RADIUS requests/responses

tcpdump –i eth0 port 1812

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

To capture the packets:-

tcpdump –i eth0 –s 0 –w capture.pcap (End capture with “Control+C”)

NAC Device Help (type nachelp):

Extreme Networks NetSight NAC Device Help
/var/log/tag.log                – NAC Log File
/var/log/syslog                 – System Log File
/var/log/message                – System Info
/var/log/radius/*               – RADIUS Logs
/var/log/squid/*                – Squid Logs
/etc/resolv.conf                – DNS Configuration

nacdb                           NAC Database Script
naccapture                      Protocol-specific packet capture
nacstatus                       General NAC Appliance Status
nacreinitializedb               Deletes NAC database, restarts appliance
nacconfig                       Configures Network
nacradiuslogging enable|disable Enable/disable NAC RADIUS logging
nacctl start|stop|restart       Start/stop/restart NAC processes
aglsctl start|stop|restart      Start/stop/restart agentless assessment
/opt/nac/configMgmtIP <ip>      Set management server IP address

CTRL+ALT+<F1-F4> provides access to multiple login shells.

NAC Troubleshooting Tips:

https://gtacknowledge.extremenetworks.com/articles/How_To/NAC-Troubleshooting-Tips-Debug-methodology-for-Authentication-issues/?q=nac+tips&l=en_US&fs=Search&pn=1

Common Trace examples:

https://gtacknowledge.extremenetworks.com/articles/How_To/NAC-Troubleshooting-Tips-common-tcpdump-commands-used-for-isolating-issue?q=nac+tips&l=en_US&fs=Search&pn=1

Switch-Port Information:

https://gtacknowledge.extremenetworks.com/articles/How_To/NAC-Troubleshooting-Tips-Debug-Methodology-for-Switch-Port-Information/?q=nac+tips&l=en_US&fs=RelatedArticle

WebView:

https://IP_CONTROL_APPLIANCE:8443   (admin/Extreme@pp)

XMC Show Support:

Administration>Diagnostics>Generate Show Support

Files stored in following folder…

/usr/local/Extreme_Networks/NetSight/appdata/ShowSupport

Data and Time:

Check the date and time by typing date command on CLI.

Note: Clock skews can affect authentication if the clock has drifted too far.

Add multiple show running config files into a folder and use Grep to pick out specific areas of interest that are hits in those files.

Results will include the files name where there is a match.

Useful Grep options:

grep -A 2 “interface loop” *
grep “ip-source-address” *
grep “ip route pref” *

-A After (2 lines)
-B Before
-i Case insensitive
-c Count
-r Recursive
-v Invert
-l Display filenames that match

* Wildcard for all files in current directory.

General Commands:

To exit vi and save changes: ZZ   or  :wq

To exit vi without saving changes: :q!

To enter vi command mode: [esc]

Inserting

r          replace character under cursor with next character typed

R         keep replacing character until [esc] is hit

i           insert before cursor

a          append after cursor

A          append at end of line

O          open line above cursor and enter append mode

:%s/original/replacement Replace original text with replacement text

:%s/original/replacement/g Replace all (/gc with confirmation)

Deleting

x           delete character under cursor

dd         delete line under cursor

dw        delete word under cursor

db         delete word before cursor

## Configure eth0 #
# vi /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=”eth0″
NM_CONTROLLED=”yes”
ONBOOT=yes
HWADDR=A4:BA:DB:37:F1:04
TYPE=Ethernet
BOOTPROTO=static
NAME=”System eth0″
UUID=5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03
IPADDR=192.168.1.44
NETMASK=255.255.255.0

## Configure Default Gateway #
# vi /etc/sysconfig/network

NETWORKING=yes
HOSTNAME=centos6
GATEWAY=192.168.1.1

## Restart Network Interface #

/etc/init.d/network restart

## Configure DNS Server #
# vi /etc/resolv.conf

nameserver 8.8.8.8      # Replace with your nameserver ip
nameserver 192.168.1.1  # Replace with your nameserver ip

Several references to an appliance created by GNS3 team for accessing the internet but could not find the appliance internet.gns3a template under marketplace on GNS3 website (also tried to bridge my loopback adapter to my Wifi using a Cloud which failed), but did manage to get internet access using the NAT cloud option.

Tested with VPCS (ip dhcp) / Firefox (enable dhcp) to get an IP address, DNS etc… and could ping public IP addresses and also resolve names to IP addresses.

Tip: As NAT cloud only has one interface add a generic Ethernet Switch to it in the topology, this way it is possible to use multiple end devices.

Can also add a firewall such as pfSense between the generic Ethernet Switch and the NAT cloud.

https://stackstorm.com/

https://exchange.stackstorm.org/

Network Essentials Pack:

sudo apt-get install build-essential libxml2-dev libxslt1-dev

st2 pack install network_essentials

Adding license:

curl -SsL -O https://stackstorm.com/bwc/install.sh && chmod +x install.sh
./install.sh –user=st2admin –password=Ch@ngeMe –version=2.6.0 –license=${EWC_LICENSE_KEY}

Action Reload:

st2ctl reload --register-actions 

http://thedataplumber.net/ifttt-for-the-network-awesome/

netstat -i

ifconfig

route -e

lspci

lspci | egrep -I –color ‘network|ethernet’

sudo apt-get install python-pip python-dev build-essential

sudo pip install –upgrade pip

sudo pip install –upgrade virtualenv

sudo -H pip install pyswitchlib

sudo apt-get install openssh-server

By default, all ports are set as untagged members of VLAN 1 with all ports configured as PVID = 1. Every VLAN is assigned a unique VLAN identifier (VID) that distinguishes it from all other VLANs. All incoming packets are assigned to VLAN 1 by the default port VLAN identifier (PVID =1). Untagged packets enter and leave the switch unchanged.

Untagged packets are marked (tagged) as they leave the switch through a tagged port, which is a tagged member of a VLAN. Untagged packets remain unchanged as they leave the switch through an untagged port, which is an untagged member of a VLAN.

VLAN Config Control on ERS

Specifies the VLAN configuration control options. The available options are:

• automatic—This selection automatically adds an untagged port to a new VLAN and automatically removes it from any previous VLAN membership. The PVID of the port is automatically changed to the VID of the VLAN it joins. Since the port is first added to the new VLAN and then removed from any previous membership, the Spanning Tree Group participation of the port is not disabled as long as the VLANs involved are in the same Spanning Tree Group.

• autopvid—This selection functions in the same manner as previous AutoPVID functionality. When an untagged port is added to a new VLAN, the port is added to the new VLAN and the PVID assigned to the new VID without removing it from any previous VLAN memberships. Using this option, an untagged port can have membership in multiple VLANs.

• flexible—This selection functions in a similar manner to disabling AutoPVID functionality. When this option is used, an untagged port can belong to an unlimited number of VLANs. Any new additions of an untagged port to a new VLAN does not change the PVID of that port.

• strict—The factory default, this selection restricts the addition of an untagged port to a VLAN if it is already a member of another VLAN. To add an untagged port to a new VLAN, the switch administrator must remove the port from all other VLANs of which it is a member before adding it to the new VLAN. The PVID of the port is changed to the new VID to which it was added.

Useful commands:

show tech

Note:

On VSP search output for MAC address with colon format XX:XX:XX:XX:XX:XX.

For ERS search with hyphen format XX-XX-XX-XX-XX-XX.

Fine tuning ERS buffers (leave as default or assess device distribution first):

qos agent buffer <regular | large | maximum>

With this command you can set how much of the buffer a single port can use:

Regular    1 port may use up to 16% of the buffers       for a group of 12 ports.
Large    1 port may use up to 33% of the buffers       for a group of 12 ports.
Maximum    1 port may use 100% of the buffers for a       group of 12 ports.

To take effect a change of the buffer value you have to reboot your ERS switch.