[FR] — Parce qu’on a tjs des bonnes intentions en début d’année…

J’ai eu de bonnes intentions en début d’années de produire du contenu en Français sur différents sujets réseaux et télécoms de niveau basiques, mais j’avoue que cela s’est vite arrêté.

Le but était de fournir tout en un :

  • Video explicative ;
  • Une fiche d’étude rapide au format cheatsheet ;
  • Un guide de travail ;
  • Un accès à un lab guidé

Bon j’avoue cela prend énormément de temps et d’autres projets personnels sont venus s’intercalés.

Bref autant partagé ce qu’il en reste et amusez-vous bien :

Soyez pas trop durs …

L’accès à la partie Lab est bien évidemment depuis périmé (on peut donner des durées d’utilisation avec pnetlab :)).

A plus,

Christophe

xrv9k-full, qemu, AMD Ryzen

If as me you have EVE-NG (2.0.3) and lab some Cisco XRV9K-Full on a virtualized box running AMD Ryzen processor, you have probably encountered problem to start the image. After reading lot of website, it seems the answer is change the command line.

My original command line is :

-enable-kvm -smbios type=1,manufacturer="cisco",product=\"Cisco IOS XRv 9000\",uuid=[...] -cpu host

I correct to :

-enable-kvm -smbios type=1,manufacturer="cisco",product="Cisco IOS XRv 9000",uuid=[...] -cpu qemu64,+ssse3,+sse4.1,+sse4.2

IOS, IOS XE and configure … revert timer X

If you are familiar with IOS XR and JunOS, it lacks a rollback to IOS and IOS XE. You can do it with “archive” such as :

  1. Configure where your archive will be stored.
  2. Say to your OS to “archive” at a point
  3. Configure your router with a “revert timer”
  4. Confirm if it is ok for you

Here we go in details now :

  1. Configure where your archive will be stored.
Router# conf t
Router(conf)# archive
Router(conf-archive)# path bootflash:myconfig
Router(conf-archive)# maximum 10
Router(conf-archive)# end
Router# wr

2. Say to your OS to “archive” at a point

Router# archive config 
Router# 
Router# show archive
The maximum archive configurations allowed is 10.
There are currently 1 archive configurations saved.
The next archive file will be named bootflash:myconfig-<timestamp>-1
 Archive #  Name
   1        bootflash:myconfig-Jan--3-2022-08-34-34.348-CET-0 <- Most Recent
   2         
   3         
   4         
   5         
   6         
   7         
   8         
   9         
   10   
Router#     

3. Configure your router with a “revert timer”

Router# configure terminal revert timer 1
Router(conf)# Rollback Confirmed Change: Backing up current running config to bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1

Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#Rollback Confirmed Change: Rollback will begin in one minute.
Enter "configure confirm" if you wish to keep what you've configured

*Jan  3 2022 08:35:01.670 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_BACKUP: Backing up current running config to bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1
*Jan  3 2022 08:35:01.670 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_START_ABSTIMER: User: console(Priv: 15, View: 0): Scheduled to rollback to config bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1 in 1 minutes
*Jan  3 2022 08:35:01.670 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_WARNING_ABSTIMER: System will rollback to config bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1 in one minute. Enter "configure confirm" if you wish to keep what you've configured
Router(conf)# hostname BLAH
BLAH(conf)#
[................... WAITING FOR A MINUTE ........................]
Rollback Confirmed Change: rolling to:bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1

!Pass 1
!List of Rollback Commands:
no hostname BLAH
hostname Router
end


Total number of passes: 1
Rollback Done

*Jan  3 2022 08:36:01.669 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_ROLLBACK_START: Start rolling to: bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1
*Jan  3 07:36:01.722: Rollback:Acquired Configuration lock.


Router(conf) # end

4. Confirm if it is ok for you

If between your “conf t revert time X” and t0+X, you are ok with the configuration you have made, so you can confirm your changes.

Router# configure confirm

That’s it ! Have fun.

FRR Routing v8.0 is out and happy to see SR

Hey,

For (perhaps) futur projet I read different documentations around Bird, FRR Routing, … and I am really happy to see in FRR Routing v8.0 the new ‘pathd‘ daemon, which implement SR (Segment Routing). It is really cool to see this.

There is others new feature which have been implemented in this release and are major IMHO.

  • TI-LFA for OSPF and IS-IS (great too for SR) ;
  • VRF for OSPFv3 ;
  • EVPN full-implementation.

It is really great work !!!

More information there : https://frrouting.org/release/8.0/

See you soon 🙂

Long long time ago, blog and FreeBSD…

It was a long long timeago I wrote here. ot of things happens to me but I don’t think it is the time and place to explain it.

This post is about a new experience to me : hosting this blog on FreeBSD machine. I am in love with BSD but don’t use it everyday. Networking&Telco is not an professional area where you can use it or your employer allow you to use it. Damn Windows, Teams, … and his egemony.

I will move this blog from Debian to FreeBSD server. I think it will lot of fun. If I have FreeBSD’s tips or remarks I will post it here. By the way I am currently studying for Cisco’s CCNP SPCOR (350-501) exam. Either I will try to give me a kick in the ass to post more technical posts.

Have fun 🙂

Site to site IKEv2 tunnel

Hello guys,

Here it is a tips / reminder how to implement an site-ot-site IKEv2 tunnel :

crypto ikev2 proposal aes-cbc-256-proposal 
 encryption aes-cbc-256
 integrity sha1
 group 2
crypto ikev2 policy policy1 
 match address local x.x.x.x
 proposal aes-cbc-256-proposal
crypto ikev2 keyring v2-kr1
 peer abc
  address y.y.y.y
  pre-shared-key somesecretpass
 !
crypto ikev2 profile profile1
 description IKEv2 profile
 match address local x.x.x.x
 match identity remote address y.y.y.y 255.255.255.255 
 authentication local pre-share
 authentication remote pre-share
 keyring v2-kr1

crypto ipsec transform-set myset esp-des esp-md5-hmac 

crypto map mymap 20 ipsec-isakmp 
 set peer y.y.y.y
 set security-association lifetime seconds 27000
 set transform-set ESP-AES-SHA 
 set ikev2-profile profile1
 match address 120

With ACL 120 is your flows / SA and your implement your crypto map on your WAN interface.