Network Security Memorandum

Friday, May 10, 2013

BGP Command : soft-reconfiguration inbound & soft in

When you apply policy changes, they are only applied on routes that are learned after the policy changes have been enacted. This is because BGP is most frequently implemented on links that connect to other ASes - and you can't just force an ISP or another organization to resend their BGP routing table to you. You can force this by running "clear ip bgp *" (every BGP neighbor) or "clear ip bgp A.B.C.D" - but these clear commands actually tear down connections between neighbors and cause communication to cease until the neighbor relations are rebuilt. In the real world where BGP is run - this is a bad thing.

When you perform the "neighbor A.B.C.D soft-reconfiguration inbound" router command - it shuts down the connection (just like a hard reset). When the neighbor resends you it's routing table, BGP stores a copy of the received routing table in memory. This 2nd copy takes up memory, but it serves a useful purpose. Now, when you apply policy changes to a neighbor or out a particular interface, you can configure "clear ip bgp * (or A.B.C.D) soft in" and run the saved copy of the neighbor's routes through your new bgp policy filters. You can make policy changes all you want and your neighbor never has to resend you its routing table, and you never have to tear down the connection between you and disrupt network communication.

EIGRP, OSPF, RIP, IGRP - If you apply a policy change (ACL, Distribute List, Route Map, whatever) - that change takes place instantly (instantly + the time to propogate the change and implement the policy). BGP acts differently - it waits until it receives new routes through its new filters. That's why the "soft-reconfiguration inbound" command was created.

R6#sh ip bgp nei 46.46.46.46 received-routes
% Inbound soft reconfiguration not enabled on 46.46.46.46

R6(config-router)#neighbor 46.46.46.46 soft-reconfiguration inbound

R6#sh ip bgp nei 46.46.46.46 received-routes

BGP table version is 3, local router ID is 6.6.6.6

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

*>i4.4.4.4/32 46.46.46.46 0 100 0 i

Total number of prefixes 1

Wednesday, May 8, 2013

Find out Linux CPU Utilization on Checkpoint Firewall

1. Top Command

top - 10:57:46 up 3 min, 2 users, load average: 1.24, 0.86, 0.35
Tasks: 66 total, 3 running, 63 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.0%us, 0.3%sy, 0.0%ni, 99.0%id, 0.7%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 1032044k total, 565316k used, 466728k free, 13536k buffers
Swap: 2128604k total, 0k used, 2128604k free, 238368k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5523 root 15 0 98584 31m 14m S 0.3 3.1 0:00.97 SVRServer
1 root 15 0 1648 536 468 S 0.0 0.1 0:00.50 init
2 root RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
3 root 15 0 0 0 0 S 0.0 0.0 0:00.00 ksoftirqd/0
4 root RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 events/0
6 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 khelper
7 root 11 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
8 root RT -5 0 0 0 D 0.0 0.0 0:00.00 kmem_kthread
11 root 10 -5 0 0 0 S 0.0 0.0 0:00.04 kblockd/0
12 root 20 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
176 root 19 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
179 root 19 -5 0 0 0 S 0.0 0.0 0:00.00 khubd
181 root 10 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod
244 root 24 0 0 0 0 S 0.0 0.0 0:00.00 pdflush
245 root 15 0 0 0 0 S 0.0 0.0 0:00.02 pdflush

2. mpstat Command to display each CPU individually utilization

# mpstat
Linux 2.6.18-92cp (CP-FW-1) 05/08/13

10:36:06 CPU %user %nice %sys %iowait %irq %soft %steal %idle intr/s
10:36:06 all 8.03 0.00 1.35 0.27 0.03 0.18 0.00 90.14 526.71

# mpstat -P ALL
Linux 2.6.18-92cp (CP-FW-1) 05/08/13

10:36:47 CPU %user %nice %sys %iowait %irq %soft %steal %idle intr/s
10:36:47 all 8.03 0.00 1.35 0.27 0.03 0.18 0.00 90.14 526.71
10:36:47 0 7.72 0.00 1.36 0.27 0.03 0.20 0.00 90.42 272.65
10:36:47 1 8.35 0.00 1.35 0.27 0.02 0.16 0.00 89.85 254.06

3. sar Command to display today's CPU activity

# sar
Linux 2.6.18-92cp (CP-FW-1) 05/08/13

00:00:01 CPU %user %nice %system %iowait %steal %idle
00:10:01 all 8.42 0.00 1.65 0.29 0.00 89.64
00:20:01 all 8.47 0.00 1.62 0.33 0.00 89.57
00:30:01 all 10.95 0.00 1.61 0.28 0.00 87.16
00:40:01 all 8.42 0.00 1.64 0.30 0.00 89.64
00:50:01 all 8.43 0.00 1.66 0.26 0.00 89.66
01:00:01 all 8.44 0.00 1.60 0.26 0.00 89.70
01:10:02 all 8.43 0.00 1.67 0.33 0.00 89.57
01:20:01 all 8.44 0.00 1.66 0.25 0.00 89.65
01:30:01 all 10.86 0.00 1.69 0.31 0.00 87.14
01:40:01 all 8.41 0.00 1.63 0.33 0.00 89.62
01:50:01 all 8.41 0.00 1.60 0.29 0.00 89.70
02:00:01 all 8.40 0.00 1.59 0.27 0.00 89.75
02:10:01 all 8.40 0.00 1.64 0.30 0.00 89.67
02:20:01 all 8.40 0.00 1.58 0.28 0.00 89.74
02:30:01 all 10.86 0.00 1.63 0.25 0.00 87.26
02:40:01 all 8.41 0.00 1.62 0.24 0.00 89.73
02:50:01 all 8.41 0.00 1.64 0.34 0.00 89.61
03:00:01 all 8.40 0.00 1.59 0.29 0.00 89.71
03:10:01 all 8.42 0.00 1.60 0.29 0.00 89.68
03:20:01 all 8.41 0.00 1.58 0.31 0.00 89.69
03:30:01 all 10.94 0.00 1.64 0.31 0.00 87.11
03:40:01 all 8.42 0.00 1.62 0.24 0.00 89.72
03:50:01 all 8.42 0.00 1.60 0.36 0.00 89.62
04:00:01 all 8.39 0.00 1.60 0.29 0.00 89.72
04:10:01 all 8.40 0.00 1.62 0.26 0.00 89.72
04:20:01 all 8.40 0.00 1.60 0.30 0.00 89.70
04:30:01 all 10.90 0.00 1.73 0.30 0.00 87.07
04:40:01 all 8.43 0.00 1.67 0.27 0.00 89.63
04:50:01 all 8.43 0.00 1.67 0.28 0.00 89.62
05:00:01 all 8.45 0.00 1.94 0.31 0.00 89.29
05:10:01 all 8.55 0.00 1.99 0.32 0.00 89.15
05:20:02 all 8.47 0.00 1.94 0.30 0.00 89.29
05:30:01 all 10.91 0.00 1.74 0.27 0.00 87.09
05:40:01 all 8.49 0.00 2.19 0.27 0.00 89.05
05:50:01 all 8.43 0.00 1.64 0.26 0.00 89.68
06:00:01 all 8.41 0.00 1.71 0.29 0.00 89.58
06:10:01 all 8.43 0.00 1.61 0.27 0.00 89.69
06:20:01 all 8.41 0.00 1.61 0.28 0.00 89.70
06:30:01 all 10.92 0.00 1.65 0.36 0.00 87.08
06:40:01 all 8.53 0.00 2.00 0.30 0.00 89.16
06:50:01 all 8.42 0.00 1.71 0.33 0.00 89.55
07:00:01 all 8.43 0.00 1.59 0.27 0.00 89.71
07:10:01 all 8.44 0.00 1.60 0.28 0.00 89.69
07:20:01 all 8.42 0.00 1.63 0.27 0.00 89.68
07:30:01 all 10.84 0.00 1.61 0.31 0.00 87.24
07:40:01 all 8.44 0.00 1.61 0.27 0.00 89.69
07:50:01 all 8.45 0.00 1.63 0.27 0.00 89.66
08:00:01 all 8.46 0.00 1.65 0.25 0.00 89.64
08:10:01 all 8.41 0.00 1.60 0.29 0.00 89.70
08:20:01 all 8.39 0.00 1.60 0.30 0.00 89.71
08:30:01 all 10.88 0.00 1.61 0.29 0.00 87.22
08:40:01 all 8.42 0.00 1.65 0.27 0.00 89.66
08:50:01 all 8.42 0.00 1.59 0.28 0.00 89.71
09:00:01 all 8.41 0.00 1.60 0.25 0.00 89.73
09:10:01 all 8.43 0.00 1.60 0.30 0.00 89.67
09:20:01 all 8.41 0.00 1.64 0.29 0.00 89.66
09:30:02 all 10.86 0.00 1.62 0.25 0.00 87.27
09:40:01 all 8.50 0.00 1.61 0.32 0.00 89.58
09:50:01 all 8.44 0.00 1.59 0.33 0.00 89.63
10:00:01 all 8.41 0.00 1.63 0.28 0.00 89.68
10:10:01 all 8.39 0.00 1.60 0.33 0.00 89.67
10:20:01 all 8.42 0.00 1.58 0.28 0.00 89.72
10:30:01 all 10.87 0.00 1.63 0.37 0.00 87.13
Average: all 8.86 0.00 1.66 0.29 0.00 89.19

sar -u 2 5 to display comparison of CPU utilization; 2 seconds apart; 5 times,

# sar -u 2 5

Linux 2.6.18-92cp (CP-FW-1) 05/08/13

10:38:11 CPU %user %nice %system %iowait %steal %idle

10:38:13 all 0.25 0.00 1.50 0.25 0.00 98.00

10:38:15 all 0.25 0.00 1.00 0.25 0.00 98.50

10:38:17 all 0.25 0.00 1.00 0.25 0.00 98.50

10:38:19 all 0.25 0.00 1.00 0.25 0.00 98.50

10:38:21 all 0.25 0.00 1.75 0.00 0.00 98.00

Average: all 0.25 0.00 1.25 0.20 0.00 98.30

4. PS command to find out who is monopolizing or eating the CPUs

# ps -eo pcpu,pid,user,args | sort -k 1 -r | head -10

82.0 12192 admin fw ctl affinity -l -v

%CPU PID USER COMMAND

0.4 5052 admin /bin/searchd

0.3 5322 admin cpd

0.1 11353 admin /bin/clish

0.1 6609 admin DAService > /opt/CPda/bin/DA.out

0.1 5054 admin /bin/monitord

0.1 3896 admin [kjournald]

0.0 24478 admin /sbin/agetty 9600 ttyS0 vt100

0.0 24471 admin /bin/bash /bin/console_agetty

# ps -eo pcpu,pid,user,args | sort -r -k1 | less

%CPU PID USER COMMAND

0.4 5052 admin /bin/searchd

0.3 5322 admin cpd

0.1 11353 admin /bin/clish

0.1 6609 admin DAService > /opt/CPda/bin/DA.out

0.1 5054 admin /bin/monitord

0.1 3896 admin [kjournald]

0.0 24478 admin /sbin/agetty 9600 ttyS0 vt100

0.0 24471 admin /bin/bash /bin/console_agetty

0.0 19410 admin /bin/lvmcmd_d

0.0 19409 nobody /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

0.0 19407 nobody /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

0.0 19406 nobody /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

0.0 19405 nobody /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

0.0 19400 admin /opt/CPshrd-R75.40/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

0.0 12314 admin [less]

0.0 12313 admin sort -r -k1

0.0 12312 admin ps -eo pcpu,pid,user,args

0.0 11468 admin /bin/bash

0.0 11363 admin /bin/clishd serving 11353

0.0 11302 admin sshd: admin@pts/2

0.0 10036 admin sleep 3600

0.0 6728 admin /sbin/agetty 9600 tty3

0.0 6723 admin /sbin/agetty 9600 tty2

0.0 6721 admin /sbin/agetty 9600 tty1

0.0 6601 admin rtmd

0.0 5921 admin in.geod 0

0.0 5920 admin dtlsd 0

0.0 5874 admin vpnd 0

0.0 5871 admin in.aufpd 0

0.0 5870 admin in.asessiond 0

0.0 5652 admin /bin/routed -N

0.0 5637 admin fwd

0.0 5625 nobody ci_http_server -j -f /opt/CPsuite-R75.40/fw1/conf/cihs.conf

0.0 5618 admin /bin/csh -f /opt/CPsuite-R75.40/fw1/bin/avi_del_tmp_files

0.0 5612 admin /opt/CPsuite-R75.40/fw1/bin/cphamcset

0.0 5344 admin mpdaemon /opt/CPshrd-R75.40/log/mpdaemon.elg /opt/CPshrd-R75.40/conf/mpdaemon.conf

0.0 5308 admin /opt/CPshrd-R75.40/bin/cpwd

0.0 5275 admin /opt/CPshrd-R75.40/bin/cprid

0.0 5255 admin /bin/csh -fb /opt/CPshrd-R75.40/bin/cprid_wd

0.0 5216 admin crond

0.0 5202 admin xinetd -stayalive -pidfile /var/run/xinetd.pid

0.0 5178 admin /usr/sbin/sshd -4

0.0 5139 admin /usr/sbin/acpid

0.0 5106 admin /bin/clish -p

0.0 5105 admin /bin/frontstage

0.0 5103 admin /bin/clishd default server

0.0 5051 admin /bin/confd

0.0 5031 admin /bin/pm

0.0 4648 admin klogd -x -c 1

0.0 4643 admin syslogd -m 0 -z 515 -f /var/run/syslog.conf

0.0 4620 admin auditd

0.0 4484 admin [fw_worker_1]

0.0 4419 admin [fw_worker_0]

0.0 3893 admin [kjournald]

0.0 512 admin /sbin/udevd -d

0.0 479 admin [kauditd]

0.0 452 admin [kjournald]

0.0 444 admin [ksnapd]

0.0 425 admin [scsi_eh_1]

0.0 424 admin [scsi_eh_0]

0.0 420 admin [ata_aux]

0.0 419 admin [ata/1]

0.0 418 admin [ata/0]

0.0 383 admin [kpsmoused]

0.0 217 admin [aio/1]

5. iostat command to report CPU statistics and input/output statistics for devices and partitions since last reboot.

# iostat
Linux 2.6.18-92cp (CP-FW-1) 05/08/13

avg-cpu: %user %nice %system %iowait %steal %idle
8.03 0.00 1.56 0.27 0.00 90.14

Device: tps Blk_read/s Blk_wrtn/s Blk_read Blk_wrtn
sda 23.67 0.10 203.59 1382468 2879161118
dm-0 15.87 0.05 126.96 681826 1795461872
dm-1 47.55 0.05 76.63 694258 1083698632
dm-2 0.00 0.00 0.00 392 0
dm-3 0.00 0.00 0.00 392 0
dm-4 0.00 0.00 0.00 392 0
dm-5 0.00 0.00 0.00 392 0
dm-6 0.00 0.00 0.00 56 8

# iostat -xtc 5 3 - gives you three outputs every 5 seconds.

Linux 2.6.18-92cp (CP-FW-1) 05/08/13

Time: 10:44:13

avg-cpu: %user %nice %system %iowait %steal %idle

8.03 0.00 1.56 0.27 0.00 90.14

Time: 10:44:18

avg-cpu: %user %nice %system %iowait %steal %idle

0.30 0.00 0.80 0.40 0.00 98.50

Time: 10:44:23

avg-cpu: %user %nice %system %iowait %steal %idle

0.30 0.00 0.90 0.10 0.00 98.70

Monday, May 6, 2013

Check Cisco Device Interface Throughput with load-interval Command

BGP_1#sh int g0/1
GigabitEthernet0/1 is up, line protocol is up
Hardware is iGbE, address is e02f.6d05.c401 (bia e02f.6d05.c401)
Internet address is 6.99.9.30/32
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full Duplex, 1Gbps, media type is RJ45
output flow-control is unsupported, input flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 1463000 bits/sec, 530 packets/sec
5 minute output rate 2452000 bits/sec, 417 packets/sec
21277230 packets input, 3855639781 bytes, 0 no buffer
Received 716 broadcasts (0 IP multicasts)

Check "load" numbers. These are defaulted to a rolling average of 5 minutes and displayed as a factor of 255 (2^8, but counting from 0 not one). So a load of 255/255 would be completely saturated.

You can change this 5 minute default to a 30 second rolling average by going to the interface in question and issuing the command "load-interval 30" This a very useful process when deploying BGP. The tx/rx of course is transmit load versus receive load, which can also be extremely handy in understanding certain traffic issues (BGP load sharing for example).

BGP_1#sh run int g0/1

Building configuration...

Current configuration : 179 bytes

interface GigabitEthernet0/1

description Link with Cogeco BGP

ip address 6.99.9.30 255.255.255.255

load-interval 30

duplex auto

speed auto

end

BGP_1#show interfaces g0/1

GigabitEthernet0/1 is up, line protocol is up

Hardware is iGbE, address is e02f.6d05.c401 (bia e02f.6d05.c401)

Internet address is 6.99.9.30/32

MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full Duplex, 1Gbps, media type is RJ45

output flow-control is unsupported, input flow-control is unsupported

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:06, output 00:00:00, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue: 0/40 (size/max)

30 second input rate 1227000 bits/sec, 469 packets/sec

30 second output rate 2202000 bits/sec, 357 packets/sec

21629047 packets input, 3970567808 bytes, 0 no buffer

Received 727 broadcasts (0 IP multicasts)

BGP_1#show interfaces g0/1 | in drops|bits

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

30 second input rate 1366000 bits/sec, 562 packets/sec

30 second output rate 3790000 bits/sec, 524 packets/sec

0 unknown protocol drops

Sunday, May 5, 2013

VRRP and Object Tracking

Having following requirements to configure First Hop Redundancy Protocol for one environment:
1. Use least public ip addresses
2. Track Internet facing interface and BGP routes
3. Primary router is high priority and will be kept active as possible as it can.

Configuration:

track 1 interface GigabitEthernet0/1 line-protocol
!
track 2 ip route 0.0.0.0 0.0.0.0 reachability
!
track 3 list boolean and
object 1
object 2

BGP_1#sh run int g0/0
Building configuration...

Current configuration : 298 bytes
!
interface GigabitEthernet0/0
ip address 99.46.16.162 255.255.255.192
shutdown
duplex auto
speed auto
vrrp 1 ip 99.46.16.162
vrrp 1 timers advertise 3
vrrp 1 timers learn
vrrp 1 priority 120
vrrp 1 authentication cisco
vrrp 1 track 3 decrement 30
end
BGP_1#sh run int g0/1
Building configuration...

Current configuration : 161 bytes
!
interface GigabitEthernet0/1
description Link with Cogeco BGP
ip address 6.9.9.130 255.255.255.252
ip access-group 100 in
duplex auto
speed auto
end

Verification:

BGP_1#show track
Track 1
Interface GigabitEthernet0/1 line-protocol
Line protocol is Up
1 change, last change 00:07:27
Tracked by:
VRRP GigabitEthernet0/0 1
Track 2
IP route 0.0.0.0 0.0.0.0 reachability
Reachability is Up (BGP)
2 changes, last change 00:02:34
First-hop interface is GigabitEthernet0/1
Track 3
List boolean and
Boolean AND is Up
4 changes, last change 00:02:34
object 1 Up
object 2 Up
Tracked by:
VRRP GigabitEthernet0/0 1

BGP_1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is 6.9.9.129 to network 0.0.0.0

B* 0.0.0.0/0 [20/0] via 6.9.9.129, 11:05:07
66.0.0.0/8 is variably subnetted, 4 subnets, 3 masks
C 6.9.9.128/30 is directly connected, GigabitEthernet0/1
L 6.9.9.130/32 is directly connected, GigabitEthernet0/1
C 66.199.44.240/29 is directly connected, GigabitEthernet0/3
L 66.199.44.241/32 is directly connected, GigabitEthernet0/3
S 99.46.16.0/24 [1/0] via 66.199.44.242

Tuesday, April 30, 2013

Why Cisco Devices refused SSH connection

Network devices usually managed through SSH services. Sometimes, those devices lost SSH access with
" The remote system refused the connection."
error message presenting on the SSH client such as SecureCRT. No matter how you tried from Internal or External interface, it is always same. Is there any configuration wrong? If yes, why did it work at last time?

Symptoms:

Through console port, there were some of interesting things:

Router1#show connection

ID Name Segment 1 Segment 2 State

================================================================================

Router1#show users

Line User Host(s) Idle Location

* 1 aux 0 user2 idle 00:00:00

132 vty 0 user1 100.9.1.1 48w0d 10.94.200.28

133 vty 1 user1 100.9.1.1 48w0d 10.94.200.28

134 vty 2 user1 100.9.1.1 48w0d 10.94.200.28

135 vty 3 user1 100.9.1.1 48w0d 10.94.200.28

136 vty 4 user1 100.9.1.1 47w6d 10.94.200.28

137 vty 5 user1 100.9.1.1 47w6d 10.94.200.28

138 vty 6 user1 100.9.1.1 47w6d 10.94.200.28

139 vty 7 user1 100.9.1.1 47w1d 10.94.200.28

140 vty 8 user1 100.9.1.1 47w1d 10.94.200.28

141 vty 9 user1 100.9.1.1 46w5d 10.94.200.28

142 vty 10 user1 100.9.1.1 43w5d 10.94.200.28

143 vty 11 user1 100.9.1.1 43w4d 10.94.200.28

144 vty 12 user1 100.9.1.1 41w6d 10.94.200.28

145 vty 13 user1 100.9.1.1 41w6d 10.94.200.28

146 vty 14 user1 100.9.1.1 41w6d 10.94.200.28

147 vty 15 user1 100.9.1.1 41w6d 10.94.200.28

Interface User Mode Idle Peer Address

Router1#show ssh

Connection Version Mode Encryption Hmac State Username

0 2.0 IN aes256-cbc hmac-sha1 Session started user1

0 2.0 OUT aes256-cbc hmac-sha1 Session started user1

1 2.0 IN aes256-cbc hmac-sha1 Session started user1

1 2.0 OUT aes256-cbc hmac-sha1 Session started user1

2 2.0 IN aes256-cbc hmac-sha1 Session started user1

2 2.0 OUT aes256-cbc hmac-sha1 Session started user1

3 2.0 IN aes256-cbc hmac-sha1 Session started user2

3 2.0 OUT aes256-cbc hmac-sha1 Session started user2

4 2.0 IN aes256-cbc hmac-sha1 Session started user2

4 2.0 OUT aes256-cbc hmac-sha1 Session started user2

5 2.0 IN aes256-cbc hmac-sha1 Session started user1

5 2.0 OUT aes256-cbc hmac-sha1 Session started user1

6 2.0 IN aes256-cbc hmac-sha1 Session started user1

6 2.0 OUT aes256-cbc hmac-sha1 Session started user1

7 2.0 IN aes256-cbc hmac-sha1 Session started user1

7 2.0 OUT aes256-cbc hmac-sha1 Session started user1

8 2.0 IN aes256-cbc hmac-sha1 Session started user1

8 2.0 OUT aes256-cbc hmac-sha1 Session started user1

9 2.0 IN aes256-cbc hmac-sha1 Session started user1

9 2.0 OUT aes256-cbc hmac-sha1 Session started user1

10 2.0 IN aes256-cbc hmac-sha1 Session started user1

10 2.0 OUT aes256-cbc hmac-sha1 Session started user1

11 2.0 IN aes256-cbc hmac-sha1 Session started user1

11 2.0 OUT aes256-cbc hmac-sha1 Session started user1

12 2.0 IN aes256-cbc hmac-sha1 Session started user1

12 2.0 OUT aes256-cbc hmac-sha1 Session started user1

13 2.0 IN aes256-cbc hmac-sha1 Session started user1

13 2.0 OUT aes256-cbc hmac-sha1 Session started user1

14 2.0 IN aes256-cbc hmac-sha1 Session started user1

14 2.0 OUT aes256-cbc hmac-sha1 Session started user1

15 2.0 IN aes256-cbc hmac-sha1 Session started user1

15 2.0 OUT aes256-cbc hmac-sha1 Session started user1

%No SSHv1 server connections running.

Router1#show line

Tty Line Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int

* 0 0 CTY - - - - - 2 1 0/0 -

1 1 AUX 9600/9600 - - - - - 0 0 0/0 -

2 2 TTY 9600/9600 - - - - - 9 0 0/0 -

* 132 132 VTY - - - - 101 14 0 0/0 -

* 133 133 VTY - - - - 101 10 0 0/0 -

* 134 134 VTY - - - - 101 5 0 0/0 -

* 135 135 VTY - - - - 101 4 0 0/0 -

* 136 136 VTY - - - - 101 2 0 0/0 -

* 137 137 VTY - - - - 101 8 0 0/0 -

* 138 138 VTY - - - - 101 14 0 0/0 -

* 139 139 VTY - - - - 101 5 0 0/0 -

* 140 140 VTY - - - - 101 4 0 0/0 -

* 141 141 VTY - - - - 101 2 0 0/0 -

* 142 142 VTY - - - - 101 4 0 0/0 -

* 143 143 VTY - - - - 101 2 0 0/0 -

* 144 144 VTY - - - - 101 2 0 0/0 -

* 145 145 VTY - - - - 101 2 0 0/0 -

* 146 146 VTY - - - - 101 2 0 0/0 -

* 147 147 VTY - - - - 101 10 0 0/0 -

Line(s) not in async mode -or- with no hardware support:

3-131

Router1#show tcp brief | i \.22_

319FCE3C 100.9.1.5.22 10.9.200.28.1903 ESTAB

2901D1E8 100.9.1.2.22 10.9.200.28.2526 FINWAIT1

301631E4 100.9.1.2.22 10.9.200.28.2486 ESTAB

29353A80 100.9.1.5.22 10.9.200.28.2735 ESTAB

28F53880 100.9.1.5.22 10.9.200.28.4035 ESTAB

293533DC 100.9.1.5.22 10.9.200.28.2293 ESTAB

28F408FC 100.9.1.2.22 10.9.200.28.3871 ESTAB

2933B460 100.9.1.2.22 10.9.200.14.8725 ESTAB

28F60DC8 100.9.1.5.22 10.9.200.28.2365 ESTAB

315D3BC0 100.9.1.5.22 10.9.200.28.2819 ESTAB

2934BD88 100.9.1.2.22 10.9.200.28.3128 ESTAB

31904740 100.9.1.2.22 10.9.200.14.8692 ESTAB

2901C298 100.9.1.5.22 10.9.200.28.3874 ESTAB

315D4264 100.9.1.5.22 10.9.200.28.3629 ESTAB

3151B7A4 100.9.1.2.22 10.9.200.28.2639 FINWAIT1

It seems all VTY lines have been used and for somehow system did not end those idle sessions although exec-timeout has been set.

Solution:

1. Clear line

Router2#clear line vty 0

[confirm]

[OK]

2. Set ssh time-out

ip ssh time-out 30

3. set absolute-timeout

line vty 0 15

absolute-timeout 15

4. Using service tcp-keepalives to Avoid Hung Telnet Sessions

http://www.cisco.com/en/US/tech/tk801/tk36/technologies_tech_note09186a00801365f3.shtml

"If, however, Router 2 is reloaded for any reason, the terminal will not be able to get back into the server. Upon attempting to activate the connection, the user will see a "Connection refused by remote host" message. This message appears because the server believes that the previous telnet session is still connected, thus blocking a new session."

Router1# config term
Router1(config)# service tcp-keepalives-in
Router1(config)# service tcp-keepalives-out
Router1(config)# end

Pages

Friday, May 10, 2013

BGP Command : soft-reconfiguration inbound & soft in

Wednesday, May 8, 2013

Find out Linux CPU Utilization on Checkpoint Firewall

Monday, May 6, 2013

Check Cisco Device Interface Throughput with load-interval Command

Sunday, May 5, 2013

VRRP and Object Tracking

Tuesday, April 30, 2013

Why Cisco Devices refused SSH connection

Symptoms:

Solution:

1. Clear line

2. Set ssh time-out

3. set absolute-timeout

4. Using service tcp-keepalives to Avoid Hung Telnet Sessions