This how-to is a step-by-step guide to configure an IPSec VPN Connection from an on-premise Cisco vEdge device to Microsoft Azure. Hardware and Software used in this guide vEdge running software version 18.4.0 Microsoft Azure account with valid subscription Prerequisites vEdge must be fully registered to vBond / vSmart / vManage. Step-by-step instructions This guide assumes that the Azure cloud hasn't been configured, some of these steps can be skipped if the resources are already established. Configuring a VPN Gateway in Azure Create a virtual network (VNET) in Azure. The address space should ideally not overlap with any other subnets you have in use anywhere else in your network. Also create a first subnet within the virtual network. In this example we use 10.1.0.0/16 as the address space for the entire VNET and 10.1.0.0/24 for the first subnet. The names for the VNET and the subnet are arbitrary.     Create a so called "Gateway Subnet" inside the new VNET. The Gateway Subnet can be of size /27 to conserve IP address space.   Create a virtual network gateway. This is the VPN endpoint inside Azure to which your vEdge will establish the IPSec connection.      Parameter  Description Name Arbitrary name for this virtual network gateway Gateway Type Select VPN to enable IPSesc VPN Type Select Route-based which should generally be preferred over policy-based (crypto-map) VPNs. SKU Need to select VpnGw1 or greater based on the amount of traffic needed. Basic doesn't support BGP Enable active/active mode Disable. This how-to does currently not support active/active mode. Public IP address Create a new public IP address Configure BGP ASN Enable BGP Autonomous system number (ASN) Leave this as the default 65515. This is the ASN Azure presents itself as.   Create a local network gateway. The local network gateway represents your vEdge.    Parameter  Description Name Arbitrary name for your local vEdge IP Address Public IP address of your vEdge Address Space Address space for the tunnel interface Configure BGP Settings Check to enable BGP ASN ASN configured on the vEdge BGP peer IP address IP address on the vEdge which terminates the BGP connection   Create a new connection between the virtual network gateway and the local network gateway.       Configure vEdge Retrieve the public IPv4 address of the virtual network gateway in Azure.   Login to your vEdge to create & configure the IPSec interface. The tunnel source interface (ge0/0 in the example below) needs to be the WAN facing interface which is configured with the public IP (i.e. B.B.B.B in the case of this how-to). It needs to be reachable from the Azure virtual network gateways public IP (i.e. from A.A.A.A in the case of this how-to).  vedge1# config vedge1(config)# vpn 0 interface ipsec1 vedge1(config-interface-ipsec1)# ip address 192.168.100.1/30 vedge1(config-interface-ipsec1)# tunnel-source-interface ge0/0 vedge1(config-interface-ipsec1)# tunnel-destination A.A.A.A vedge1(config-interface-ipsec1)# mtu 1400 vedge1(config-interface-ipsec1)# tcp-mss-adjust 1350 vedge1(config-interface-ipsec1)# no shutdown Configure the IKE Version 2 parameters. vedge1(config)# vpn 0 interface ipsec1 ike vedge1(config-ike)# version 2 vedge1(config-ike)# group 2 vedge1(config-ike)# cipher-suite aes256-cbc-sha2 vedge1(config-ike)# rekey 86400 vedge1(config-ike)# authentication-type pre-shared-key pre-shared-secret ChooseSomeSecretPassword vedge1(config-pre-shared-key)# local-id B.B.B.B vedge1(config-pre-shared-key)# remote-id A.A.A.A  Configure IPsec tunnel parameters. vedge1(config)# vpn 0 interface ipsec1 vedge1(config-interface-ipsec1)# ipsec vedge1(config-ipsec)# cipher-suite aes256-cbc-sha1 vedge1(config-ipsec)# replay-window 512 Retrieve the IP address of the BGP router in Azure. Create a static route to reach the BGP router in Azure from vEdge. vedge1(config)# vpn 0 vedge1(config-vpn-0)# ip route 10.1.1.254/32 192.168.100.2 Configure BGP on vEdge. vedge1(config)# vpn 0 router bgp 65000 vedge1(config-bgp-65000)# neighbor 10.1.1.254 remote-as 65515 ebgp-multihop 255 update-source ipsec1 vedge1(config-neighbor-10.1.1.254)# address-family ipv4-unicast vedge1(config-address-family-ipv4-unicast)# exit vedge1(config-neighbor-10.1.1.254)# exit vedge1(config-bgp-65000)# address-family ipv4-unicast Commit all changes on vEdge and exit configuration mode. vedge1(config)# commit vedge1(config)# end   Verify Perform the following steps to verify the IPSec tunnel on vEdge Verify the ipsec1 interface is in up/up state and receiving / transmitting packets. vedge1# show interface | include ipsec1 0 ipsec1 ipv4 192.168.100.1/30 Up Up NA vlan service 1400 00:00:00:00:00:01 1000 full 1316 0:00:29:28 1943 37  Verify the sate of the IPSec IKE session, check for SPIs and state. vedge1# show ipsec ike sessions | include ipsec1 0 ipsec1 2 10.0.0.7 4500 A.A.A.A 4500 d12a70f1676929a3 f447897484c3dd7e aes256-cbc-sha2 2 (MODP-1024) IKE_UP_IPSEC_UP 0:00:33:59 Verify that the BGP connection is established. vedge1# show bgp summary vpn 0 vpn 0 bgp-router-identifier 1.1.1.9 local-as 65000 rib-entries 4 rib-memory 448 total-peers 1 peer-memory 4816 Local-soo SoO:0:600 ignore-soo MSG MSG OUT PREFIX PREFIX PREFIX NEIGHBOR AS RCVD SENT Q UPTIME RCVD VALID INSTALLED STATE --------------------------------------------------------------------------- 10.1.1.254 65515 23 22 0 0:00:18:32 3 3 3 established  Verify that BGP is receiving routes from Azure. vedge1# show ip routes vpn 0 bgp Codes Proto-sub-type: IA -> ospf-intra-area, IE -> ospf-inter-area, E1 -> ospf-external1, E2 -> ospf-external2, N1 -> ospf-nssa-external1, N2 -> ospf-nssa-external2, e -> bgp-external, i -> bgp-internal Codes Status flags: F -> fib, S -> selected, I -> inactive, B -> blackhole, R -> recursive PROTOCOL NEXTHOP NEXTHOP NEXTHOP VPN PREFIX PROTOCOL SUB TYPE IF NAME ADDR VPN TLOC IP COLOR ENCAP STATUS ------------------------------------------------------------------------------------------------------ 0 10.1.0.0/16 bgp i - 10.1.1.254 - - - - F,S,R 0 192.168.100.0/30 bgp i - 10.1.1.254 - - - - - 0 192.168.100.1/32 bgp i - 10.1.1.254 - - - - -   Perform the following steps to verify the IPSec tunnel in Azure Check the status of the connection to vEdge in the virtual network gateway References Please see these links for additional information: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices https://sdwan-docs.cisco.com/Product_Documentation/Software_Features/Release_18.4/Security/02Configuring_Security_Parameters/Configuring_IKE-Enabled_IPsec_Tunnels Acknowledgments For the creation of this how-to the following configuration example was extensively used and a lot of screenshots copied verbatim: Configure ASA IPsec VTI Connection to Azure  ... View more

This is a step-by-step guide with instructions for changing the encryption key on UCS E-Series blades which have SED drives installed using the MegaRaid bios.   Hardware and Software used in this guide UCS E-Series blade from generation M3 CIMC Version 3.2.6 BIOS Version 2.6 HDD with encryption capabilities (E100D-SED-12T) Prerequisites In this guide we assume that drive security is already enabled and that the virtual KVM console is accessible. Step-by-step instructions Login to the CIMC Web GUI and launch the virtual KVM console.   From the KVM console, power-on or reload the server. Wait for the MegaRAID BIOS to finish initialising and to show "Press <CTRL><R> to run MegaRAID Configuration Utility". Press CTRL-R to launch the MegaRAID configuration utility.   In the MegaRAID configuration utility, select the MegaRAID controller and press F2. From the menus select "Drive Security" and then "Change security settings".   Input the new security key twice. Select "OK" to proceed.  Note: The security key is case-sensitive. It must be between eight and thirty-two characters and contain at least one number, one lowercase letter, one uppercase letter, and one non-alphanumeric character (e.g. < > @ +). The space character is not permitted.   Provide the current security key and select "OK". Acknowledge the warning by selecting "YES". That's it. You have successfully changed the security key. ... View more

 Howto Install A Custom Linux VM on NFVIS / ENCS This Howto is a step-by-step guide to install a custom Linux VM on Cisco Enterprise NFV Infrastructure Software (NFVIS) running on the Cisco Enterprise Network Compute System (ENCS). This guide uses the standalone Web-GUI. Hardware and Software used in this guide NFVIS Version 3.8.1-FC3 ENCS5408/K9 Ubuntu Server 18.04 AMD64 (ubuntu-18.04.1-live-server-amd64.iso) Prerequisites NFVIS installed on (supported) hardware and access to the local management Web-GUI. Copy of your Linux distribution of choice in ISO file format. Step-by-step instructions The easiest way to install a custom Linux distribution on NFVIS is to install it from an ISO file. The resulting VM can later be exported as a NFVIS specific package for mass deployment. Upload ISO to NFVIS Login to NFVIS, go to VM Life Cycle -> Image Repository. Click on the file upload button.   Click on Drop Files or Click, select the ISO file you want to upload from your local filesystem, select Other as VM Type and click Start. Wait for the file to upload. Create a new Profile Still in the Image Repository screen, click on the profile creation button.   Input a name for the new profile. Select the amount of vCPUs, memory and disk space the VM shall of available. Finally, click on Submit. ☞ For a more granular selection of Memory and Disk, click on the blue slider and adjust the value using the left- and right-arrow keys on your keyboard VM Deployment Go to VM Life Cycle -> Deploy. Click and drag the VM type called OTHER onto the deployment diagram.   In the VM Details, choose a custom name for your VM. For Image and Profile select the ones, you upload / created in the previous steps. Choose Deployment Disk.   Next step, is to connect the new VM to one of the existing networks. On the deployment diagram, click and hold the VM and drag towards the network you want to connect it to.   In the vNIC Details section, you can adjust, if necessary, the vNIC ID and the Model of the virtual NIC.   Finally click on Deploy beneath the deployment diagram to deploy and start the VM. Wait for the deployment to reach 100% and finish. Install and configure the VM Go to VM Life Cycle -> Manage. Click on the console icon next to your VM to launch the virtual console (virtual KVM).   A new browser window should open (make sure your browser allows pop-ups), giving you access to the VMs console.   Follow the installation wizard and select the desired options that fit the intended purpose. With Ubuntu Server 18.04, installation is straight forward. Once the installation is finished and the new virtual disk is made bootable, NFVIS will automatically boot from it. The ISO file from which you installed will still be available after reboot if needed (on Ubuntu: sudo mount /dev/cdrom /media).   Congratulations, you have successfully installed a custom Linux VM on NVFIS.     ... View more

PONG on IOS Good old PONG now runs on IOS as a TCL script. Features and Limitations: Runs on IOS and Unix (tested on OS X) Demo mode that stops after some time Endless demo mode that goes on forever Not interactive on IOS, as STDIN is always blocking Unzip iospong.tcl_.zip, copy to your routers (or switches) flash: as iospong.tcl and run it with "tclsh iospong.tcl". Youtube video: http://youtu.be/rf6fkDtXkBQ Enjoy! ... View more