Tuesday, September 21, 2021

Aruba CX Quick Config


Hostname
hostname <building>_<MDF/IDF location>_core_<model>

Username
user manager group administrators password plaintext <password>
user manager authorized-key ssh-rsa VeryLongKeyShouldGoHere

Logging
logging x.x.x.x
logging facility local2

Default gateway and DNS
ip route 0.0.0.0/0 <MGMT gateway>
ip dns server-address priority 1 1.0.0.1
ip dns server-address priority 2 8.8.8.8

NTP and time
ntp server <default gateway> prefer iburst minpoll 4
clock timezone us/central
ntp enable

SNMP
snmp-server vrf default
snmp-server system-location <location>
snmp-server system-contact <ITS>
snmp-server community snmpv1string

Standard VLAN
vlan 100
name VlanName100
exit

vlan 200
name VlanName200
interface vlan 200
ip address X.X.X.X/24

LACP 
interface 1/1/1
no shut
lag 1

interface 1/1/2
no shut 
lag 1

interface lag 1
no shut
vlan trunk native 1
vlan trunk allowed all
lacp mode active

Tag VLAN's on interfaces - if you want to allow all vlan's
interface 1/1/1-1/1/x
vlan trunk native 1
vlan trunk allowed all

Vlan access - if you only want to allow 1 vlan 
interface 1/1/1
vlan access 6



 

Tuesday, September 7, 2021

Thursday, September 2, 2021

Oxidized Example - Config file

 ---
username: manager
password:
model: procurve
resolve_dns: false
interval: 3600
use_syslog: false
debug: false
threads: 30
timeout: 20
retries: 3
prompt: !ruby/regexp /^([\w.@-]+[#>]\s?)$/
rest: 127.0.0.1:8888
next_adds_job: false
vars: {}
groups: {}
models: {}
pid: "/root/.config/oxidized/pid"
crash:
  directory: "/root/.config/oxidized/crashes/"
  hostnames: false
stats:
  history_size: 10
input:
  default: ssh
  debug: false
  ssh:
    secure: false
  ftp:
    passive: true
  utf8_encoded: true
output:
   file:
       directory: "/mnt/c/Users/user-account/oxidized/configs"
source:
  default: csv
  csv:
        file: "/mnt/c/tftp/switches.csv"
#        file: "/root/.config/oxidized/switch.db"
        delimiter: !ruby/regexp /,/
        map:
         name: 0
         ip: 1
         username: 2
         password: 3
         group: 4
         model: 5
#      vars_map:
#            enable:4
model_map:
  aruba: aos-cx
  hp: procurve
  fortigate: fortios



Thursday, August 26, 2021

Aruba CX Quick Commands

List of helpful commands for Aruba-CX switches.

 Reboot the switch

    boot system   primary|secondary

Show MAC address - by MAC

    show mac-address-table address x:x:x:x:x:x

Show MAC address - by port

    show mac-address-table port x/x/x

Show LLDP

    show lldp neighbor-info

Disable POE on Port

    no power-over-ethernet

Enable SSH - Key

    user manager authorized-key "ssh-rsa long line of key"

Show VLANs on a port

    show vlan port x/x/x

Show Port infor

    show interface brief

ServiceOS - If the switch ever boots to 'ServiceOS'

https://community.arubanetworks.com/browse/articles/blogviewer?blogkey=118b36b3-1d6f-4a8a-b4c9-b58e6f5d375a

Aruba CX - Enable SSH / Upgrade Firmware

https://community.arubanetworks.com/community-home/digestviewer/viewthread?MID=26514

Wednesday, August 18, 2021

LibreNMS + Oxidized in Docker Container - Centos

If you would like to get LibreNMS and Oxidized working in a docker environment this will be a down and dirty way to do it.  This will cover some of the helpful commands that we used for troubleshooting.

I am using CentOS 7.

** NOTE - Before you even start figure out how many devices that you will be monitoring with LibreNMS.  for all the graphs and data there will be .rrd files that get created for each device..... each device's rrd files can be 90mb to 140mb.  Make sure you size your OS properly before you starting so you dont have to go back and resize your disk.... it sucks.

As a reference 10k devices is around you might want to have 500GB.


Install Docker + Docker Compose

1.  I went to the docker website and used the following guide to install docker.

            https://docs.docker.com/engine/install/centos/ 

2.  Once you have Docker installed go ahead and install "Docker Compose"

            https://docs.docker.com/compose/install/

3.  At this point you should be able to run the following command to show that you have Docker running.

           systemctl status docker



Install LibreNMS with Docker Compose 

1.  Create directory for LibreNMS
            mkdir /var/librenms/
            cd /var/librenms

2.  Download files
     a.  Go to the following site and wget all the files and place them in /var/librenms/

3.  Edit the files to fit your needs.
     a.  I edited .env and changed  "MYSQL_PASSWORD=password"


4.  Run docker-compose
            docker-compose up -d

5.  Once it completes you should have LibreNMS install.  so start it up.
            systemctl start docker

6.  you should have something that looks like this.... Notice there are 4 containers of LibreNMS.. dont delete any of them!!!!  It will also will have created a mariadb database.
            docker ps


7.  If you want to check to make sure librenms is working you should be able to use curl and make sure it connects.

            curl -I -v --ipv4 http://localhost:8000



8.  You should be able to go to your servers IP address @ port 8000 and get the LibreNMS login screen. librenms/librenms for the user/pass.


Install Oxidized with Docker-Compose

1.  Create oxidized directory
                 mkdir /var/oxidized/
2.  Get files oxidized with docker-compose
            nano docker-compose.yml

# docker-compose.yml
# docker-compose file example for oxidized that will start along with docker daemon
oxidized:
  restart: always
  image: oxidized/oxidized:latest
  ports:
    - 8888:8888/tcp
  environment:
    CONFIG_RELOAD_INTERVAL: 600
  volumes:
    - /etc/oxidized:/root/.config/oxidized


3.  Run docker-compose
            docker-compose up -d

4.  You might have to allow port 8888 through your firewall.  You can check this by:
            semanage port -l | grep http_port_t
  

    a.  If port 8888 is not there use the following to add it.
            sudo semanage port -a -t http_port_t -p tcp 8888
    b.  Restart firewall
             systemctl stop firewalld
            systemctl start firewalld

5.  You should have Oxidized installed now.  Stop/Start docker and show the status.
            systemctl stop docker
            systemctl start docker
            systemctl status docker

Working with in the Docker Containers

1.  At this point you should have both LibreNMS and Oxidized both running.  To get into the Oxidized container is pretty easy as it is the only one.  Use the following command.... keep in mind the "bc2" will be different for your Container ID.
            docker exec -it bc2 /bin/bash
    .  If you need to edit the Oxidized config file it will be located at:
                nano /root/.config/oxidized/config

2.  The LibreNMS containers are a little tricky as there are 4 of them that look the same.  
     You will need to find the one that just says "librenms" to actually change the config file.  I am snipping 2 pictures together because the text is to long.



3.  Get into the LibreNMS container using the following.... replace the "235" with your Container ID.
                docker exec -it 235 /bin/bash

    a.  To edit the LibreNMS config go to the following once you are in the container.
                    vi /opt/librenms/config.php
    b.  If you would like to scan a network to look for devices use the following command while you are in the LibreNMS container
                    python3 snmp-scan.py -r X.X.X.X/X



Tips

  • Once you get everything going take a snapshot of your VM.
  • The formatting is VERY important within Oxidized and LibreNMS... If you reload docker after a change and your container will not start or HTTP will not load go back and check the formatting.
  •  If oxidized is erroring out because it can not find your switch/firewall model you might have to add it.  Add it at the following location within your Oxidized container.
    • cd /var/lib/gems/2.5.0/gems/oxidized-0.28.0/lib/oxidized/model
  • Deleting a device  - need to be in the LibreNMS container
    • ./delhost.php x.x.x.x
  • If you have multiple locations that you manage and you want to organize them within Oxidized so LibreNMS can see them in a more useable way you can change the group so that they will be placed in the correct group.  Below is an example of how we have don that based on the first 2 octets of the ip address.
    •  This is in the LibreNMS container under /opt/librenms.config.php
  • If you are having trouble with a device not pulling the correct group use the following to see all of the variables that it is pulling.
    • curl -H 'X-Auth-Token: token-created-in-Libre-GUI' http://X.X.X.X:8000/api/v0/devices/X.X.X.X
  • The LibreNMS containers are built on Alpine Linux.  If you want to install a package use...
    • apk add packageName


 
























Wednesday, June 2, 2021

Aruba CX VSX Config Example

This is an example of how to set up a VSX cluster for Aruba CX switches.  As well as setting up a lag from each one of the members of the VSX down to another switch.

Version:  10.05.0020




Friday, May 14, 2021

Aruba CX OSPF Config Example

 Building OSPF in Aruba CX switches. 

VIDEO LINK---> https://youtu.be/N9dIGVzdjIU

Version 10.05.0020

DistMain-Switch

vlan 1
vlan 2
vlan 6

vlan 830
    name OSPF-Dist-HS
vlan 831
    name OSPF-Dist-MS

//  vlan 1,2,6 are the local vlans
interface vlan 1
    ip address 10.129.31.254/22
interface vlan 2
    ip address 10.129.47.254/22
interface vlan 6
    ip address 10.129.3.254/22

//  vlan 830,831 are the OSPF networks that will distribute the routes.
interface vlan 830
    description OSPF-Dist-HS
    ip address 10.130.253.1/27
    ip ospf 1 area 0.0.0.0
interface vlan 831
    description OSPF-Dist-MS
    ip address 10.131.253.1/27
    ip ospf 1 area 0.0.0.0

// ospf config..... we are redistributing ALL connected routes on this switch.... If you want to only redistribute certain routes you would need to do a route-map.. see bottom of page for that example.
route ospf 1
    rotuer-id 1.1.1.1
    redistribute connected
    area 0.0.0.0

interface 1/1/2
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 830

interface 1/1/3
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 831


HS-Main-Switch

vlan 2
vlan 830

interface vlan 2
    ip address 10.130.47.254/22
interface vlan 830
    ip address 10.130.253.2/27
    ip ospf 1 area 0.0.0.0

router ospf 1
    router-id 1.1.1.2
    redistribute connected
    area 0.0.0.0

interface 1/1/2
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 830


MS-Main-Switch

vlan 6
vlan 831
interface vlan 6
    ip address 10.131.3.254/22
interface vlan 831
    ip address 10.131.253.2/27
    ip ospf 1 area 0.0.0.0

router ospf 1
    router-id 1.1.1.3
    redistribute connected
    area 0.0.0.0

At this point you should be able to see your ospf peers come up.

"show ip ospf neighbors"



"show ip route ospf"



Route-Map

//  If you would like to only advertise certain routes through OSPF then route-map will be the command to use. 

route-map Allow-Vlan permit seq 10
match interface vlan1
exit
route-map Allow-Vlan permit seq 20
match interface vlan2
exit


Router ospf 1
router ospf redistribute route-map Allow-Vlan


//  This will only allow vlan 1 and 2 to be advertised into OSPF for redistribution.... if you add more vlan's and want to advertise them you will need to add them to the route-map.



Aruba CX BGP Setup Example

 Very simple setup of BGP and advertising networks.

Version 10.05.0020

Switch 1

1.  Create your Vlan interfaces

vlan 100
    name BGP-1

interface vlan 100
    ip address 20.20.20.254/24

2.  Set up interface

interface 1/1/5
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 100

3.  Set up BPG

router bgp 1234
    bgp router-id 20.20.20.254
    neighbor 20.20.20.253 remote-as 12345
    address-family ipv4 unicast
        neighbor 20.20.20.253 activate
        exit
    exit

//  The route-id we are using as the "interface vlan id"... this does not have to be like this... you could set this up as 1.1.1.1 if you would like.  Keep in mind though that if you change it the BGP setup will have to rebuilt itself.
//  The "neighbor" will be the other side of our BGP peer
//  neighbor "20.20.20.253 activate"  will actually enable the routes to transverse between BGP peers

_________________________________________________

Switch 2

1.  Create your Vlan interfaces

vlan 100
    name BGP-1
vlan 200
    name test-vlan

interface vlan 100
    ip address 20.20.20.253/24
interface vlan 200
    ip address 30.0.0.254/24

2.  Set up interface

interface 1/1/5
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 100
interface 1/1/7
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 200

3.  Set up BPG

router bgp 12345
    bgp router-id 20.20.20.253
    neighbor 20.20.20.254 remote-as 1234
    address-family ipv4 unicast
        neighbor 20.20.20.254 activate
        network 30.0.0.0/24
        exit
    exit

//  Notice that we have added "network 30.0.0.0/24" to our BGP setup... this is the network that we are advertising out through BGP.  If we go back to Switch 1 we can run "show ip route bgp" and we will see that this network is being advertised through BGP and we are able to ping it.



















show bgp ipv4 unicast neighbors
















show bgp ipv4 unicast summary