Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Is there any Juniper router or switch that doesn't cost a million dollars*?

*(a million figurative dollars)

Now that I have juniper routers set up in GNS3 and working, I might do a write up. I'm pretty impressed with JunOS so far.

Adbot
ADBOT LOVES YOU

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Moey posted:

I have only been working with Juniper stuff for about a month now, but absolutely love JunOS compaired to IOS. Currently working with a 2xEX4550 and 2xEX4200 in a virtual chassis along with 2xSRX240H at each of our main sites.

Yeah ditto. JunOS is just so sexy. Those nested configs, mmm...

code:
system {
    host-name Router;
    login {
        user QPZIL {
            uid 2000;
            class super-user;
            authentication {
                encrypted-password "!@%!^#^@#@#butts!@#!%@#^";
            }
        }
    }
}
interfaces {
    /* uplink to the matrix */
    fe-0/0/0 {
        unit 0 {
            family inet {
                address 10.69.69.69/24;
            }
        }
    }
    /* connection to VLAN 10 */
    fe-0/0/1 {
        unit 10 {
            family inet {
                address 10.10.10.1/24;
            }
        }
    }
}
I just pulled that out of my rear end, but come on... comments! Nesting! Prefix length instead of subnet mask!

Ah, it's wonderful.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Finally decided to sketch out my home lab since I was bored enough today.



Everything's set up so I can do labbing without my WiFi interfering with anything.

So I've got one 1841 dedicated to NAT translation, as sort of a border between my ISP router (some $20 WalMart special) and my lab network.
Then the next 1841 (C_Router_1) is my router-on-a-stick and routes to NATRouter via OSPF.

The top switch (C_Switch_1) is the only one worth a drat, because the XL switches are so bad and are stuck on IOS 11.2. But VLAN 10 (ports 17-23) is the only one with access to get NAT'ed, so I can plug my laptop into one of those ports and have internet while I gently caress around and experiment with the rest of the setup.

It works for me, and segments things well enough that I don't feel like I'm messing up anything by connecting GNS3 networks and firewalls and IP phones and Juniper bullshit and whatnot.

Overkill? Maybe, but it's fun :)

Not pictured:
- 2610 router
- 1721 router
I haven't figured out what fun things to do with those yet.

And I still need to buy a couple 3550s if I'm going to be studying up for the CCNP exams.

Count Thrashula fucked around with this message at 20:51 on Aug 23, 2013

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Sepist posted:

I was all excited about a 3750 I got off ebay for my home lab and after they sent me the shipping info they sent me a followup email saying that they didn't actually have the switch and refunded my money :smith:

:smith:

Could be worse, I bought a 3550 (i.e. layer 3 switch) on eBay for about $50 after shipping was factored in, and what they sent me was a 3524XL (a layer 2 switch that doesn't even run IOS version 12).

They seller told me that it was basically the same thing and that I was complaining about nothing :downs: A week later, eBay reviewed the case and refunded my full payment amount. I still have the switch, but I don't do a drat thing with it.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
I tried to snipe an auction for a Juniper J2320 but lost it because I wasn't logged in and that messed up my sniping by like 3 seconds.

It ended at $28.

gently caress.

I'm gonna go take a walk.

(edit-- VBoxing a Juniper machine is semi-feasible but doesn't have full functionality and doesn't have any switching functionality at all. So, a physical box would be great to have.)

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Here's my current baby, my CCNP ROUTE lab in GNS3



Since taking that screenshot, I've added an SNMP server using Paessler's PRTG.

If anyone has any questions about it, I'm happy to write a short tutorial on how to get something up and running. The ASA and the IP phones were both kind of a pain to get working, but it was exciting when they finally did!

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
BEHOLD MY POWER

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

IT Guy posted:

We have a couple of those still in production.

Now I'm sad.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Erkenntnis posted:

Both the ASA amd IP Phone are what I'm interesting in getting set up - how'd you do it?

ASA

The ASA was fairly straightforward after I figured out a couple little quirks. The first step is to make sure you have the latest version of GNS3 (0.8.5 as of this post). The latest version makes it a LOT easier to configure an ASA/PIX/whatever.

First, you're going to need the ASA 8.4(2) kernel and init files. Those you can get from Cisco or get off of your home ASA - I'll leave that part for you to figure out. But you'll have two files, "asa842-initrd.gz" and "asa842-vmlinuz".

Open GNS3, and go to Edit -> Preferences. On the "Qemu" tab, first hit "Test Settings" and make sure you get the green go-ahead that everything is working. If not, you may have to download Qemu or whatever, but I believe everything is pre-installed in the Windows version.

Next, go to the ASA tab. This is where the latest version of GNS3 shines. There will be a "preconfiguration" option. ASA 8.4(2) should be selected, so just hit "apply," and that will fill in all the values for you. Leave all the defaults.

ONE LITTLE TWEAK - I don't know if this is necessary, but currently the "Qemu Options" should look like the following:
-vga none -icount auto -hdachs 980,16,32
Change it to the following:
-vnc none -vga none -m 1024 -icount auto -hdachs 980,16,32
That way, it'll run headless (i.e. you won't see the Qemu emulation window), and you can just console to it. I had some issues when I wasn't using these options.

Now, hit "save", hit "okay", and close out of that window. Drag an ASA onto your topology, right click it, click start. Right click it, click console. If all went as planned, you should see it booting up.

It's not a perfect solution. If you want to connect any cables, you have to stop the emulation to do that. And sometimes it won't boot up, I'll have to stop and start it a couple times to get it to go. But, generally speaking, it's the best way to emulate an ASA.

I'll write up an IP phone thing soon. Hope this helps!

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Stealthgerbil posted:

What cisco routers and switches are cheap but not super out of date?

Routers: 2610, 1721, 1841 ($20, $16, and $100 used on Amazon)
Switches: 2950, 3550 ($20 and around $100 usually)

For starting out, I'd recommend just sticking with 2610s and 2950s. A couple of each of those should be plenty for the CCNA. going further than that, you'll probably want specialized gear (i.e. for Security or Voice), or 3550s for Layer 3 switching (i.e. for the CCNP)

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Red87 posted:

So with the only CCNA test now being offered being the 200-120 or the CCENT route, I take it a physical home lab isn't really an option anymore? From what I can gather and looking at the 200-120 syllabus, you're going to need newer equipment because there's IOS 15 stuff on . I have a few 2950's and a couple 2600 series routers that I picked up last year but I never got around to doing the 640 exam. My employer wants me to get my CCNA now (Even though I work in a pure Brocade/Foundry environment). Which is my best route to go now for simulations? I previously planned to just do all the objectives and study on a regular lab, but it seems that's not the best course of action now.

What's on there that's only in IOS 15?

But FYI, the 7200 series version 15 IOS image is supported in GNS3.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Speaking of PIX - there are a ton of PIXs for cheap on eBay, but ASAs are somewhat pricey.

A PIX is no replacement for an ASA, right? What would I be missing out on with a PIX box?

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Docjowles posted:

The PIX platform hit "end of sale" in 2008 and isn't comparable to an ASA other than "they're both firewalls". They don't even run the same OS. There is no reason to own one in your lab.

Noted. Thanks! And, I guess I can do basically everything I need to with a GNS3-based ASA. The only really real thing I need in my CCNA:Security lab is some switches.

Also finally got ACS up and running on my VMware box. TREMBLE at it's 4gigs of RAM, 60gig SCSI hard drive, and DUAL 3gHz processors. The question I had asked before about why the "acs" application wasn't running on the box, turns out it just didn't install correctly. Works fine now.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Moey posted:

So are there any good current guides out there for setting up GNS3 and Juniper Olive in an ESXi environment?

Would like to play around with them outside of work a little more.

I'll type something up tonight, how I got mine set up.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Apparently I am just dumb as a bag of hammers when it comes to firewalls.

I've been trying to get an ASA working in my setup, but somehow I can't get it to route the outside to the inside.

My setup is:

~~~*THE CLOUD*~~~ <====> g0 [ASA] g1 <====> fa0/0 [Router] fa0/1 <==== (everything else)

I have g0 setup with "nameif OUTSIDE", "ip address 192.168.0.254", "security-level 0"
I have g1 setup with "nameif INSIDE", "ip address 10.1.1.1", "security-level 100"

The ASA and the router are both running EIGRP with the default static route of 0.0.0.0 to 192.168.0.1 (the outside router). The ASA is NATing everything from g1 to the outside.

However, I can ping 4.2.2.2 from the OUTSIDE interface on the ASA, but get "?????" when I try to ping from the INSIDE interface.

I tried making both in and out ACLs for the echo protocol on both interfaes, but the packet tracer tool in ASDM still says that an access rule is blocking the pings from going through. Hm.

This same setup works on the router if it were plugged straight into the internet, but I feel like I'm missing something dumb. I just finished the CBT Nuggets series on CCNA Security, so now I'm getting around to the practice/lab part of things, and... welp, I feel dumb :downs:


edit-- oh for gently caress sake, I didn't have an ACL to allow echo-reply traffic in on the OUTSIDE interface, only allowing echo traffic through to get out. Fixed.

Count Thrashula fucked around with this message at 01:41 on Oct 21, 2013

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

The Third Man posted:

I'm trying to create a topology in GNS3 to practice off of, can anyone suggest a good real-world example to model this off of? I don't want to practice off of a something I'll never actually see in production.

The Cisco Design Guides are a good start. Find one that looks good and shoot for building one from scratch.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Jelmylicious posted:

GNS 3 1.0 crowdfunding has started. New features will include switching and dropping packets on links. Backers will get access to the beta version, so you will have it about 8 months early. Everybody give stephen your money!!

https://gns3.crowdhoster.com/become-an-early-release-member

I literally would not have gotten my CCNA R&S or my CCNA Security without GNS3. Well, not as easily or cheaply at least. $25 is almost criminally low for how much I value that software.

CONTRIBUTED.

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Swink posted:

We just replaced some switches and now I have a HP 4000M and HP 8000M sitting under my desk.

Are these of any value to me or anyone for anything or should I just junk them?

I'd love to have an HP ProCurve for labbing stuff, since I just started a new job where we use them and I'm not that familiar with them.

But holy moly those are big :stare:

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Docjowles posted:

I'm a fan of the HP 1810 series if you want a cheap, managed gigabit switch. It's not gonna help you on anything vendor specific like the CCNA but they do support things like VLAN's, jumbo frames, link aggregation, and spanning-tree if you just want to learn the concepts (or actually want to use those features in your lab).

You can get an 8 porter for under $100.

I'm hella familiar with Cisco stuff, I just wanted a beater HP device to test on. That looks pretty good, I'm assuming it runs the same standard HP CLI that the ProCurve devices use?

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord

Syano posted:

Im looking for a cheap/simple console server to manage my lab rack with. Does anyone have any suggestions?

Get a Raspberry Pi, a USB-to-quad-serial cable or two, and run Raspbian linux and Ser2net to make it a console server.

edit-- or a 2511 on eBay or something

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Why not just buy a few Cisco 2950s instead of a Dell switch since he's studying for, you know, a Cisco exam?

They're <$30 on Amazon
http://www.amazon.com/Cisco-WS-C295...1&keywords=2950

Adbot
ADBOT LOVES YOU

Count Thrashula
Jun 1, 2003

Death is nothing compared to vindication.
Buglord
Any CCIEs in the house? I currently have the following gear, and I'm curious what else I'll need for the CCIE eventually. I guess I'm trying to "futureproof" my lab setup, so I only buy things I'll eventually need, instead of filling up with crap that'll be useless to me later on (like I've somewhat done already).

Routers:
- 1841 ISR
- 1841 ISR
- 2610
- 1721

Switches:
- 3550
- 3524XL
- 2924XL
- 2950

Really, the only semi-modern items in there are the 1841s and the 3550 :(

  • Locked thread