NAS 해놀로지(Xenology) 서비스 제공
NAS 40% 할인 쿠폰: D82JJOR0FVG2 11월30일까지
https://kr.netdedi.com
2017년 11월 6일 월요일
2017년 9월 18일 월요일
Cloud 개인 NAS 시작하기
업데이트는 하지 마세요. !!!
1. 내 서비스 -> 개인NAS를 선택합니다.
2. 아래와 같이 지금 사용중인 제품/서비스를 선택합니다.
3. 아래와 같이 해당 장비에 대한 컨트롤 패널이 보입니다.
4. 본인 NAS 장비의 IP를 확인 하기위해, 위 화면의 콘솔 버튼을 누릅니다.
그러면 해당 장비의 ID와 PW를 입력하라는 메세지가 나옵니다. ifconfig를 누르면 IP 정보가 출력됩니다.
Login: admin
Password:
>ifconfig
5. 해당 IP를 확인 후 웹 브라우저의 IP를 입력합니다.
로그인 정보는 Login Info 버튼을 클릭하면 알 수 있습니다.
6. 로그인 후에 디스크 볼륨을 설정하고, 사용하고자 하는 서비스를 설치하여 사용하 실 수 있습니다. 또한, 모바일 기기에서 앱을 설치하여, 언제어디서든 자유롭게 사용하실 수 있습니다.
관련 페이지: https://kr.netdedi.com/index.php?/page/langaddservice/
https://www.synology.com/ko-kr/knowledgebase/Mobile/help/DSfile
https://www.synology.com/ko-kr/knowledgebase/Mobile/help/DSphoto
https://www.synology.com/ko-kr/knowledgebase/Mobile/help/DSvideo
2017년 2월 20일 월요일
netdedi.com
Only for new users
Now, 20% off Coupon is available until 28th Feb, 2017
Applies to All products:
A2WBYA2OWU3XAV
Please, visit and take advantage of your right.
Thanks,
Only for new users
Now, 20% off Coupon is available until 28th Feb, 2017
Applies to All products:
A2WBYA2OWU3XAV
Please, visit and take advantage of your right.
Thanks,
2016년 10월 24일 월요일
How to reset Windows Server 2012 administrator password
To reset the password on your Windows 2012 server, simply complete the following steps:
- Boot from the Micrsoft Windows Server 2012 DVD
- From the Windows Setup menu, click “Next”.
- Select “Repair your computer”
- Under Choose and option, click on “Troubleshoot”.
- Under Advanced options, click “Command Prompt”.
- At the command prompt, run the following commands:
- d: cd windows\system32
- ren Utilman.exe Utilman.exe.old
- copy cmd.exe Utilman.exe
- Close the command prompt and then click “Continue”.
- The server should now boot and present the logon screen. Here click Windows Key + U.
- At the prompt you can now change the password, by typing the following command: net user administrator Password123 This will set the password for the Administrator user to be Password123 (case sensitive).
To join the affiliate program, visit at https://www.netdedi.com
2016년 9월 6일 화요일
PXE BOOT SETUP
Installation
First, you should Install and configure
DHCP server on your PXE server. To install and configure DHCP server,
refer the following link:
Now, install the following packages for setting up PXE environment:
# yum install httpd xinetd syslinux tftp-server -y
Configure PXE Server
# tree /var/lib/tftpboot/├── CentOS6.5
│ ├── initrd.img
│ └── vmlinuz
├── centos6_5_x86_64
│ └── CentOS-6.5-x86_64-bin-DVD1.iso
├── CentOS7.0
│ ├── initrd.img
│ └── vmlinuz
├── centos_7_x86_64
│ └── CentOS-7-x86_64-DVD-1511.iso
├── chain.c32
├── images
│ ├── centos-6.5-64
│ ├── initrd.img
│ └── vmlinuz
├── initrd.img
├── mboot.c32
├── memdisk
├── menu.c32
├── pxelinux.0
├── pxelinux.cfg
│ └── default
├── Ubuntu14.04
├── ubuntu14.04_64
│ └── ubuntu-14.04.4-server-amd64.iso
├── Ubuntu16.04
├── ubuntu16.04_64
│ └── ubuntu-16.04-server-amd64.iso
└── vmlinuz
Copy the following TFTP configuration files to the /var/lib/tftpboot/ directory.
#cd /usr/share/syslinux/ #cp pxelinux.0 menu.c32 memdisk mboot.c32 chain.c32 /var/lib/tftpboot/
Edit file /etc/xinetd.d/tftp
#vi /etc/xinetd.d/tftp
Enable TFTP server. To d this, change “disable=yes” to “no”.
# default: off
# description: The tftp server serves files using the trivial file transfer \
# protocol. The tftp protocol is often used to boot diskless \
# workstations, download configuration files to network-aware printers, \
# and to start the installation process for some operating systems.
service tftp
{
socket_type = dgram
protocol = udp
wait = yes
user = root
server = /usr/sbin/in.tftpd
server_args = -s /var/lib/tftpboot
disable = no
per_source = 11
cps = 100 2
flags = IPv4
}
Next, create a directory to store CentOS
installation ISO image. and mount the image to that directory as shown
below. I have CentOS 6.5 32bit ISO image on my /root directory.
#mkdir /var/lib/tftpboot/centos6.5
#mount -o loop /var/lib/tftpboot/CentOS-6.5-bin-DVD1.iso /mnt
#cp /mnt/images/pxeboot/vmlinuz, initrd.img /CentOS6.5
Create a apache configuration file for PXE server under /etc/httpd/conf.d/ directory:
#vi /etc/httpd/conf.d/pxeboot.conf
Add the following lines:
Alias /centos6_5 /mnt <Directory /mnt> Options Indexes FollowSymLinks Order Deny,Allow Deny from all Allow from 58.x.x.0/26 </Directory>
Save and close the file.
Then, create a configuration directory for PXE server:
#mkdir /var/lib/tftpboot/pxelinux.cfg
Now, create PXE server configuration file under the pxelinux.cfg:
#vi /var/lib/tftpboot/pxelinux.cfg/default
Add the following lines:
prompt 0
timeout 300
ONTIMEOUT local
Menu title ########## PXE Boot Menu ##########
LABEL CENTOS 6.5 Installation
MENU LABEL centos-6.5-64
KERNEL CentOS6.5/vmlinuz
APPEND initrd=CentOS6.5/initrd.img method=http://58.x.x.50
*Ubuntu
Make sure you are using the one from /install/netboot/ubuntu-installer/amd64
LABEL HardDisk
MENU LABEL ^Hard DIsk
LOCALBOOT 0x80
Configure DHCP Server
Now, we have to configure the DHCP server to work with PXE server.
Edit file /etc/dhcp/dhcpd.conf,
#vi /etc/dhcp/dhcpd.conf
Add the following lines at the end:
allow booting; allow bootp; next-server 58.x.x.50; filename "pxelinux.0";
Save and close the file.
Now, We have come to the end of PXE server configuration. Restart all the services to complete the configuration.
service xinetd restart service httpd restart service dhcpd restart
Configure HTTPD Server
DocumentRoot "/var/www/html"
ServerName 58.x.x.50
#cp /mnt/* /var/www/html/
Installation with Kickstart File
#vi /var/lib/tftpboot/pxelinux.cfg/default
prompt 0
timeout 300
ONTIMEOUT local
menu title ########## PXE Boot Menu ##########
LABEL CENTOS 6.5 Installation
MENU LABEL centos-6.5-64
KERNEL CentOS6.5/vmlinuz ksdevice=eth0
APPEND initrd=CentOS6.5/initrd.img ks=http://IP Address/ks.cfg
LABEL CENTOS 7.0 Installation
MENU LABEL centos-7.0-64
KERNEL CentOS7.0/vmlinuz
APPEND initrd=CentOS7.0/initrd.img ks=http://IP Address/centos7/ks.cfg
LABEL Ubuntu 14.04 Installation
MENU LABEL Ubuntu 14.04
KERNEL
APPEND
LABEL HardDisk
MENU LABEL ^Hard DIsk
LOCALBOOT 0x80
CentOS 6.5
#vi ks.cfg# Kickstart file automatically generated by anaconda.
#version=DEVEL
install
url --url=http://IP Address/
lang en_US.UTF-8
keyboard us
network --onboot yes --device eth0 --bootproto dhcp
rootpw --iscrypted $6$VW.mEEJY9d2fKaNb$3fPvVgdrgrKVwYNVmtU5sWzB3BbiCo.1W5gO4FVE3/6vU.gBZCDtrJ4Urf.f2T3c87gSlPqQYqkKU39tzVsCN1
firewall --service=ssh
authconfig --enableshadow --passalgo=sha512
selinux --enforcing
timezone --utc Asia/Seoul
bootloader --location=mbr --driveorder=sda --append="crashkernel=auto rhgb quiet"
# The following is the partition information you requested
# Note that any partitions you deleted are not expressed
# here so unless you clear all partitions first, this is
# not guaranteed to work
clearpart --all --drives=sda
#volgroup VolGroup --pesize=4096 pv.008002
#logvol /home --fstype=ext4 --name=lv_home --vgname=VolGroup --grow --size=100
#logvol / --fstype=ext4 --name=lv_root --vgname=VolGroup --grow --size=1024 --maxsize=51200
#logvol swap --name=lv_swap --vgname=VolGroup --grow --size=7968 --maxsize=7968
part /boot --fstype=ext4 --size=500
part swap --fstype=swap --recommended
part / --fstype=ext4 --size=940000
#part pv.008002 --grow --size=1
repo --name="CentOS" --baseurl=http://IP Address --cost=100
reboot
%packages
@core
@server-policy
@workstation-policy
%end
CentOS 7.0
#vi ks.cfg
#version=DEVEL # System authorization information auth --enableshadow --passalgo=sha512 # Use network installation url --url="http://IP Address/centos7" # Use graphical install graphical # Run the Setup Agent on first boot firstboot --enable ignoredisk --only-use=sda # Keyboard layouts keyboard --vckeymap=us --xlayouts='us' # System language lang en_US.UTF-8 # Network information network --bootproto=dhcp --device=eno1 --onboot=on --ipv6=auto network --bootproto=dhcp --device=eno2 --onboot=on --ipv6=auto network --hostname=localhost.localdomain # Root password rootpw --iscrypted $6$b.HgyW9b6uH9fHvQ$mjPxiumdpTatP3GXL9ziIaUpxUVcreGFjG0Vb8iEU9nJuXISLnlAzcGnFQB1I2svRvdodz8zWw4qqeCzYnkH50 # System timezone timezone Asia/Seoul --isUtc # System bootloader configuration bootloader --append=" crashkernel=auto" --location=mbr --boot-drive=sda # Partition clearing information clearpart --all --initlabel --drives=sda # Disk partitioning information part /boot --fstype="xfs" --ondisk=sda --size=500 part pv.369 --fstype="lvmpv" --ondisk=sda --size=953368 volgroup centos --pesize=4096 pv.369 logvol / --fstype="xfs" --grow --maxsize=51200 --size=1024 --name=root --vgname=centos logvol swap --fstype="swap" --size=8064 --name=swap --vgname=centos logvol /home --fstype="xfs" --grow --size=500 --name=home --vgname=centos reboot %packages @^minimal @core kexec-tools wget net-tools %end %addon com_redhat_kdump --enable --reserve-mb='auto' %end
2016년 8월 23일 화요일
How to Assign SR-IOV Enabled NICs with XenServer 6.x
Objective
This article describes how to assign SR-IOV enabled Network Interface Cards (NICs) to Virtual Machines (VMs) for maximum performance by using the Single Route I/O Virtualization (SR-IOV) capabilities of XenServer 6.1.0.Note: SR-IOV is supported only with SR-IOV enabled NICs listed on the XenServer Hardware Compatibility List (HCL) and only when used in conjunction with a Windows Server 2008 guest operating system.
Single Root I/O Virtualization (SR-IOV) is a PCI device virtualization technology that allows a single PCI device to appear as multiple PCI devices on the physical PCI bus. The actual physical device is known as a Physical Function (PF) while the others are known as Virtual Functions (VF). The purpose of this is for the hypervisor to directly assign one or more of these VFs to a VM using SR-IOV technology: the guest can then use the VF as any other directly assigned PCI device.
Assigning one or more VFs to a VM allows the VM to directly exploit the hardware. When configured, each VM behaves as though it is using the NIC directly, reducing processing overhead and improving performance.
WARNING! If your VM has an SR-IOV VF, functions that require VM mobility are not possible. For example, Live Migration, Workload Balancing, Rolling Pool Upgrade, High Availability and Disaster Recovery, cannot be used. This is because the VM is directly tied to the physical SR-IOV enabled NIC VF. In addition, VM network traffic sent via an SR-IOV VF bypasses the vSwitch, so it is not possible to create Access Control Lists (ACL) or view Quality of Service (Qos).
Instructions
To enable SR-IOV on Intel NICs:
WARNING! Customers must not attempt to boot a SR-IOV enabled VM before carrying out the following steps.-
For Intel 1GBe NICs edit /etc/modprobe.d/igb and uncomment the line that includes:
#options igb max_vfs=7,7,7,7
-
For Intel 10GBe NICs edit /etc/modprobe.d/ixgbe and uncomment the line that includes:
#options ixgbe max_vfs=40,40
To assign an SR-IOV enabled NIC VF to a Virtual Machine on XenServer 6.1.0:
-
Open a local command shell on your XenServer host.
-
Run the command lspci to display a list of the Virtual Functions (VF).
For example:
07:10.0 Ethernet controller: Intel Corporation 82559 Ethernet Controller Virtual Function (rev 01)
In this example, 07:10.0 is the bus:device.function address of the VF.
-
Assign the required VF to the target VM by running the following commands:
xe vm-param-set other-config:pci=0/0000:<bus:device.function> uuid=<vm-uuid>
-
Start the VM, and install the appropriate VF driver for your specific hardware.
Note: You can assign multiple VFs to a single VM, however the same VF cannot be shared across multiple VMs.
2016년 7월 29일 금요일
XenServer 7.0: Release Notes Welcome to XenServer 7.0.
XenServer 7.0: Release NotesWelcome to XenServer 7.0.
This document provides important information about the XenServer 7.0 release. For frequently asked questions about XenServer, refer to the XenServer 7.0 Technical FAQ. Documentation may be updated or changed after the initial release. Citrix suggests regularly visiting the XenServer 7.0 page on Citrix Product Documentation to learn about updates. Customers can download the latest version of the XenServer 7.0.0 Base Installation ISO from the XenServer Product Download page.
Note: The XenServer 7.0.0 Base Installation ISO has been reissued on 6 July 2016 to include hotfix XS70E004. The reissued ISO also contains an updated version of the XenCenter Management Console (v7.0.1). This version of XenCenter is same as the version available to download on the XenServer 7.0 Download page and hotfix XS70E001.
This document provides important information about the XenServer 7.0 release. For frequently asked questions about XenServer, refer to the XenServer 7.0 Technical FAQ. Documentation may be updated or changed after the initial release. Citrix suggests regularly visiting the XenServer 7.0 page on Citrix Product Documentation to learn about updates. Customers can download the latest version of the XenServer 7.0.0 Base Installation ISO from the XenServer Product Download page.
Note: The XenServer 7.0.0 Base Installation ISO has been reissued on 6 July 2016 to include hotfix XS70E004. The reissued ISO also contains an updated version of the XenCenter Management Console (v7.0.1). This version of XenCenter is same as the version available to download on the XenServer 7.0 Download page and hotfix XS70E001.
Dedicated Servers at NETDEDI. Somebody posted.
We provide single E3-1231, X5690, E5-2609 and Dual X5690 and E5-2609.
Netdedi.com also offers powerful Virtual Private Servers! You can get the hypervisor and create lots of VMs.
Dedicated Servers are ready in few hours after order.
Netdedi.com is here for you 24/7. Netdedi's goal is the customers satisfaction and support!
Please check our servers:
Single One
Plan includes
CPU E3-1231 v3 3.4GHz
MEMORY 8 GB
DISK 1TB SATA
BANDWIDTH 1 TB
IP ADDRESS 1
OS Linux & Windows
$79.99 USD / Monthly
ORDER NOW
Single Two
Plan includes
CPU X5690 3.43 GHz
MEMORY 8GB
DISK 250 GB SSD
BANDWIDTH 1 TB
IP ADDRESS 1
OS Linux & WIndows
$89.99 USD / Monthly
ORDER NOW
Single Three
Plan includes
CPU E5-2609 2.4GHz
MEMORY 8GB
DISK 250 GB SSD
BANDWIDTH 1 TB
IP ADDRESS 1
OS Linux & WIndows
$149.99 USD / Monthly
ORDER NOW
Dual One
Plan includes
2 CPU X5690 3.43 GHz
MEMORY 16 GB
DISK 250 GB SSD
BANDWIDTH 1 TB
IP ADDRESS 1
OS Linux & Windows
$99.99 USD / Monthly
ORDER NOW
Dual Two
Plan includes
2 CPU E5-2609 2.4GHz
MEMORY 16 GB
DISK 250 GB SSD
BANDWIDTH 1 TB
IP ADDRESS 1
OS Linux & Windows
$189.99 USD / Monthly
ORDER NOW
Virtual Host Server
Plan includes
2 CPU X5690 3.43 GHz
MEMORY 16 GB
DISK 250 GB SSD
BANDWIDTH 1 TB
IP ADDRESS 1
OS Hypervisor
$99.99 USD / Monthly
ORDER NOW
Have question?
Please feel free to ask any question by opening ticket:
https://www.netdedi.com/index.php?/tickets/new/
2016년 7월 13일 수요일
RAID Scrubbing
RAID Scrubbing*
RAID scrubbing is a data maintenance feature that inspects volumes or disk groups and repairs any detected data inconsistencies. This function can be used with volumes or disk groups that implement SHR (comprised of three or more disks), RAID 5, or RAID 6.
We recommend regularly performing RAID scrubbing in order to maintain data consistency and avoid losing any critical data in the event of hard drive failure.
To perform RAID scrubbing:
- Open Storage Manager.
- Go to Volume or Disk Group.
- Select the volume or disk group on which to perform RAID scrubbing.
- Click Manage.
- Select RAID scrubbing.
2016년 6월 29일 수요일
How to Modify Network Speed and Duplexing
Instructions
To modify network speed and duplexing, complete the following procedure:
- Run the following command to find the physical interface where you need to apply the settings:
# xe pif-list host-uuid=<host_uuid>
Note: xe pif-list command lists all the physical interfaces from all hosts in the pool. It is required to filter the interfaces by “host-uuid” if you need to find the right interface. - Review current physical interface settings:
# xe pif-list uuid=<UUID of physical interface> params=all
- Run the following command to set speed, duplex, and auto-negotiation:
# xe pif-param-set uuid=<UUID of physical interface> other-config:ethtool-autoneg=off other-config:ethtool-speed=1000 other-config:ethtool-duplex=full
Note: Turn off auto-negotiation before setting the speed manually.
- Apply the setting on the interface.
- Unplug and plug the physical interface:
Note: You do not need to unplug and plug the interface as follows. If you are unable to unplug the interface and skip the following step, then the settings will be applied after the next reboot.
# xe pif-unplug uuid=<UUID of physical interface>
# xe pif-plug uuid=<UUID of physical interface>
Or
Restart the host:
# xe host-reboot host=<hostname>
2016년 6월 23일 목요일
VPS in USA
VPS in USA
Just Launched the VPS in USA.
Please, visit and order it. It is easiest way to get a server.
2016년 6월 21일 화요일
Resetting the Device to Factory Defaults : Netscreen Device
Resetting the Device to Factory Defaults
If you lose the admin password, or you need to clear the configuration of your device, you can reset the device to its factory default settings.
Resetting the device destroys any existing configurations and restores access to the device. You can restore the device to its default settings using one of these methods: Using the device serial number Using the CLI unset all command Using the Reset Config pinhole button The following sections describe how to use these methods to reset the device to its factory defaults.
Device Serial Number To use the device serial number to reset the device to its factory defaults:
1. Start a Console session as described in “Using a Console Connection” on page 30.
2. At the Login prompt, enter the device serial number.
3. At the Password prompt, enter the serial number again. The following message appears: !!! Lost Password Reset !!! You have initiated a command to reset the device to factory defaults, clearing all current configuration and settings. Would you like to continue? y/[n]
CAUTION: Resetting the device deletes all existing configuration settings and disables all existing firewall and VPN services.
NOTE: By default, the device recovery feature is enabled. You can disable it by entering the CLI unset admin device-reset command. Also, if the security device is in FIPS mode, the recovery feature is automatically disabled. Resetting the Device to Factory Defaults 43 Configuring the Device
4. Press the y key. The following message appears: !! Reconfirm Lost Password Reset !! If you continue, the entire configuration of the device will be erased. In addition, a permanent counter will be incremented to signify that this device has been reset. This is your last chance to cancel this command. If you proceed, the device will return to factory default configuration, which is: device IP: 192.168.1.1; username: netscreen, password: netscreen. Would you like to continue? y/[n] 5. Press the y key to reset the device. The system now resets and returns to the login prompt; the default login name and password are both reset to netscreen
To use the CLI unset all command, you will need to know the login name and password. To reset the device to its factory defaults:
1. Start a Console session as described in “Using a Console Connection” on page 30, then log in.
2. At the command prompt, enter unset all. The following message is displayed: Erase all system config, are you sure y/[n] ?
3. Press y
4. Enter reset.
Press n for the first question and y for the second question: Configuration modified, save? [y]/n
System reset, are you sure? y/[n]
The system now resets and returns to the login prompt; the default login name and password are both reset to netscreen.
2016년 6월 15일 수요일
Amazon Web Services outage causes Austrialian Website chaos
http://www.smh.com.au/technology/technology-news/amazon-web-services-outage-causes-australian-website-chaos-20160605-gpc41p.html
shoppers were left unable to pay for trolleys full of groceries, while websites and servers crashed around the nation in a spate of technical outages on Sunday.
Amazon Web Services, which hosts cloud computing services for many companies, listed a number of connectivity issues for its services based in Sydney. It is not yet known whether the storms that lashed Sydney over the weekend were responsible.
Some of the websites affected include those belonging to Fairfax Media, publisher of this website; Foxtel and Fox Sports; car sharing service Go Get; The Daily Telegraph's NRL Super Coach site; Nine and Fairfax-owned online streaming platform Stan; ticketing platform TryBooking; and online food ordering service Menulog.
Amazon Web Services' status dashboard lists a number of connectivity issues for its services based in Sydney.
Meanwhile, a separate technical outage caused numerous financial services including debit cards, ATMs and Eftpos machines to fail on Sunday night.
Advertisement
An AWS spokesman said the problem was not related to the website issues with Amazon Web Services.
Customers from Westpac, Commonwealth Bank and ME Bank complained on the companies' Facebook pages, with some saying their eftpos payments did not work.
One person said he had to leave a trolley full of groceries in Aldi because his card did not work.
A Commonwealth Bank spokeswoman said the bank was not aware of any systemic issues, but some individuals may be experiencing intermittent issues with other eftpos machines.
Read more: http://www.smh.com.au/technology/technology-news/amazon-web-services-outage-causes-australian-website-chaos-20160605-gpc41p.html#ixzz4BhlWkSdF
Follow us: @smh on Twitter | sydneymorningherald on Facebook
VPS Hosting Package is right for you.
VPS Package is launched!!
You can build your network easily.
If you need more resources, please, contact us.
visit at https://www.netdedi.com
Monthly
You can build your network easily.
If you need more resources, please, contact us.
visit at https://www.netdedi.com
Starter Package 15
$15.00 USD
Starter Package 15
$15.00 USDMonthly
- CPU 2 Cores
- MEMORY 2 GB
- SSD DISK 20GB
- 1 Public IP Address
- 1 TB BANDWIDTH
- Build up to 2 Starter T1
- NAT within Your Network
- Load Balancing
- Inbound/Outbound Firewall
- VPN Service
- Snapshots
- Additional Storage
- Port Forwarding
Business Package25
$25.00 USD
Monthly- CPU 3 Cores
- MEMORY 3 GB
- SSD DISK 40GB
- 1 Public IP Address
- 1 TB BANDWIDTH
- Build Up to 3 T1
- NAT within Your Network
- Load Balancing
- Inbound/Outbound Firewall
- VPN Service
- Snapshots
- Additional Storage
- Port Forwarding
WordPress product Launched!!
Create an unforgettable website
netdedi.com powers beautiful websites for businesses, professionals, and bloggers
Please, visit at
2016년 6월 9일 목요일
VPS Package Launched!!
VPS Package is launched!!
You can build your network easily.
If you need more resources, please, contact us.
visit at https://www.netdedi.com
You can build your network easily.
If you need more resources, please, contact us.
visit at https://www.netdedi.com
Starter Package 15
$15.00 USD
Monthly- CPU 2 Cores
- MEMORY 2 GB
- SSD DISK 20GB
- 1 Public IP Address
- 1 TB BANDWIDTH
- Build up to 2 Starter T1
- NAT within Your Network
- Load Balancing
- Inbound/Outbound Firewall
- VPN Service
- Snapshots
- Additional Storage
- Port Forwarding
Business Package25
$25.00 USD
Monthly- CPU 3 Cores
- MEMORY 3 GB
- SSD DISK 40GB
- 1 Public IP Address
- 1 TB BANDWIDTH
- Build Up to 3 T1
- NAT within Your Network
- Load Balancing
- Inbound/Outbound Firewall
- VPN Service
- Snapshots
- Additional Storage
- Port Forwarding
2016년 6월 8일 수요일
[ScreenOS] How do I create a Route Based LAN to LAN VPN by using preshared secrets (ScreenOS 6.0 and later)?
SUMMARY:
PROBLEM OR GOAL:
CAUSE:
SOLUTION:
If you have performed the following procedure,and need help with troubleshooting, refer to the VPN Configuration & Troubleshooting Guide.
PURPOSE:
This article provides information on how to create a Route Based LAN to LAN VPN by using preshared secrets in ScreenOS 6.x.
Environment:
- Preshared secrets
- Route Based VPN
- Static IP Addresses on both gateways of VPN
- This example assumes that static IP addresses are assigned on both of the VPN devices of the VPN tunnel.
- The tunnel interfaces are created in the Untrust zone.
- The preshared secret used is netscreen.
- The following matrix displays the IP addresses and proposals that are used for this example:
Site A B Untrust IP of Firewall 1.1.1.1 (eth0/0) 2.2.2.1 (eth0/0) Trust Network 10.1.1.0/24 172.16.10.0/24 Phase 1 Proposal pre-g2-3des-sha pre-g2-3des-sha Phase 2 Proposal g2-esp-3des-sha g2-esp-3des-sha
WebUI
Site A:
- Create tunnel interface:
Click Network > Interfaces> List- In upper right corner, select pulldown 'Tunnel IF', and Click New
- Interface Name: tunnel.1
- Zone: Untrust (trust-vr)
- Click unnumbered
- Interface ethernet0/0 (trust-vr) (or whichever interface is in same zone (Untrust) that it can borrow an IP from)
- Click OK
- In upper right corner, select pulldown 'Tunnel IF', and Click New
- Click VPNs > AutoKey Advanced > Gateway
Click New- Gateway Name: Site B GW
- Remote Gateway: Click Static, and enter IP address 2.2.2.1
- Click Advanced
- Preshared Key: netscreen
- Outgoing Interface: ethernet0/0 (or whichever interface goes out to the Internet)
- Security Level, User-Defined: Select Custom, and select Phase 1 Proposal: pre-g2-3des-sha
- Mode (Initiator): Main
- Click Return
- Click OK
- Click VPNs > Autokey IKE
Click New- VPN Name: Site B VPN
- Remote Gateway: Click Predefined, and select Site B GW from the pulldown menu
- Click Advanced
- Security Level, User Defined: Custom, and select Phase 2 Proposal: g2-esp-3des-sha
- Bind To: Tunnel Interface. Select tunnel.1
- Click Proxy ID
- Local IP/Netmask: 10.1.1.0 / 24
- Remote IP/Netmask: 172.16.10.0 /24
- Service: ANY
- Click VPN Monitor (recommended)
- Click Optimized (recommended)
- Click Rekey (recommended)
- Click Return
- Click OK (Important)
- Click Policy > Policies
- Select From Trust to Untrust Zone, and click New
- Source Address: Click New Address, and enter 10.1.1.0/24
- Destination Address: Click New Address, and enter 172.16.10.0/24
- Service: Any
- Action: Permit (Note: Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
- Position at Top: Enabled
- Click OK
- Select From Untrust to Trust Zone, and click New
- Source Address: Click New Address, and enter 172.16.10.0/24
- Destination Address: Click New Address, and enter 10.1.1.0/24
- Service: Any
- Action: Permit (Note: Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
- Position at Top: Enabled
- Click OK
- Select From Trust to Untrust Zone, and click New
- Create static route for destination network through VPN:
- Click Network > Routing > Destination
- Click New
- Network Address / Netmask: 172.16.10.0 / 255.255.255.0
- Click Gateway
- Interface: tunnel.1
- Click OK
Site B:
- Create tunnel interface:
Click Network > Interfaces> List- In upper right corner, select pulldown 'Tunnel IF', and Click New
- Interface Name: tunnel.1
- Zone: Untrust (trust-vr)
- Click unnumbered
- Interface ethernet0/0 (trust-vr) (or whichever interface is in same zone (Untrust) that it can borrow an IP from)
- Click OK
- In upper right corner, select pulldown 'Tunnel IF', and Click New
- Click VPNs > AutoKey Advanced > Gateway
Click New- Gateway Name: Site A GW
- Remote Gateway: Click Static, and enter IP address 1.1.1.1
- Click Advanced
- Preshared Key: netscreen
- Outgoing Interface: ethernet0/0 (or whichever interface goes out to the Internet)
- Security Level, User-Defined: Select Custom, and select Phase 1 Proposal: pre-g2-3des-sha
- Mode (Initiator): Main
- Click Return
- Click OK
- Click VPNs > Autokey IKE
Click New- VPN Name: Site A VPN
- Remote Gateway: Click Predefined, and select Site A GW from the pulldown menu
- Click Advanced
- Security Level, User Defined: Custom, and select Phase 2 Proposal: g2-esp-3des-sha
- Bind To: Tunnel Interface. Select tunnel.1
- Click Proxy ID
- Local IP/Netmask: 172.16.10.0/24
- Remote IP/Netmask: 10.1.1.0/24
- Service: ANY
- Click VPN Monitor (recommended)
- Click Optimized (recommended)
- Click Rekey (recommended)
- Click Return
- Click OK (Important)
- Click Policy > Policies
- Select From Trust to Untrust Zone, and click New
- Source Address: Click New Address, and enter 172.16.10.0/24
- Destination Address: Click New Address, and enter 10.1.1.0/24
- Service: Any
- Action: Permit (Note: Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
- Position at Top: Enabled
- Click OK
- Select From Untrust to Trust Zone, and click New
- Source Address: Click New Address, and enter 10.1.1.0/24
- Destination Address: Click New Address, and enter 172.16.10.0/24
- Service: Any
- Action: Permit (Note: Do not select Tunnel or specify Tunnel VPN because this is a route-based VPN configuration)
- Position at Top: Enabled
- Click OK
- Select From Trust to Untrust Zone, and click New
- Create static route for destination network through VPN:
- Click Network > Routing > Destination
- Click New
- Network Address / Netmask: 10.1.1.0 / 255.255.255.0
- Click Gateway
- Interface: tunnel.1
- Click OK
NOTE:
If the tunnel interface is bound to the trust zone (i.e. you specified Zone Trust in step 1.1.2), then no policies are needed (i.e. step 4), since everything is routed. The VPN communication is effectively a trust to trust policy.
If the tunnel interface is bound to the trust zone (i.e. you specified Zone Trust in step 1.1.2), then no policies are needed (i.e. step 4), since everything is routed. The VPN communication is effectively a trust to trust policy.
CLI
Site A:
- Create tunnel interface
- set int tun.1 zone untrust
- set int tun.1 ip unnumbered interface e0/0
- Set Gateway
- set ike gateway "Site B GW" address 2.2.2.1 outgoing-interface e0/0 preshare netscreen proposal pre-g2-3des-sha
- Set Autokey Ike
- set vpn "Site B VPN" gateway "Site B GW" proposal g2-esp-3des-sha
- set vpn "Site B VPN" bind int tun.1
- set vpn "Site B VPN" proxy-id local-ip 10.1.1.10/24 remote-ip 172.16.10.0/24 any
- set vpn "Site B VPN" monitor optimized rekey
- Set Policies
- set address trust 10.1.1.0/24 10.1.1.0/24
- set address untrust 172.16.10.0/24 172.16.10.0/24
- set policy from trust to untrust 10.1.1.0/24 172.16.10.0/24 any permit
- set policy id xx move before (name of first policy) from trust to untrust
- set policy from untrust to trust 172.16.10.0/24 10.1.1.0/24 any permit
- set policy id xx move before (name of first policy) from untrust to trust
- Create static route
- set route 172.16.10.0/24 int tun.1
- Create tunnel interface
- set int tun.1 zone untrust
- set int tun.1 ip unnumbered interface e0/0
- Set Gateway
- set ike gateway "Site A GW" address 1.1.1.1 outgoing-interface e0/0 preshare netscreen proposal pre-g2-3des-sha
- Set Autokey Ike
- set vpn "Site A VPN" gateway "Site A GW" proposal g2-esp-3des-sha
- set vpn "Site A VPN" bind int tun.1
- set vpn "Site A VPN" proxy-id local-ip 172.16.10.0/24 remote-ip 10.1.1.10/24 any
- set vpn "Site A VPN" monitor optimized rekey
- Set Policies
- set address trust 172.16.10.0/24 172.16.10.0/24
- set address untrust 10.1.1.0/24 10.1.1.0/24
- set policy from trust to untrust 172.16.10.0/24 10.1.1.0/24 any permit
- set policy id xx move before (name of first policy) from trust to untrust
- set policy from untrust to trust 10.1.1.0/24 172.16.10.0/24 any permit
- set policy id xx move before (name of first policy) from untrust to trust
- Create static route
- set route 10.1.1.0/24 int tun.1
If you have performed the following procedure,and need help with troubleshooting, refer to the VPN Configuration & Troubleshooting Guide.
Configuration
피드 구독하기:
글 (Atom)