Trending Topics

VMware on AWS - How to restore NSX DFW firewall rules to previous state

Image
Customers who uses NSX day-in, day-out would like to have a point-in time restore functionality of DFW firewall rules. Many customer have a large footprints in VMC and make changes to DFW quite often. This feature was missing for long time and we could see its included in recent versions . Let's see how DFW configuration roll back works  NSX DFW configuration has versioning, and it is stored in the NSX Manager.  Every time when someone update DFW configuration, NSX creates one more version but keep storing the previous ones. You can rollback for previous config but reapplying it once again.  You can find the options under Networking & Security tab , > Security > Distributed Firewall . In the right side we see an Actions drop down. Choose View to get to the below screen.  Let’s go through the use case:  1. Original state- default config with no custom rules:  a. There are no saved configurations during last 30 days: In my existing test setup, with the current setting

GVRP


·         Generic Attribute Registration Protocol (GARP) VLAN Registration Protocol (GVRP) is an application defined in the IEEE 802.1Q standard that allows for the control of VLANs.
·         GVRP runs only on 802.1Q trunk links.
·         GVRP prunes trunk links so that only active VLANs will be sent across trunk connections.
·         GVRP expects to hear join messages from the switches before it will add a VLAN to the trunk.
·         GVRP updates and hold timers can be altered.
·         GVRP ports run in various modes to control how they will prune VLANs.
·         GVRP can be configured to dynamically add and manage VLANS to the VLAN database for trunking purposes.

Configuring GVRP

GVRP is supported only on COS switches. GVRP will run only on 802.1Q trunk ports and is used primarily to prune traffic from VLANs that does not need to be passed between trunking switches. Use the following steps to configure GVRP.
1.      Enable GVRP globally:
COS set gvrp enable

2.      By default GVRP is not enabled for the switch. You must first enable GVRP on the switch before you can configure the 802.1Q ports for GVRP operation.
3.      Configure the port for 802.1Q operation:
COS set trunk mod/port [auto | desirable | on ] dot1q

4.      GVRP will run only on ports that are configured for 802.1Q trunking. See section "6-3: Trunking" for more information on trunking.
5.      Configure the port GVRP:
COS set port gvrp mod/port enable

6.      This command enables GVRP on the individual 802.1Q trunk port. GVRP must be configured on both sides of the trunk to work correctly.
7.      (Optional) Configure the port registration mode:
COS set gvrp registration [normal | fixed | forbidden] mod/port

8.      By default GVRP ports are in normal registration mode. These ports use GVRP join messages from neighboring switches to prune the VLANs running across the 802.1Q trunk link. If the device on the other side is not capable of sending GVRP messages, or if you do not want to allow the switch to prune any of the VLANs, use the fixed mode. Fixed mode ports will forward for all VLANs that exist in the switch database. Ports in forbidden mode forward only for VLAN 1.

Configuring GVRP for Dynamic VLAN Creation

Like VTP, GVRP can dynamically create VLANs on switches for trunking purposes. By enabling GVRP dynamic VLAN creation, a switch will add VLANs to its database when it receives GVRP join messages about VLANs it does not have.
1.      (Optional) Enable dynamic VLAN creation:
COS set gvrp dynamic-vlan-creation enable

2.      Dynamic VLAN creation is configured on a switch-by-switch basis. GVRP does not synchronize between switches, but only adds VLANs on devices that have dynamic creation enabled in order to pass traffic between trunks. To enable dynamic VLAN creation, all the trunk ports on the switch have to be 802.1Q and they all must be GVRP-enabled ports. If the switch has any non-802.1Q trunk ports or if the 802.1Q ports that exist are not configured for GVRP, this feature will not be enabled. VLANs will be added only for join messages received across a normal registration port. You must also have configured VTP in transparent or off mode, because VTP and dynamic VLAN creation cannot both be enabled at the same time.
3.      The trunk ports 15/1 and 16/1 on a 5000 or 6000 series switch do not count as ISL trunks when enabling dynamic-vlan-creation and will not prevent the function from operating.

Verifying GVRP Operation

After you have configured GVRP, use the following command to verify operation:
COS show gvrp configuration

Feature Example

In this example, the switch Access_1 is connected to Distribution_1 via an 802.1Q trunk Distribution_1 is also connected to Core_1 via an 802.1Q trunk. GVRP is enabled on both the distribution and core switches and on each GVRP port on those switches. Dynamic VLAN creation has also been enabled on the switches, and the port from Distribution_1 to Access_1 has been set to GVRP fixed mode because the Access_1 device will not send join messages and the distribution switch would prune all VLANs if it were in the normal default mode.
Network Diagram for GVRP Configuration on Access_1, Distribution_1, and Core_1
An example of the Catalyst OS configuration for Core_1 follows:
Core_1 (enable)>set vtp mode transparent
Core_1 (enable)>set trunk 1/1 on dot1Q
Core_1 (enable)>set gvrp enable
Core_1 (enable)>set port gvrp 1/1 enable
Core_1 (enable)>set gvrp dynamic-vlan-creation enable
An example of the Catalyst OS configuration for Distribution_1 follows:
Distribution_1 (enable)>set vtp mode transparent
Distribution_1 (enable)>set trunk 1/1 on dot1q
Distribution_1 (enable)>set trunk 2/1 on dot1q
Distribution_1 (enable)>set gvrp enable
Distribution_1 (enable)>set gvrp enable 1/1
Distribution_1 (enable)>set gvrp enable 2/1 
Distribution_1 (enable)>set gvrp registration fixed 2/1
Distribution_1 (enable)>set gvrp dynamic-vlan-creation enable
An example of the Layer 2 IOS configuration for Access_1 follows:
Access_1 #config t
Access_1 (config)#interface gigabitethernet 0/1
Access_1 (config-if)#switchport mode trunk
Access_1 (config-if)#switchport trunk encapsulation dot1Q
Access_1 (config-if)#end
Access_1#copy running-config startup-config

Popular posts from this blog

HOW TO EDIT THE BCD REGISTRY FILE

Image
The BCD registry file controls which operating system installation starts and how long the boot manager waits before starting Windows. Basically, it’s like the Boot.ini file in earlier versions of Windows. If you need to edit it, the easiest way is to use the Startup And Recovery tool from within Vista. Just follow these steps: 1. Click Start. Right-click Computer, and then click Properties. 2. Click Advanced System Settings. 3. On the Advanced tab, under Startup and Recovery, click Settings. 4. Click the Default Operating System list, and edit other startup settings. Then, click OK. Same as Windows XP, right? But you’re probably not here because you couldn’t find that dialog box. You’re probably here because Windows Vista won’t start. In that case, you shouldn’t even worry about editing the BCD. Just run Startup Repair, and let the tool do what it’s supposed to. If you’re an advanced user, like an IT guy, you might want to edit the BCD file yourself. You can do this
Read more

DNS Scavenging.

                        DNS Scavenging is a great answer to a problem that has been nagging everyone since RFC 2136 came out way back in 1997.  Despite many clever methods of ensuring that clients and DHCP servers that perform dynamic updates clean up after themselves sometimes DNS can get messy.  Remember that old test server that you built two years ago that caught fire before it could be used?  Probably not.  DNS still remembers it though.  There are two big issues with DNS scavenging that seem to come up a lot: "I'm hitting this 'scavenge now' button like a snare drum and nothing is happening.  Why?" or "I woke up this morning, my DNS zones are nearly empty and Active Directory is sitting in a corner rocking back and forth crying.  What happened?" This post should help us figure out when the first issue will happen and completely avoid the second.  We'll go through how scavenging is setup then I'll give you my best practices.  Scavenging s
Read more

AD LDS – Syncronizing AD LDS with Active Directory

Image
First, we will install the AD LDS Instance: 1. Create and AD LDS instance by clicking Start -> Administrative Tools -> Active Directory Lightweight Directory Services Setup Wizard. The Setup Wizard appears. 2. Click Next . The Setup Options dialog box appears. For the sake of this guide, a unique instance will be the primary focus. I will have a separate post regarding AD LDS replication at some point in the near future. 3. Select A unique instance . 4. Click Next and the Instance Name dialog box appears. The instance name will help you identify and differentiate it from other instances that you may have installed on the same end point. The instance name will be listed in the data directory for the instance as well as in the Add or Remove Programs snap-in. 5. Enter a unique instance name, for example IDG. 6. Click Next to display the Ports configuration dialog box. 7. Leave ports at their default values unless you have conflicts with the default values. 8. Click N
Read more