0.0 255.255.255.252 22.0.0.5 name NatedLAN-viaIPS2

do write

ISP2-SECONDARY
====================================================
enable
conf t

hostname ISP2-SECONDARY

interface FastEthernet0/1
description *** Link to CPE1 ***
ip address 22.0.0.1 255.255.255.252
no shutdown
 
interface FastEthernet0/0
description *** Link to ISP1 ***
ip address 22.0.0.5 255.255.255.252
no shutdown

ip route 0.0.0.0 0.0.0.0 22.0.0.6 name Default
 
do write
 
 
CPE2
====================================================
enable
conf t

hostname CPE2

interface FastEthernet0/1
description *** Link to ISP1 ***
ip address 11.0.0.6 255.255.255.248
no shutdown
 
interface FastEthernet1/0
description *** Link to Internet Server ***
no switchport
ip address 77.0.0.6 255.255.255.248

ip route 0.0.0.0 0.0.0.0 11.0.0.5 name Default

do write

INTERNET SERVER
====================================================
enable
conf t

hostname INTERNET-SERVER

interface FastEthernet0/0
description *** Link to CPE1 ***
ip address 77.0.0.1 255.255.255.248
no shutdown
 
ip route 0.0.0.0 0.0.0.0 77.0.0.6 name Default

do write

Related Links

• http://docwiki.cisco.com/wiki/NAT_failover_with_DUAL_ISP_on_a_router_Configuration_Example

Linux/Raspberry - Send Emails (SMTP Setup - Gmail)

 

SMTP Mail Setup

Many times you want to have the ability to send email from processes on your Raspberry Pi to email addresses out on the network. Adding email to your Raspberry Pi is pretty simple. You can use the following three packages for some simple mail capabilities.

It is assumed that you have networking working already...

 

Loading the packages

sudo apt-get install ssmtp
sudo apt-get install mailutils
sudo apt-get install mpack

Setting up the defaults for SSMTP

sudo nano /etc/ssmtp/ssmtp.conf

Now edit the fields:

AuthUser=youruserid@gmail.com
AuthPass=userpass
FromLineOverride=YES
mailhub=smtp.gmail.com:587
UseSTARTTLS=YES

Using Email Now

echo "sample text" | mail -s "Subject" username@domain.tld

Sending Attachments

mpack -s "test" /home/pi/test/somefile.ext username@domain.tld

Taken From:

• https://rpi.tnet.com/project/faqs/smtp

How to Mount CD/DVDs Images - Windows, Mac, and Linux

Disc images have become more useful than ever on modern PCs that often lack CD and DVD drives. Create ISO files and other types of disc images and you can “mount” them, accessing the virtual discs as if they were physical discs inserted into your computer.

You can also use these image files to burn copies of the original discs later, creating duplicate copies. Disc image files contain a complete representation of a disc.

 

Windows

Windows 10 allows you to mount both .ISO and .IMG disc image files without any third-party software. Just double-click a .ISO or .IMG disc image you want to make available. If this doesn’t work, you should be able to click the “Disk Image Tools” tab on the ribbon and click “Mount.” It will appear under Computer as if it were inserted into a physical disc drive.

This feature was added back in Windows 8, so it will also work on Windows 8 and 8.1.

To unmount the disc later, right-click the virtual disc drive and select “Eject.” The disc will be unmounted and the virtual disc drive will disappear from the Computer window until you mount a disc in it again.

To mount ISO or IMG images on Windows 7 — or to mount images in other formats, such as BIN/CUE, NRG, MDS/MDF, or CCD — we recommend the free, open-source, and simple WinCDEmu utility.

Just right-click an image file after installing it, click “Select drive letter & mount,” and you can mount other types of images Windows doesn’t support.

Some other third-party utilities have additional support for emulating various copy-protection technologies, allowing copy-protected discs to function normally. However, such techniques are being phased out and aren’t even supported by modern versions of Windows.

 

Mac

On a Mac, double-clicking common disc image formats will mount them. This is why you can simply double-click a downloaded .DMG file to access its contents and install Mac applications, for example.

The DiskImageMounter application that handles this can also mount .ISO, .IMG, .CDR, and other types of image files. Just double-click the file to mount it. If this doesn’t work, Option-click or right-click a file, point to “Open With,” and select “DiskImageMounter.”

When you’re done, just click the “Eject” button next to the mounted image in the Finder’s sidebar to eject it and unmount it — just like you’d unmount a .DMG image when you’re done with it.

You can also try mounting the disc image file by opening the Disk Utility application. Press Command+Space, type Disk Utility, and press Enter to open it. Click the “File” menu, select “Open Image,” and select the disc image you want to mount.

 

Linux

Ubuntu’s Unity desktop and GNOME include an “Archive Mounter” application that can mount ISO files and similar image files graphically. To use it, right-click an .ISO file or another type of disc image, point to Open With, and select “Disk Image Mounter.”

You can later unmount the image by clicking the eject icon next to the mounted image in the sidebar.

You can also mount an .ISO file or another disc image with a Linux terminal command. This is particularly useful if you’re just using the command line, or if you’re using a Linux desktop that doesn’t provide a tool to make this easy. (Of course, graphical tools for mounting ISO files and similar images may be available in your Linux distribution’s software repositories.)

To mount an ISO or IMG file on Linux, first open a Terminal window from your Linux desktop’s applications menu. First, type the following command to create the /mnt/image folder. You can create practically any folder you like — you just have to create a directory where you’ll mount the image. The contents of the disc image will be accessible at this location later.

sudo mkdir /mnt/image

Next, mount the image with the following command. Replace “/home/NAME/Downloads/image.iso” with the path to the ISO, IMG, or other type of disc image you want to mount.

sudo mount -o loop /home/NAME/Downloads/image.iso /mnt/image

To unmount the disc image later, just use the umount command:

sudo umount /mnt/image

Some guides recommend you add “-t iso9660” to the command. However, this isn’t actually helpful - it’s best to let the mount command automatically detect the required file system.

If you’re trying to mount a more obscure type of disc image format that the mount command can’t automatically detect and mount in this way, you may need commands or tools designed specifically for working with that type of image file format.

This should “just work” on most modern operating systems, allowing you to mount and use ISO images and other common types of image files in a few clicks. Windows 7 users will have the toughest time, as it isn’t integrated into that older version of Windows, but WinCDEmu is a lightweight and easy way to accomplish this.

Taken From:

• http://www.howtogeek.com/230468/how-to-mount-isos-and-other-disc-images-on-windows-mac-and-linux/

Cisco - EEM Scripts Examples (TSHOOT)

EEM is a very useful tool to troubleshoot occasional, sporadic CPU spikes that are short-lived and difficult to troubleshoot manually with the command line interface. This is an example of CPU spikes:

Switch#show process cpu history
<snip>
    11111822511   11 111277711111 124111  11 1211111112161116
    143342171209994090111878458239607111981270283361362429475
100
 90
 80      *               ***
 70      *               ***                                *
 60      *               ***                            *   *
 50      *  *            ***        *                   *   *
 40      *  *            ***        *                   *   *
 30      * **            ***        *                   *   *
 20      ****           **** **   ***         **  *  ** ** **
 10 *********************************************************
   0....5....1....1....2....2....3....3....4....4....5....5....6....6....7.
             0    5    0    5    0    5    0    5    0    5    0    5    0
                   CPU% per hour (last 72 hours)
                  * = maximum CPU%   # = average CPU%

This section includes several examples of the use of EEM scripts to monitor CPU utilization. Catalyst 2960 and 3750 switches allow EEM to use non-volatile RAM (NVRAM); Catalyst 4500 switches allow EEM to write to bootflash; and Catalyst 6500 switches allow EEM to use disk0 and sup-bootdisk.

Email Alerts

This script emails an alert when CPU utilization goes above 50 percent. The body of the email is the output of theshow process cpu sorted command.

event manager applet highcpu
  event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge 
  entry-val 50 poll-interval 0.5
  action 1.0 cli command "enable"
  action 2.0 cli command "show proc cpu sorted"
  action 3.0 mail server "192.168.1.1" to "user-to@domain.com" from "user-from@domain.com" 
  subject "High CPU Alert" body "$_cli_result"

The definitions of italicized variables are:

highcpu - name of the event manager applet/script

1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 - Object identifier (OID) for polling the total CPU utilization of the route processor (RP)

50 - CPU utilization that triggers the script
poll-interval 0.5 - Frequency (every 0.5 seconds) the script monitors the CPU

192.169.1.1 - IP of the mail server

Append Output to Local File

This script appends required outputs to a file in the local file system. Replace file system with the appropriate file system on the switch.

event manager scheduler script thread class default number 1 
event manager applet High_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op ge  
    entry-val 50 poll-interval 0.5
  action 0.0 syslog msg "High CPU DETECTED. Please wait - logging Information  
    to file system:high_cpu.txt"
  action 0.1 cli command "enable"
  action 0.2 cli command "show clock | append file system:high_cpu.txt"
  action 1.2 cli command "term length 0"
  action 1.3 cli command "show process cpu sorted | append file system:high_cpu.txt"
  action 1.4 cli command "show log | append file system:high_cpu.txt"
  action 1.5 cli command "show interfaces | append file system:high_cpu.txt"
  action 1.6 cli command "term length 24"

Append Output to Local File and Remove Script

This script appends the output of the show process cpu sorted command to a file in the local file system, then removes itself once completed. Replace file system with the appropriate file system on the switch.

event manager scheduler script thread class default number 1 
event manager applet High_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.3.1 get-type exact entry-op gt 
    entry-val 50 poll-interval 0.5
  action 0.0 syslog msg "High CPU DETECTED. Please wait - logging Information  
    to flash:high_cpu.txt"
  action 0.1 cli command "enable"
  action 0.2 cli command "term exec prompt timestamp"
  action 1.3 cli command "show process cpu sorted | append file system:high_cpu.txt"
  action 1.4 cli command "show process cpu sorted | append file system:high_cpu.txt"
  action 1.4 cli command "show process cpu sorted | append file system:high_cpu.txt"
  action 5.1 syslog msg "Finished logging information to file system:high_cpu.txt..."
  action 5.1 syslog msg "Self-removing applet from configuration..."
  action 5.2 cli command "term no exec prompt timestamp"
  action 9.1 cli command "configure terminal"
  action 9.2 cli command "no event manager applet High_CPU"
  action 9.3 cli command "end"

Collect Output and Write to Local File

This script uses a syslog-based trigger in order to run and collect required outputs and write those outputs to the local file system. Replace file system with the appropriate file system on the switch.

process cpu threshold type total rising 70 interval 15 
event manager applet DETECT_CPU
event syslog pattern ".*SYS-1-CPURISINGTHRESHOLD.*" 
  action 1 cli command "en" 
  action 2 cli command "show clock | append file system:cpuinfo" 
  action 3 cli command "show proc cpu sort | append file system:cpuinfo" 
  action 4 cli command "show line | append file system:cpuinfo"

Monitor CPU Utilization on Modular IOS

The Cisco EEM can also be used to monitor CPU utilization on modular IOS. Because of the differences in how the CPU is monitored on modular IOS, you can use the Simple Network Management Protocol (SNMP) OID (1.3.6.1.4.1.9.9.109.1.1.1.1.3.1) in order to check CPU utilization by the IOS base process.

This script uses the OID as a trigger and writes required outputs to the local file system. Replace file system with the appropriate file system on the switch.

event manager scheduler script thread class default number 1
event manager applet High_CPU
event snmp oid 1.3.6.1.4.1.9.9.109.1.1.1.1.10.1  get-type exact entry-op ge  
    entry-val 50 poll-interval 0.5 
  action 0.0 syslog msg "High CPU DETECTED. Please wait - logging Information  
    to file system:high_cpu.txt"
  action 0.1 cli command "enable"
  action 0.2 cli command "show clock | append file system:high_cpu.txt"
  action 1.2 cli command "term length 0"
  action 1.3 cli command "show process cpu sorted | append file system:high_cpu.txt"
  action 1.4 cli command "show log | append file system:high_cpu.txt"
  action 1.5 cli command "show interfaces | append file system:high_cpu.txt"
  action 1.6 cli command "term length 24"

Remove Script

Enter this command in order to remove an EEM script:

Switch(config)#no event manager applet applet 

Based On: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/116141-trouble-eem-scripts-00.html
Contributed by Cisco Engineers: Shashank Singh and Saurav Lahiri

Linux - PPTP VPN Server (via GUI on Ubuntu)

 

How to Setup a “Split Tunnel” VPN (PPTP) Client on Ubuntu 10.04

Sometimes you need to use a VPN connection to grant access to remote network resources and for that you use a VPN, but if you don’t want all of your client traffic to go through the VPN link, you’ll need to setup your VPN to connect in a “split tunnel” mode. Here’s how to do it on Ubuntu.

Note: make sure that you’ve read our article covering how to setup a VPN server for Debian-based Linux, which also covers configuring the Windows client.

 

Split what the what now?

The “split tunnel” term refers to the fact that the VPN client creates a “tunnel” from the client all the way to the server for “private” communication.

Traditionally the VPN connection is set up to create “the tunnel” and once it is up all the client’s communication is routed through that “tunnel”. this was good back in the day when the VPN connection had a couple of goals that overlapped and complimented each other:

• The connection was meant to grant access for the road warrior from anywhere.
• All of  the client’s connections need to be secured by means of  going through the corporate firewall.
• The client computer must not be able to connect a potentially malicious network with the corporate network.

The way the VPN connection of the time achieved this goal, was to set the “default gateway” or “route” of the client machine to the corporate VPN server.

• This method, while affective for the above goals has several disadvantages, espeshelly if you are implementing the VPN connection only for the “grant access” point:
• It will slow down the entire surfing experience of the client computer to the speed of the VPN server’s upload speed, which is usually slow.
• It will disable access to local resources like other computers in the local network unless they are all connected to the VPN, and even then the access will be slowed down because it has to go all the way to the internet and come back.

To overcome these shortcomings we will create a regular VPN dialer with one note worthy exception, that we will set the system to NOT use it as the “Default Gateway” or “route” when connected.

Doing this will make it so that the client will use the “VPN tunnel” only for the resources behind the VPN server and will access the internet normally for everything else.

 

Let’s get cracking

The first step is to get into “Network connections” and then “Configure VPN”.

One way you can do this is by clicking the desktop icon for networking as shown in the picture.

Another way is to go to “System” > “Preferences” > “Network Connections”.

Once your on the “VPN” tab in the “Network connections” configurations window, click “Add”.

On the next window we only need to click “Create”, as the default connection type of PPTP is what we want to use.

In the next window give your dialer a name, fill in the gateway with your servers DNS-name or IP address as seen from the internet and fill in the user credentials.

If you have used the “Setting up a VPN (PPTP) server on Debian” guide for the server setup or you are using this client for a DD-WRT PPTP server setup, you also need to enable the MPPE encryption options for authentication.

Click on “Advanced”.

On the “Advanced Options” window check the first checkbox for the MPPE option, then the second checkbox to allow stateful encryption and click “OK”.

Back on the main window, click the “IPv4 Settings” tab.

On the routes configuration window check the checkbox of “Use this connection only for resources on its network”.

Activate the VPN connection client by clicking on the “Network connections” icon and selecting it.

That’s it, you can now access the resources on the VPN servers side as if you were on the same network while not sacrificing your download speed in the process…

 

Taken From: http://www.howtogeek.com/51340/setting-up-a-split-tunnel-vpn-pptp-client-on-ubuntu-10-04/