Autres systèmes réseau

Procédures pour les autres OS réseau

• Commandes de base MikroTik
• Configuration de base VyOS
• Aruba
• Hard Reset
• Perte du mot passe admin
• Initialisation & configuration basique
• vLAN & DHCP

Commandes de base MikroTik

Commandes principales

Navigation

Gestion de la configuration

Commandes de visualisation

Commandes de modification

Vlan

Services

DHCP

Monitoring (Graphiques)

Mises à jour & Mises à niveau

Bonus

L'administration est aussi possible via les logiciels The Dude et Winbox

Configuration de base VyOS

Brouillon

VyOS est un OS de routeur virtuel à placer dans une VM ou sur une petite 1u

Le lien de téléchargement de Vyos :
https://downloads.vyos.io/?dir=rolling/current/amd64

Configuration minimale

conf
set interfaces ethernet eth0 description WAN
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth1 description LAN
set interfaces ethernet eth1 address 192.168.2.1/24

set service dhcp-server shared-network-name dhcpproc authoritative
set service dhcp-server shared-network-name subnet 192.168.2.0/24 default-router 192.168.2.1
set service dhcp-server shared-network-name subnet 192.168.2.0/24 dns-server 192.168.2.1
set service dhcp-server shared-network-name subnet 192.168.2.0/24 range 0 start 192.168.2.10
set service dhcp-server shared-network-name subnet 192.168.2.0/24 range 0 stop 192.168.2.200

set nat source rule 99 description LAN2WAN
set nat source rule 99 outbound-interface eth0
set nat source rule 99 source address 192.168.2.0/24
set nat source rule 99 translation address masquerade

commit
save

Configuration simple

sudo dpkg-reconfigure keyboard-configuration # Tant qu'a faire, autant mettre le clavier en français...
conf

set interfaces ethernet eth0 address '192.168.1.253/24'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '192.168.2.1/24'
set interfaces ethernet eth1 description 'LAN'

set nat source rule 100 outbound-interface 'eth0'
set nat source rule 100 source address '192.168.2.0/24'
set nat source rule 100 translation address 'masquerade'

set service dhcp-server disabled 'false'
set service dhcp-server shared-network-name LAN authoritative 'disable'
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 default-router '192.168.2.1'
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 dns-server '192.168.2.1'
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 domain-name 'lan-interne'
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 lease '86400'
set service dhcp-server shared-network-name LAN subnet 192.168.2.0/24 start 192.168.2.128 stop '192.168.2.255'
set service dns forwarding cache-size '0'
set service dns forwarding listen-on 'eth1'
set service dns forwarding name-server '9.9.9.9'
set service dns forwarding name-server '1.1.1.1'
set service snmp community public authorization 'ro'
set service snmp community public network '192.168.2.0/24'
set service snmp community public network '192.168.1.0/24'
set service snmp contact 'Somebody <someone@somewhe.re>'
set service snmp listen-address 0.0.0.0 port '161'
set service snmp location 'Some hypervisor'
set service ssh port '22'

set system gateway-address '192.168.1.1'
set system host-name 'routeur-NAT'
set system login user vyos authentication plaintext-password 'un mot de passe, pour changer...'
set system login user vyos level 'admin'
set system ntp server '0.pool.ntp.org'
set system ntp server '1.pool.ntp.org'
set system ntp server '2.pool.ntp.org'
set system time-zone 'Europe/Paris'

set firewall all-ping 'enable'
set firewall broadcast-ping 'disable'
set firewall receive-redirects 'disable'
set firewall send-redirects 'enable'
set firewall source-validation 'disable'
set firewall syn-cookies 'enable'
set firewall twa-hazards-protection 'disable'

# On crée une règle pour autoriser les connexions http https et ssh a arriver depuis le WAN
set firewall name OUTSIDE-IN default-action 'drop'
set firewall name OUTSIDE-IN rule 10 action 'accept'
set firewall name OUTSIDE-IN rule 10 state established 'enable'
set firewall name OUTSIDE-IN rule 10 state related 'enable'
set firewall name OUTSIDE-IN rule 20 action 'accept'
set firewall name OUTSIDE-IN rule 20 destination port '80'
set firewall name OUTSIDE-IN rule 20 protocol 'tcp'
set firewall name OUTSIDE-IN rule 20 state new 'enable'
set firewall name OUTSIDE-IN rule 21 action 'accept'
set firewall name OUTSIDE-IN rule 21 destination port '443'
set firewall name OUTSIDE-IN rule 21 protocol 'tcp'
set firewall name OUTSIDE-IN rule 21 state new 'enable'
set firewall name OUTSIDE-IN rule 22 action 'accept'
set firewall name OUTSIDE-IN rule 22 destination port '22'
set firewall name OUTSIDE-IN rule 22 protocol 'tcp'
set firewall name OUTSIDE-IN rule 22 state new 'enable'

# On crée une règle pour autoriser les connexions déjà établies ainsi que ping ntp et ssh a se connecter au routeur
set firewall name OUTSIDE-LOCAL default-action 'drop'
set firewall name OUTSIDE-LOCAL rule 10 action 'accept'
set firewall name OUTSIDE-LOCAL rule 10 state established 'enable'
set firewall name OUTSIDE-LOCAL rule 10 state related 'enable'
set firewall name OUTSIDE-LOCAL rule 20 action 'accept'
set firewall name OUTSIDE-LOCAL rule 20 icmp type-name 'echo-request'
set firewall name OUTSIDE-LOCAL rule 20 protocol 'icmp'
set firewall name OUTSIDE-LOCAL rule 20 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 30 action 'drop'
set firewall name OUTSIDE-LOCAL rule 30 destination port '22'
set firewall name OUTSIDE-LOCAL rule 30 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 30 recent count '4'
set firewall name OUTSIDE-LOCAL rule 30 recent time '60'
set firewall name OUTSIDE-LOCAL rule 30 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 31 action 'accept'
set firewall name OUTSIDE-LOCAL rule 31 destination port '22'
set firewall name OUTSIDE-LOCAL rule 31 protocol 'tcp'
set firewall name OUTSIDE-LOCAL rule 31 state new 'enable'
set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
set firewall name OUTSIDE-LOCAL rule 40 destination port '161'
set firewall name OUTSIDE-LOCAL rule 40 protocol 'udp'
set firewall name OUTSIDE-LOCAL rule 40 state new 'enable'

set interfaces ethernet eth0 firewall in name 'OUTSIDE-IN'
set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'

commit
save

Script de sauvegarde de configuration

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template

run show configuration commands > $HOME/$(date +%Y%m%d)-$(hostname)-vyos.conf.txt

Aruba

A été utilisé un Aruba S2500-24p-4x10g

Hard Reset

Au niveau de l'écran LCD

• Allez dans le menu Maintenance et sélectionnez "Factory Default"
• Effectuer via le menu le reboot du switch

Information de login par défaut

admin/admin123

Perte du mot passe admin

En console

Utilisateur: mot de passe
Mot de passe: forgetme!
(Aruba) > activer
Mot de passe: activer
(Aruba) #configure terminal entrez les commandes de configuration, une par ligne. Fin avec CNTL/Z
Aruba) (config) #mgmt-User Admin mot de passe root: < new admin password >
Re-tapez mot de passe: < new admin password >
(Aruba) (config) #exit
(Aruba) #exit
(Aruba) > Exit

Utilisateur: admin
Mot de passe: < new admin password >
(Aruba) > activer
Mot de passe: activer
(Aruba) #configure terminal entrez les commandes de configuration, une par ligne. Fin avec CNTL/Z
(Aruba) (config) #enable secret
Mot de passe: < new enable password >
Re-tapez mot de passe: < new enable password >
(Aruba) (config) #write mémoire

Initialisation & configuration basique

Notes pré installation :

Les câbles console de chez Cisco fonctionne très bien.

Configuration via GUI quick config

La mise en page sous IE est étrange, mais l'important est de pouvoir la valider la configuration basique.

Casser le staking présent par défaut

(ArubaS2500-24P) (config) #show interface brief

Interface Admin Link Line Protocol Speed/Duplex
--------- ----- ---- ------------- ------------
GE0/0/0 Enable Up Up 1 Gbps / Full
GE0/0/1 Enable Down Down N/A
GE0/0/2 Enable Up Up 100 Mbps / Full
GE0/0/3 Enable Down Down N/A
GE0/0/4 Enable Up Up 100 Mbps / Full
GE0/0/5 Enable Down Down N/A
GE0/0/6 Enable Up Up 100 Mbps / Full
GE0/0/7 Enable Down Down N/A
GE0/0/8 Enable Up Up 100 Mbps / Full
GE0/0/9 Enable Down Down N/A
GE0/0/10 Enable Down Down N/A
GE0/0/11 Enable Down Down N/A
GE0/0/12 Enable Down Down N/A
GE0/0/13 Enable Down Down N/A
GE0/0/14 Enable Down Down N/A
GE0/0/15 Enable Down Down N/A
GE0/0/16 Enable Down Down N/A
GE0/0/17 Enable Down Down N/A
GE0/0/18 Enable Down Down N/A
GE0/0/19 Enable Down Down N/A
GE0/0/20 Enable Down Down N/A
GE0/0/21 Enable Down Down N/A
GE0/0/22 Enable Down Down N/A
GE0/0/23 Enable Down Down N/A
GE0/1/0 Enable Down Down N/A
GE0/1/1 Enable Down Down N/A
MGMT Enable Down Down N/A

(ArubaS2500-24P) (config) # show stacking interface

stack1/2
--------
stack1/2 is administratively Enabled, link is Down, line protocol is Down
Speed: N/A, MTU: 9224 bytes, Link flaps: 0
Last update of counters: 0d 00:00:00 ago
Last clearing of counters: 0d 00:00:00 ago
Link status last changed: 0d 00:00:00 ago
Statistics:
Received 0 frames, 0 octets
0 pps, 0 bps
0 broadcasts, 0 runts, 0 giants, 0 throttles
0 error octets, 0 CRC frames
0 multicast, 0 unicast
Transmitted 0 frames, 0 octets
0 pps, 0 bps
0 broadcasts, 0 throttles
0 multicast, 0 unicast
0 errors octets, 0 deferred
0 collisions, 0 late collisions

stack1/3
--------
stack1/3 is administratively Enabled, link is Down, line protocol is Down
Speed: N/A, MTU: 9224 bytes, Link flaps: 0
Last update of counters: 0d 00:00:00 ago
Last clearing of counters: 0d 00:00:00 ago
Link status last changed: 0d 08:13:09 ago
Statistics:
Received 0 frames, 0 octets
0 pps, 0 bps
0 broadcasts, 0 runts, 0 giants, 0 throttles
0 error octets, 0 CRC frames
0 multicast, 0 unicast
Transmitted 0 frames, 0 octets
0 pps, 0 bps
0 broadcasts, 0 throttles
0 multicast, 0 unicast
0 errors octets, 0 deferred
0 collisions, 0 late collisions

(ArubaS2500-24P) (config) # delete stacking interface stack 1/2
(ArubaS2500-24P) (config) # delete stacking interface stack 1/3
(ArubaS2500-24P) (config) #show interface brief

Interface Admin Link Line Protocol Speed/Duplex
--------- ----- ---- ------------- ------------
GE0/0/0 Enable Up Up 1 Gbps / Full
GE0/0/1 Enable Down Down N/A
GE0/0/2 Enable Up Up 100 Mbps / Full
GE0/0/3 Enable Down Down N/A
GE0/0/4 Enable Up Up 100 Mbps / Full
GE0/0/5 Enable Down Down N/A
GE0/0/6 Enable Up Up 100 Mbps / Full
GE0/0/7 Enable Down Down N/A
GE0/0/8 Enable Up Up 100 Mbps / Full
GE0/0/9 Enable Down Down N/A
GE0/0/10 Enable Down Down N/A
GE0/0/11 Enable Down Down N/A
GE0/0/12 Enable Down Down N/A
GE0/0/13 Enable Down Down N/A
GE0/0/14 Enable Down Down N/A
GE0/0/15 Enable Down Down N/A
GE0/0/16 Enable Down Down N/A
GE0/0/17 Enable Down Down N/A
GE0/0/18 Enable Down Down N/A
GE0/0/19 Enable Down Down N/A
GE0/0/20 Enable Down Down N/A
GE0/0/21 Enable Down Down N/A
GE0/0/22 Enable Down Down N/A
GE0/0/23 Enable Down Down N/A
GE0/1/0 Enable Down Down N/A
GE0/1/1 Enable Down Down N/A
GE0/1/2 Enable Down Down N/A
GE0/1/3 Enable Down Down N/A
MGMT Enable Down Down N/A

Ajout d'un utilisateur

(ArubaS2500-24P) (config) #mgmt-user ?

<username> Name of the user (maximum 16 characters).
localauth-disable Disable Local authentication event if RADIUS
authentication timeout.
password-recovery-dis.. Disable recovery login
ssh-pubkey SSH login of management users by public key
authentication
webui-cacert CA Certificate used to sign management user's
certificate

(ArubaS2500-24P) (config) #mgmt-user nida ?

<rolename> Role name from one of the following:
root - super user role
guest-provisioning - guest provisioning role
network-operations - Network operator role
read-only - Read only role
location-api-mgmt - Location API Management Role

(ArubaS2500-24P) (config) #mgmt-user nida root
Password:***********
Re-Type password:**********

(ArubaS2500-24P) (config) #show mgmt-user

Management User Table
---------------------
USER PASSWD ROLE STATUS
---- ------ ---- ------
admin ***** root ACTIVE
nida ***** root ACTIVE

Jumbo Frames

(ArubaS2500-24P) (config) #show interface gigabitethernet 0/0/0

GE0/0/0 is administratively Up, Link is Up, Line protocol is Upq
Hardware is Gigabit Ethernet, Interface is GE0/0/0, Address is 00:0b:86:aa:a6:c2
Encapsulation ARPA, Loopback not set
Configured: duplex (Auto), Speed (Auto), FC (Off), Autoneg (On)
Negotiated: duplex (Full), Speed (1 Gbps)
Interface index: 1
MTU 1514 bytes

(ArubaS2500-24P) (config) #interface gigabitethernet 0/0/0
(ArubaS2500-24P) (gigabitethernet "0/0/0") #mtu ?

<mtu> Set MTU on interface between 64 and 9216

(ArubaS2500-24P) (gigabitethernet "0/0/0") #mtu 9216

(ArubaS2500-24P) (config) #show interface gigabitethernet 0/0/0

GE0/0/0 is administratively Up, Link is Up, Line protocol is Up
Hardware is Gigabit Ethernet, Interface is GE0/0/0, Address is 00:0b:86:aa:a6:c2
Encapsulation ARPA, Loopback not set
Configured: duplex (Auto), Speed (Auto), FC (Off), Autoneg (On)
Negotiated: duplex (Full), Speed (1 Gbps)
Interface index: 1
MTU 9216 bytes

 

Configuration SNMP v2

(ArubaS2500-24P) (config) #show snmp community

SNMP COMMUNITIES
----------------
COMMUNITY ACCESS VERSION
--------- ------ -------
Zer0t0uchpr0visi0ning READ_ONLY V1, V2C

(ArubaS2500-24P) (config) #hostname ArubaS2500-24P
(ArubaS2500-24P) (config) #syscontact monitoring
(ArubaS2500-24P) (config) #syslocation France
(ArubaS2500-24P) (config) #snmp-server community public
(ArubaS2500-24P) (config) #snmp-server enable trap
(ArubaS2500-24P) (config) #snmp-server host 192.168.1.205 community public
(ArubaS2500-24P) (config) #snmp-server engine-id ?

<engineid>      Engine ID of SNMP server in HEX (10-64 chars) eg.
                         800039e703000b86112233

(ArubaS2500-24P) (config) #snmp-server engine-id 800039e703000b86112233

Configuration SNMP v3

vLAN & DHCP

Création d'un vLan

(ArubaS2500-24P) (VLAN "4") #vlan 10
(ArubaS2500-24P) (VLAN "10") #description lab
(ArubaS2500-24P) (VLAN "10") #exit

Attribution d'une IP

(ArubaS2500-24P) (vlan "10") #ip address 172.16.255.250 255.255.0.0
(ArubaS2500-24P) (vlan "10") #mtu 1500
(ArubaS2500-24P) (vlan "10") #exit

Configuration du switching-profile pour le vLAN

(ArubaS2500-24P) (config) #interface-profile switching-profile vlan10-sw
(ArubaS2500-24P) (switching profile "vlan10-sw") #switchport-mode access
(ArubaS2500-24P) (switching profile "vlan10-sw") #access-vlan 10
(ArubaS2500-24P) (switching profile "vlan10-sw") #native-vlan 10
(ArubaS2500-24P) (switching profile "vlan10-sw") #exit

Application du vLAN à un port

(ArubaS2500-24P) (config) #interface gigabitethernet 0/0/0
(ArubaS2500-24P) (gigabitethernet "0/0/8") #switching-profile vlan10-sw
(ArubaS2500-24P) (gigabitethernet "0/0/8") #exit

Application du vLAN à un groupe de ports

(ArubaS2500-24P) (config) #interface-group gigabitethernet vlan10-grp
(ArubaS2500-24P) (gigabitethernet "vlan10") #apply-to 0/0/0-0/0/3
(ArubaS2500-24P) (gigabitethernet "vlan10") #trusted port
(ArubaS2500-24P) (gigabitethernet "vlan10") #no shutdown
(ArubaS2500-24P) (gigabitethernet "vlan10") #switching-profile vlan10
(ArubaS2500-24P) (gigabitethernet "vlan10") #exit
(ArubaS2500-24P) (config) #exit
(ArubaS2500-24P) #write memory

Ajout ou suppression d'interface à un vLAN

(ArubaS2500-24P) (gigabitethernet "vlan10") #apply-to [add | remove] <interface-list>

DHCP