Blog Posts in May 2007
Catching all syslog messages
If you use UDP-based syslog servers, you might have noticed that they miss a message or two generated during a router reload (particularly when the syslog server is on a directly connected LAN). The reason is simple - when the first message is sent to the syslog server, its MAC address is not yet in the router's ARP cache and the message is dropped. To prevent the message loss, you can use the logging server-arp configuration command (introduced in IOS release 12.3T), making sure that the router sends ARP request to the configured syslog server(s) before generating the first syslog messages.
The DNS configuration "challenges"
With the introduction of DNS views in IOS release 12.4(9)T, a number of additional DNS-related configuration commands were introduced. As IOS still supports all the older configuration commands (and the DHCP-acquired DNS servers), the results are not as obvious as one would hope. The IOS documentation is pretty explicit (a nice surprise :), but I still had a bit of a headache figuring it all out, so you might be in the same position.
Warm upgrade
After you've configured the Warm Reload, you can also perform warm IOS upgrade/downgrade (assuming that you already run at least the IOS release 12.3(11)T or 12.4). The Warm Upgrade functionality loads the new IOS image into the main memory, decompresses it and starts it, significantly reducing the downtime (in my case, a 2800 router reloaded in 62 seconds as compared to 415 seconds it took to load the image from a locally-attached server).
Apart from the downtime reduction, the warm upgrade (requested with the reload warm file url command) has a number of other benefits:
- The new image does not have to be stored in flash
- You don't have to change the boot image with the boot system command
- If the new image crashes, the router will revert to the original IOS image stored in flash
Reload EEM Tcl policy with help of Tcl shell
Testing Embedded Event Manager (EEM) Tcl policies is a convoluted process:
- Source file is usually edited on a general-purpose workstation.
- The file has to be downloaded to router's local storage (EEM does not register non-local policies).
- The new version of the EEM policy has to be registered with EEM with event manager policy configuration command
- After all these steps, the new policy can be tested.
While you can use EEM applet to automate this process, slightly more flexible approach (you can specify the policy name to be replaced) can be implemented with Tcl script:
Unbundle DNS settings from DHCP client
In one of my previous posts I've been writing about the problems I had when the DHCP client on Cisco IOS was messing up the DNS name-servers I've configured manually with the ip name-server configuration command. As is quite usual in Cisco IOS, there's one more know to turn to fix this - the Configurable DHCP Client feature introduced in IOS release 12.3(8)T.
To stop the router's DHCP client from overwriting the static name-server settings, use the no ip dhcp client request dns-nameserver interface configuration command (you can also exclude a few other DHCP options).
Change the Telnet font color from a Cisco router
I've recently got an intriguiging question: how can I change the color of the terminal emulator font from the CLI by sending the telnet program an escape sequence?
For those of you that haven't worked with escape sequences before - you can control a lot of parameters in you terminal emulation program by sending it a special sequence starting with
DNS resolver in Cisco IOS is auto-configured with parameters from a DHCP reply
If you're using DHCP to get IP interface addresses on your router (using the ip address dhcp interface configuration command), the router will also inherit the DNS resolver settings included in the DHCP reply. Makes sense, but the implementation is "a bit" unexpected: if you configure the DNS name servers manually with the ip name-server address-list command, the ones matching the values in the DHCP reply packet are not included in the running configuration and thus not saved to NVRAM. Even worse, the statically-configured name-servers overwritten by a DHCP reply are lost if the DHCP-configured interface goes down.
To avoid total confusion, you thus have these options:
- Do not use DHCP to acquire IP interface addresses
- Make sure the DHCP server does not send DNS-related parameters (a bit hard if you're using DHCP with your ISP)
- Rely exclusively on DHCP to provide your router with the DNS name server addresses
Periodic execution of IOS show commands
If you want to execute IOS show commands periodically (for example, to monitor router status or take snapshots of routing tables), you can combine new output redirection features introduced in IOS release 12.2T in an Embedded Event Manager (EEM) applet. For example, to store the brief interface status into a file on an FTP server, use the following EEM applet:
event manager applet SaveInterfaceStatus
event timer watchdog name SaveIfStat time 60
action 1.0 cli command "show ip interface brief | redirect ftp://username@password:host/path"
action 2.0 syslog msg "Interface status saved"
Notes:
Protecting the primary DNS server on your router
In a comment to my post describing how to make a router into a primary DNS server, one of the readers noted that you could easily overload a router doing that ... and he's obviously right.
Apart from having too many valid DNS requests for the zone the router is responsible for, the observed behavior could be spam-related. Just a few days ago when I've discussed the router-based DNS server with my security engineers, they've pointed out that a lot of spammers perform regular DNS attacks trying to poison the DNS cache of unpatched open caching DNS servers.
Unicode IPS vulnerability: more details
Cisco has released security response acknowledging that the IPS software does not properly handle a rarely used Unicode encoding. Reading the security notice you might be left wondering what's going on. Here's the whole story.
Within an URI (web address), the ASCII characters can be encoded in one of three ways:
- Unless they are reserved, they can be included in the URI directly (for example, you can always use the letter a in an URI).
- You can always escape a character using its hexadecimal value. Letter a can thus be written as %61.
- Unicode character set includes full-width form of ASCII characters, where letter a can be encoded as a two-byte value 0xFF61 (or %ff%61 in an URI)
The IPS software (standalone or integrated in Cisco IOS) does not recognize the sequence %ff%61 as letter a. It's thus possible to evade some IPS triggers by replacing ASCII characters with their full-width Unicode encoding.
DNS views are broken in release 12.4(11)T
The Split DNS functionality introduced in IOS release 12.4(9)T has survived a single maintenance cycle before being broken. While you can still configure the DNS views in 12.4(11)T2 (and they still work), the view names are missing from the router-generated configuration (show running, for example), making the configuration syntactically incorrect. The router will thus reboot without DNS views after you've saved the running configuration to NVRAM.
Command Authorization Fails with EEM applet or Tcl policy
One of my readers asked an interesting question: „why do the commands executed within a EEM Tcl policy fail with Command authorization fails message?“ The short answer is simple: If you use AAA command authorization (which you can only do if you're using a TACACS+ server), you have to specify the username under which the EEM will execute its CLI commands with the event manager session cli username user configuration command.
Background Continuous Ping from a Router
In a previous post, I've described how you could generate a (almost) continuous ping from a router using the extended ping command. While that approach is extremely simple to implement, it ties up a line (and if you're working from the console, it's highly impractical). You could get the same results (as Tom has already pointed out) using IP SLA feature of Cisco IOS. Configure the ping request with commands similar to these:
What is a cached CEF adjacency?
Whenever a router running CEF switching has LAN interfaces (or any other multi-access interfaces), you'll find cached adjacencies for active directly attached IP neighbors in its CEF table. These adjacencies ensure the smooth traffic flow toward the LAN-attached next-hops (preventing the initial packet drop symptom once the next-hop becomes active).
The self zone in zone-based firewall configuration
One of my readers made an interesting observation when faced with configuring zone-based firewall on Cisco IOS: „My main issue is a confusion between when to use self and when to use in/outside.“
The rules are simple:
Use Tcl script to change the interface status
During network troubleshooting or proof-of-concept testing, I often change the state of a loopback interface (to insert or remove an IP prefix from the routing protocols) or flap it to test the impact on network stability. The traditional approach to this procedure should be known to everyone:
IOS Tclsh resources
Before trying to write Tcl procedures to be executed by Cisco IOS tclsh command, read the following articles:
- Running Tcl procedures from IOS command line
- Tclsh command line parameters
- Where does Tcl output go
- Executing IOS commands from Tcl shell
- IOS scripting with Tcl (IOS 12.3T documentation)
- TCL'ing your Cisco router
And last but not least, if you want to store Tcl procedures on your router and don't want to write into the router's Flash memory (I hate that the router prompts me whether I want to erase the flash every time I store something into it), you can store them in NVRAM.