'가족이야기' 카테고리의 다른 글

우리집 덩치큰 강아지 '루피'  (0) 2018.10.18
들고양이 꼬시기  (0) 2017.08.13
자전거로 한강까지 도전  (0) 2017.08.08
카카오프랜즈  (0) 2017.08.08
벙개 휴가  (0) 2017.08.08
눈썰매  (0) 2015.01.26
Juniper Firewall Transparent mode config (Example)

Management
set interface vlan1 ip 1.1.1.1/24
set interface vlan1 manage web
set interface vlan1 manage telnet
set interface vlan1 manage ssh
set interface vlan1 manage ping

Interfaces
set interface ethernet0/1 ip 0.0.0.0/0
set interface ethernet0/1 zone v1-trust
set interface ethernet0/3 ip 0.0.0.0/0
set interface ethernet0/3 zone v1-untrust

V1-Trust Zone
set zone v1-trust manage web
set zone v1-trust manage telnet
set zone v1-trust manage ping

Addresses
set address v1-trust FTP_Server 1.1.1.5/32
set address v1-trust Mail_Server 1.1.1.10/32

Route
set vrouter trust-vr route 0.0.0.0/0 interface vlan1 gateway 1.1.1.250 metric 1

Policies
set policy from v1-trust to v1-untrust any any any permit
set policy from v1-untrust to v1-trust any Mail_Server mail permit

set policy from v1-untrust to v1-trust any FTP_Server ftp-get permit


Aruba Controller CLI

#show ip interface brief
#show ip route
#show port status
#show license
#aaa user delete all
#show running-config | include adp
#show user
#show user-table
#show ap active
#show ap database
#show ap essid
#show vpdn l2tp local pool
#show ap config ap-group ISD
#show crypto ipsec sa
#show crypto isakmp sa
# show datapath session | include 7.7.7.1
#clear gap-db ap-name AP1

Client Match 설정
#configure terminal
(config) # rf arm-profile default
(Adaptive Radio Management Profile "default")#cm-report-interval 30
(Adaptive Radio Management Profile "default")#cm-sticky-check-interval 3
(Adaptive Radio Management Profile "default")#cm-sticky-snr 25
(Adaptive Radio Management Profile "default")#cm-sticky-snr-delta 10
(Adaptive Radio Management Profile "default")#cm-sticky-min-signal 70
(Adaptive Radio Management Profile "default")#cm-steer-timeout 20
(Adaptive Radio Management Profile "default")#cm-lb-thresh 20
(Adaptive Radio Management Profile "default")#cm-stale-age 120
(Adaptive Radio Management Profile "default")#cm-max-steer-fails 5
(Adaptive Radio Management Profile "default")#cm-lb-client-thresh 10

(Adaptive Radio Management Profile "default")#cm-lb-snr-thresh 30


'업무이야기 > Aruba' 카테고리의 다른 글

Aruba Controller CLI  (0) 2018.05.08
Aruba Controller 초기 설정  (0) 2018.05.08
MAC 프로 root 비빌번호 설정 MAC / 운영체제



백북설치시 등록한 사용자는 관리자 권한이다. root user는 아니였음.

맥북에서 터미널을 실행하고 다음과 같은 Unix명령어를 쳐서 root 패스워드를 지정한다.

Mac:$> sudo -s (엔터를 치니 바로 bash-3.2# 이 프롬프트가 나온다. 패스워드 설정이 되지 않은 상태였음)

bash-3.2#> passwd root

Changing password for root.

New password: (여기서 원하는 root패스워드를 입력한다.)

Retype new password: (다시한번 입력하는 끝.)

bash-3.2#> exit (종료하고)
exit

Mac:$> su

Password: (입력한 root패스워드 입력)

sh-3.2# (맞으면 이 프롬프트로 떨어짐)

[출처] MAC 프로 root 비빌번호 설정|작성자 쭌쭈주준


## Aruba Controller 초기 설정

* 공장 초기화 설정
. 호스트 네임 : [aruba2400]
. 기본 접속 IP : [172.16.0.254]
. 넷마스크 : [255.255.255.0]
. 게이트웨이 IP : [none]
. 컨트롤러의 역활 : (master|local) [master]
. 국가코드 : KR
. 국가코드 재확인 : (yes|no)
. 시간대역 : GMT+9:0
. 현재시간 : [09:49:30]
. 현재날짜 : [6/2/2014]
. Admin패스워드 : (up to 32 chars)
. Admin패스워드 확인
. Enable패스워드
. Enable패스워드 확인
. Port Shutdown 여부 : (yes|no) [no] - 보안을 위해 ㅣ본적으로 모든 포트를 막을 것인지 여부

* Telnet Port : 2300

* AP 설정
apboot> location
apboot> ipaddr
apboot> netmask
apboot> gatewayip
apboot> serverip
apboot> master
apboot> group

apboot> purge
apboot>printenv

* AP Controller Configuration
1. Interface
- Configuration / controller / lookback Interface - 임의의 IP 설정
- Configuration / IP / VLANs Edit - Use the following IP Address 설정
- Configuration / VLANs - VLAN 생성 - Enable Inter-VLAN Routing [V]
- Configuration / Ports / Port Selection / Port Mode [Access], Vlan [Vlan ID]
- Configuration / Ports / Port Selection / Port Mode [Trunk], Allow VLANS 선택
- Configuration / Controller / Loopback IP Address - 삭제
- Configuration / IP / VLAN 선택 / Enable source NAT for this VLAN [V]
- IP / DHCP Server / Enable DHCP Server [V], 추가 - Pool name, 기타 등등

2. Authentication (RADIUS Server Profile)
- Configuration / Authentication / RADIUS Server / 추가 - Host(IP), Key(Preshare) 설정, Mode [V]
- Configuration / Access Control / Policies / 추가 - Policy Name 추가 / Add - 정책
- Configuration / Access Control / User Roles / 추가 -Role Name 추가 - Choose from Configured Policies에서 생성된 Policy 선택
- Configuration / Authentication / Server Group / 추가 / New - 인증 서버 선택, Server Rules - Condition [Filter-ID], Operation [Value-OF], Set [Set role] 추가 (인증서버 리턴값)
- Configuration / Authentication / Server Group / 수정 / Server Rules - Condition [Filter-ID], Operation [Equals] [test], Set [Set role], Value [authenticated] 추가Configuration / Authentication / Internal DB / Add User (Internal DB 계정 생성)

3. 802.1x
- Configuration / All Profiles / Wireless Lan / 802.1x Authentication / 새로운 항목 추가 / Advanced - Validate PMKID [V], Termination [V], Termination EAP Type [eap-peap], Termination Inner EAP-Type [eap-maschapv2]
- Configuration / All Profiles / Wireless Lan / AAA Profile / 새로운 항목 추가 / 802.1x Authentication / 802.1x Authentication Profile 선택
- Configuration / All Profiles / Wireless Lan / AAA Profile / 추가된 항목 / 802.1x Authentication Server Group - 802.1x Authentication Server Group [추가된 인증 서버 그룹]
- Configuration / All Profiles / Wireless Lan / AAA Profile / 추가된 항목 / RADIUS Accounting Server Group [인증 서버 선택]
- Configuration / All Profiles / Wireless Lan / SSID Profile / 새로운 항목 추가 / Network Name(SSID) [SSID], Network Authentication [WPA2], Encryption [AES]
- Configuration / All Profiles / Wireless Lan / Virtual AP Profiles / 새로운 항목 추가 / VLAN 선택, Band Steering [V]
- Configuration / All Profiles / Wireless Lan / Virtual AP Profiles / 추가된 항목 / AAA Profile - AAA Profile 선택
- Configuration / All Profiles / Wireless Lan / Virtual AP Profiles / 추가된 항목 / SSID Profile - SSID Profile 선택
- Configuration / All Profles / AP Configuration / AP Group / 새로운 항목 추가 후 Edit / Wireless Lan / Virtual APs / Virutal APS [신규로 생성된 Profile 선택]

- Configuration / AP Installation / AP 목록에서 선택 후 Provision / AP Parameters [생성된 AP 구룹 선택], Apply and Reboot


'업무이야기 > Aruba' 카테고리의 다른 글

Aruba Controller CLI  (0) 2018.05.08
Aruba Controller 초기 설정  (0) 2018.05.08

root@srx# set security log mode stream
root@srx# set security log format sd-syslog
root@srx# set security log source-address 10.10.10.2
root@srx# set security log stream securitylog category all
root@srx# set security log stream securitylog host 10.10.10.1
root@srx# set security log stream securitylog host port 514


When complete and a 'commit' is executed, and the configuration looks like this:

security {
log {
mode stream;
format sd-syslog;
source-address 10.10.10.2;
stream securitylog {
category all;
host {
10.0.10.1;
port 514;
}
}
}
}
set security log mode stream
set security log format sd-syslog
set security log source-address 10.10.10.2
set security log stream securitylog format sd-syslog
set security log stream securitylog category all
set security log stream securitylog host 10.10.10.1

set security log stream securitylog host 172.22.154.214 port 514


admin@PA-VM>configure
admin@PA-VM#set deviceconfig system ip-address 192.168.200.63 netmask 255.255.255.0 default-gateway 192.168.200.254 dns-setting servers primary 8.8.8.8


If you have every worked on any
Juniper Box with JUNOS CLI, you will feel at home when working on Palo
Alto Firewall Appliance....

Operational Mode and Configuration Modes

username@hostname> (Operational mode)

username@hostname> configure

Entering configuration mode

[edit]

username@hostname# (Configuration mode)


Moving between Modes

up—changes the context to one level up in the hierarchy.

Example:

[edit network interface] (network level)

@abce# up

[edit network]


username@hostname# (now at the network level)


top—changes context to the top level of the hierarchy.

Example:

[edit network interface vlan] (network vlan level)

username@hostname# top

[edit]

username@hostname# (now at network vlan level)


Changing modes

username@hostname# exit


Software Version, Mgmt Address etc.

dmin@PA-VM> show system info


Grep/Match

admin@PA-VM> show system info | match model

model: PA-VM


Find commands with following keyword

username@hostname# find command keyword hsm


Restart Appliance

>request restart system


Show Configuration Hierarchy

username@hostname# show network interface ethernet

ethernet {

  ethernet1/1 {

    virtual-wire;

  }

  ethernet1/2 {

    virtual-wire;

  }

  ethernet1/3 {

    layer2 {

    units {

      ethernet1/3.1;

    }

  }

}

ethernet1/4;

}

[edit]

username@hostname#


Configure IP Address to a given Port

IP address/netmask 10.1.1.12/24 to the Layer 3 interface for the Ethernet port ethernet1/4:

[edit]

username@hostname# set network interface ethernet ethernet1/4 layer3 ip10.1.1.12/24


Check pending changes (uncommitted)

username@hostname# check pending-changes


Saves a snapshot of the firewall configuration or the device state files

username@hostname# save config to savefile


Get Hw Address of Interfaces

show system state | match hwaddr


Routing Table

> show routing route


Show running-configuration

admin@PA-VM#show

Logs

admin@PA-VM> less mp-log  ? (you will see all possible logs)

Packet Capture:-

admin@PA-VM> debug dataplane packet-diag set log on 

admin@PA-VM> debug dataplane packet-diag set filter on


admin@PA-VM> debug dataplane packet-diag set filter match source <ip Address>

Removing Filters


If setting command shows two filters configured and we want to remove on of them, then we can use


admin@PA-VM> debug dataplane packet-diag clear filter <filter number>


Export pcap file


scp export filter-pcap from <file> to <SCP_serv>


Viewing Packet Hitting Filter in live mode


admin@PA-VM> view-pcap follow yes filter-pcap test1_capture 


Show Packet Capture Setting

admin@PA-VM> debug dataplane packet-diag show setting


Management Traffic Capture:-

Their Mgmt Interface is eth0

admin@PA-VM> tcpdump filter "dst 49.0.0.254"

Press Ctrl-C to stop capturing


tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

^C

11 packets captured

22 packets received by filter


0 packets dropped by kernel

admin@PA-VM> tcpdump filter "dst 49.0.0.254"

admin@PA-VM> view-pcap mgmt-pcap mgmt.pcap


Show all Sessions

>show session all


'업무이야기 > PaloAlto' 카테고리의 다른 글

Palo Alto Firewall Appliance PA-VM - Useful Commands  (0) 2018.05.08
1. VDOM enable
conf sys global
set vdom-admin enable
end

2. Create VDOM
conf vdom
edit test

3. VDOM mode setting
TP
conf vdom
edit test
conf sys setting
set opmode transparent
set manageip 10.10.10.1/32
end
end

4. Management Port setting
conf sys interface
edit mgmt
set vdom root
set ip 10.10.10.1/24
next
edit port1
set vdom test
next
edit port2
set vdom test
next
edit port4
set ip 192.168.12.1/24
set allowaccess ping https ssh snmp telnet
next
end

5. Sessins-sync setting
conf system session-sync
edit 1
set peerip 192.168.12.2
set syncvd test
next
end

6. HA setting
conf sys ha
set hbdev port3 100
set session-sync-dev port4
set hb-interval 4
set hb-lost-threshold 12
set ha-uptime-diff-margin 1
set session-pickup enable
set session-pickup-connectionless enable
set session-pickup-expectation enable
set session-pickup-nat enable
set standalone-config-sync enable
set override disable

end


'업무이야기 > Fortinet' 카테고리의 다른 글

FortiGate FGSP  (0) 2018.05.08
FortiAnalyzer CLI  (0) 2018.05.08
fortigate File reached uncompressed size limit  (0) 2018.05.08
FortiGate 점점 CLI  (0) 2018.05.08
How-to: Automate FortiGate configuration backups  (0) 2018.05.08
Scheduled Daily Reboot of FortiGate  (0) 2018.05.08
get system sql
diagnose sql status
diagnose sql show db-size
diagnose log device
diagnose sql process list
diagnose dvm device list
diagose fortilogd msgrate-device
diagose fortilogd lograte
get system performance
get system status

execute log device logstore list


'업무이야기 > Fortinet' 카테고리의 다른 글

FortiGate FGSP  (0) 2018.05.08
FortiAnalyzer CLI  (0) 2018.05.08
fortigate File reached uncompressed size limit  (0) 2018.05.08
FortiGate 점점 CLI  (0) 2018.05.08
How-to: Automate FortiGate configuration backups  (0) 2018.05.08
Scheduled Daily Reboot of FortiGate  (0) 2018.05.08
fortigate # config firewall profile-protocol-options
fortigate (profile-protocol~ons) # edit default
fortigate (default) # config smtp
fortigate (default) # set uncompressed-oversize-limit 5
fortigate (smtp) # get
ports : 25
status : enable
inspect-all : disable
options : oversize
oversize-limit : 10
uncompressed-oversize-limit: 5
uncompressed-nest-limit: 12
scan-bzip2 : enable

server-busy : disable


'업무이야기 > Fortinet' 카테고리의 다른 글

FortiGate FGSP  (0) 2018.05.08
FortiAnalyzer CLI  (0) 2018.05.08
fortigate File reached uncompressed size limit  (0) 2018.05.08
FortiGate 점점 CLI  (0) 2018.05.08
How-to: Automate FortiGate configuration backups  (0) 2018.05.08
Scheduled Daily Reboot of FortiGate  (0) 2018.05.08