Thursday, March 4, 2010
Sunday, February 28, 2010
Friday, February 19, 2010
Clack
I had never heard of this application but it sounds pretty neat.
Clack. The author, Dan Wendlandt had some nice resources linked on his page.
Clack. The author, Dan Wendlandt had some nice resources linked on his page.
Friday, February 12, 2010
UNetbootin
UNetbootin - Universal Netboot Installer. UNetbootin loads utilities or installs Linux/BSD to a partition or USB drive without a CD.
Monday, October 19, 2009
Scott Hogg article on IPv6 in IOS 15
http://www.networkworld.com/community/node/46491
Scott Hogg article on IPv6 in IOS 15.
Scott Hogg article on IPv6 in IOS 15.
Friday, September 25, 2009
show tcam command for access lists
I was trying to use 'show access-list ' to find ACL hits from a local machine to a web server. I noticed I was only seeing the initial connection from the local device to the server hitting the inbound ACL on the VLAN interface but the outbound ACL on the VLAN interface was never reporting matches on the reciprocal ACE - even though the web connection was working.
After research I found a few features on newer IOSes (CBAC being the main one) which behave this way but the code on this device didn't support it and, even if it did, it wasn't configured for any such thing. Apparently, the culprit is hardware ACL processing. The 6500 was pushing the ACL processing to the TCAM and once the connection was hitting the first ACL, I never saw it again. It is possible (but I haven't tested this) that adding the 'log' statement to the ACE on the return ACL will force matches (or at least log entries) to show up. Either way, that isn't necessary. The show tcam interface acl ip shows basically the old-school 'show access-list ' output with the matches I was looking for.
Some of the information about this is (vaguely) documented here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/acl.html
https://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/configuration/guide/secure.html
https://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00800c9470.shtml
http://www.elemental.net/~lf/undoc/#d0e59
After research I found a few features on newer IOSes (CBAC being the main one) which behave this way but the code on this device didn't support it and, even if it did, it wasn't configured for any such thing. Apparently, the culprit is hardware ACL processing. The 6500 was pushing the ACL processing to the TCAM and once the connection was hitting the first ACL, I never saw it again. It is possible (but I haven't tested this) that adding the 'log' statement to the ACE on the return ACL will force matches (or at least log entries) to show up. Either way, that isn't necessary. The show tcam interface
Some of the information about this is (vaguely) documented here:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/acl.html
https://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/configuration/guide/secure.html
https://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00800c9470.shtml
http://www.elemental.net/~lf/undoc/#d0e59
Subscribe to:
Posts (Atom)