Category Archives: howto

Unifi USG Radius default vlan

on USG

/config/scripts/post-config.d/radius_default_vlan.sh

#!/bin/bash
# radius_default_vlan.sh
# This script goes in /config/scripts/post-config.d


if [[ -z "$1" ]] ; then
	echo "* * * * * root /config/scripts/post-config.d/radius_default_vlan.sh cron" > /etc/cron.d/radius_default_vlan
	exit 0
fi



if grep -q "DEFAULT Auth-Type" "/etc/freeradius/users" ; then
	exit 0
fi

cat >> /etc/freeradius/users <<EOF

DEFAULT Auth-Type := Accept
	Tunnel-Type             = 13,
	Tunnel-Medium-Type      = 6,
	Tunnel-Private-Group-Id = 1

EOF

service freeradius restart

install

chmod +x /config/scripts/post-config.d/radius_default_vlan.sh
/config/scripts/post-config.d/radius_default_vlan.sh

remove

rm /etc/cron.d/radius_default_vlan
rm /config/scripts/post-config.d/radius_default_vlan.sh

EdgeRouter IPv6

Interfaces used:

  • eth0: WAN
  • eth1: secondary WAN (optional)
  • eth2: LAN

Adjust accordingly.

Create firewall rules for WAN6_IN

edit firewall ipv6-name WAN6_IN
set default-action drop
set rule 10 action accept
set rule 10 description "allow established"
set rule 10 protocol all
set rule 10 state established enable
set rule 10 state related enable
set rule 20 action drop
set rule 20 description "drop invalid packets"
set rule 20 protocol all
set rule 20 state invalid enable
set rule 30 action accept
set rule 30 description "allow ICMPv6"
set rule 30 protocol icmpv6
top

Create firewall rules for WAN6_LOCAL

edit firewall ipv6-name WAN6_LOCAL
set default-action drop
set rule 10 action accept
set rule 10 description "allow established"
set rule 10 protocol all
set rule 10 state established enable
set rule 10 state related enable
set rule 20 action drop
set rule 20 description "drop invalid packets"
set rule 20 protocol all
set rule 20 state invalid enable
set rule 30 action accept
set rule 30 description "allow ICMPv6"
set rule 30 protocol icmpv6
set rule 40 action accept
set rule 40 description "allow DHCPv6 client/server"
set rule 40 protocol udp
set rule 40 source port 547
set rule 40 destination port 546
top

Assign IPv6 firewall rules to primary wan interface

set interfaces ethernet eth0 firewall in ipv6-name WAN6_IN
set interfaces ethernet eth0 firewall local ipv6-name WAN6_LOCAL

Assign IPv6 firewall rules to secondary wan interface (optional)

set interfaces ethernet eth1 firewall in ipv6-name WAN6_IN
set interfaces ethernet eth1 firewall local ipv6-name WAN6_LOCAL

Request prefix with eth0 and assign to eth2

Requested prefix size /60 for compatibility with FritzBox

edit interfaces ethernet eth0 dhcpv6-pd
set prefix-only
set pd 0 prefix-length /60
set pd 0 interface eth2 host-address ::1
set pd 0 interface eth2 prefix-id :0
set pd 0 interface eth2 service slaac
top

Set options for eth2

edit interfaces ethernet eth2 ipv6 router-advert
set send-advert true
set min-interval 200
set max-interval 600
set managed-flag true
set default-preference high
set prefix '::/64' autonomous-flag true
set prefix '::/64' preferred-lifetime 300
set prefix '::/64' valid-lifetime 600
top

finally

commit
save

Resources

https://washburn.at/howtos/edgeos-dhcpv6-pd
https://netwerk.io/ipv6-dhcpv6-pd-slaac-dnsmasq-edgeos/

ESXi configure SNMP

To configure the ESXi SNMP Agent:

  1. Open an SSH session to the ESXi host.
  2. Run this command to show the current SNMP config:
    esxcli system snmp get
  3. Set the SNMP parameters of the ESXi Host:
    esxcli system snmp set --communities public,eastnoc,westnoc
    esxcli system snmp set --syscontact user
    esxcli system snmp set --syslocation "location, world"
    
  4. Enable the SNMP Agent:
    esxcli system snmp set --enable true

Cisco Catalyst 9300 ios upgrade

  1. Remove Unwanted Packages
    install remove inactive
  2. Copy New Image to Flash
    copy usbflash0:/cat9k_iosxe.x.x.x.SPA.bin flash:/
  3. Set Boot Variable
    (config) boot system flash:packages.conf
    wr
    show boot system
  4. Software Install Image to Flash
    install add file flash:cat9k_iosxe.x.x.x.SPA.bin activate commit
  5. Verify New Packages and Image after reload
    dir flash:*.pkg
  6. Check Version and New Bootloader
    show version
  7. Clean up
    install remove inactive