I love it when I'm researching a problem I've been having, and I suddenly find a forum whereby someone has posted the same issue. If it's a complicated fix, people are usually nice enough to provide assistance, but occasionally there are no answers posted; the thread will just _die_.
Want to know why that happens? It's because you're either overthinking the problem, or you didn't RTFM. Go back and think about the problem, read the documentation, and then take a step back. You've missed something, and it's right there in front of you.
Yeah, I know. I do it, too. Welcome to the club.
20110729
Visual copy verification using TeraCopy
I've been using TeraCopy on my Windows machines for years now, and have been very pleased with it. After copying a few files and then Verifying the CRCs on each, it occurred to me that I also wanted to check the other files I had copied earlier.
To do this, all you have to do is choose to TeraCopy the set again, but tell it to Skip All. When the summary window pops up, just hit [Verify] at the bottom and TC will take care of the rest.
I frequently use md5sum and fc to check for copy consistency, but this is a nice, colorful alternative.
Not using TeraCopy yet? You're missing out. Download it here from CodeSector, or here from CNet.
To do this, all you have to do is choose to TeraCopy the set again, but tell it to Skip All. When the summary window pops up, just hit [Verify] at the bottom and TC will take care of the rest.
I frequently use md5sum and fc to check for copy consistency, but this is a nice, colorful alternative.
Not using TeraCopy yet? You're missing out. Download it here from CodeSector, or here from CNet.
20101122
PIX Firewalls Do Not Eat Large Amounts of Copypasta.
One of the appliances we use frequently here are Cisco PIX firewalls. These devices are excellent in that they help keep your network secure without you having to dedicate a computer to firewalling. They are not-so-excellent in that they're not user-friendly if you don't have much experience with the Cisco IOS, and the PDM doesn't always play nicely with commands entered from the console.
I've not had to worry about messing with these much since we have a Cisco guru in Switzerland, but since I needed to send a PIX to one of our new locations and he is unable to assist me remotely with this currently, I decided to get my hands dirty. Nothing major; just need to copy a config from one PIX to another. Easy, right?
Well, hrm. Doing a write net doesn't guarantee a good "image"; you can't just copy tftp://server/imagefile flash:image back over. The PIX tells you it's invalid.
Okay, no problem. I'll just do a config net to load the config.
Or not. Turns out the PIX config doesn't save in the same order as the commands must be entered.
So I spent today learning about the order in which the commands must be entered into the PIX firewall, and here's what it appears to be (after a write erase and reload:
I would suggest taking an existing config file and rearranging it for this purpose. Use Notepad++, since the config files use LFs only (as opposed to CR+LF).
A colleague suggested that you can then copy/paste the config into the PIX, but, as the title of this post suggests, that doesn't work out so well. The PIX seems to take only the first 10-15 lines, skip several, take another 10-15 lines, skip several more, etc., until you're left with a fragmented, wonky configuration. This doesn't work too well, and copy/pasting 10 lines at a time can be tedious, depending on how long your configuration is and how many VPNs you have to different sites. Instead, you may want to do it via the config net command.
BEFORE DOING SO: Have a TFTP server ready that you can connect directly to the PIX (more info below). Don't try to hack this remotely.
Aaand once more, for the cheap seats:
CAUTION! Don't do this remotely or on a live system unless your connectivity is already botched and you know you have a good working config file!
With that said, here's how you load your newly-rearranged PIX configuration file:
For [ip] above, set it to the same IP range and subnet as your TFTP server. For mine, I loaded Solarwinds Free TFTP Server on a laptop and connected directly to the PIX via patch cable (port 1-4) for the TFTP connection, and used a Console cable for the actual Terminal connection. The [TFTPserver] above was my laptop's IP.
I keep seeing updated questions from people online regarding PIX firewalls, so I know I can't be the only person who works with them from time to time, despite the newer ASAs out there. Hopefully this information helps someone. Until next time!
Rob
I've not had to worry about messing with these much since we have a Cisco guru in Switzerland, but since I needed to send a PIX to one of our new locations and he is unable to assist me remotely with this currently, I decided to get my hands dirty. Nothing major; just need to copy a config from one PIX to another. Easy, right?
Well, hrm. Doing a write net doesn't guarantee a good "image"; you can't just copy tftp://server/imagefile flash:image back over. The PIX tells you it's invalid.
Okay, no problem. I'll just do a config net to load the config.
Or not. Turns out the PIX config doesn't save in the same order as the commands must be entered.
So I spent today learning about the order in which the commands must be entered into the PIX firewall, and here's what it appears to be (after a write erase and reload:
- Interface- and IP-related commands
- Protocols
- Names
- Services (object-group and port-object commands)
- VPDN commands
- Sysopt commands to permit IPSec &/or PPTP
- Crypto commands (except match) and ISAKMP commands & keys
- ACLs
- Crypto match commands (to link the crypto maps with the ACLs)
- DHCPd commands
- Everything else (ICMP, PDM, NAT, AAA Server, SNMP, etc).
I would suggest taking an existing config file and rearranging it for this purpose. Use Notepad++, since the config files use LFs only (as opposed to CR+LF).
A colleague suggested that you can then copy/paste the config into the PIX, but, as the title of this post suggests, that doesn't work out so well. The PIX seems to take only the first 10-15 lines, skip several, take another 10-15 lines, skip several more, etc., until you're left with a fragmented, wonky configuration. This doesn't work too well, and copy/pasting 10 lines at a time can be tedious, depending on how long your configuration is and how many VPNs you have to different sites. Instead, you may want to do it via the config net command.
BEFORE DOING SO: Have a TFTP server ready that you can connect directly to the PIX (more info below). Don't try to hack this remotely.
Aaand once more, for the cheap seats:
CAUTION! Don't do this remotely or on a live system unless your connectivity is already botched and you know you have a good working config file!
With that said, here's how you load your newly-rearranged PIX configuration file:
- write erase
- reload
- no (When it asks you if you want managed setup)
- enable
- configure terminal
- interface eth0 auto
- interface eth1 100full
- ip address inside [ip] [netmask]
- config net [TFTPserver]:[reorderedfile]
For [ip] above, set it to the same IP range and subnet as your TFTP server. For mine, I loaded Solarwinds Free TFTP Server on a laptop and connected directly to the PIX via patch cable (port 1-4) for the TFTP connection, and used a Console cable for the actual Terminal connection. The [TFTPserver] above was my laptop's IP.
I keep seeing updated questions from people online regarding PIX firewalls, so I know I can't be the only person who works with them from time to time, despite the newer ASAs out there. Hopefully this information helps someone. Until next time!
Rob
20101104
Setting up HylaFAX: Complete!
No, I didn't just finish the project I started two years ago. I did have to shelve it for several months as something else came up, but I completed in Q3 of 2009. I thought it would be a good idea to finally update this blog with additional details to help others who attempt the same thing!
First off, the Rocketport card works flawlessly. If you can obtain one, I highly recommend it. They're standard analogue loop-start ports; if you're looking for a T1 solution, you'll need to drop some extra money on either a Brooktrout or an Eicon Diva board. But for standard fax lines, the Rocketport card is perfect.
For the mail solution, I ended up going with Qmail on the HylaFAX box. Here's what is required to get QMail talking to Exchange:
Bounce your services, and you're good to go. I used Ubuntu 9.04 for Hylamonster, so /etc/init.rd/hylafax restart does the trick.
First off, the Rocketport card works flawlessly. If you can obtain one, I highly recommend it. They're standard analogue loop-start ports; if you're looking for a T1 solution, you'll need to drop some extra money on either a Brooktrout or an Eicon Diva board. But for standard fax lines, the Rocketport card is perfect.
For the mail solution, I ended up going with Qmail on the HylaFAX box. Here's what is required to get QMail talking to Exchange:
- HylaFAX needs fax addresses formatted as Name@Number.fax (i.e.:Rob@7701234567.fax). Go to Exchange, navigate to your Connectors under the local Routing Group, and create a new SMTP Connector.
- On the [General] tab, set it to forward all mail for that connector to the HylaFAX server. You can use the FQDN here as well as the IP address.
- On the the [Address Space] tab, create an SMTP Address Space for a *.fax address. Set your cost & scope as needed. If you only have one, a cost of 1 and a scope of Entire organization should be good. Just make sure you aren't utilizing another fax solution which requires an address of *.fax. If you're using Rightfax, Faxination or GFI Faxmaker, there should be no conflict. They actually use the FAX address space native in Exchange (used for the "Business Fax" listing in your Contacts).
- Back on the HylaFAX server (or whichever server you have hosting QMail), configure for the following:
- /var/qmail/control/virtualdomains: Add the line .fax:fax
- /var/qmail/alias/.qmail-fax-default: Add the line /local/etc/mailfax
Bounce your services, and you're good to go. I used Ubuntu 9.04 for Hylamonster, so /etc/init.rd/hylafax restart does the trick.
20081111
Fun With Setting Up HylaFAX, Part Eight
Wait, what? Part Eight? What happened to parts two through seven?
I didn't waste time blogging on them when they occurred, but here, I'll sum them up for you:
Part 1: As you may recall, I got stuck at what I thought was VMWare ESXi Server. I may have been incorrect at that.
Part 2: Realized that using Windows XP and VMWare Workstation wasn't helping me, either. No serial ports forwarded.
Part 3: Installed Ubuntu directly on the machine and loaded Hylafax. Still can't talk to the modem? WTF?
Part 4: Realized you can't call up a softmodem when it relies on software which is only available for Windows. Returned softmodems, feeling like a moron; bought a US Robotics and a Hayes external modem for $99.99 and $69.99, respectively. Will return them soon, most likely, if they don't work.
Part 5: Hayes modem can be spoken to, and it talks back to me! Woot! This is going to be GREAT!
Part 6: Can actually talk to fax machines w/ the Hayes modem, but for some odd reason, getting DIS/DTC 3 times, losing the transmission every time. Played around with init strings, but nothing seems to work. Not making sense.
Part 7: Hooked up the US Robotics modem and re-ran faxsetup. Test fax outbound works like a charm!
Part 8: So here we are, at Part 8, which was completed last night. After configuring faxdispatch and dumping it into the /etc directory (not /etc/hylafax, which is what I was doing initially), I actually received my first test fax! The received e-fax looks like this:
Next step: need to find a way to have Hylafax interface with Exchange for outbound faxes so I don't need to install a print-to-fax client on each machine.
When using the FAX address space, Microsoft formats the address like this: IMCEAFAX-faxnumber@company.com.
Knowing this is all well and good, but even so, you still have to have something which will accept the message, strip off the excess, and pass the appropriate info (with attachment) to HylaFAX. May need to interface with Samba and smbfax to make something work. I'll see what I can come up with/find, and post results later.
In the interim, I'm just happy as hell to have a working, open-source fax server. I can increase or decrease as many lines or users as I have space for without having to pay additional licensing fees, which is important for any small company. For additional lines to come off our T1, I have an SLA on the way to convert a single digital channel to two analogue channels (already have one in place, so I'll have four fax lines total), and a RocketPort card I purchased on eBay. Here's hoping the bloody thing works when it arrives. The HylaFAX documentation points to this card as being compatible, so here's hoping....
I didn't waste time blogging on them when they occurred, but here, I'll sum them up for you:
Part 1: As you may recall, I got stuck at what I thought was VMWare ESXi Server. I may have been incorrect at that.
Part 2: Realized that using Windows XP and VMWare Workstation wasn't helping me, either. No serial ports forwarded.
Part 3: Installed Ubuntu directly on the machine and loaded Hylafax. Still can't talk to the modem? WTF?
Part 4: Realized you can't call up a softmodem when it relies on software which is only available for Windows. Returned softmodems, feeling like a moron; bought a US Robotics and a Hayes external modem for $99.99 and $69.99, respectively. Will return them soon, most likely, if they don't work.
Part 5: Hayes modem can be spoken to, and it talks back to me! Woot! This is going to be GREAT!
Part 6: Can actually talk to fax machines w/ the Hayes modem, but for some odd reason, getting DIS/DTC 3 times, losing the transmission every time. Played around with init strings, but nothing seems to work. Not making sense.
Part 7: Hooked up the US Robotics modem and re-ran faxsetup. Test fax outbound works like a charm!
Part 8: So here we are, at Part 8, which was completed last night. After configuring faxdispatch and dumping it into the /etc directory (not /etc/hylafax, which is what I was doing initially), I actually received my first test fax! The received e-fax looks like this:
That's a bit too much detail for the average user, so I'll modify the /etc/hylafax/templates/en/faxrcvd-success.txt file to remove things like the quality, size, signal rate, data format, etc. All a user really cares about is that a fax was received and, more often than not, that it's in PDF format.recvq/fax000000002.tif (ftp://:4559/recvq/fax000000002.tif):
Sender: 770XXXXXXX
Pages: 1
Quality: Normal
Size: North American Letter
Received: 2008:11:10 18:05:18
Time To Receive: 0:14
Signal Rate: 14400 bit/s
Data Format: 2-D MMR
Error Correct: Yes
CallID1:
CallID2:
Received On: ttyS0
CommID: 000000071 (ftp://:4559/log/c000000071)
Next step: need to find a way to have Hylafax interface with Exchange for outbound faxes so I don't need to install a print-to-fax client on each machine.
When using the FAX address space, Microsoft formats the address like this: IMCEAFAX-faxnumber@company.com.
Knowing this is all well and good, but even so, you still have to have something which will accept the message, strip off the excess, and pass the appropriate info (with attachment) to HylaFAX. May need to interface with Samba and smbfax to make something work. I'll see what I can come up with/find, and post results later.
In the interim, I'm just happy as hell to have a working, open-source fax server. I can increase or decrease as many lines or users as I have space for without having to pay additional licensing fees, which is important for any small company. For additional lines to come off our T1, I have an SLA on the way to convert a single digital channel to two analogue channels (already have one in place, so I'll have four fax lines total), and a RocketPort card I purchased on eBay. Here's hoping the bloody thing works when it arrives. The HylaFAX documentation points to this card as being compatible, so here's hoping....
20081021
Awesome Buddhist Quote
I love this quote:
Hey you, expecting results without effort! So sensitive! So long-suffering! You, in the clutches of death, acting like an immortal! Hey sufferer, you are destroying yourself!
-Santideva, Bodhicaryavatara
Somehow, in my quest for a nice balance between efficiency, fun, and mindfulness, I always seem to get off-track. I occasionally come back to center and ground myself, then get back to business, but I always seem to work back towards a feeling of imbalance, frustration, and just generally not having enough time in the day.
With that said, I'm going to go regain my focus. Be back in a bit. kthxbai.
Hey you, expecting results without effort! So sensitive! So long-suffering! You, in the clutches of death, acting like an immortal! Hey sufferer, you are destroying yourself!
-Santideva, Bodhicaryavatara
Somehow, in my quest for a nice balance between efficiency, fun, and mindfulness, I always seem to get off-track. I occasionally come back to center and ground myself, then get back to business, but I always seem to work back towards a feeling of imbalance, frustration, and just generally not having enough time in the day.
With that said, I'm going to go regain my focus. Be back in a bit. kthxbai.
20080919
Fun With Setting Up Hylafax, Part One
Okay, I admit it: I'm a Windows user. I've used Windows all my life. Sure, I've played around in Ubuntu here and there, and the Gnome desktop is great. Even KDE is nice and intuitive. Stick me at a Bash prompt, though, and "ls" is about all I know. That, and to avoid "vi" at all costs unless I want to reboot the machine, since I can't get out of vi or vim.
Well, that was Monday. Today is Friday, and I've spent the week learning my way around Bash a bit. I've spent considerable amounts of time getting used to emacs & nano, which are much more intuitive than vi or vim, and using ssh to connect directly to the machine's terminal window rather than using TightVNC or the VMWare Infrastructure Client to play around in Gnome, since it's faster to go straight to the terminal.
Why am I going through all of this? Well, besides the fact that I've been meaning to learn Linux for quite some time, I need a fax server. We already have GFI Faxmaker, but it's only for one line, and the server only has one PCI slot. We need more than that, and if I go above four, GFI costs extra; not something I can head towards, since I've been told to "make do with what I have" in terms of IT budget. That means open-source solutions are afoot.
So I learned about Hylafax from a friend's son, who happens to be a Linux geek. You can learn more about Hylafax from www.hylafax.org. Needless to say, the installation and usage should've been relatively painless, but I inadvertently threw my own monkey wrench in there with one thing: The VMWare ESXi Hypervisor. For some reason, it simply refuses to recognize any local COM ports on the hypervisor machine, which I would then forward to the host machine.
I finally discovered this after using cu -hl ttyS0 caused the terminal to lock up again and again.
Now, I'm downloading the machine's virtual disk files locally from the hypervisor's datastore. I'll wipe the hypervisor box, install Windows XP, then load the VMWare Desktop hypervisor. Windows XP plays nicer with faxmodems, so we'll see if I can forward the COM ports that way.
Time will tell; I'll post an update with my results later. And yes, for those of you who have also read the documentation and set up your own Hylafax server, I DID name the virtual machine "Hylamonster." It'll be a cuter name when it's actually working.
Well, that was Monday. Today is Friday, and I've spent the week learning my way around Bash a bit. I've spent considerable amounts of time getting used to emacs & nano, which are much more intuitive than vi or vim, and using ssh to connect directly to the machine's terminal window rather than using TightVNC or the VMWare Infrastructure Client to play around in Gnome, since it's faster to go straight to the terminal.
Why am I going through all of this? Well, besides the fact that I've been meaning to learn Linux for quite some time, I need a fax server. We already have GFI Faxmaker, but it's only for one line, and the server only has one PCI slot. We need more than that, and if I go above four, GFI costs extra; not something I can head towards, since I've been told to "make do with what I have" in terms of IT budget. That means open-source solutions are afoot.
So I learned about Hylafax from a friend's son, who happens to be a Linux geek. You can learn more about Hylafax from www.hylafax.org. Needless to say, the installation and usage should've been relatively painless, but I inadvertently threw my own monkey wrench in there with one thing: The VMWare ESXi Hypervisor. For some reason, it simply refuses to recognize any local COM ports on the hypervisor machine, which I would then forward to the host machine.
I finally discovered this after using cu -hl ttyS0 caused the terminal to lock up again and again.
Now, I'm downloading the machine's virtual disk files locally from the hypervisor's datastore. I'll wipe the hypervisor box, install Windows XP, then load the VMWare Desktop hypervisor. Windows XP plays nicer with faxmodems, so we'll see if I can forward the COM ports that way.
Time will tell; I'll post an update with my results later. And yes, for those of you who have also read the documentation and set up your own Hylafax server, I DID name the virtual machine "Hylamonster." It'll be a cuter name when it's actually working.
Subscribe to:
Posts (Atom)