Your unique network set-up

[RailWolf]

Greetings....   thought I would start this topic.

There's a lot of network experts/enthusiasts in the tastyspleen community, share your stuff!

So anyhow, I made a quick replica of my network in a Cisco training program I obtained from the CCNA course I took years ago.




All nics and switches are 10/100.

Start off with the modem.... basic DSL modem/router sent to me by bellsouth. PPPoE is done from here and it's set in the 'ip passthrough' mode. To give a rough description of that, the modem is forwarding the WAN IP to the device connected to the ethernet port.

Next in line.....router.   Who says you can't put that old Pentium II w/64MB of RAM to good use ?    This old horse is running Debian 3.1 Linux and is using a script which does the mighty function of NAT as well as a bullet-proof firewall. I've installed two nic cards in it which are seen as eth0 and eth1 in linux. dhcp3-server has been installed on it outside of the static network ip range for the purpose of my laptop's wireless.
I've connected eth0 to the port on the modem. The ip on eth0 is set to my WAN ip.  eth1 is set to a LAN address and is the network's gateway.    Yes, I do own linksys home routers... which are up in the closet Upon much work with some server applications I can say that using a linux machine as a router is much more reliable, capable, faster, and far more secure with the added firewall software.

Next is a basic netgear 10/100 switch. Pretty self explanatory from the image above and just general... well... it's a switch

All of my stationary computers and the server are static ip.  The debian 4.0 server runs all of the WallFly[BZZZ]'s for the bake-n-quake servers as well as TastyBot and WallFly[BZZZ] on our IRC channels. It has other personal functions for files and such but.. it's outside interaction is purely just to serve IRC and the goto for BnQ servers...

My wireless AP is a netgear wireless router. I connected a wire from the main switch to a switch port on this router, set a static ip of the device to one inside the network and disabled DHCP (in other words it's been turned into just an AP)..  WPA2 crypt on it, never acts weird or causes random connection resets... im pleased with it for my laptop I take back and forth from work.  This is where the dhcp3-server set up on my network's router comes into play.

-  There's a LOT of different configuration things I left out like the hosts files, hostnames, ip addresses, specific software versions, etc for the purpose of my own security  

It's a VERY reliable network.  I used a linksys router for a while and it was always having problems with mass simultaneous udp packet transmission required by quadz's awesome WallFly system, port forwarding and just.. bleh... lots of problems. I've spent a good bit of time with configuration of the router and server but it's well worth it.


Anyone out there who likes to tinker with networks ?

[reaper]

Hey, glad you are enjoying the network! 

I've been doing networking for some quite some time now, and I think you might be interested in this:
http://dynagen.org/tutorial.htm

Dynamips is a cisco router emulator,  basically on a PC you run the real IOS, and dynamips emulates the hardware of a cisco router.  What that means is that you can create simulations of entire networks virtually, and actually forward packets through it!  You won't get the packet forwarding performance, or be able to fully analyze how capable the real hardware is.  However i've been doing this for a while, this is a huge step in the right direction.  There is also a PIX firewall emulator, but for load-balancers, and firewalls, you can't simulate that 100 percent,  but anyways, it will also emulate switches, so it's almost a total mirror..

You can scale dynamips across mulitple servers, so it can scale quite well.  Anyways, here's a lab i've been working on.  I created it, and constantly I have been moving the production enviorment forward through the lab.

GNS3 is a gui for dynagen, and dynagen is a front-end management interface to dynamips (dynamips is the router emulator, allowing you to run real IOS).

The second screenshot is a terminal that actually connects to the lab, and I have a script which runs "screen", so I hit a number, and in one window  you're on a different router.   That is really nice for studying, and great for simulating production enviornments.

[reaper]

here's a funny site:

www.ratemynetworkdiagram.com


as long as you click "funny diagram"   

 

[UUD-40]

[Tailgunner]

Hi all

glad to see that there are some network expert guys in TastySpleen.. nice network setup, Wolf, and good idea about starting this post...
i also set up a network just for fun i got some cisco devices over the years, and i spent some time playing with them... (well.. a lot of these things i did also because it's my job )
here are 2 schemas i did using visio, in which is displayed the network configuration i set up, and where the TG-ITALY quake2 servers are running... the first is a "physical" scheme, showing how the devices are interconnected, the second one is a logical scheme, in which is displayed the L3 infrastructure


some explainations:
switch01: is a cisco catalyst 2950 24 port 10/100 switch, (hehe i would have liked to use a cisco 3750 layer 3 switch, but it's too expensive for me, lol) is the core switch, where all the devices are connected, obviouvsly, there are vlans configured on it, because i need devices in different network segments.

Debian01: is a old server running linux debian lenny, configured as a firewall-nat/pat it also has proxy functions for the internal network clients and runs a vpn server (openswan with certificates) configured for "roadwarriors" windows clients (l2tp/ipsec) . In order to gain vpn access, clients must have a certificate issued from an internal (self-signed) certification authority, the l2tp server running on the firewall is configured with radius plugin for  user authentication against the radius servers running on the Debian03 server. Also, this server has 4 network interfaces, but a single ethernet nic. In fact, as you can see, there is a 802.1Q trunk configured between the firewall and the switch, this can be called a "Firewall on a stick".

Debian02: Hehe... this is the public server where the TG* quake2 servers are running. There is also an http server configured for fast map downloads for players using "advanced" q2 clients, such as r1q2, aprq2, etc... the OS actually is linux debian lenny, and is placed in dmz because it's a public server.

Router02: this is an almost "old horse" router, i bought it several years ago over the internet just for testing, it's a very powerful platform, and allow me to do several interesting things. His ethernet interface is configured as a 802.1Q trunk, to be able to perform inter-vlan routing, (just the external and the guest vlans for security reasons) it acts as a firewall/nat and dhcp server for clients using the guest vlan, and as "edge" router (without NAT) for the external vlan. I configured some QOS on it to prioritize q2 and voice traffic over the all other protocols (such as http and ftp) because gaming and voice packets are sensible to the delay.


Debian03: another debian linux server. This is an internal server running an asterisk pbx, and the  dorkbuster (WallFly[BZZZZ]) q2 script server providing goto for all the TG* servers. Also, it acts as radius server for vpn and 802.1X authentication.

Ap01: this is a cisco aironet 1100 access point, configured for virtual ssid. actually it has 2 wireless networks configured on it, a guest ssid with wpa-psk, for allow guest pc to access the internet without entering in the internal network, and a strong wpa authentication for trusted clients which need to access the internal network. (these client need to have certificates installed on them to be able to authenticate)


   

[|iR|Focalor]

[[BTF]adam]

lol'd heartily.

[reaper]

asterisk is pretty cool.

I especially like how voip can be designed to fall back over to  the pots system

[Tailgunner]

hehe, yea asterisk is pretty cool.. is a very powerful pbx, and there are a lot of nice things you can do with it

in my setup actually is configured with three internet sip accounts acting as external lines, i am able to place/receive calls to/from fixed phones at a very suitable cost, and obviouvsly, i can talk for free with other ppl using sip phone numbers over the internet. I'd like to attach also the classic phone line on it.. i just miss a device acting as FXO port. I would like to use some external device, (for example a cisco router with FXS and FXO ports.)

on the internal side, there are software phones installed on the pc's, 2 old analogic phones connected through a grandstream HT386 and 2 cisco 7961 phones with sip firmware. (had to configure manually the xml files, set up an internal tftp server, and configure the option 150 on the dhcp server  to make them to work with asterisk, but it isn't too hard to do.  If you are interested in this... just ask )

also i configured music on hold, attended and unattended call transfer, and voicemail, but there are some other features (such as ivr) that i don't have (yet) used ...

[reaper]

yeah it's a pretty powerful platform.  I have only really worked with one asterisk box, and I try to stay away from it so I don't break anything.   I'm pretty sure the IVR is just a checkbox in Trixbox.  I would like to setup web based voice mail, since I despise voice mail.  Anyways, here's a script I wrote which connects to the asterisk API and monitors the queue length for a call group.  Based on it's condition you could then go add more agents to the queue and move them around, but I haven't done that yet.
   

#!/bin/bash
#run expect script to connect to asterisk AMI and login, turn off event output, and grab the tech support queue length
/etc/monitor/parse.exp > /dev/null 2>&1
#put the queue length in a variable
len=`grep "^2 *has" x_test | cut -d " " -f 14`
echo $len
if [ $len -ge 2 ] ; then
echo "FAIL" > /var/www/queuelength.html
else
echo "OK" > /var/www/queuelength.html
fi


[root@asterisk1 monitor]#

[root@asterisk1 monitor]# cat parse.exp
#!/usr/bin/expect
#
# Usage: ./vmcount.exp 1234@default

# The user account from manager.conf:
set username ""
set secret ""
set host "127.0.0.1"
set port "5038"


# Open connection to AMI:
spawn telnet $host $port

# Just in case telnet aborts because it cannot connect:
expect_before eof {
    send_user "Failed to connect.\n"
    exit 1
}

# Wait for the text "Manager"; once received, send a login packet:
#
expect "Manager/1.0" {
    send_user "Connected.\n"
    send "Action: Login\nEvents: off\nUsername: $username\nSecret: $secret\n\n"
    # Please note that telnet automatically converts line feeds
    # (\n) to CR LF (\r\n) - so you must not write \r\n here.
}

# Login successful?:
#

log_file -noappend /etc/monitor/x_test

expect "Success"
send "Action: Queues\n\n"

expect "default"
send "Action: Logoff\n\n"
log_file

[Tailgunner]

hehe, nice script
i think there are a lot of things to do with the manager api,  i never used it,  but it seems very useful... it's also possible interact with it using php or java... and create some kind of web application. I think there are already some applications ready to use with it... 

Is almost easy to configure a ivr in asterisk... you can do it directly in extensions.conf, we did it at our office recording the voice of a girl who was working with us also in our office, we used a gsm card, so, if a call is directed to a cell phone (here all the cell phone's numbers begins with 3) it's routed on the gsm card. This allow us to save some money if we have to call someone on his cell

About Voicemail... well... Asterisk can be configured to send an email to the user with the message attached in it, so, if there is a webmail system running... the user can check his voicemail messages using the web of course this is a very basic web voicemail access (hehe, it isn't properly a web voicemail) but it has also some advantages... the message is basically an email, so the user can access it also using his pop3/imap client (or lotus notes/outlook), or by using his mobile device, and it works without the need to implement  additional services (email systems already exists almost everywhere), you don't have to provide users with dedicated websites, (with all the implications... such as setting up webservers, making them publicly available, securing them with ssl certificates and whatever) additional usernames and passwords. 

[reaper]

I don't know, I don't want to go to regular webmail or my mail client.  I just want a website where it has a list, voice mail:
time,caller - listen....

[Tailgunner]

you can have a look on astmail (http://sourceforge.net/project/memberlist.php?group_id=172433) is a php applications and use a mysql database. I didn't tried it, but it seems interesting...