Suresh Vinasiththamby - Packetswitch

Configure F5 TACACS+ authentication against Cisco ISE

OverviewYou can use TACACS+ to authenticate and authorize users into the F5 BIG-IP system which eliminates the need to configure and manage local user accounts. The goal here is to make sure that the administrators can log in to F5 using the TACACS+ protocol where the ISE authenticates the user

cisco

Configure Palo Alto TACACS+ authentication against Cisco ISE

OverviewYou can use TACACS+ to authenticate and authorize users into the Palo Alto firewall which eliminates the need to configure and manage local user accounts. The goal here is to make sure that the firewall administrators can log in to Palo Alto using the TACACS+ protocol where the ISE authenticates

cisco

APC Radius authentication with Cisco ISE

In this blog, I will show you how to use Cisco ISE to authenticate users into APC Network-enabled devices such as PDU or UPS using Radius. Radius Vendor-Specific Attributes (VSA)There are various dictionaries created for different vendors and attributes can be added to each of these dictionaries. Each attribute,

cisco

Cisco ISE config-backup failure

SymptomWhen you try to take ISE config-backup, the following error occurs and the backup process fails even though there is sufficient disk space available. status: Error: The data filesystem is 77 percent full, which is above threshold of 70. Backup terminated ise-pan/admin# show backup status %% Configuration backup status %% ----------------------------

cisco

Cisco IOS-XE Built-in Packet Capture

The Embedded Packet Capture feature was introduced in IOS-XE 15.2(4)S. This enables us to easily take captures directly from the switch and export them for analysis. The process is very straightforward and only takes a couple of minutes to set it up. Once you configured the capture,

Python

Using Python to resolve multiple hostnames to IP addresses

As a Network Engineer, I work with IP addresses all day long. But most of the time I am handed out hostnames rather than IP addresses to work with. I can of course use nslookup or ping to quickly resolve the hostnames to IP addresses but imagine having more than

cisco

Cisco IOS-XE RSPAN configuration example

RSPAN copies all the traffic that comes in and out of source ports or source VLANs to a destination port on a different switch for analysis. RSPAN does not affect the switching of traffic on the source ports or VLANs that are being used. This blog post shows an example

cisco

Cisco C9300 switch stack IOS-XE upgrade

This post describes IOS-XE upgrade on C9300 switch stack with five members. The switch is currently running 16.9.4 and will be upgraded to 16.9.7

cisco

Cisco FMC HTTPS certificate with OpenSSL

ProblemYou want to install HTTPS certificate for the Cisco FirePower Management Centre (FMC) SolutionI already have an Internal CA certificate created with OpenSSL. You only need two commands to create one for you. #Generate private key openssl genrsa -des3 -out internalCA.key 2048 #Generate root certificate.You need to create

cisco

Cisco ASA syslog with Splunk

In this blog post, I will show you how to send and visualize Cisco ASA syslog in Splunk. Splunk is used to search and analyse the data/logs generated from various devices. As you can see below the syslog generated from the ASA are unstructured and complex to understand. You

firewall

Palo Alto NAT Example

In this blog post, I will show you how to configure NAT on Palo Alto Firewalls. One of the main functions of the NAT is to translate private IP addresses to globally-routable IP addresses, thereby conserving an organization’s routable IP addresses. NAT examples in this section are based on

ansible

Palo Alto and Ansible Example

In this blog post, I will show you how to use Ansible to deploy configurations to the Palo Alto Firewalls. Setting up the environmentI'm using Ubuntu 18.04 server for this example. Ansible Galaxy Role pip pan-os SDK Palo Alto Networks Ansible Galaxy Rolehttps://ansible-pan.readthedocs.io/en/latest/ The

ansible

Network Configuration Backup with Ansible and Git

The typical way you would perform Network Configuration Backup is by using NCM software such as Solarwinds NCM, Rancid, Oxidized etc. However, you can also utilise Ansible and Git to perform the backups. I know it sounds silly, why would anyone do it? But believe me, it requires very little

terraform

Terraform VPC example with for_each loop

On my previous post, we used count parameter to deploy multiple resources of the same kind. This method may cause some unintended results. Let's take a look at the route table as an example. You can check out my previous post here: Terraform AWS VPC ExampleTerraform is a tool for

cisco

Cisco 9300 IOS upgrade and Smart Licensing

IntroductionThis blog post describes how to upgrade Cisco Catalyst C9300 Series Switch using Install mode. The example shows the upgrade procedure for a C9300-48P switch upgrading from 16.6.3 to 16.12.4. Please note that devices running IOS-XE starting from 16.9.x requires smart licensing.The image

aws

Setup AWS Network Firewall

What is it?AWS Network Firewall is a managed firewall service for our VPC. We can use Network Firewall to filter traffic at the perimeter of our VPC. Network Firewall includes filtering traffic going to and coming from IGW, NAT Gateway, VPN and Direct Connect. Network Firewall components Firewall Firewall

ansible

Ansible with Cisco - Part 2 ios_config module

Cisco IOS configurations use a simple block indent file syntax for segmenting configuration into sections. Ansible ios_config module provides an implementation for working with IOS configuration sections in a deterministic way. This post continues my previous post Anisble with Cisco Part 1. Ansible with Cisco - Part 1 Installation

ansible

Ansible with Cisco - Part 1 Installation and basic set up

InstallationI'm going to install Ansible on my Raspberry Pi for this examle. You can use any other OS including Ubuntu, MacOS etc. Our end goal is to manage both of the routers via Ansible. In this example, we will get the 'show version | incl Version' output on both routers using

firewall

Configuring Palo Alto Administrator Authentication with Cisco ISE (Radius)

OverviewYou can use Radius to authenticate users into the Palo Alto Firewall. You can also use Radius to manage authorization (admin role) by defining Vendor-Specific Attributes (VSAs). The article describes the steps to configure and verify Palo Alto admin authentication/authorization with Cisco ISE. If you want to use TACACS+

firewall

Palo Alto Packet Capture

Packet capture is very useful when you troubleshoot network connectivity issues or monitor suspicious activity. DiagramDiagramFew things to consider Four packet capture filters can be added with a variety of attributes. Packet captures are session/flow based, so having a single filter is enough for capturing both inbound and outbound

juniper

Configuring PIM AnyCast RP with MSDP on Juniper

What problem does AnyCast RP solves?Having a single active rendezvous point (RP) is a single point of failure. Anycast RP allows two or more rendezvous points (RPs) to share the load for source registration and the ability to act as hot backup routers for each other. Multicast Source Discovery

juniper

Juniper Source-Specific Multicast (SSM)

In the previous articles, we have discussed about PIM Dense Mode and PIM Sparse Mode. Both protocols use IGMPv2 and known as Any Source Multicast (ASM). You can check out both articles below: Juniper Multicast PIM Dense ModeMulticast OverviewIP has three fundamental types of addresses: unicast, broadcast, and multicast. A

juniper

Juniper Multicast PIM Sparse Mode

PIM Sparse mode uses an 'explicit join' approach whereas PIM Dense mode uses 'implicit join' approach. With PIM Sparse mode, only network segments with active receivers that have explicitly requested the data will receive the traffic. ‌‌‌‌ PIM sparse mode distributes information about active sources by forwarding data packets on the

juniper

Juniper Multicast PIM Dense Mode

Multicast OverviewIP has three fundamental types of addresses: unicast, broadcast, and multicast. A unicast address is used to send a packet to a single destination. A broadcast address is used to send a packet to an entire local subnet. A multicast address is used to send a datagram to a

aws

ASA to AWS asymmetric routing - BGP

By default, instances that we launch into an Amazon VPC can't communicate with our on-prem network. We can enable access to our network from the VPC by creating an AWS managed Site-to-Site VPN connection, and configuring routing to pass traffic through the connection. A single Site-to-Site VPN connection consists of