Simple ISATAP setup

Here We have enabled ISATAP in our network to enable clients to access Internet through IPv6 communication. We have used the Cisco 2821 router as the ISATAP server and enabled Windows 7/ Windows XP clients to make tunnels with the ISATAP router (Which is the Cisco 2821 router) and get assigned a global IPv6 address.




The diagram shows an overview of the network.


Enabled ISATAP in cisco

configure terminal
!
interface Tunnel 100
ip address 2001:df0:17:8ff::/64 eui-64
no ipv6 nd suppress-ra
tunnel source 192.248.8.125
tunnel mode ipv6ip isatap
!

The ip address is the IPv6 IP address block that you are going to assign to the ISATAP clients. The first 64 bit will be the block that you define here and the remaining 64 bits will be filled as given in the RFC 5214

Use following commands to check the the status of the tunnel interface

show ip interface tunnel 100
show ipv6 interface tunnel 100

Configuring Windows 7/ XP clients

As Windows 7 is inheritance IPv6 enabled, following commands will enable the ISATAP tunnel according to the setup;

Enabling ISATAP interface

netsh interface isatap set state enabled

Check the default router settings

netsh interface isatap show router

Set the ISATAP router
netsh interface isatap set router isatap.abc.lk

Enable ISATAP in WindowsXP

First IPv6 should be enabled in the host OS using following commands

netsh interface ipv6 install

OR

you can install IPv6 using the GUI in following manner

• Open Network Connections
• Right-click any local area connection, and then click Properties.
• Click Install.
• In the Select Network Component Type dialog box, click Protocol, and then click Add.
• In the Select Network Protocol dialog box, click Microsoft TCP/IP version 6, and then click OK.
• Click Close to save changes to your network connection.

Reference http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_ip_v6_pro_inst.mspx?mfr=true

After installing ipv6, the host is automatically enabled for isatap and 6to4 tunneling

To enable ISATAP interface and router use following commands

netsh interface ipv6 isatap set state enabled
netsh interface ipv6 isatap set router isatap.mrt.ac.lk

After setting the router, host will communicate with the router and get assigend ipv6 address from the isatap router
The ipv6 address assiged to the isatap interface has a direct relationship with the ipv4 address of the host.

Enable ISATAP in Ubuntu

The Ubuntu versions we have tested is 10.04 LTS

The isatapd deamon should be installed from apt-get install command and start the daemon with the ISATAP router parameters;

isatapd -r isatap.abc.lk &

The Ipv6 communications can be monitored using tcpdump -n ip6 command;

Following given is an observation of IPv6 communication

tcpdump -n ip6

Good references:
http://www.ciscosim.net/ipv6-transition-mechanisms-part-4-isatap-tunnels/9.html
http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-tunnel.html#wpxref21012
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_ip_v6_pro_inst.mspx?mfr=true
http://measureofchaos.blogspot.com/2011/03/isatap-setup-on-windows-clients.html

BIND and Openssl

In installing BIND latest versions which has DNSSEC inbuilt support, Openssl is a pre-requirement. You can disable openssl by using the option --without opessl but it will disable the DNSSEC support of your DNS server.

When I tried to install the latest bind-9.7.3-P3 from the source, in the compilation stage I got the following error;

checking for OpenSSL... configure error "/usr/bin/openssl/include/openssl/opensslv.h" not found


I checked for openssl and found that it is available at /usr/bin. I tried to update/install openssl using 'yum' but failed with following message
Package openssl-1.0.0b-1.fc13.x86_64 already installed and latest version

Later I found 'opensslv.h' is available with openssl development package and I installed it with the command

yum install openssl-devel

It installed the required libraries for bind and I was able to compile and install bind-9.7.3-P3

Send Nagios Status Reports through a Cron Job

It will be useful for the managers to get a summarized status report of the system daily. This can be achieved through following script . The script should be listed in the crontab to execute in daily basis.

Steps (Commands should be written to the script file)

1. Generate the html version of the report automatically.
wget -v --user nagios_user --password 'password' --no-check-certificate -O ./`date +%Y%m%d`-report.html "https://your_nagios_server_URL/nagios/cgi-bin/avail.cgi?show_log_entries=&host=Host1&service=all&timeperiod=yesterday&timeperiod=24x7"

Here replace nagios_user with whoever the user having privileges to generate status report and 'password' with his password, Host1 to the host name that you want to generate report. It is better to run the command separately and check whether you are getting the html file correctly. If everything is fine you will get a a html report with the date
i.e. 20110627-report.html

If you have no idea how to get the https:// .... code part, just put a tail -f for the http access log of the server (nagious) and generate the report from the nagios GUI. The required code to generate the report will be on your screen.

Here my nagios is running on https://..So I need to put a tail -f for /var/log/httpd/ssl_access_log and generate the required report from the nagios GUI.

Get the code and replace it with the code above.



2. Copy this file to a temporary file named rep.html
cp `date +%Y%m%d`-report.html rep.html

The temporary file will be useful for HTML altering purposes with sed command.

3. Convert HTML file to PS2
/usr/bin/html2ps -U rep.html > rep.ps

4. Convert ps file to PDF version
ps2pdf rep.ps report`date +%Y%m%d`.pdf
This will create a pdf file with the name report-yyyymmdd.pdf

5. Mail the content to the appropriate user
nail -a reportyyyymmdd.pdf -s "Nagios Report" admin@your_domain


Now the script file should be called through a cronjob
If you wish to set the cron job to a user, login to the system as that user and type the command crontab -e which enables him to edit the cron jobs

Put an entry related to the cron job
15 00 * * * /home/user/scrip.sh
Here the scrip.sh is the file you have all commands related to nagios report generation + emailing parameters

Save and exit from the crontab edit mode.
Make sure the user has the privileges to execute the file 'script.sh'