Archive for 2012

Little tip with SRX Dynamic VPNs and 'security screens' on the VPN's ingress zone I stumbled across during my JNCIE-SEC study.

UPDATE (20120401): Seems Juniper has addressed and fixed this bug ...
More info:
http://kb.juniper.net/InfoCenter/index?page=content&id=KB21713&actp=RSS 

It seems you can not have the 'IP Spoofing' screen enabled when sending IPSec Dynamic VPN traffic ingressing into the zone with the screen set. This traffic is dropped by the screen which can be seen via a 'security flow traceoption flag basic-datapath':

  • 'packet dropped, drop by spoofing check.'

So removing (or deactivating) the ip spoofing check solved the problem:

  • deactivate security screen ids-option from-Internet ip spoofing

Kind of lame, the spoofing screen sounds a good idea on your Internet facing interfaces, but seems a no no if you want dynamic VPNs. That is all. Hopefully eventually Juniper make this check smarter.

Awesome - This would get the chicks ...

Junos Valentines

@cooperlees is yours truely

[youtube https://www.youtube.com/watch?v=al71G4Isunc]

EX VC tip of the moment: Use apply-groups to add specific config to each node.
For example:

[plain]
set groups member0 system host-name member0
set groups member1 system host-name member1
set groups member2 system host-name member2
set apply-groups member0
set apply-groups member1
set apply-groups member2
[/plain]

Recently I was required to do a network performance test between a Head Office and a WAN site. I knocked up this quick python script to parse the data collect to see the results. Thought it could be handy for others so here it is to download / share.

Download Script

Sample Output:

[plain]
cooper@dfbit:~/scripts/iperf-parse$ ./iperf-summary.py
------------------------------------
-- IPERF CSV Summariser --
-- Cooper Lees <me@cooperlees.com --
------------------------------------
-- SUMMARY --
- 20111212103043 to 20120103090052
- 1004 runs of IPERF
- Averages:
- Average Sent = 2.64M
- Average Received = 2.28M
- Average Send Bandwidth = 985.75K
- Average Receive Bandwidth = 805.12K
- Max Send Bandwidth = 1.08M (at 20111230183021)
- Max Receive Bandwidth = 837.16K (at 20120102113052)
------------------------------------
[/plain]

Code:

[python]
#!/usr/bin/python

# date,sender-ip,sender-port,receiver-ip,receiver-port,id,interval,transfer,bandwidth
# 20111212103043,10.120.15.8,45020,10.120.13.120,5001,5,0.0-21.4,2490368,931080
# 20111212103109,10.120.15.8,5001,10.120.13.120,57022,4,0.0-24.2,2228224,736145

FILENAME = 'client-iperf.log'

RUNS = 1

MAX_BANDWIDTH_SENT = 0
MAX_BANDWIDTH_SENT_DATE = 0
MAX_BANDWIDTH_RECEIVED = 0
MAX_BANDWIDTH_RECEIVED_DATE = 0

TOTAL_BANDWIDTH_SENT = 0
TOTAL_BANDWIDTH_RECEIVED = 0

TOTAL_SENT = 0
TOTAL_RECEIVED = 0

def convert_bytes(bytes):
bytes = float(bytes)
if bytes >= 1099511627776:
terabytes = bytes / 1099511627776
size = '%.2fT' % terabytes
elif bytes >= 1073741824:
gigabytes = bytes / 1073741824
size = '%.2fG' % gigabytes
elif bytes >= 1048576:
megabytes = bytes / 1048576
size = '%.2fM' % megabytes
elif bytes >= 1024:
kilobytes = bytes / 1024
size = '%.2fK' % kilobytes
else:
size = '%.2fb' % bytes
return size

f = open(FILENAME)
l1 = f.readline().strip().split(',')
l2 = f.readline().strip().split(',')
while l2 and l2[0] != '':
if RUNS == 1:
START = l1[0]

BW_SENT = int(l1[8])
BW_RECEIVED = int(l2[8])

TOTAL_SENT = TOTAL_SENT + int(l1[7])
TOTAL_RECEIVED = TOTAL_RECEIVED + int(l2[7])

TOTAL_BANDWIDTH_SENT = TOTAL_BANDWIDTH_SENT + int(l1[8])
TOTAL_BANDWIDTH_RECEIVED = TOTAL_BANDWIDTH_RECEIVED + int(l2[8])

if BW_SENT > MAX_BANDWIDTH_SENT:
MAX_BANDWIDTH_SENT = BW_SENT
MAX_BANDWIDTH_SENT_DATE = l1[0]

if BW_RECEIVED > MAX_BANDWIDTH_RECEIVED:
MAX_BANDWIDTH_RECEIVED = BW_RECEIVED
MAX_BANDWIDTH_RECEIVED_DATE = l2[0]

END = l2[0]
RUNS = RUNS + 1
l1 = f.readline().strip().split(',')
l2 = f.readline().strip().split(',')

f.close()

print "------------------------------------"
print " -- IPERF CSV Summariser -- "
print "-- Cooper Lees <me@cooperlees.com --"
print "------------------------------------"
print "-- SUMMARY --"
print "- %s to %s" % ( START, END )
print "- %d runs of IPERF" % RUNS
print "- Averages:"
print "-tAverage Sentttt= %s" % convert_bytes((TOTAL_SENT / RUNS))
print "-tAverage Receivedtt= %s" % convert_bytes((TOTAL_RECEIVED / RUNS))
print "-tAverage Send Bandwidthtt= %s" % convert_bytes((TOTAL_BANDWIDTH_SENT / RUNS))
print "-tAverage Receive Bandwidtht= %s" % convert_bytes((TOTAL_BANDWIDTH_RECEIVED / RUNS))
print "-tMax Send Bandwidthtt= %s (at %s)" % (convert_bytes((MAX_BANDWIDTH_SENT)), MAX_BANDWIDTH_SENT_DATE)
print "-tMax Receive Bandwidthtt= %s (at %s)" % (convert_bytes((MAX_BANDWIDTH_RECEIVED)), MAX_BANDWIDTH_RECEIVED_DATE)
print "------------------------------------"
[/python]

Cron Job Script to Collect Data:

[bash]
#!/bin/bash

SERVER="x.x.x.x"
LOG="client-iperf.log"
TIME="5"

echo "--> Starting iperf client @ $(date) ..." | tee -a $LOG

if [ "$1" == "-v" ]; then
iperf -t $TIME -c $SERVER -r -y C | tee -a $LOG
else
iperf -t $TIME -c $SERVER -r -y C >> $LOG
fi

echo "--> Finished iperf client @ $(date)" | tee -a $LOG
[/bash]