Scan for New/Removed LUNs Linux (FC)

more /sys/class/scsi_host/host*/state

echo "- - -" > /sys/class/scsi_host/hostN/scan

# Re-scans


multipath -F && multipath

ls -ltra /dev/mapper


# Removing a LUN

umount /path/to/volume

multipath -l

multipath -F

lsof /dev/sdX

# Delete the drives.
# Do this for EACH drive

echo 1 > /sys/block/sdX/device/delete

# Unmap the volume on the SAN

multipath
multipath -l

Migrating Data form one San to another

This is not an offical post, just to keep what I did, I hope I can add more later on!

I used both these weblogs and came up with a little bit better solution
to recreate the old VG on old san:

http://saharageeks.com/2011/07/26/migrated-data-using-lvm-mirroring/

http://codeworks.gnomedia.com/archives/2005/general/lvm_recovery/

http://storagemeat.blogspot.com/2010/07/migrating-volumes-with-linux-lvm.html

Old VG: /dev/loop0 and /dev/loop1
New VG: only /dev/loop5

888 dd if=/dev/zero of=LUN01 bs=4096 count=250000
889 dd if=/dev/zero of=LUN02 bs=4096 count=250000
890 dd if=/dev/zero of=LUN03 bs=4096 count=2500000

897 losetup /dev/loop0 LUN01
898 losetup /dev/loop1 LUN02
901 losetup /dev/loop5 LUN03

1031 pvcreate /dev/loop5
1032 pvcreate /dev/loop0
1033 pvcreate /dev/loop1

1034 vgcreate TestEMC /dev/loop0 /dev/loop1
1035 lvcreate -L 800M -n testLV01 TestEMC
1037 lvcreate -L 1100M -n testLV02 TestEMC
1041 lvcreate -l 13 -n testLV03 TestEMC
1042 vgs

1054 mkfs.ext2 /dev/mapper/TestEMC-testLV01
1055 mkfs.ext2 /dev/mapper/TestEMC-testLV02
1057 mkfs.ext2 /dev/mapper/TestEMC-testLV03

1059 mount /dev/mapper/TestEMC-testLV01 test1
1060 mount /dev/mapper/TestEMC-testLV02 test2
1066 mount /dev/mapper/TestEMC-testLV03 test3

1067 lvs
1068 vgs
1069 lvs -m
1070 lvdisplay -m

1071 cp /etc/lvm/backup/TestEMC .

1073 vgextend TestEMC /dev/loop5

1074 vgs

1075 lvconvert -m1 --corelog TestEMC/testLV01 /dev/loop5
1092 lvconvert -m1 --corelog TestEMC/testLV02 /dev/loop5
1093 lvconvert -m1 --corelog TestEMC/testLV03 /dev/loop5

1094 umount test1
1096 umount test2
1097 umount test3

1098 lvconvert -m0 TestEMC/testLV01 /dev/loop0 /dev/loop1
1099 lvconvert -m0 TestEMC/testLV02 /dev/loop0 /dev/loop1
1100 lvconvert -m0 TestEMC/testLV03 /dev/loop0 /dev/loop1

1101 vgsplit TestEMC OldTestEMC /dev/loop0 /dev/loop1
1102 cp /etc/lvm/backup/TestEMC ./OldTestEMC

1110 vi OldTestEMC

(I made a copy of TestEMC, named it OldTestEMC, and I changed the UUID for LVs and VG and the name of VG in OldTestEMC)

1111 vgcfgrestore -f OldTestEMC OldTestEMC
1112 vgs
1113 lvs -v

1118 mkdir test1old
1119 mkdir test2old
1120 mkdir test3old

1121 vgs

1125 vgchange -ay OldTestEMC

1126 mount /dev/mapper/OldTestEMC-testLV01 test1
1127 mount /dev/mapper/OldTestEMC-testLV02 test2
1128 mount /dev/mapper/OldTestEMC-testLV03 test3
1137 umount test1
1138 umount test2
1139 umount test3

1140 fsck /dev/mapper/OldTestEMC-testLV01
1141 fsck /dev/mapper/OldTestEMC-testLV03
1142 fsck /dev/mapper/OldTestEMC-testLV02

1143 mount /dev/mapper/OldTestEMC-testLV03 test3
1144 mount /dev/mapper/OldTestEMC-testLV03 test2
1145 mount /dev/mapper/OldTestEMC-testLV03 test1

Clean UP and destory the lab!

1155 lvremove TestEMC
1156 lvremove OldTestEMC (it will remove LVs one by one in this VG)

1159 umount test1
1160 umount /test/test1
1161 umount /test/test2
1162 umount /test/test3
1163 mount | grep test
1164 lvremove OldTestEMC
1178 vgchange -a n NetApp
1187 umount /dev/mapper/NetApp-orappl
1188 fuser /dev/mapper/NetApp-orappl
1190 umount /dev/mapper/NetApp-orappl
1194 losetup -d /dev/loop0
1195 losetup -d /dev/loop1
1196 losetup -d /dev/loop2
1197 losetup -d /dev/loop3
1198 losetup -d /dev/loop4
1199 losetup -d /dev/loop5
1200 losetup -a

My Experience with DirectAccess

Recently I had to troubleshoot DirectAccess for a customer.


This is the summary of what I did:

1- on public NIC:
- removed the dns settings on public NIC

2- On private NIC:
- change the order of NIC cards, LAN should be above Public in list! (ref #1)
- remove the default GW from Private NIC

3- Fixed IPv6 from previous setup and routing with netsh command

4- Symantec Antivirus had conflict with Windows firewall which is important for DA to work (uninstalled)

5- When they setup CRL (Certificate Revocateion List) url, they had missed "/" in the url and preventing IP-HTTPS to come up (fixed it in DC04 -> CA)

6- The IIS on DA shouldn't have 443 configured (confilcts with DA), [REMOVED]

7- Directory browsing needed to be enabled on DA's IIS, so clients can see /CRLD folder remotely over HTTP.

8- There is a bug in Win2008 which preventing system to accept a new cert once you run the setup in DA! (ref #2)

9- Generating proper certifications for DA and Clients

10- Installing DA connectivity assistant which monitor DA connection and can generate advanced logs.
(configuration has to be done in GroupPolicy editor and documents comes in the setup files) (ref# 5 )


On the client:

1- join the laptop to domain

2- add the computer name to da_clients group

3- make sure the laptop cert is correct,

4- install direct access connectivity assistance


More troubleshooting:

here are 3 methods of communications between clients and server and you can disable one to force

the other one:



1- 6TO4: if user has a public IPv4


netsh interface 6to4>set state state=enabled

netsh interface 6to4>set state state=disabled

netsh interface 6to4> show relay


2- Teredo: if users is behind NAT but has access to UDP port 3544



to disable/enable Teredo to see if it will fail over to IPHTTPS method


netsh interface teredo>set state disabled

netsh interface teredo>set state client 1.2.3.4

netsh interface teredo>show state


ping -6 file01


3- IPHTTPS: if user is behind NAT but no access has given in FW for UDP/3544 (slowest method)


netsh interface httpstunnel show interfaces

Interface IPHTTPSInterface (Group Policy) Parameters
---------------------------------------------------
Role : client
URL : https://da-gw.mydomain.com:443/IPHTTPS
Last Error Code : 0x0
Interface Status : IPHTTPS interface active


On the client:

nslookup -q=aaaa file01.mydoamin.com [ipv6 address of DNS]

ping -6 file01

To monitor IPSec tunnels:

netsh advfirewall monitor show mmsa

netsh advfirewall monitor show qmsa





Ref:

1- blog.concurrency.com/infrastructure/uag-directaccess-ip-addressing-the-server/

2- support.microsoft.com/kb/973982/en-us

3- blogs.technet.com/b/edgeaccessblog/archive/2009/10/27/deep-dive-into-uag-directaccess-certificates.aspx

4- www.techrepublic.com/blog/10things/10-things-you-should-know-about-directaccess/1371

5- www.microsoft.com/download/en/details.aspx?displaylang=en&id=10322

Callback in Android!

Whenever one class might need notifications of changes in another—
especially if the association changes dynamically, at runtime—consider implementing
the relationship as a callback. If the relationship is not dynamic, consider using
dependency injection—a constructor parameter and a final field—to make the required
relationship permanent.

Programming Android By Zigurd Mednieks (Page 137)

IPSET and IPTABLES

I really need to do more study on ipset . This post is just a reminder for
myself.

Example #1:

ipset -N myset iphash
ipset -A myset 1.1.1.1
ipset -A myset 2.2.2.2
iptables -A INPUT -m set --set myset src -j DROP

Example #2:

ipset -N routed_nets nethash
ipset -A routed_nets 10.30.30.0/24
ipset -A routed_nets 10.40.40.0/24
ipset -A routed_nets 192.168.4.0/23
ipset -A routed_nets 172.22.0.0/22
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 \
-m set ! --set routed_nets dst -j MASQUERADE


Ref: Linux Journal (October 2011)

Launch ASDM in Linux

root@ipng:/# cat /bin/asdm
#!/bin/bash

/usr/bin/javaws https://<ASA_IP>/admin/public/asdm.jnlp 2>&1 >/dev/null &

root@ipng:/# chmod u+x /bin/asdm


root@ipng:/# asdm

Use LDAP Authentication to Assign a Group Policy at Login

Finally after some head scratching, it worked! Now I can permit only AD users belong to
a certainAD group to connect to our ASA by anyconnect client.

If you did some research already, you might already know about step 1 and 2 but
the making work is all about step 3!

Step 1: Define your AD and your profile, explained here:

http://www.block.net.au/blogs/james/pages/active-directory-vpn-authentication-with-a-cisco-asa-5510-series-appliance.aspx

Step 2: The memberOf attribute is mapped to Radius-IETF-Class by the configured LDAP Attibute map:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808d1a7c.shtml

Note: This part need to be done in CLI:

ciscoasa(config)#ldap attribute-map CISCOMAP
ciscoasa(config-ldap-attribute-map)#map-name memberOf IETF-Radius-Class
ciscoasa(config-ldap-attribute-map)#map-value memberOf CN=Employees,CN=Users,
DC=yourplace,DC=com ExamplePolicy1

Now you can do the rest in ASDM.


Step 3: The Ldap attribute map created in previous steps just bind the group-policy to the user.If you want to restrict the access, you need DAP.

http://www.ciscosystems.com/en/US/products/ps6120/products_white_paper09186a00809fcf38.shtml


So now you just need to create a DAP policy to reject users belong to this connection profile
and not part of the AD group:








Troubleshooting:

debug dap trace
debug ldap 255