ise01/admin#show logging system 5147905 Jan 04 2025 09:17:55 ade/ADE.log 29677 Dec 31 2024 03:40:45 anaconda/anaconda.log 3366 Dec 31 2024 03:40:45 anaconda/dbus.log 3195 Dec 31 2024 03:40:45 anaconda/dnf.librepo.log 120 Dec 31 2024 03:40:45 anaconda/hawkey.log 2484919 Dec 31 2024 03:40:45 anaconda/journal.log 1559 Dec 31 2024 03:40:45 anaconda/ks-script-caesfgpm.log 0 Dec 31 2024 03:40:45 anaconda/ks-script-f16lj7nf.log 0 Dec 31 2024 03:40:45 anaconda/ks-script-geecaiup.log 0 Dec 31 2024 03:40:45 anaconda/ks-script-mlj3w0uu.log 0 Dec 31 2024 03:40:45 anaconda/ks-script-n5tsd_t9.log 27 Dec 31 2024 03:40:45 anaconda/ks-script-pg6uv0jk.log 28057 Dec 31 2024 03:40:45 anaconda/lvm.log 416289 Dec 31 2024 03:40:45 anaconda/packaging.log 8579 Dec 31 2024 03:40:45 anaconda/program.log 274997 Dec 31 2024 03:40:45 anaconda/storage.log 949201 Dec 31 2024 03:40:45 anaconda/syslog 1880031 Jan 04 2025 09:17:56 audit/audit.log 8388726 Jan 04 2025 09:05:29 audit/audit.log.1 8388886 Jan 04 2025 07:03:20 audit/audit.log.2 8388687 Jan 04 2025 04:32:46 audit/audit.log.3 8388878 Jan 04 2025 02:00:42 audit/audit.log.4 560 Dec 31 2024 05:14:40 boot.log 0 Dec 31 2024 03:23:40 btmp 2299981 Jan 04 2025 09:17:56 confd/confd-audit.log 0 Dec 31 2024 04:29:06 confd/confd-browser.log 7222 Jan 04 2025 09:07:37 confd/confd-devel.log 12320 Dec 31 2024 05:27:31 confd/confd-error.log.1 18 Dec 31 2024 05:14:53 confd/confd-error.log.idx 13 Dec 31 2024 05:14:53 confd/confd-error.log.siz 0 Dec 31 2024 04:28:54 confd/confd-netconf.log 43873 Dec 31 2024 05:15:07 confd/confd-startconfig.log 61536 Jan 04 2025 09:17:56 confd/confd.log 12361 Dec 31 2024 05:27:31 confd/localhost:8008.access 355991 Jan 04 2025 09:09:22 confd/localhost:9888.access 217380 Jan 04 2025 09:15:02 cron 31552 Jan 04 2025 08:30:02 dnf.librepo.log 95976 Jan 04 2025 08:30:02 dnf.log 3944 Jan 04 2025 08:30:02 dnf.rpm.log 32032 Dec 31 2024 04:38:21 faillog 8388608 Jan 04 2025 09:17:56 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system.journal 15728640 Jan 01 2025 07:20:01 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-000000000000529f-00062a9695a585e3.journal 15728640 Jan 01 2025 18:40:38 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-0000000000007ef4-00062a9fdfafcf96.journal 15728640 Jan 02 2025 06:00:01 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-000000000000ab5d-00062aa961ca3de2.journal 15728640 Jan 02 2025 17:32:32 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-000000000000d79d-00062ab2df73367a.journal 15728640 Jan 03 2025 04:37:55 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-00000000000103e6-00062abc8c1003b8.journal 15728640 Jan 03 2025 15:55:09 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-0000000000013040-00062ac5d7a6fc7d.journal 15728640 Jan 04 2025 03:10:02 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-0000000000015ca8-00062acf4da7c039.journal 15728640 Jan 04 2025 09:07:48 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/system@909543f9760543a8952a757be3c846d2-00000000000188f3-00062ad8bb272d4e.journal 8388608 Jan 04 2025 09:10:09 journal/dbbe2fd2b5a54ad2a4f66f9832ce8eeb/user-1000.journal 1814 Dec 31 2024 05:14:47 kdump.log 292292 Jan 04 2025 09:17:56 lastlog 0 Dec 31 2024 03:32:50 maillog 3296256 Jan 04 2025 09:17:56 messages 314 Jan 04 2025 09:02:07 monit.log 62781 Dec 31 2024 04:39:04 pbis-open-install.log 6025 Jan 04 2025 08:00:45 rhsm/rhsm.log 3832 Jan 04 2025 08:00:46 rhsm/rhsmcertd.log 517652 Jan 01 2025 23:50:01 sa/sa01 517652 Jan 02 2025 23:50:02 sa/sa02 517652 Jan 03 2025 23:50:01 sa/sa03 201404 Jan 04 2025 09:10:00 sa/sa04 424876 Dec 31 2024 23:50:01 sa/sa31 846672 Jan 02 2025 00:07:13 sa/sar01 846672 Jan 03 2025 00:07:13 sa/sar02 846672 Jan 04 2025 00:07:13 sa/sar03 698107 Jan 01 2025 00:07:13 sa/sar31 3935168 Jan 04 2025 09:17:56 secure 0 Dec 31 2024 03:32:50 spooler 57119 Jan 04 2025 09:05:28 sssd/sssd.log 932 Dec 31 2024 05:14:41 sssd/sssd_implicit_files.log 614 Dec 31 2024 05:14:41 sssd/sssd_nss.log 4608 Dec 31 2024 05:14:46 tuned/tuned.log 719 Dec 31 2024 03:41:04 vmware-network.log 3116 Dec 31 2024 05:14:41 vmware-vgauthsvc.log.0 3538 Dec 31 2024 06:17:58 vmware-vmsvc-root.log 348 Dec 31 2024 05:14:41 vmware-vmtoolsd-root.log 6912 Jan 04 2025 08:52:24 wtmp ise01/admin# Possible completions: application Application Install and Administration backup Backup system backup-logs Backup system and application logs cd Change working directory clear Reset functions clock Set the System Clock configure cfg copy Enter URL (use disk:/path/file for local) (Max Size - 2048) crypto Crypto operations debug Debugging functions (see also 'undebug') delete Delete a file dir List files on local filesystem esr Enter the Embedded Services Router console exit Exit the management session forceout Force Logout all the sessions of a specific system user generate-password Username for which password has to be generated halt Shutdown the system idle-timeout Idle timeout for all the sessions of a specific system user license License operations mkdir Create new directory nslookup DNS lookup for an IP address or hostname password Update Password patch Install System or Application Patch permit List cli for Secure Tunnel ping Ping a remote ip address ping6 Ping a remote ipv6 address reload Reload the system reset-config Reset network and time settings restore Restore system rmdir Remove existing directory screen-length Configure screen length screen-width Configure screen width show Show information about the system ssh SSH to a remote ip address tech TAC commands terminal Set terminal line parameters traceroute Trace the route to a remote ip address undebug Disable debugging functions (see also 'debug') who Display currently logged on users ise01/admin#
Cisco Application Deployment Engine OS Release: 3.2 ADE-OS Build Version: 3.2.0.401 ADE-OS System Architecture: x86_64
Copyright (c) 2005-2022 by Cisco Systems, Inc. All rights reserved. Hostname: ise01
Version information of installed applications ---------------------------------------------
Cisco Identity Services Engine --------------------------------------------- Version : 3.2.0.542 Build Date : Wed Oct 19 16:27:24 2022 Install Date : Tue Dec 31 04:37:28 2024
오늘은 cisco ISE basic command에 대해서 알아보겠습니다. cisco GUI는 가끔식 CLI모드에 접속 해서 확인 해야되는 부분이 있습니다.
? 입력하면 사용 가능한 명령어를 호가인 할 수 있습니다.
ise01/admin#? Possible completions: application Application Install and Administration backup Backup system backup-logs Backup system and application logs cd Change working directory clear Reset functions clock Set the System Clock configure cfg copy Enter URL (use disk:/path/file for local) (Max Size - 2048) crypto Crypto operations debug Debugging functions (see also 'undebug') delete Delete a file dir List files on local filesystem esr Enter the Embedded Services Router console exit Exit the management session forceout Force Logout all the sessions of a specific system user generate-password Username for which password has to be generated halt Shutdown the system idle-timeout Idle timeout for all the sessions of a specific system user license License operations mkdir Create new directory nslookup DNS lookup for an IP address or hostname password Update Password patch Install System or Application Patch permit List cli for Secure Tunnel ping Ping a remote ip address ping6 Ping a remote ipv6 address reload Reload the system reset-config Reset network and time settings restore Restore system rmdir Remove existing directory screen-length Configure screen length screen-width Configure screen width show Show information about the system ssh SSH to a remote ip address tech TAC commands terminal Set terminal line parameters traceroute Trace the route to a remote ip address undebug Disable debugging functions (see also 'debug') who Display currently logged on users
1. application 상태 확인
show application status ise
ise01/admin#show application status ise
ISE PROCESS NAME STATE PROCESS ID -------------------------------------------------------------------- Database Listener running 7637 Database Server running 125 PROCESSES Application Server running 26414 Profiler Database running 15924 ISE Indexing Engine running 27730 AD Connector running 29004 M&T Session Database running 22341 M&T Log Processor running 26671 Certificate Authority Service running 28799 EST Service running 60153 SXP Engine Service disabled TC-NAC Service disabled PassiveID WMI Service disabled PassiveID Syslog Service disabled PassiveID API Service disabled PassiveID Agent Service disabled PassiveID Endpoint Service disabled PassiveID SPAN Service disabled DHCP Server (dhcpd) disabled DNS Server (named) disabled ISE Messaging Service running 10778 ISE API Gateway Database Service running 14612 ISE API Gateway Service running 20984 ISE pxGrid Direct Service running 46645 Segmentation Policy Service disabled REST Auth Service disabled SSE Connector disabled Hermes (pxGrid Cloud Agent) disabled McTrust (Meraki Sync Service) disabled ISE Node Exporter running 29632 ISE Prometheus Service running 31413 ISE Grafana Service running 35505 ISE MNT LogAnalytics Elasticsearch disabled ISE Logstash Service disabled ISE Kibana Service disabled % WARNING: ISE DISK SIZE NOT LARGE ENOUGH FOR PRODUCTION USE % RECOMMENDED DISK SIZE: 200 GB, CURRENT DISK SIZE: 100 GB
2. cisco ise application service 종료 - ISE를 종료 하기 위해서는 꼭 application service 중지 하고 ISE종료 해야합니다.
application stop ise
ise01/admin#application stop ise
Stopping ISE Monitoring & Troubleshooting Log Processor... PassiveID WMI Service is disabled PassiveID Syslog Service is disabled PassiveID API Service is disabled PassiveID Agent Service is disabled PassiveID Endpoint Service is disabled PassiveID SPAN Service is disabled Stopping ISE Application Server... Stopping ISE Process Monitoring Service... Stopping ISE Certificate Authority Service... Stopping ISE EST Service... ISE Sxp Engine Service is disabled Stopping TC-NAC Service ... VA Service is not running ISE VA Database is not running Segmentation Policy Service is disabled REST Auth Service is disabled Stopping ISE Messaging Service... Stopping ISE API Gateway Service... Stopping edda-url-fetcher-service Service... Stopping ISE API Gateway Database Service... Stopping ISE Profiler Database... Stopping ISE Indexing Engine... Stopping ISE Monitoring & Troubleshooting Session Database... Stopping ISE AD Connector... Stopping ISE Database processes... Stopping ISE Node Exporter... Stopping ISE Prometheus Service... Stopping ISE Grafana Service... ISE MNT LogAnalytics Elasticsearch Service is not running. ISE Logstash Service is not running. ISE Kibana service is not running.
ise01/admin#
3. ise application 서비스 시작 명령어
application start ise
ise01/admin#application start ise
ISE Database processes already running, PID: 2658610 Starting ISE Messaging Service... Starting ISE API Gateway Database Service... Starting ISE Profiler Database... Starting ISE API Gateway Service... Starting ISE Monitoring & Troubleshooting Session Database... Starting edda-url-fetcher-service Service... Starting ISE Process Monitoring Service... Starting ISE Application Server... Starting ISE Monitoring & Troubleshooting Log Processor... Starting ISE Indexing Engine... Starting ISE Certificate Authority Service... NSS database for CA Service is ready ISE EST service is already running, PID: 2671617 Starting ISE AD Connector... Starting ISE Node Exporter... Starting ISE Prometheus Service... Starting ISE Grafana Service... ISE MNT LogAnalytics Elasticsearch Service is disabled ISE Logstash Service is disabled ISE Kibana Service is disabled Note: ISE Processes are initializing. Use 'show application status ise' CLI to verify all processes are in running state.
ise01/admin#
3. 스크린 clear하는 방법
ise01/admin#cls
4. 현재 시간 확인 하는 방법
ise01/admin#show clock Sat Jan 4 09:08:34 UTC 2025
5. CLI mode에서 debug enable
debug all, 또는 원하는 부분은 debug enable가능 합니다.
ise01/admin#debug ? Possible completions: all Enable all debugging application Application debugging backup-restore Backup and restore cdp Cisco Discovery Protocol config Configuration copy Copy commands locks Resource locking logging Logging configuration snmp Snmp configuration system System transfer File transfer user User Management utils Utilities ise01/admin#debug all
6. debug disable
ise01/admin#undebug all
7. ping 8.8.8.8
ise01/admin#ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=1.41 ms 64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=1.53 ms 64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=1.62 ms 64 bytes from 8.8.8.8: icmp_seq=4 ttl=57 time=1.43 ms
--- 8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 1.406/1.493/1.615/0.083 ms
8. traceroute 8.8.8.8
ise01/admin#traceroute 8.8.8.8 traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets 1 192.168.10.253 2.182 ms 2.158 ms 2.152 ms 2 202.X.X.X 2.735 ms 2.884 ms 2.855 ms 3 202.X.X.X 2.618 ms 2.638 ms 2.694 ms 4 203.117.190.81 3.149 ms 3.181 ms 3.176 ms 5 * * * 6 203.116.3.50 3.633 ms 2.102 ms 2.059 ms 7 72.14.196.189 3.577 ms 4.002 ms 4.017 ms 8 172.253.77.227 2.596 ms 2.541 ms 2.509 ms 9 74.125.251.205 3.248 ms 2.941 ms 2.994 ms 10 8.8.8.8 1.825 ms 1.583 ms 1.033 ms
ise01/admin#
9. 재부팅
reload
ise01/admin#reload
10. 종료
halt
se01/admin#halt
지금까지 [2024][CISCO ISE#3] - basic CLI command - 01 글을 읽어주셔서 감사합니다.
Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/8/2021 1:20 AM PerfLogs d-r--- 12/31/2024 3:24 AM Program Files d----- 12/31/2024 3:22 AM Program Files (x86) d----- 1/1/2025 12:19 AM Share_Authorized_User d----- 1/1/2025 12:19 AM share_hide d----- 1/1/2025 12:18 AM Share_USER01_ONLY d----- 1/1/2025 12:18 AM Share_USER_ALL_READ d----- 1/1/2025 12:18 AM Share_USER_ALL_READ_WRITE d-r--- 12/31/2024 2:24 AM Users d----- 12/31/2024 2:30 AM Windows -a---- 1/1/2025 12:56 AM 7 goodmorning.txt -a---- 1/1/2025 12:56 AM 7 hello.txt
PS C:\Users\Administrator>
txt파일만 출력하기
PS C:\Users\Administrator> get-childitem c:\*.txt
Directory: C:\
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 1/1/2025 12:56 AM 7 goodmorning.txt -a---- 1/1/2025 12:56 AM 7 hello.txt
write-command 뒤에 무엇이 있는지 확인 하고 싶을때.
PS C:\Users\Administrator> get-command write*
CommandType Name Version Source ----------- ---- ------- ------ Alias write -> Write-Output Alias Write-FileSystemCache 2.0.0.0 Storage Alias Write-FileSystemCache 1.0.0.0 VMDirectStorage Function Write-DtcTransactionsTraceSession 1.0.0.0 MsDtc Function Write-PrinterNfcTag 1.1 PrintManagement Function Write-VolumeCache 2.0.0.0 Storage Cmdlet Write-Debug 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-Error 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-EventLog 3.1.0.0 Microsoft.PowerShell.Management Cmdlet Write-Host 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-Information 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-Output 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-Progress 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-Verbose 3.1.0.0 Microsoft.PowerShell.Utility Cmdlet Write-Warning 3.1.0.0 Microsoft.PowerShell.Utility Application write.exe 10.0.20... C:\Windows\system32\write.exe Application write.exe 10.0.20... C:\Windows\write.exe
이런 형식으로 Linux 또는 Unix 처럼 여러가지 기능들을 shell형식으로 제공합니다.
이 관련 부분을 script를 이용해서 자동화에도 사용 하루 있습니다.
이 글에서는 powershell를 이용한 자동화 스크립트에 대해서는 다루지 않겠습니다.
지금까지 [Windows Server 2019][#6] - PowerShell 글을 읽어주셔서 감사합니다.
C:\Users\Administrator>netdom renamecomputer %COMPUTERNAME% /newname:SERVER01 This operation will rename the computer FIRST to SERVER01.
Certain services, such as the Certificate Authority, rely on a fixed machine name. If any services of this type are running on FIRST, then a computer name change would have an adverse impact.
Do you want to proceed (Y or N)? y The computer needs to be restarted in order to complete the operation.
ISP02 - WAN02는 WAN01이 죽어야지 Default Gateway WAN02로 바뀌면서 통신 가능 합니다.
config system ddns edit 1 set ddns-server FortiGuardDDNS set ddns-domain "fw1004.float-zone.com" set use-public-ip enable set update-interval 60 set monitor-interface "port1" "port2"
202. X.X .196에 대한 Ping 통계: 패킷: 보냄 = 5, 받음 = 5, 손실 = 0 (0% 손실), 왕복 시간(밀리초): 최소 = 10ms, 최대 = 25ms, 평균 = 16ms Control-C ^C C:\Users\USER> C:\Users\USER>nslookup fw1004.float-zone.com -t ^C C:\Users\USER>nslookup fw1004.float-zone.com 서버: UnKnown Address: 43.245.107.6
권한 없는 응답: 이름: fw1004.float-zone.com Address: 202. X.X .196
Fortigate에서 WAN01에서 케이블을 제거 합니다.
DDNS서버에 정보가 업데이트되고 ROOT DNS서버까지 동기화 하기 위해서는 조금 시간이 걸립니다.
5분 정도 기다립니다.
라우팅 테이블은 port2으로 ISP2으로 변경 되었습니다.
fortiGate-VM64-KVM # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
Routing table for VRF=0 S* 0.0.0.0/0 [150/0] via 202. X.X .193, port2, [1/0] C 10.1.1.0/24 is directly connected, port3
권한 없는 응답: 이름: fw1004.float-zone.com Address: 202.X.X.197
fortigate wan01 케이블을 다시 연결 합니다.
Default Gateway는 변경 되었습니다.
FortiGate-VM64-KVM # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 202. X.X .193, port1, [1/0] C 10.1.1.0/24 is directly connected, port3
WAN02가 BACKUP internet으로 동작중에 INT-SW G0/0가 죽으면 Fortigate입장에서는 감지 할수 있는 방법이 없어서 계속 WAN01로 Traffic보내어서 PC가 통신이 불가능 합니다.
WAN01 - Interface로 Ping 8.8.8.8 보내어서 응답이 없으면 Defualt Gateway를 WAN02변경해서 PC가 계속 외부로 통신이 가능 하도록 설정해보겠습니다.
FortiGate-VM64-KVM # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 202.14.X.X, port1, [1/0] C 10.1.1.0/24 is directly connected, port3
외부로 통신이 가능 합니다.
INT-SW01에서 Int G0/0 Shutdown 합니다.
en conf t int g0/0 sh
PC에서 통신이 불가능 합니다.
그 이유는 방화벽 입장에서 직접 물리적으로 연결된 링크가 죽은게 아니기때문에, 감지를 못합니다.
계속 Port1로 패킷을 보내고 있습니다.
FortiGate-VM64-KVM # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 202.14.X.X, port1, [1/0] C 10.1.1.0/24 is directly connected, port3
Fortigate 에서 IP SLA 설정 합니다.
FortiGate-VM64-KVM # config system link-monitor
FortiGate-VM64-KVM (link-monitor) # edit pri new entry 'pri' added
FortiGate-VM64-KVM (pri) # set srcintf port1
FortiGate-VM64-KVM (pri) # set source-ip 202.14.X.X
FortiGate-VM64-KVM (pri) # show config system link-monitor edit "pri" set srcintf "port1" set server "8.8.8.8" set source-ip 202.14.X.X next end
FortiGate-VM64-KVM # diagnose sys link-monitor status pri
Link Monitor: pri, Status: dead, Server num(1), HA state: local(dead), shared(dead) Flags=0x9 init log_downgateway, Create time: Fri Dec 27 18:45:55 2024 Source interface: port1 (3) Source IP: 202.14.X.X Interval: 500 ms Service-detect: disable Diffservcode: 000000 Class-ID: 0 Peer: 8.8.8.8(8.8.8.8) Source IP(202.14.X.X) Route: 202.14.X.X->8.8.8.8/32, gwy(202.14.X.X) protocol: ping, state: dead Packet lost: 100.000% Number of out-of-sequence packets: 0 Recovery times(0/5) Fail Times(2/5) Packet sent: 18, received: 0, Sequence(sent/rcvd/exp): 19/0/0
PC가 정상적으로 외부로 통신이 가능 합니다.
아래처럼 디폴트 게이트웨이가 Port2로 변경 되었습니다.
FortiGate-VM64-KVM # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
Routing table for VRF=0 S* 0.0.0.0/0 [150/0] via 202.14.X.X, port2, [1/0] C 10.1.1.0/24 is directly connected, port3
INT_SW01에서 int g0/0 no shutdown해서 인터페이스를 살립니다.
en conf t int g0/0 no sh
그리고 IP SLA상태를 확인 합니다. Status alive입니다.
FortiGate-VM64-KVM # diagnose sys link-monitor status pri
Link Monitor: pri, Status: alive, Server num(1), HA state: local(alive), shared(alive) Flags=0x1 init, Create time: Fri Dec 27 18:45:55 2024 Source interface: port1 (3) Source IP: 202.14.X.X Interval: 500 ms Service-detect: disable Diffservcode: 000000 Class-ID: 0 Peer: 8.8.8.8(8.8.8.8) Source IP(202.14.X.X) Route: 202.14.X.X->8.8.8.8/32, gwy(202.14.X.X) protocol: ping, state: alive Latency(Min/Max/Avg): 3.238/7.040/3.807 ms Jitter(Min/Max/Avg): 0.024/3.550/0.523 ms Packet lost: 51.000% Number of out-of-sequence packets: 0 Fail Times(0/5) Packet sent: 881, received: 49, Sequence(sent/rcvd/exp): 882/882/883
FortiGate-VM64-KVM #
라우팅 테이블을 확인 합니다.
Port2에서 Port1으로 변경 되었습니다.
FortiGate-VM64-KVM # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default
Routing table for VRF=0 S* 0.0.0.0/0 [10/0] via 202.14.X.X, port1, [1/0] C 10.1.1.0/24 is directly connected, port3
Traceback (most recent call last): File "ishare.py", line 118, in <module> File "ishare.py", line 112, in main File "ishare.py", line 82, in search TypeError: 'bool' object has no attribute '__getitem__'
등등 에러 메시지가 발생 합니다. 구글에 검색해보니 ishare제대로 동작안되는거 같습니다.
┌────────────────────────────────────────────────────────────────────────┐ │ Welcome to the ishare2 configuration wizard. │ │ - This wizard will guide you through the configuration process. │ │ - Press Enter to accept the default value. │ │ - You can modify the configuration later by running: ishare2 config. │ │ - Press Ctrl+C to cancel. │ └────────────────────────────────────────────────────────────────────────┘ [+] Use aria2c for faster downloads? (default: no) [+] (y/n): [+] Check SSL certificate? (default: yes) [+] (y/n): [+] Choose the update channel. 1) alpha 2) beta 3) main [*] Enter the number of the branch you want to use (default: main): [!] Using the default branch. [+] Choose a mirror. (default: Rotate mirrors) 1) Rotate mirrors (recommended) 2) Google Drive mirror 3) Onedrive mirror 4) Custom mirror [*] Enter the number of the mirror you want to use (default: 1): [!] ishare2 will rotate among the available mirrors. ┌─────────────────────────────────────────────────────────────┐ │ Configuration completed successfully. │ │ You can start using ishare2! │ │ [!] IMPORTANT NOTICES: │ │ - ishare2 is a free and open-source project. If you paid │ │ for it, you have been scammed. │ │ - Do not download ishare2 from unofficial sources as they │ │ may contain arbitrary code. │ └─────────────────────────────────────────────────────────────┘ ┌────────────────────────────────────────────────────────────────┐ │ MOTD from the ishare2 team: │ │ Changelog: │ │ - Fixed bug when doing integrity checks againts qemu images. │ │ │ │ Telegram: https://t.me/NetLabHub │ │ Donate: https://buymeacoffee.com/sudoalex │ │ GitHub: https://github.com/ishare2-org/ishare2-cli │ └────────────────────────────────────────────────────────────────┘ Syntax
ishare2 [action] [param1] [param2] [--overwrite]
action: search : Search for images available on LabHub mirrors. pull : Download an image by specifying the type and id. installed : Shows images installed on the server. labs : Shows available labs and downloads the images for the selected lab. mylabs : Same as labs command but you can use a customized path. relicense : Generates an iourc license for iol images. upgrade : Shows a menu to upgrade ishare2 or PNETLab. test : Test internet connectivity to required sites. help : Shows full help information.
param1: type = all, iol, qemu, dynamips, docker or name.
param2: id = This can be obtained using ishare2 search <type>
--overwrite: Used to overwrite an existing image if it already exists on your system.
ip dhcp pool VLAN110 network 192.168.110.0 255.255.255.0 dns-server 8.8.8.8 default-router 192.168.110.254 !
IP주소를 Clinet에게 할당 하였습니다.
SW01#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type State Interface Hardware address/ User name 192.168.110.1 013e.6d3f.25af.12 Dec 27 2024 07:16 AM Automatic Active Vlan110 SW01#
mysql> create database zabbix character set utf8mb4 collate utf8mb4_bin; mysql> create user zabbix@localhost identified by 'Password123!@#'; ->password는 zabbix user password를 입력 합니다. mysql> grant all privileges on zabbix.* to zabbix@localhost; mysql> set global log_bin_trust_function_creators = 1; mysql> quit;
root@kevin-VMware-Virtual-Platform:/home/kevin# mysql -uroot -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 8 Server version: 8.0.40-0ubuntu0.24.04.1 (Ubuntu)
Copyright (c) 2000, 2024, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> create database zabbix character set utf8mb4 collate utf8mb4_bin; Query OK, 1 row affected (0.01 sec)
mysql> create user zabbix@localhost identified by 'Password123!@#'; Query OK, 0 rows affected (0.03 sec)
mysql> grant all privileges on zabbix.* to zabbix@localhost; Query OK, 0 rows affected (0.01 sec)
mysql> set global log_bin_trust_function_creators = 1; Query OK, 0 rows affected, 1 warning (0.00 sec)
kevin@kevin-VMware-Virtual-Platform:~$ sudo apt-get upgrade Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done The following upgrades have been deferred due to phasing: python3-distupgrade ubuntu-release-upgrader-core ubuntu-release-upgrader-gtk The following packages have been kept back: gnome-control-center linux-generic-hwe-24.04 linux-headers-generic-hwe-24.04 linux-image-generic-hwe-24.04 The following packages will be upgraded: acl alsa-ucm-conf amd64-microcode apparmor apport apport-core-dump-handler apport-gtk bubblewrap cloud-init cpp-13 cpp-13-x86-64-linux-gnu cups cups-browsed cups-bsd cups-client cups-common cups-core-drivers cups-daemon cups-ipp-utils cups-ppdc cups-server-common distro-info-data dmidecode dmsetup evince evince-common firmware-sof-signed fwupd gcc-13-base gcc-14-base ghostscript gir1.2-glib-2.0 gir1.2-gnomebluetooth-3.0 gir1.2-gstreamer-1.0 gir1.2-gtk-3.0 gir1.2-javascriptcoregtk-4.1 gir1.2-javascriptcoregtk-6.0 gir1.2-mutter-14 gir1.2-nm-1.0 gir1.2-packagekitglib-1.0 gir1.2-soup-3.0 gir1.2-webkit-6.0 gir1.2-webkit2-4.1 gnome-bluetooth-3-common gnome-bluetooth-sendto gnome-control-center-data gnome-control-center-faces gnome-initial-setup gnome-shell gnome-shell-common gnome-shell-extension-appindicator gnome-shell-extension-ubuntu-dock gstreamer1.0-alsa gstreamer1.0-gl gstreamer1.0-packagekit gstreamer1.0-pipewire gstreamer1.0-plugins-base gstreamer1.0-plugins-base-apps gstreamer1.0-plugins-good gstreamer1.0-tools gstreamer1.0-x gtk-update-icon-cache heif-gdk-pixbuf heif-thumbnailer initramfs-tools initramfs-tools-bin initramfs-tools-core intel-microcode ipp-usb krb5-locales ldap-utils libacl1 libapparmor1 libarchive13t64 libatomic1 libaudit-common libaudit1 libcryptsetup12 libcups2t64 libcupsfilters2-common libcupsfilters2t64 libcupsimage2t64 libcurl3t64-gnutls libcurl4t64 libdevmapper1.02.1 libegl-mesa0 libevdocument3-4t64 libevview3-3t64 libexpat1 libfwupd2 libgbm1 libgcc-s1 libgl1-mesa-dri libglapi-mesa libglib2.0-0t64 libglib2.0-bin libglib2.0-data libglx-mesa0 libgnome-bluetooth-3.0-13 libgnome-bluetooth-ui-3.0-13 libgomp1 libgs-common libgs10 libgs10-common libgsf-1-114 libgsf-1-common libgssapi-krb5-2 libgstreamer-gl1.0-0 libgstreamer-plugins-base1.0-0 libgstreamer-plugins-good1.0-0 libgstreamer1.0-0 libgtk-3-0t64 libgtk-3-bin libgtk-3-common libheif-plugin-aomdec libheif-plugin-aomenc libheif-plugin-libde265 libheif1 libipa-hbac0t64 libjavascriptcoregtk-4.1-0 libjavascriptcoregtk-6.0-1 libk5crypto3 libkrb5-3 libkrb5support0 libldap-common libldap2 libmpg123-0t64 libmutter-14-0 libnm0 libnss-sss libopenjp2-7 libpackagekit-glib2-18 libpam-sss libpipewire-0.3-0t64 libpipewire-0.3-common libpipewire-0.3-modules libppd2 libppd2-common libproc2-0 libpython3.12-minimal libpython3.12-stdlib libpython3.12t64 libsoup-2.4-1 libsoup-3.0-0 libsoup-3.0-common libsoup2.4-common libspa-0.2-bluetooth libspa-0.2-modules libspeex1 libssl3t64 libsss-certmap0 libsss-idmap0 libsss-nss-idmap0 libstdc++6 libsysmetrics1 libtiff6 libudisks2-0 libwebkit2gtk-4.1-0 libwebkitgtk-6.0-4 libxatracker2 linux-firmware linux-libc-dev linux-tools-common login mesa-vulkan-drivers mtr-tiny mutter-common mutter-common-bin nano network-manager network-manager-config-connectivity-ubuntu openssl openvpn packagekit packagekit-tools passwd pipewire pipewire-alsa pipewire-audio pipewire-bin pipewire-pulse procps python3-apport python3-pkg-resources python3-problem-report python3-software-properties python3-sss python3-update-manager python3-urllib3 python3.12 python3.12-minimal snapd software-properties-common software-properties-gtk ssh-import-id sssd sssd-ad sssd-ad-common sssd-common sssd-ipa sssd-krb5 sssd-krb5-common sssd-ldap sssd-proxy systemd-hwe-hwdb thermald ubuntu-advantage-desktop-daemon ubuntu-drivers-common ubuntu-pro-client ubuntu-pro-client-l10n ubuntu-report ubuntu-settings udisks2 unzip update-manager update-manager-core vim-common vim-tiny xdg-desktop-portal xserver-common xserver-xephyr xserver-xorg-core xserver-xorg-legacy xwayland xxd zip 226 upgraded, 0 newly installed, 0 to remove and 7 not upgraded. Need to get 718 MB of archives. After this operation, 23.7 MB of additional disk space will be used. N: Some packages may have been kept back due to phasing. Do you want to continue? [Y/n] y Get:1 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 login amd64 1:4.13+dfsg1-4ubuntu3.2 [202 kB] Get:2 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libexpat1 amd64 2.6.1-2ubuntu0.2 [87.4 kB] Get:3 http://archive.ubuntu.com/ubuntu noble-updates/main amd64 libpython3.12t64 amd64 3.12.3-1ubuntu0.3 [2,333 kB] 0% [3 libpython3.12t64 1,322 kB/2,333 kB 57%]
업그레이드가 완료 될때까지 기다립니다.
kevin@kevin-VMware-Virtual-Platform:~$ sudo apt-get update Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease Hit:2 http://security.ubuntu.com/ubuntu noble-security InRelease Hit:3 http://archive.ubuntu.com/ubuntu noble-updates InRelease Hit:4 http://archive.ubuntu.com/ubuntu noble-backports InRelease Reading package lists... Done kevin@kevin-VMware-Virtual-Platform:~$ sudo apt-get upgrade Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done The following upgrades have been deferred due to phasing: python3-distupgrade ubuntu-release-upgrader-core ubuntu-release-upgrader-gtk The following packages have been kept back: gnome-control-center linux-generic-hwe-24.04 linux-headers-generic-hwe-24.04 linux-image-generic-hwe-24.04 0 upgraded, 0 newly installed, 0 to remove and 7 not upgraded. N: Some packages may have been kept back due to phasing. kevin@kevin-VMware-Virtual-Platform:~$
더이상 업데이트 할것이 없습니다.
지금까지 [ZABBIX][#3]-Ubuntu 24.04.01 update/upgrade 글을 읽어주셔서 감사합니다.
오늘은 C9800에 Data Interface 2개를 Port Channel로 구성하는 방법에 대해서 알아보겠습니다.
WLC01: Gi3 - MGMT IP vrf MGMT
G1 and G2 - Portchannel 01로 묶고 Trunk 포트로 모든 VLAN를 허용 하게 설정 하겠습니다.
1. WLC GUI에 접속합니다.
Gi1/Gi2를 아래와 같이 설정합니다.
2. Port-channel를 설정합니다.
SW01(config)#int ra g1/0, gi0/3 SW01(config-if-range)#channel-group 1 mode on SW01(config)#int po 1 SW01(config-if)#sw tr en dot1q SW01(config-if)#sw mo trunk
Interface Status 확인
SW01#show int status
Port Name Status Vlan Duplex Speed Type Gi0/0 connected trunk auto auto unknown Gi0/1 connected trunk auto auto unknown Gi0/2 connected 100 auto auto unknown Gi0/3 connected trunk auto auto unknown Gi1/0 connected 1 auto auto unknown Gi1/1 connected 10 auto auto unknown Gi1/2 connected 20 auto auto unknown Gi1/3 connected 100 auto auto unknown Po1 connected trunk auto auto SW01#
테스트를 위해서 WLC 아래와 같이 설정 합니다.
VLAN 110
VLAN 120 VLAN 130
SVI 110 - 192.168.110.254
SVI 120 - 192.168.120.254
SVI 130 - 192.168.130.254
VLAN 110를 설정합니다. 그리고 아래 사진처럼 VLAN 120, VLAN 130도 설정 합니다.
VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi1/0 10 VLAN0010 active Gi1/1 20 VLAN0020 active Gi1/2 30 VLAN0030 active 100 VLAN0100 active Gi0/2, Gi1/3 110 VLAN0110 active 120 VLAN0120 active 130 VLAN0130 active 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup SW01#
SW01#show ip int brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 unassigned YES unset up up GigabitEthernet0/1 unassigned YES unset up up GigabitEthernet0/2 unassigned YES unset up up GigabitEthernet0/3 unassigned YES unset up up GigabitEthernet1/0 unassigned YES unset up up GigabitEthernet1/1 unassigned YES unset up up GigabitEthernet1/2 unassigned YES unset up up GigabitEthernet1/3 unassigned YES unset up up Port-channel1 unassigned YES unset down down Vlan10 192.168.10.250 YES NVRAM administratively down down Vlan20 unassigned YES unset administratively down down Vlan100 192.168.100.179 YES NVRAM up up Vlan110 192.168.110.253 YES manual up up Vlan120 192.168.120.253 YES manual up up Vlan130 192.168.130.253 YES manual up up
ping test
SW01#ping 192.168.110.254 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.110.254, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms SW01#ping 192.168.120.254 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.120.254, timeout is 2 seconds: .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/6 ms SW01#ping 192.168.130.254 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.130.254, timeout is 2 seconds: .!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms SW01#
SW01#show etherchannel summary Flags: D - down P - bundled in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 U - in use N - not in use, no aggregation f - failed to allocate aggregator
M - not in use, minimum links not met m - not in use, port not aggregated due to minimum links not met u - unsuitable for bundling w - waiting to be aggregated d - default port
A - formed by Auto LAG
Number of channel-groups in use: 1 Number of aggregators: 1
Group Port-channel Protocol Ports ------+-------------+-----------+----------------------------------------------- 1 Po1(SU) - Gi0/3(P) Gi1/0(P)
지금까지 [C9800CL][#8]- Data Interface Redundancy - Port Channel 글을 읽어주셔서 감사합니다.
사용할 방법은 AP MAC주소를 WLC에 등록해서 허가된 AP MAC만 WLC에 등록 할 수 있습니다.
AP IP: DHCP Server로 부터 IP주소를 받아감. 192.168.200.X/24
AP GW: 192.168.200.181
WLC: 192.168.100.182 DHCP option43를 이용함.
1. Configuration -> Security -> AAA 클릭 합니다.
2. AAA Advanced -> AP Policy 에서 Authorized AP aginast MAC를 Enable하고 Apply를 클릭 합니다.
*** 만약에 Default값으로 아래 처럼 설정 안되어져 있으면 추가로 설정 합니다. ***
3. 현재 아래처럼 AP한대가 WLC에 등록 되어져 있습니다.
4. AP를 재부팅 합니다.
5. 약 5분후 - Monitoring -> Wireless -> AP statistics를 클릭해서 AP가 상태를 확인 합니다.
AP가 WLC에게 CAPWAP join request 메시지를 전송하지만 reponse패킷을 받지 못합니다.
그리고 CAPWAP state: DTLS Teardown이 되고, 다시 CAPWAP join request를 보냅니다. 이 과정을 반복합니다.
[*12/25/2024 05:57:51.4299] CAPWAP State: Join [*12/25/2024 05:57:51.6198] Sending Join request to 192.168.100.182 through port 5272, packet size 1376 [*12/25/2024 05:57:56.3783] Sending Join request to 192.168.100.182 through port 5272, packet size 1376 [*12/25/2024 05:58:01.0569] Sending Join request to 192.168.100.182 through port 5272, packet size 896
[*12/25/2024 05:58:48.1321] CAPWAP State: DTLS Teardown [*12/25/2024 05:58:48.3621] status 'upgrade.sh: Script called with args:[CANCEL]' [*12/25/2024 05:58:48.4121] do CANCEL, part2 is active part [*12/25/2024 05:58:48.4320] status 'upgrade.sh: Cleanup tmp files ...' [*12/25/2024 05:58:53.0506] dtls_queue_first: Nothing to extract! [*12/25/2024 05:58:53.0506] [*12/25/2024 05:58:53.5504] Discovery Response from 192.168.100.182 [*12/25/2024 05:59:04.0000] Started wait dtls timer (60 sec) [*12/25/2024 05:59:04.0099] [*12/25/2024 05:59:04.0099] CAPWAP State: DTLS Setup [*12/25/2024 05:59:04.1799] First connect to vWLC, accept vWLC by default [*12/25/2024 05:59:04.1799] [*12/25/2024 05:59:04.1799] dtls_verify_server_cert: vWLC is using SSC, returning 1 [*12/25/2024 05:59:04.2599] [*12/25/2024 05:59:04.2599] CAPWAP State: Join [*12/25/2024 05:59:04.4299] Sending Join request to 192.168.100.182 through port 5272, packet size 1376 [*12/25/2024 05:59:09.1284] Sending Join request to 192.168.100.182 through port 5272, packet size 1376
[*12/25/2024 06:20:28.8807] CAPWAP State: Discovery [*12/25/2024 06:20:28.8807] Got WLC address 192.168.100.182 from DHCP. [*12/25/2024 06:20:29.1006] Discovery Request sent to 192.168.100.182, discovery type STATIC_CONFIG(1) [*12/25/2024 06:20:29.3005] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0) [*12/25/2024 06:20:29.3005] Discovery Response from 192.168.100.182 [*12/25/2024 06:20:39.0000] Started wait dtls timer (60 sec) [*12/25/2024 06:20:39.0099] [*12/25/2024 06:20:39.0099] CAPWAP State: DTLS Setup [*12/25/2024 06:20:39.1099] First connect to vWLC, accept vWLC by default [*12/25/2024 06:20:39.1099] [*12/25/2024 06:20:39.1199] dtls_verify_server_cert: vWLC is using SSC, returning 1 [*12/25/2024 06:20:39.1799] [*12/25/2024 06:20:39.1799] CAPWAP State: Join [*12/25/2024 06:20:39.3399] Sending Join request to 192.168.100.182 through port 5272, packet size 1376 [*12/25/2024 06:20:43.9185] Sending Join request to 192.168.100.182 through port 5272, packet size 1376 [*12/25/2024 06:20:44.1484] Join Response from 192.168.100.182, packet size 1397 [*12/25/2024 06:20:44.1484] AC accepted previous sent request with result code: 0 [*12/25/2024 06:20:44.1484] Received wlcType 0, timer 30 [*12/25/2024 06:20:44.2584] nss_capwapmgr_enable_tunnel[1682]:ef30e800: tunnel 0 is already enabled [*12/25/2024 06:20:44.2783] [*12/25/2024 06:20:44.2783] CAPWAP State: Image Data [*12/25/2024 06:20:44.2883] AP image version 17.13.0.107 backup 17.8.0.144, Controller 17.13.0.107 [*12/25/2024 06:20:44.2883] Version is the same, do not need update. [*12/25/2024 06:20:44.3583] status 'upgrade.sh: Script called with args:[NO_UPGRADE]' [*12/25/2024 06:20:44.3983] do NO_UPGRADE, part2 is active part [*12/25/2024 06:20:44.4183] [*12/25/2024 06:20:44.4183] CAPWAP State: Configure [*12/25/2024 06:20:44.6382] Radio [2] Administrative state DISABLED change to ENABLED [*12/25/2024 06:20:44.6382] Radio [1] Administrative state DISABLED change to ENABLED [*12/25/2024 06:20:44.6382] Radio [0] Administrative state DISABLED change to ENABLED [*12/25/2024 06:20:45.3880] [*12/25/2024 06:20:45.3880] CAPWAP State: Run [*12/25/2024 06:20:45.4680] AP has joined controller WLC01 [*12/25/2024 06:20:45.4680] Flexconnect Switching to Connected Mode! [*12/25/2024 06:20:46.0678] Previous AP mode is 2, change to 2 [*12/25/2024 06:20:46.0778] Current session mode: ssh, Configured: Telnet-No, SSH-No, Console-Yes [*12/25/2024 06:20:46.0778] [*12/25/2024 06:20:46.3377] Current session mode: telnet, Configured: Telnet-No, SSH-No, Console-Yes [*12/25/2024 06:20:46.3377] [*12/25/2024 06:20:46.3577] Current session mode: console, Configured: Telnet-No, SSH-No, Console-Yes [*12/25/2024 06:20:46.3577] [*12/25/2024 06:20:46.4177] chpasswd: password for user changed [*12/25/2024 06:20:46.4677] chpasswd: password for user changed [*12/25/2024 06:20:46.6376] [*12/25/2024 06:20:46.6376] Same LSC mode, no action needed [*12/25/2024 06:20:46.9275] Same value is already set. [*12/25/2024 06:20:47.2374] USB Device Disconnected from the AP [*12/25/2024 06:20:47.3974] Got WSA Server config TLVs [*12/25/2024 06:20:48.7270] Socket: Valid Element: wcp/wcp_db Handler: set_vlan_name_map Data: null Length: 10 [*12/25/2024 06:20:50.4064] SD AVC only supports 802.11ax AP [*12/25/2024 06:20:50.5664] Re-Tx Count=1, Max Re-Tx Value=5, SendSeqNum=16, NumofPendingMsgs=1 [*12/25/2024 06:20:50.5664] [*12/25/2024 06:20:50.8163] DOT11_DRV[0]: Stop Radio0 - Begin [*12/25/2024 06:20:50.8963] DOT11_DRV[0]: Stop Radio0 - End [*12/25/2024 06:20:50.8963] DOT11_DRV[0]: Start Radio0 - Begin [*12/25/2024 06:20:50.8963] DOT11_DRV[0]: Start Radio0 - End [*12/25/2024 06:20:53.0756] **** CAC start for 62 seconds for radio 1 **** [*12/25/2024 06:21:15.6385] netlink socket init done, pnl->spectral_fd=4 [*12/25/2024 06:21:15.6385] CLEANAIR: Slot 0 admin disabled [*12/25/2024 06:21:16.6382] CLEANAIR: Slot 1 admin disabled [*12/25/2024 06:21:55.1962] cac_timeout cac expired, chan 5560 curr time 306 [*12/25/2024 06:21:55.1962] **** CAC stop for radio 1 ****
Username: Username: % Authentication failed
아래 사진처럼 AP가 WLC에 등록 되었습니다.
시간이 지나도 AP는 계속 UP상태 입니다. 그 이유는 이미 WLC등록되어기 때문에, 다시 AP Authentication를 확인 하지 않습니다.
AP를 재부팅 합니다.
재부팅후에는 다시 AP authentication를 시도해야합니다. 하지만 WLC에서 AP MAC주소를 제거 했기 떄문에, 아래처럼 인증 실패로 표시 됩니다.
지금까지 [C9800CL][#7]- AP authentication - AP Mac Filter 글을 읽어주셔서 감사합니다.
Type: Sub-option code 241, used to define a method for Cisco Lightweight APs, represented in hex (f1)
Length: Number of controller IP addresses to be supplied - multiplied by 4, represented in hex (04)
Value: List of Cisco WLC IP addresses, represented in hex(c0a864b6)
1. 스위치에서 DHCP 서버를 설정합니다
ip dhcp pool AP-MGMT-POOL network 192.168.200.0 255.255.255.0 dns-server 8.8.8.8 default-router 192.168.200.181 option 43 hex f104.c0a8.64b6
2. AP에서 IP주소를 확인 합니다
APC884.A1CC.2F48#show ip interface brief Brief summary of IP status and configuration APC884.A1CC.2F48#show ip interface brief Interface IP-Address Method Status Protocol Speed Duplex wired0 192.168.200.1 DHCP up up 1000 full wired1 n/a n/a administatively down down n/a n/a auxiliary-client unassigned unset up up n/a n/a wifi0 n/a n/a administatively down down n/a n/a wifi1 n/a n/a administatively down down n/a n/a
3. switch에서 IP주소 Binding를 확인 합니다
SW1#show ip dhcp binding Bindings from all pools not associated with VRF: IP address Client-ID/ Lease expiration Type Hardware address/ User name 192.168.200.1 01c8.84a1.cc2f.48 Dec 25 2024 11:09 AM Automatic SW1#
4. 아래처럼 capwap 명령어로도 확인 가능 합니다.
APC884.A1CC.2F48#show capwap ip config CAPWAP IP static configuration APC884.A1CC.2F48#show capwap ip config IP Address : 192.168.200.1 IP netmask : 255.255.255.0 Default Gateway : 192.168.200.181
5. 패킷 상황
[*12/24/2024 10:49:41.9079] pid 4559's new affinity mask: 1 [*12/24/2024 10:49:42.0079] hostapd:failed to open wcp socket [*12/24/2024 10:49:42.2878] device aptrace0 entered promiscuous mode [*12/24/2024 10:49:43.0275] pid 4632's current affinity mask: 3 [*12/24/2024 10:49:43.0275] pid 4632's new affinity mask: 1 [*12/24/2024 10:49:43.6273] USB not initialized [*12/24/2024 10:49:44.0372] chpasswd: password for user changed [*12/24/2024 10:49:45.0069] ethernet_port wired0, ip 192.168.200.1, netmask 255.255.255.0, gw 192.168.200.181, mtu 1500, bcast 192.168.200.255, dns1 8.8.8.8, vid 0, static_ip_failover false, dhcp_vlan_failover false [*12/24/2024 10:49:46.0366] Check whether client_ip_table entry need to be cleared 0 [*12/24/2024 10:49:46.0366] Clearing client entry [*12/24/2024 10:49:46.1366] DOT11_TXP[0]:Domain configured: 1 class:E [*12/24/2024 10:49:46.3365] DOT11_TXP[0]:Regdb file: /radio_fw/AP1852I_power_table_mapping.txt [*12/24/2024 10:49:46.3665] DOT11_TXP[1]:Domain configured: 14 class:S [*12/24/2024 10:49:46.8263] /etc/dnsmasq.host.conf: [*12/24/2024 10:49:46.8363] no-resolv [*12/24/2024 10:49:46.8363] pid-file=/var/run/dnsmasq.host.pid [*12/24/2024 10:49:46.8363] port=53 [*12/24/2024 10:49:46.8363] min-port=61000 [*12/24/2024 10:49:46.8363] server=8.8.8.8 [*12/24/2024 10:49:46.8363] bind-interfaces [*12/24/2024 10:49:46.8363] interface=lo [*12/24/2024 10:49:47.1363] DOT11_TXP[1]:Regdb file: /radio_fw/AP1852I_power_table_mapping.txt [*12/24/2024 10:49:47.4661] DOT11_DRV[1]: vendor_set_slot_capability: slot 1, radio_service_type 0 [*12/24/2024 10:49:47.4661] DOT11_DRV[1]: Init Radio1 [*12/24/2024 10:49:47.4961] DOT11_DRV[1]: set_channel Channel set to 36 [*12/24/2024 10:49:47.5261] DOT11_DRV[0]: vendor_set_slot_capability: slot 0, radio_service_type 0 [*12/24/2024 10:49:47.5261] DOT11_DRV[0]: Init Radio0 [*12/24/2024 10:49:47.5561] DOT11_DRV[0]: set_channel Channel set to 6 [*12/24/2024 10:49:47.9660] DOT11_DRV[0]: set_channel Channel set to 1 [*12/24/2024 10:49:47.9760] DOT11_DRV[0]: Channel set to 1, width 20 [*12/24/2024 10:49:47.9760] DOT11_DRV[0]: Channel set to 1 skipped [*12/24/2024 10:49:48.3559] DOT11_DRV[0]: Channel set to 1, width 20 [*12/24/2024 10:49:48.3559] DOT11_DRV[0]: Channel set to 1 skipped [*12/24/2024 10:49:48.4358] DOT11_DRV[1]: set_channel Channel set to 36 [*12/24/2024 10:49:48.4358] DOT11_DRV[1]: Channel set to 36, width 20 [*12/24/2024 10:49:48.4358] DOT11_DRV[1]: Channel set to 36 skipped [*12/24/2024 10:49:48.5258] DOT11_DRV[1]: Channel set to 36, width 20 [*12/24/2024 10:49:48.5258] DOT11_DRV[1]: Channel set to 36 skipped [*12/24/2024 10:49:54.5839] pid 4895's current affinity mask: 3 [*12/24/2024 10:49:54.5839] pid 4895's new affinity mask: 1 [*12/24/2024 10:49:55.2737] AP IPv4 Address updated from 0.0.0.0 to 192.168.200.1 [*12/24/2024 10:49:58.9726] dtls_init: Use MIC certificate [*12/24/2024 10:49:59.2825] [*12/24/2024 10:49:59.2825] CAPWAP State: Init [*12/24/2024 10:50:08.5096] PNP:Server not reachable, Start CAPWAP Discovery [*12/24/2024 10:50:08.5196] [*12/24/2024 10:50:08.5196] CAPWAP State: Discovery [*12/24/2024 10:50:08.5196] Got WLC address 192.168.100.182 from DHCP. [*12/24/2024 10:50:08.7295] Discovery Request sent to 192.168.100.182, discovery type DHCP(2) [*12/24/2024 10:50:08.7795] Discovery Response from 192.168.100.182 [*12/24/2024 10:50:08.9294] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0) [*12/24/2024 10:50:08.9494] [*12/24/2024 10:50:08.9494] CAPWAP State: Discovery [*12/24/2024 11:24:00.0000] Started wait dtls timer (60 sec) [*12/24/2024 11:24:00.0000] [*12/24/2024 11:24:00.0000] CAPWAP State: DTLS Setup [*12/24/2024 11:24:00.0999] First connect to vWLC, accept vWLC by default [*12/24/2024 11:24:00.0999] [*12/24/2024 11:24:00.1099] dtls_verify_server_cert: vWLC is using SSC, returning 1 [*12/24/2024 11:24:00.1699] [*12/24/2024 11:24:00.1699] CAPWAP State: Join [*12/24/2024 11:24:00.3499] Sending Join request to 192.168.100.182 through port 5248, packet size 1376 [*12/24/2024 11:24:02.5492] [*12/24/2024 11:24:02.5492] phy_value=0: org="0x1800" phy_reg="0x1000" [*12/24/2024 11:24:02.5592] device wired1 left promiscuous mode [*12/24/2024 11:24:02.5592] [*12/24/2024 11:24:02.5592] Detect link-status changed !! [*12/24/2024 11:24:02.5592] wired1 ADDED [*12/24/2024 11:24:04.9185] Sending Join request to 192.168.100.182 through port 5248, packet size 1376 [*12/24/2024 11:24:05.0184] Join Response from 192.168.100.182, packet size 1397 [*12/24/2024 11:24:05.0184] AC accepted previous sent request with result code: 0 [*12/24/2024 11:24:05.0184] Received wlcType 0, timer 30 [*12/24/2024 11:24:05.0684] nss_capwapmgr_enable_tunnel[1682]:c5b68000: tunnel 0 is already enabled [*12/24/2024 11:24:05.1284] [*12/24/2024 11:24:05.1284] CAPWAP State: Image Data [*12/24/2024 11:24:05.1284] AP image version 17.13.0.107 backup 17.8.0.144, Controller 17.13.0.107 [*12/24/2024 11:24:05.1284] Version is the same, do not need update. [*12/24/2024 11:24:05.1884] status 'upgrade.sh: Script called with args:[NO_UPGRADE]' [*12/24/2024 11:24:05.2384] do NO_UPGRADE, part2 is active part [*12/24/2024 11:24:05.2584] [*12/24/2024 11:24:05.2584] CAPWAP State: Configure [*12/24/2024 11:24:05.2584] Telnet is not supported by AP, should not encode this payload [*12/24/2024 11:24:05.4683] Radio [2] Administrative state DISABLED change to ENABLED [*12/24/2024 11:24:05.4683] Radio [1] Administrative state DISABLED change to ENABLED [*12/24/2024 11:24:05.4683] Radio [0] Administrative state DISABLED change to ENABLED [*12/24/2024 11:24:05.4783] DOT11_CFG[1]: Starting radio 1 [*12/24/2024 11:24:05.4783] DOT11_DRV[1]: Start Radio1 - Begin [*12/24/2024 11:24:05.4783] DOT11_DRV[1]: Start Radio1 - End [*12/24/2024 11:24:05.4783] DOT11_CFG[0]: Starting radio 0 [*12/24/2024 11:24:05.4783] DOT11_DRV[0]: Start Radio0 - Begin [*12/24/2024 11:24:05.4883] DOT11_DRV[0]: Start Radio0 - End [*12/24/2024 11:24:05.9681] Radio Authority: no country code [*12/24/2024 11:24:05.9881] Cannot open CDUMP_COUNT! [*12/24/2024 11:24:06.1081] [*12/24/2024 11:24:06.1081] CAPWAP State: Run [*12/24/2024 11:24:06.1881] AP has joined controller WLC01 [*12/24/2024 11:24:06.2980] Previous AP mode is 0, change to 2 [*12/24/2024 11:24:06.3080] DOT11_CFG[0] Radio Mode is changed from Local to FlexConnect [*12/24/2024 11:24:06.3080] DOT11_DRV[0]: Stop Radio0 - Begin [*12/24/2024 11:24:06.3080] DOT11_DRV[0]: Stop Radio0 - End [*12/24/2024 11:24:06.3080] DOT11_CFG[0]: Starting radio 0 [*12/24/2024 11:24:06.3080] DOT11_DRV[0]: Start Radio0 - Begin [*12/24/2024 11:24:06.3080] DOT11_DRV[0]: Start Radio0 - End [*12/24/2024 11:24:06.3180] DOT11_CFG[1] Radio Mode is changed from Local to FlexConnect [*12/24/2024 11:24:06.3180] DOT11_DRV[1]: Stop Radio1 - Begin [*12/24/2024 11:24:06.3280] DOT11_DRV[1]: Stop Radio1 - End [*12/24/2024 11:24:06.3280] DOT11_CFG[1]: Starting radio 1 [*12/24/2024 11:24:06.3280] DOT11_DRV[1]: Start Radio1 - Begin [*12/24/2024 11:24:06.3280] DOT11_DRV[1]: Start Radio1 - End [*12/24/2024 11:24:06.4980] DOT11_DRV[0]: Stop Radio0 - Begin [*12/24/2024 11:24:06.4980] DOT11_DRV[0]: Stop Radio0 - End [*12/24/2024 11:24:06.4980] DOT11_DRV[0]: Start Radio0 - Begin [*12/24/2024 11:24:06.4980] DOT11_DRV[0]: Start Radio0 - End [*12/24/2024 11:24:06.8778] USB Device Disconnected from the AP [*12/24/2024 11:24:07.0678] syslog level is being set to 70 [*12/24/2024 11:24:07.0678] [*12/24/2024 11:24:07.1078] Previous AP mode is 2, change to 2 [*12/24/2024 11:24:07.1378] Current session mode: ssh, Configured: Telnet-No, SSH-No, Console-Yes [*12/24/2024 11:24:07.1378] [*12/24/2024 11:24:07.3577] Current session mode: telnet, Configured: Telnet-No, SSH-No, Console-Yes [*12/24/2024 11:24:07.3577] [*12/24/2024 11:24:07.3777] Current session mode: console, Configured: Telnet-No, SSH-No, Console-Yes [*12/24/2024 11:24:07.3777] [*12/24/2024 11:24:07.4377] chpasswd: password for user changed [*12/24/2024 11:24:07.4877] chpasswd: password for user changed [*12/24/2024 11:24:07.6476] [*12/24/2024 11:24:07.6476] Same LSC mode, no action needed [*12/24/2024 11:24:07.6476] Cannot open CDUMP_COUNT! [*12/24/2024 11:24:07.9275] Same value is already set. [*12/24/2024 11:24:08.3674] Got WSA Server config TLVs [*12/24/2024 11:24:09.5470] Socket: Valid Element: wcp/wcp_db Handler: set_vlan_name_map Data: null Length: 10 [*12/24/2024 11:24:11.2565] SD AVC only supports 802.11ax AP [*12/24/2024 11:24:11.7963] AP tag change to default-policy-tag [*12/24/2024 11:24:32.6698] ip6_port srcr2, ip6local fe80::ca84:a1ff:fecc:2f48, ip6 ::, plen 0, gw6 ::, gw6_mac 00:00:00:00:00:00, mtu 1500, vid 0, mode6 2(slaac) [*12/24/2024 11:24:34.6392] netlink socket init done, pnl->spectral_fd=4 [*12/24/2024 11:24:34.6392] CLEANAIR: Slot 0 admin disabled [*12/24/2024 11:24:36.6385] CLEANAIR: Slot 1 admin disabled
6. WLC GUI에서 AP 등록 되었는지 확인 합니다.
별도 설정이 없으면, AP가 WLC에 붙으면 Policy Tag, Site Tag, RF Tag, Location이 Default로 설정 됩니다.
지금까지 [C9800CL][#5]-AP Join Process - DHCP option 43 글을 읽어주셔서 감사합니다.
capwap ap ip 192.168.200.200 255.255.255.0 192.168.200.181
IP주소를 입력하면 CAPWAP discovery 패킷을 Broadcase를 사용 해서 전송 하고 있습니다.
하지만 AP랑 WLC가 같은 L2도메인 안에 없기 때문에, WLC 찾을수 없습니다.
[*12/24/2024 10:37:43.9513] Check whether client_ip_table entry need to be cleared 0 [*12/24/2024 10:37:43.9613] Clearing client entry [*12/24/2024 10:37:46.6105] AP IPv4 Address updated from 0.0.0.0 to 192.168.200.200 [*12/24/2024 10:37:46.6305] send CAPWAP ctrl msg to the socket: Socket operation on non-socket [*12/24/2024 10:37:46.6305] dtls_init: Use MIC certificate [*12/24/2024 10:37:46.9404] [*12/24/2024 10:37:46.9404] CAPWAP State: Init [*12/24/2024 10:38:02.6655] PNP:Server not reachable, Start CAPWAP Discovery [*12/24/2024 10:38:02.6855] [*12/24/2024 10:38:02.6855] CAPWAP State: Discovery [*12/24/2024 10:38:02.8954] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0) [*12/24/2024 10:38:02.9054] [*12/24/2024 10:38:02.9054] CAPWAP State: Discovery
2. AP Hostname를 변경하고 WLC주소를 입력합니다.
APC884.A1CC.2F48#capwap ap hostname AP01 APC884.A1CC.2F48#capwap ap primary-base WLC01 192.168.100.182
아래처럼 WLC가 Discovery Response 패킷을 전송하였습니다.
그리고 Found Confirued WLC01 이후 DTLS setup 시작 합니다.
[*12/24/2024 10:40:01.2284] CAPWAP State: Discovery [*12/24/2024 10:40:01.4283] Discovery Request sent to 192.168.100.182, discovery type STATIC_CONFIG(1) [*12/24/2024 10:40:01.6383] Discovery Request sent to 192.168.100.182, discovery type STATIC_CONFIG(1) [*12/24/2024 10:40:01.8382] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0) [*12/24/2024 10:40:01.8482] Discovery Response from 192.168.100.182 [*12/24/2024 10:40:01.8482] Found Configured MWAR 'WLC01' (respIdx 0). [*12/24/2024 10:41:34.0000] Started wait dtls timer (60 sec) [*12/24/2024 10:41:34.0000] [*12/24/2024 10:41:34.0000] CAPWAP State: DTLS Setup [*12/24/2024 10:41:34.0399] Invalid event 2 & state 3 combination. [*12/24/2024 10:41:34.0399] CAPWAP SM handler: Failed to process message type 2 state 3. [*12/24/2024 10:41:34.0399] Failed to handle capwap control message from controller - status 1 [*12/24/2024 10:41:34.0399] Failed to process unencrypted capwap packet 0x2c1ab000 from 192.168.100.182 [*12/24/2024 10:41:34.0399] Failed to send capwap message 0 to the state machine. Packet already freed. [*12/24/2024 10:41:34.0999] First connect to vWLC, accept vWLC by default [*12/24/2024 10:41:34.0999] [*12/24/2024 10:41:34.1399] dtls_verify_server_cert: vWLC is using SSC, returning 1 [*12/24/2024 10:41:34.2099] [*12/24/2024 10:41:34.2099] CAPWAP State: Join [*12/24/2024 10:41:34.3699] Sending Join request to 192.168.100.182 through port 5248, packet size 1376 [*12/24/2024 10:41:39.0884] Sending Join request to 192.168.100.182 through port 5248, packet size 1376 [*12/24/2024 10:41:39.1784] Join Response from 192.168.100.182, packet size 1397 [*12/24/2024 10:41:39.1784] AC accepted previous sent request with result code: 0 [*12/24/2024 10:41:39.1784] Received wlcType 0, timer 30 [*12/24/2024 10:41:39.2284] nss_capwapmgr_enable_tunnel[1682]:ef30c000: tunnel 0 is already enabled [*12/24/2024 10:41:39.3183] [*12/24/2024 10:41:39.3183] CAPWAP State: Image Data [*12/24/2024 10:41:39.3183] AP image version 17.13.0.107 backup 17.8.0.144, Controller 17.13.0.107 [*12/24/2024 10:41:39.3183] Version is the same, do not need update. [*12/24/2024 10:41:39.3883] status 'upgrade.sh: Script called with args:[NO_UPGRADE]' [*12/24/2024 10:41:39.4383] do NO_UPGRADE, part2 is active part [*12/24/2024 10:41:39.4483] [*12/24/2024 10:41:39.4483] CAPWAP State: Configure [*12/24/2024 10:41:39.6682] Radio [2] Administrative state DISABLED change to ENABLED [*12/24/2024 10:41:39.6782] Radio [1] Administrative state DISABLED change to ENABLED [*12/24/2024 10:41:39.6782] Radio [0] Administrative state DISABLED change to ENABLED [*12/24/2024 10:41:39.6782] DOT11_CFG[1]: Starting radio 1 [*12/24/2024 10:41:39.6782] DOT11_DRV[1]: Start Radio1 - Begin [*12/24/2024 10:41:39.6782] DOT11_DRV[1]: Start Radio1 - End [*12/24/2024 10:41:39.6782] DOT11_CFG[0]: Starting radio 0 [*12/24/2024 10:41:39.6782] DOT11_DRV[0]: Start Radio0 - Begin [*12/24/2024 10:41:39.6882] DOT11_DRV[0]: Start Radio0 - End [*12/24/2024 10:41:40.1481] Radio Authority: no country code [*12/24/2024 10:41:40.1581] Cannot open CDUMP_COUNT! [*12/24/2024 10:41:40.2680] [*12/24/2024 10:41:40.2680] CAPWAP State: Run [*12/24/2024 10:41:40.3480] AP has joined controller WLC01 [*12/24/2024 10:41:40.3980] Previous AP mode is 0, change to 2 [*12/24/2024 10:41:40.4080] DOT11_CFG[0] Radio Mode is changed from Local to FlexConnect [*12/24/2024 10:41:40.4280] DOT11_DRV[0]: Stop Radio0 - Begin [*12/24/2024 10:41:40.4380] DOT11_DRV[0]: Stop Radio0 - End [*12/24/2024 10:41:40.4380] DOT11_CFG[0]: Starting radio 0 [*12/24/2024 10:41:40.4380] DOT11_DRV[0]: Start Radio0 - Begin [*12/24/2024 10:41:40.4380] DOT11_DRV[0]: Start Radio0 - End [*12/24/2024 10:41:40.4380] DOT11_CFG[1] Radio Mode is changed from Local to FlexConnect [*12/24/2024 10:41:40.4480] DOT11_DRV[1]: Stop Radio1 - Begin [*12/24/2024 10:41:40.4480] DOT11_DRV[1]: Stop Radio1 - End [*12/24/2024 10:41:40.4480] DOT11_CFG[1]: Starting radio 1 [*12/24/2024 10:41:40.4480] DOT11_DRV[1]: Start Radio1 - Begin [*12/24/2024 10:41:40.4480] DOT11_DRV[1]: Start Radio1 - End [*12/24/2024 10:41:40.5779] DOT11_DRV[0]: Stop Radio0 - Begin [*12/24/2024 10:41:40.5779] DOT11_DRV[0]: Stop Radio0 - End [*12/24/2024 10:41:40.5779] DOT11_DRV[0]: Start Radio0 - Begin [*12/24/2024 10:41:40.5879] DOT11_DRV[0]: Start Radio0 - End [*12/24/2024 10:41:41.1178] syslog level is being set to 70 [*12/24/2024 10:41:41.1178] [*12/24/2024 10:41:41.1578] Previous AP mode is 2, change to 2 [*12/24/2024 10:41:41.1678] Current session mode: ssh, Configured: Telnet-No, SSH-No, Console-Yes [*12/24/2024 10:41:41.1678] [*12/24/2024 10:41:41.3977] Current session mode: telnet, Configured: Telnet-No, SSH-No, Console-Yes [*12/24/2024 10:41:41.3977] [*12/24/2024 10:41:41.4177] Current session mode: console, Configured: Telnet-No, SSH-No, Console-Yes [*12/24/2024 10:41:41.4177] [*12/24/2024 10:41:41.4777] chpasswd: password for user changed [*12/24/2024 10:41:41.4977] USB Device Disconnected from the AP [*12/24/2024 10:41:41.5376] chpasswd: password for user changed [*12/24/2024 10:41:41.7176] [*12/24/2024 10:41:41.7176] Same LSC mode, no action needed [*12/24/2024 10:41:41.7176] Cannot open CDUMP_COUNT! [*12/24/2024 10:41:41.8975] Same value is already set. [*12/24/2024 10:41:42.3374] Got WSA Server config TLVs [*12/24/2024 10:41:43.6270] Socket: Valid Element: wcp/wcp_db Handler: set_vlan_name_map Data: null Length: 10 [*12/24/2024 10:41:45.3265] SD AVC only supports 802.11ax AP [*12/24/2024 10:41:45.8563] AP tag change to default-policy-tag [*12/24/2024 10:42:08.7391] netlink socket init done, pnl->spectral_fd=4 [*12/24/2024 10:42:08.7391] CLEANAIR: Slot 0 admin disabled [*12/24/2024 10:42:10.7385] CLEANAIR: Slot 1 admin disabled
AP01#[*12/24/2024 10:42:36.8903] Warning: Stopping dbg_day0_bundle.service, but it can still be activated by: [*12/24/2024 10:42:36.8903] dbg_day0_bundle.timer
AP01#
3. 이번에는 WLC GUI에 접속해서 AP를 확인해보겠습니다.
Monitoring ->Wireless ->AP statistics 클릭 합니다.
아래 사진처럼 AP01이 WLC에 등록이 되었고 Admin Status를 표시면 초록색으로 정상적입니다.
테스트를 위해서 WLC GUI에서 AP를 Reset 합니다.
AP를 더블클릭 합니다.
지금까지 [C9800CL][#3]-AP Join Process - Manual Method 글을 읽어주셔서 감사합니다.
다음글은 DHCP option43를 이용해서 AP를 WLC에 등록 하는 글을 다루겠습니다.
만약에 WLC에 다른 지역에 있는 상황이라면 Note: As per RFC 5415, CAPWAP uses the UDP Ports 5246 (for CAPWAP Control) and 5247 (for CAPWAP Data).
위에 포트는 방화벽에서 허용 되어야 합니다.
Session Establishment Process.
Access Point sends aDiscovery Request. See the WLC Discovery Methods section for more information on this
WLC sends aDiscovery Response
DTLS session establishment. After this, all messages after this are encrypted and are shown as DTLS application data packets in any packet analysis tool.
Access Point sends aJoin Request
WLC sends aJoin Response
AP performs an image check. If it has the same image version as the WLC, then it proceeds with the next step. If it does not, then it downloads the image from the WLC and reboots to load the new image. In such case, it repeats the process from step 1.
Access Point sends aConfiguration Status Request.
WLC sends aConfiguration Status Response
Access Point goes toRUNState
During theRUNstate,CAPWAP Tunnel Maintenanceis pefrormed in two ways:
Keepalivesare exchanged to mantain theCAPWAP Datatunnel
APsends anEcho Requestto theWLC, which has to be answered with its respectiveEcho Response. This is to mantain theCAPWAP Controltunnel.
Wireless LAN Controller Discovery Methods
There are several options to let the Access Points know of the existance of one WLC in the network:
DHCP Option 43:This option provides the APs the IPv4 address of the WLC to join. This process is convenient for large deployments in which the APs and the WLC are in different sites.
DNS Discovery: APs queries the domain nameCISCO-CAPWAP-CONTROLLER.localdomain.You must configure your DNS server to resolve either the IPv4 or IPv6 address of the WLC tto join. This option is convenient for deployments in which the WLCs are stored in the same site as the APs.
Layer 3 Broadcast: The APs automatically send a broadcast message to 255.255.255.255. Any WLC within the same subnet as the AP is expected to respond to this discovery request.
Static configuration:You can use thecapwap ap primary-base <wlc-hostname> <wlc-IP-address>command to configure a static entry for a WLC in the AP.
Mobility Discovery: If the AP was previously joined to a WLC that was part of a mobility group, the AP also saves a record of the WLCs present in that mobility group.
kevin@kevin-virtual-machine:~$ sudo apt-get install fping [sudo] password for kevin: Reading package lists... Done Building dependency tree... Done Reading state information... Done The following NEW packages will be installed: fping 0 upgraded, 1 newly installed, 0 to remove and 3 not upgraded. Need to get 32,0 kB of archives. After this operation, 90,1 kB of additional disk space will be used. Get:1 http://id.archive.ubuntu.com/ubuntu jammy/universe amd64 fping amd64 5.1-1 [32,0 kB] Fetched 32,0 kB in 0s (201 kB/s) Selecting previously unselected package fping. (Reading database ... 171483 files and directories currently installed.) Preparing to unpack .../archives/fping_5.1-1_amd64.deb ... Unpacking fping (5.1-1) ... Setting up fping (5.1-1) ... Processing triggers for man-db (2.10.2-1) ... kevin@kevin-virtual-machine:~$ sudo apt-get install php-snmp Reading package lists... Done Building dependency tree... Done Reading state information... Done The following additional packages will be installed: php8.1-snmp snmp The following NEW packages will be installed: php-snmp php8.1-snmp snmp 0 upgraded, 3 newly installed, 0 to remove and 3 not upgraded. Need to get 201 kB of archives. After this operation, 810 kB of additional disk space will be used. Do you want to continue? [Y/n] y Get:1 http://id.archive.ubuntu.com/ubuntu jammy-updates/main amd64 php8.1-snmp amd64 8.1.2-1ubuntu2.20 [23,2 kB] Get:2 http://id.archive.ubuntu.com/ubuntu jammy/main amd64 php-snmp all 2:8.1+92ubuntu1 [1.836 B] Get:3 http://id.archive.ubuntu.com/ubuntu jammy-updates/main amd64 snmp amd64 5.9.1+dfsg-1ubuntu2.6 [176 kB] Fetched 201 kB in 0s (689 kB/s) Selecting previously unselected package php8.1-snmp. (Reading database ... 171493 files and directories currently installed.) Preparing to unpack .../php8.1-snmp_8.1.2-1ubuntu2.20_amd64.deb ... Unpacking php8.1-snmp (8.1.2-1ubuntu2.20) ... Selecting previously unselected package php-snmp. Preparing to unpack .../php-snmp_2%3a8.1+92ubuntu1_all.deb ... Unpacking php-snmp (2:8.1+92ubuntu1) ... Selecting previously unselected package snmp. Preparing to unpack .../snmp_5.9.1+dfsg-1ubuntu2.6_amd64.deb ... Unpacking snmp (5.9.1+dfsg-1ubuntu2.6) ... Setting up php8.1-snmp (8.1.2-1ubuntu2.20) ...
Creating config file /etc/php/8.1/mods-available/snmp.ini with new version Setting up snmp (5.9.1+dfsg-1ubuntu2.6) ... Setting up php-snmp (2:8.1+92ubuntu1) ... Processing triggers for man-db (2.10.2-1) ... Processing triggers for libapache2-mod-php8.1 (8.1.2-1ubuntu2.20) ... Processing triggers for php8.1-cli (8.1.2-1ubuntu2.20) ...
그리고 /etc/apache2/apache2.conf 파일에 수정이 필요합니다.
vi /etc/apache2/apache2.conf
아래처럼 추가합니다.
<Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride all order allow,deny Allow from all #Require all granted </Directory>
apache를 새로 시작 합니다
sudo systemctl restart apache2
지금까지 [phpIPAM][#6]-fping and snmp install for scan 글을 읽어주셔서 감사합니다.
Press Enter to login as root - password를 입력 합니다. Type N and press Enter to not switch to unix socket authentication Type Y and press Enter to set a root password, type the password twice to confirm Type Y and press Enter to remove anonymous users Type Y and press Enter to disallow root login remotely Type Y and press Enter to remove the test database Type Y and press Enter to reload privilege tables
아래는 결과값 입니다.
kevin@kevin-virtual-machine:~$ sudo su root@kevin-virtual-machine:/home/kevin# mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MariaDB to secure it, we'll need the current password for the root user. If you've just installed MariaDB, and haven't set the root password yet, you should just press enter here.
Enter current password for root (enter for none): OK, successfully used password, moving on...
Setting the root password or using the unix_socket ensures that nobody can log into the MariaDB root user without the proper authorisation.
You already have your root account protected, so you can safely answer 'n'.
Switch to unix_socket authentication [Y/n] n ... skipping.
You already have your root account protected, so you can safely answer 'n'.
Change the root password? [Y/n] New password: Re-enter new password: Sorry, passwords do not match.
New password: Re-enter new password: Password updated successfully! Reloading privilege tables.. ... Success!
By default, a MariaDB installation has an anonymous user, allowing anyone to log into MariaDB without having to have a user account created for them. This is intended only for testing, and to make the installation go a bit smoother. You should remove them before moving into a production environment.
Remove anonymous users? [Y/n] y ... Success!
Normally, root should only be allowed to connect from 'localhost'. This ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] y ... Success!
By default, MariaDB comes with a database named 'test' that anyone can access. This is also intended only for testing, and should be removed before moving into a production environment.
Remove test database and access to it? [Y/n] y - Dropping test database... ... Success! - Removing privileges on test database... ... Success!
Reloading the privilege tables will ensure that all changes made so far will take effect immediately.
Reload privilege tables now? [Y/n] y ... Success!
Cleaning up...
All done! If you've completed all of the above steps, your MariaDB installation should now be secure.
Thanks for using MariaDB! root@kevin-virtual-machine:/home/kevin#
6. MySQL Table를 생성합니다.
mysql -u root -p
CREATE DATABASE php_ipam; GRANT ALL ON php_ipam.* to 'php_ipam_rw'@'localhost' IDENTIFIED BY 'P4P1p@m!!'; FLUSH PRIVILEGES; EXIT; exit
아래는 결과값입니다. 패스워드를 위와 같이 사용 하겠습니다.
root@kevin-virtual-machine:/home/kevin# mysql -u root -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 39 Server version: 10.6.18-MariaDB-0ubuntu0.22.04.1 Ubuntu 22.04
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
sudo git checkout "$(git tag --sort=v:tag | tail -n1)"
아래는 결과값입니다.
root@kevin-virtual-machine:/var/www/html/phpipam# sudo git checkout "$(git tag --sort=v:tag | tail -n1)" Note: switching to 'v1.7.3'.
You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may do so (now or later) by using -c with the switch command. Example:
git switch -c <new-branch-name>
Or undo this operation with:
git switch -
Turn off this advice by setting config variable advice.detachedHead to false
HEAD is now at 602d8122 Bugfix: PDNS PHP8 compatibility cleanup. Fixes #4337 root@kevin-virtual-machine:/var/www/html/phpipam#
