Whilst working with a customer recently, we encountered a situation recently where we were required to run a packet capture on a VCSA (vCenter Server appliance) version 6.0. Being a Linux appliance underneath, the tool to use is tcpdump, but by default tcpdump is not actually installed by default. There are a few steps you need to follow to get it installed. SSH into the VCSA which should get you to the standard appliance shell ...
On various engagements I am involved with, I often need to produce some code to add or delete objects from NSX-v. These objects in general are things like IP Sets, MAC Sets, Security Groups, Security Tags, Services, Service Groups, Security Policies and even deleting the FW rulebase itself. Until recently I was doing this manually as I was dealing with relatively small numbers of objects, however on a previous engagement I was working on a script to import up to 33,000 objects and when testing the script in a dev environment, we needed a way to go through and delete everything we had just imported and set it back to “defaults”. ...
When working on a customer site recently, it was discovered that the root account on the vRealize Operations Manager 6.0 server had been locked out. This is the process we used to unlock the root account. Open up a console session to the VM Press Alt + F1 and try to login as root You can see by the screenshot above that someone has tried many unsuccessful attempts to access the root account and subsequently it has been locked by the operating system. ...
Recently on a customer site we had a peculiar scenario where we were deploying a VM into a NSX environment via vRA and the operation was failing due to an unknown reason. However, we noticed that the IP address that vRA had allocated for the new VM was still responding to our pings even though the provisioning process had failed and the VM was never actually deployed…… so what was responding to our pings and where was it???? ...
Its well documented that the only way to configure syslog settings on NSX-v controllers is via the REST API. One of the things I find myself constantly doing over and over again on customer engagements is configuring syslog servers details on the NSX-v controllers, whether its because I am at a new client, or someone decides to change the destination for their syslog and we need to update them all. ...
The Broadcom bnx2x NIC driver for VMware ESXi when installed on a ESXi 5.5 host is often an overlooked component when working with VMware NSX. If you have one of the Broadcom NICs which supports VXLAN offload and uses the bnx2x driver, it is important to choose the correct driver version. Not all versions are created equal! If you look through the release notes provided with all versions of the bnx2x driver download on the VMware website, it will show you a full history of changes and enhancements made to the driver. ...
When logging is enabled on a Cisco ASA, it often logs way to much information and makes it difficult to troubleshoot when there are issues to be looked at. Below is a config that can be pasted into an ASA which will disable most “noisy” logs and leave you with the denies, and most other relevant logs. This config will cut down your logging considerably. asdm history enable logging enable logging facility 20 logging timestamp logging emblem logging standby logging console critical logging monitor debugging logging buffered informational logging trap informational logging asdm informational logging history alerts asdm history enable ! Build outbound TCP connection is not logged no logging message 302013 ! Teardown outbound TCP connection is not logged no logging message 302014 ! Build outbound UDP connection is not logged no logging message 302015 ! Teardown outbound UDP connection is not logged no logging message 302016 ! Build outbound ICMP connection is not logged no logging message 302020 ! Teardown outbound ICMP connection is not logged no logging message 302021 ! User accessed url is not logged no logging message 304001 ! Build dynamic TCP xlate is not logged no logging message 305011 ! Teardown dynamic TCP xlate is not logged no logging message 305012 ! Build local-host is not logged no logging message 609001 ! Teardown local-host is not logged no logging message 609002 ! Constructing * hash payload is not logged no logging message 715046 ! Processing * hash payload is not logged no logging message 715047 ! IKE keepalive message is not logged no logging message 715075 no logging message 715036 ! IKE decode message is not logged no logging message 713236
Its become quite a common occurance that I need to create encrytped zip files to send to clients, and it seems to be one of those things which I always have to Google to figure out how to do it. So to save me looking up Google all the time, I am posting it up here so I always know where to look for it. This command will create an encrypted zip file of all files in a folder, exlcuding those pesky hidden OSX ones that begin with a period (.) ...
Often when working in customer environments, there is a requirement to define security group members which are not virtual machines within the visualised environment. To achieve this, these security group members must be defined as an IP Set. The IP Set can then be included as an object in a security group. However, within the UI, it doesn’t show you all the non-vm members of a security group. ...
Whilst working on a vCloud Automation Center integration with NSX-v this evening, I noticed a strange error which had appeared in the logs in regards to the data collection for Network and Security Inventory. The Network and Security Inventory data collection was displaying the time the data collection last completed, which looked fine to me, as it was inline with what I was expecting, but the status was showing as Failed. ...