Put a text file on router flash without file transfer

Say, you want to put a text-based file on a router's flash memory.  It could be a license file, a config file, or some scripts.

The 'regular' way is to use TFTP/FTP to transfer the file.  But it could be a problem in some circumstances.  For example:

1) You're accessing the router through a terminal server (console port).  There's no network connectivity between your PC and the router.
2) Firewall/security policy prevents TFTP/FTP from happening.

It would be great if Cisco IOS has a 'notepad' (or 'vi') so we can create/edit the file from IOS CLI.  But it has not.

Fortunately, Cisco IOS has tclsh.  You may use tclsh create a file in flash memory and write some text to it.

Router#tclsh
Router(tcl)#puts [open "flash:script.txt" w+] "Some sample text"
Router(tcl)#tclquit

Router#dir flash:
Directory of flash:/
2 -rwx 2072 Jan 9 2014 10:24:23 -06:00 multiple-fs
3 -rwx 676 Feb 28 1993 18:01:35 -06:00 vlan.dat
4 -rwx 3570 Jan 9 2014 10:24:23 -06:00 private-config.text
5 -rwx 16 Jun 9 2014 09:34:35 -05:00 script.txt
6 drwx 192 Feb 28 1993 18:06:36 -06:00 c2960-lanbasek9-mz.122-55.SE7
562 -rwx 7340 Jan 9 2014 10:24:23 -06:00 config.text

32514048 bytes total (18987520 bytes free)

Router#more flash:script.txt
Some sample text

Router#

 What if you want to create a file with multiple lines?  Just escape the 'enter' with '\n'.  For example:

Router(tcl)#puts [open "flash:script.txt" w+] "Line 1 \n Line 2 \n Line 3"

Hope this helps!

Ref: https://www.cisco.com/c/en/us/support/docs/ip/telnet/116214-technote-technology-00.html

Build a $30 Wireless Lab

One of the recent project has quite a lot wireless LAN stuff.  So I feel the urge to build a home lab.

To build a wireless LAN lab, you need at least two things - a WLC (Wireless LAN Controller) and some compatible APs (Access Points).

WLC was easy since you may download the virtual WLC (vWLC) software from cisco.com and throw it on VMware.

It's not that easy when it comes to AP.  There are so many different models from Cisco.  I want the one that I can test most (if not all) the features with, while not costing me a fortune.  After some research (both on cisco.com and eBay.com), I decided 1242AG is the one.  This is a not-so-old AP that has 802.11a/b/g frequency and support many enterprise WLAN features (such as FlexConnect).  Most importantly, it's pretty affordable.  I got two for $30 (free shipping) from eBay.  I ordered two in case I need to test the "roaming" feature.

It looks like this:

Two things to be aware of:
1) Make sure to order one with antennas.  Otherwise it'll cost you some extra bucks.
2) They are mostly POE.  So you'll need a POE switch or power adapter.  You may get a cheap POE switch for less than $20.  But those switch won't support VLAN trunking, just FYI.

Luckily I still have my 3750G POE switch sitting around (from my CCIE voice lab).  Now I have to design the network.

In case you don't know, in real-life enterprise WLAN, they usually use DHCP option 43 to deliver the WLC IP address to APs.  I'd like to do the same in my lab.

But my Linksys router doesn't have the capability to configure DHCP options.  Thus I need to set up a another DHCP server.  How may I set up a secondary DHCP server while not interfering with the primary one?  The answer is to put them into different VLAN/subnets.

Here's my network design:

My Linksys home router connects to 3750 switch VLAN 1.  The two APs connect to 3750 switch VLAN 3.

3750 configuration:

ip dhcp excluded-address 192.168.3.1 192.168.3.10
!
ip dhcp pool Wireless-Lab
   network 192.168.3.0 255.255.255.0
   default-router 192.168.3.1
   option 43 hex f104.c0a8.0216
!
interface Vlan1
 ip address 192.168.2.1 255.255.255.0
!
interface Vlan3
 ip address 192.168.3.1 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 192.168.2.100
!
interface GigabitEthernet1/0/1
 description Linksys Router
!
interface GigabitEthernet1/0/2
 description AP-1
 switchport access vlan 3
!
interface GigabitEthernet1/0/3
 description AP-2
 switchport access vlan 3

Linksys configuraiton:

Now you should be able to ping from home PC (VLAN1) to VLAN 3 and vice versa.

On the vWLC virtual machine, I set the NIC to bridge network so I can configure a static IP in my home network segment (I used 192.168.2.22).

Now you should be able to open a web page to the vWLC management portal.  Also, you should be able to ping from the vWLC (192.168.2.22) to VLAN3 (192.168.3.1) and vice versa.

In theory, when I plug the APs to the switch, they should:
1) Power up
2) Get their IP address and the vWLC's IP address (via option 43 from DHCP)
3) Join the WLC

Well, not surprisingly, they didn't work as desired.  (if they did, there will be not much value for CCIEs)

As a WLAN newbie, I went for documents, turned on debug, capture error messages, post questions on Cisco support forum.  After spent quite some time on troubleshooting, I was advised to upgrade the IOS (does that sound familiar?)

There are many different software, tools and procedures regarding AP upgrade:

• Autonomous vs. Lightwight vs. Recovery
• TFTP vs. Upgrade Tool
• etc.

After many trial and err, here are my conclusions:
1) Upgrade to the latest IOS version before you troubleshoot
2) All you need is a TFTP server.  Don't use "upgrade tool"

High-level recovery(upgrade) process:
1) When the AP boots into recovery mode, it'll set its own IP address to 10.0.0.1 and search for TFTP server in the range of 10.0.0.2 - 10.0.0.30.
2) If it found one, it'll try to download the "default" image.  File name of the "default" image depends on the AP model.  For 1242AG, the default image file name is "c1240-k9w7-tar.default".
3) If the above file is found on TFTP, AP will download and install it.  Then reboot with that image.

Now you have a high-level view, let's talk about the details and catchas.

1) How to put a AP into recovery mode
Power off the AP.  Hold the "mode" button.  Plug in the power (POE or Power Adapter).  Now the status LED will be orange.  Keep holding the button for about 30 seconds.  You'll see the status LED turned purple.  That means the AP is in recovery mode.  You may release the button.

2) What TFTP server to use
You need a TFTP server that can customize the timeout threshold.  Cisco recommends 30 seconds timeout.  I set it to 60 just in case.

3) What IP address to configure for the TFTP server
You may use any IP in the range of 10.0.0.2 - 10.0.0.30.  I normally use 10.0.0.2.  If you got a "IP Conflict" message, just pick another one.

4) What IOS image I should download
There are three different IOS images you can download:
Autonomous Image (e.g. c1240-k9w7-tar.124-25d.JA2.tar)
Lightweight Image (e.g. c1240-k9w8-tar.124-25e.JAO3.tar)
Recovery Image (e.g. c1240-rcvk9w8-tar.124-25e.JAO3.tar)

You'll ultimate goal is to upgrade to the latest lightweight image (that's the image who can work with a WLC).  But you might need to flash the AP with other images first in some situations (e.g. when your AP has a very very old firmware).

When AP joins a WLC, it'll compare its IOS version and the ones on the WLC.  If there's any discrepancy, it'll download and use the one from WLC.  This is similar to IP phones download firmware from CallManager during registration.

Because of that, it's recommended to put the recovery image on AP in recovery mode.  The recovery image is a small footprint image that boot up the AP, provide network function so the AP can download the latest IOS from WLC.

5) How do I make the AP take the image I specified?

Remember that AP will only take a "default" image with specific file name in recovery mode.  If you want AP to take the image, you'll need to rename it to the specific file name.  See this link for naming conventions: http://www.cisco.com/c/en/us/td/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html#wp160918

Be aware that Windows normally hide the file extensions.  You need to configure Windows Explorer to show file extension so you can name the file correct.

For example, you want to rename c1240-rcvk9w8-tar.124-25e.JAO3.tar to c1240-k9w7-tar.default.  By default, Windows explorer will display "c1240-rcvk9w8-tar.124-25e.JAO3" as the file name.  If you rename it to "c1240-k9w7-tar.default" in Windows Explorer, the file name actually becomes "c1240-k9w7-tar.default.tar", which is NOT correct.

If AP successfully joined a WLC, you'll see something like this:

For troubleshooting, take a look at http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99948-lap-notjoin-wlc-tshoot.html

Enjoy your $30 wireless lab.  :)

IOU Web

Lately I had to recreate a MPLS network.  I used to use GNS3 as it's user friendly and can use vanilla IOS (i.e. you may download IOS from cisco.com and throw it into GNS3).  GNS3 can also emulate other devices such as PIX, ASA, IDS, Juniper, and even a host (with simple ping command).

GNS3 is almost perfect except for performance.  With a couple routers turned on, GNS3 is pegging about 90% of the CPU. So I look for alternatives.

IOU (IOS on Unix) is a Cisco-Internal-Only tool that emulate IOS devices.  It has quite a few drawbacks:

• Cisco Internal Only
• Has to run proprietary IOS
• Not user friendly - You'll have to build your network topology from a text editor instead of drag-and-drop.  You'll have to do a lot of thing from Unix/Linux command line.

However, IOU has one, big advantage - performance.  You may run tens (if not hundreds) of routers at the same time with minimal CPU/memory consumption.

Drawback #1 and #2 are no longer problems in the era of Google.  For #3, Andrea Dainese built "IOU Web" - a web interface to manage labs on IOU.

Just think of IOU as a back end process running on Linux.  'IOU Web' is the front end interface.  Like "CallManager Service" is the back end and "CCMAdmin web" is the front end.

One other thing I like about IOU Web is - you may make your own 'clickable' network diagrams.  You make your own network diagram, save it as jpg, make the routers/switches clickable.  When you click on a router on the drawing, it'll open up a telnet session to that router.

You may also copy the lab content (in rich format) and paste it into the 'Description' tab.  Then edit it the way you like.  Very convenient on building your home lab (and carry it anywhere you go).

Running UC Labs on a laptop

Not everyone has the luxury of running a Cisco UCS server at home.  Even if you do, it's a little bit heavy to drag the UCS around.  It would be convenient to have the UC lab built on your laptop.

I myself am using VMware Workstation 9.0.2 on a ThinkPad T430 with 16G RAM/1TB HDD.  Some of the laptops (such as ThinkPad W-series) allow you go for 32G RAM, which is really helpful if you need to run multiple boxes (such as UCM, UCCX, UCXN, CUPS, CER, AD) at the same time.

Personally, I prefer creating the VM spec myself instead of importing the OVA file from Cisco.  Some of the spec in OVA doesn't make sense in a lab environment.  (For example, what good would it do to have 2 vCPU in the VM while you're running it on a laptop?)

For the VM hard drive, I always use thin provisioning and use one single file.

For VM network, I'd prefer "host-only network" unless you have other external components need to talk to the UC lab.

Depending on your UC version, you might run into strange problems that the UC box can't ping anywhere in "host-only network" (not even the VMs in the same network).  For example, I ran into this problem with UCCX 8.5.1 while UCM 8.6.2 was fine.  The solution is to upgrade VMTools on the UC box.

In later versions, NTP and DNS become mandatory.  You may set up those on your Windows 7 desktop (your host OS), so you don't need a dedicated Windows server to do that.  For NTP, it's built in Win7.  Just follow the procedure on  http://htluo.blogspot.com/2009/02/ntp-network-time-protocol.html.  For DNS, you may google for some freeware or shareware.

In a "host-only network", you have the option to have a host adapter connects to the network.  So you may connect to the UC boxes from your host OS (e.g. run CIPC from your Win7 desktop).  By default, the "host-only network" is in the 192.168.130.0 network (or a random class-C in the 192.168 range).  You may change it.  You may also change the host adapter (default is VMnet1) IP address.  If the change didn't seem to take effect, please check the 'Advanced' button in the TCP/IP bindings.  You might have multiple IP addresses bound to the VMnet1 adapter.

Correction to the Cisco UC rooting process

I got a lot of feedback regarding the problem after rooting Cisco UC products (CUCM/UCCX, etc.).  The symptom was that every service is in [STARTING] state and you get 'Database Communication Error' while trying to log into the GUI (as the 'A Cisco DB' service was not able to start).

It's strange as I never ran into any problem.  I reviewed the process today and ran some tests.  I think I found the problem.  There's an unnecessary section in the instructions:

For version 8.6 or later, Cisco use SeLinux for additional security.  You need the following:

vi /etc/pam.d/su, comment the following:
    #auth   sufficient      /lib/security/$ISA/pam_rootok.so debug
    #auth   required        /lib/security/$ISA/pam_wheel.so group=priviledged_grp

 This section was added to the blog based on a reader's feedback.  I didn't verify it myself and thought it wouldn't do any harm even if it's unnecessary.

Evidently, this unnecessary step broke the system.  If you already performed this, you may undo it by removing the # signs. So the two lines should read like this:

auth    sufficient      /lib/security/$ISA/pam_rootok.so debug
auth    required        /lib/security/$ISA/pam_wheel.so group=priviledged_grp

Reboot the system after making the changes.  View service status with command 'utils service list page'.  You should see 'A Cisco DB' service is [STARTED].  Wait for a while, other services should be in [STARTED] state.

I've removed the section from original post.  Sorry for the inconvenience caused.

Enterprise Licence Manager

Since from UCM 9.0, Cisco introduced ELM (Enterprise License Manager).  Instead of putting license files on UCM, CUC servers, now you put license files on a "License Server" (ELM).

This is similar to some other software manufacturers such as Microsoft's KMS, VMware's license server, etc.

The advantages are obvious:

• Have a centralized location to manage licenses for multiple servers/products (UCM, CUC, etc.)
• Having a single license pool makes it easier to allocate/relocate license.  For example, you decommissioned a UCM server and installed a new one.  In the past, you need to open a Cisco case to "rehost" the license (because of the change of license MAC).  Now you may do it yourself with ELM.

ELM comes with the UCM9 installation DVD.  You may install it as a standalone server or co-resident with UCM.  In a real enterprise environment, it makes sense to have a standalone ELM server.  So the ELM was not affected if you had to reinstall the UCM.

Please note that workflow has changed with this new architecture.  Before, you need the "license MAC" of the UCM server when requesting license.  Now, you need the "license request" of the ELM server.  With this workflow, you may request license without knowing the UCM's MAC address.

"license request" is the signature of ELM server.  Cisco uses this signature to encrypt the license file so it can only be decrypted by the requesting ELM (signature owner).

The request (signature) is encoded in Base64 format.  You may decode it with any Base64 decoder.

Don't be confused if you're still seeing scrambled characters after decoding.  As seen from screenshot above, the request consists of Cisco proprietary info (such as server ID) and a standard X.509 CSR.  Proprietary info are in binary format thus you won't be able to read it in plain text.  CSR is encoded in Base64 (yes, Base64 in Base64).  You may further decode the CSR if you're interested.  Just copy the text portion between "-----BEGIN CERTIFICATE REQUEST----- " and "-----END CERTIFICATE REQUEST----- ", then paste it into a CSR decoder.

Interesting enough, ELM uses PostgreSQL instead of UCM's Informix.  Use "su - postgres" to switch to postgres user so you can have access to the database.

In case you're not familiar with PostgreSQL, here are some commands you may use to get started:

psql : PostgreSQL command line interface
\l : List databases
\c : Connect to a database
\d : List tables
\d: Describe a table

You may use standard SQL statement to view or change the data in tables.  You may put the SQL statement in one line or multiple lines.  Semicolon(;) is a special character to trigger the execution of the SQL statement.  You may put the semicolon at the same line of the SQL statement or a different line.

is the same as

Perl Script For Subtitle Conversion

This has nothing to do with Unified Communications.  But I don't have another blog for video editing.  Thus I post it here for anyone who needs it.

I've been using SVDTS plugin for Sony Vegas Pro to export the timecode from AVCHD video (.mts) to a subtitle file.  Having the timecode as a subtitle gives you the flexibility to turn it on or off at will.  If the timecode was "burned in", it'll display on the screen all the time.

With subtitle on:

With subtitle off:

However, the SVDTS plugin exports subtitle in Sony DVD Architect format, which is not a recognized format for other software (such as Corel VideoStudio, Adobe Premiere Pro, etc.).  It'd be better if it was in SubRip (.srt) format, which is more popular and well recognized.

DVD Architect format:

SubRip format:

Perl is the perfect tool for this kind of task:

if ($#ARGV != 1) {
  print "\nUsage: perl sub2srt.pl sub_filename srt_filename\n";
  exit;
 }

if (-e $ARGV[1]) {
  print "\nFile $ARGV[1] already exists!\n";
 }

open (SubFile, "< $ARGV[0]") or die "Couldn't open $ARGV[0] for reading: $!\n";
open (SrtFile, "> $ARGV[1]") or die "Couldn't open $ARGV[1] for writing: $!\n";

my($n) = 1;    #SRT subtitle index

while () {
  next if /^$/;    #Skip blank lines
  my($line) = $_;
  my($start) = substr($line, 5, 8);
  my($end) = substr($line, 17, 8);
  my($content) = substr($line, 29);
  print SrtFile "$n\n";
  print SrtFile "$start,000 --> $end,000\n";
  print SrtFile "$content\n";
  $n++;
 }

close (SubFile);
close (SrtFile);

 Save above codes as sub2srt.pl.  The command line syntax is "perl sub2srt.pl myfile.sub myfile.srt".