So I thought I would have this lab ready by now...

But obviously, that won't be quite ready today. Spinning up 2 CUCM clusters, to set parameters on the SIP trunks and make a LUA scripting post... I also hit a really nice BUG with FIPS on 14 SU2, haven't confirmed it's on SU1, and working on that in a production environment has taken up more time than I like to admit.

Update, we have both call managers stood up, it will be an A side to B side across a trunk from Jabber clients injects and parsing key value pairs via LUA.

LUA Scripting... Labbing... Moved... Long time no see.

So it's been ages since I posted last, and covid and a great many things happened. Lest we shall blissfully ignore this all and go back to collabing. So recently I had to implement a LUA script that takes custom headers from an IVR and passes them as such, they are key value pairs to the application. There are multiple transparency references out there, but once I have my lab back up, I will resume and test some implementation so I can properly document them. Unfortunately, everything I implemented was proprietary to their SaaS IVR.

So onto the labbing... the states of things:

\

Do take notice, it's not done and I am travelling for work for the next few weeks. Let's hope it goes better from here and the site when it comes to updates again. And oh yeah, labs shut down, what was the point of this site if no one can get their CCIE? Well, there's my excuse, bye!

Policy Based Routing on a Nexus

First of all, let's just admit, I am a collab guy, doing work on a Nexus is a foreign experience. While some things are intuitive not everything follows RFC's and the Nexus platform is a bit more restrictive.

First of all, to get PBR going, I had to change the hardware profile, since I have no intention of using QoS internally in my lab, I decided to steal from it:

hardware profile tcam region qos 0
hardware profile tcam region pbr 256

This then requires a reboot. 

After this is done and the pbr feature is enabled:
feature pbr

You can get into creating the route-maps.  However, unlike IOS devices you can only use permits in your acl's and then use a deny statement on the route map itself:

ip access-list PBR_DENY
statistics per-entry
10 permit ip any 192.168.1.0/24

ip access-list PBR_PERMIT
 statistics per-entry
 10 permit ip any any

route-map PBR_RULE pbr-statistics
route-map PBR_RULE deny 10
 match ip address PBR_DENY
route-map PBR_RULE permit 20
 match ip address PBR_PERMIT
 set ip next-hop 192.168.10.1

Google Domains, no API and a lot of collab edge sadness

Not that it's not something that can't be worked around, but I was enjoying using Google Domains' own name servers and not having to manage my own.  However, given the fact I use Let's Encrypt and I would rather not renew my own certs every 90 days and the fact you need A records for each SAN... well, I guess I have to spin up my own External DNS server.  Luckily, Google Domains use DNS SEC, so I will have to do that this weekend.

I found that my old ASA Let's Encrypt script was not perfect, I will also update that this weekend with more logical checks.  It will need to be ran as a sudoer as well, as there is some mkdir commands that need to happen.  I have gotten to a point, where I will test it as a cron job. 

In the mean time, someone has asked me to automate Windows Server 2016 installs for their lab, so I guess I will do that tonight.

I haven't been posting lately, because I am leading a game development team outside of work, studying for the lab and frankly, no clue where I have any time to do even this post.

Script to quickly create a pastable list of AD users in Powershell.

I might rewrite this in powershell at some point, but due to my familiarity with python, I tossed this together to create a pastable list of AD users for a collaboration lab environment spin up.  Hopefully this saves someone time.

#!/usr/bin/python3
list = ["John Doe", "Jane Doe"]
for fullName in list:
   nameList = fullName.split(" ")
   firstName = nameList[0]
   lastName = nameList[1]
   print("$Attributes = @{")
   print("    Enabled = $true")
   print("    ChangePasswordAtLogon = $false")
   print("    PasswordNeverExpires = $true")
   print("    UserPrincipalName = \"" + lastName.lower() + firstName[0].lower() + "@join.com\"")
   print("    Name = \"" + lastName.lower() + firstName[0].lower() + "\"")
   print("    GivenName = \"" + firstName + "\"")
   print("    Surname = \"" + lastName + "\"")
   print("    DisplayName = \"" + fullName + "\"")
   print("    Office = \"Remote\"")
   print("    Company = \"Company\"")
   print("    Department = \"Support\"")
   print("    Title = \"Test User\"")
   print("    City = \"New York\"")
   print("    State = \"New York\"")
   print("    AccountPassword = \"CHANGEME\" | ConvertTo-SecureString -AsPlainText -Force")
   print("}")
   print("New-ADUser @Attributes")
   print("Set-ADUser -Identity " + lastName.lower() + firstName[0].lower() + " -Add @{\"msRTCSIP-PrimaryUserAddress\" =\"sip:" + lastName.lower() + firstName[0].lower() + "@join.com\"}")
   print("")

Policy Based Routing on a Cisco Switch

While policy based routing is available on a great many Cisco switches, you will need the right firmware that supports it.  For my home lab, a 3560X is my main switch, it requires 15.1-15.3 to work, currently 15.2 has MD releases, which is what I used.  A quick show sdm prefer will output the features you have available, ensure ip routing is enabled as well.

Lastly, as far as creating an access list for policy based routing, ensure you deny your internal networks in the ACL prior to implementation or a lot of things won't work.

access-list 100 deny   ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 100 permit ip 192.168.1.0 0.0.0.255 any

This ACL will allow you to policy route all traffic that is external to a next hop.

Enjoy!

Vsphere 6.7 OVA issues.

In the new release of VMWare's Vsphere which is currently a release candidate you may get many OVA errors.  In many collaboration OVA's there are dual purpose sections where the XML portion may include a comma.  Currently, Vsphere will report errors when importing them, you need to copy the section entirely, remove the comma and have both.

This section will create errors:

      <Item ovf:configuration="CUCM_10000,CUCM_2500_small_disk">
        <rasd:AllocationUnits>hertz * 10^6</rasd:AllocationUnits>
        <rasd:Description>Number of Virtual CPUs</rasd:Description>
        <rasd:ElementName>4 virtual CPU(s)</rasd:ElementName>
        <rasd:InstanceID>1</rasd:InstanceID>
        <rasd:Reservation>7200</rasd:Reservation>
        <rasd:ResourceType>3</rasd:ResourceType>
        <rasd:VirtualQuantity>4</rasd:VirtualQuantity>
      </Item>
To fix:

      <Item ovf:configuration="CUCM_10000">
        <rasd:AllocationUnits>hertz * 10^6</rasd:AllocationUnits>
        <rasd:Description>Number of Virtual CPUs</rasd:Description>
        <rasd:ElementName>4 virtual CPU(s)</rasd:ElementName>
        <rasd:InstanceID>1</rasd:InstanceID>
        <rasd:Reservation>7200</rasd:Reservation>
        <rasd:ResourceType>3</rasd:ResourceType>
        <rasd:VirtualQuantity>4</rasd:VirtualQuantity>
      </Item>
      <Item ovf:configuration="CUCM_2500_small_disk">
        <rasd:AllocationUnits>byte * 2^20</rasd:AllocationUnits>
        <rasd:Description>Memory Size</rasd:Description>
        <rasd:ElementName>3072MB of memory</rasd:ElementName>
        <rasd:InstanceID>2</rasd:InstanceID>
        <rasd:Reservation>3072</rasd:Reservation>
        <rasd:ResourceType>4</rasd:ResourceType>
        <rasd:VirtualQuantity>3072</rasd:VirtualQuantity>
      </Item>

Now just do a sha1sum on the updated ovf, update the manifest and reimport it into your OVA.