Blocking ZenMate

CheckPoint:
Image.png

Cisco ASA:

(config)# object-group network zenmate
(config)# network-object host 78.137.98.120
(config)# network-object host 78.137.98.123
(config)# network-object host 162.159.244.96
(config)# network-object host 162.159.245.96
(config)# network-object host 207.244.77.22
(config)# network-object host 103.10.197.146
(config)# network-object host 46.165.220.211
(config)# network-object host 81.17.26.242
(config)# network-object host 149.3.140.250

(config)# access-list acl-inside extended deny ip any object-group zenmate

Cyberoam:

FortiGate:

Juniper:

Mikrotik:
# export
/ip firewall address-list
add address=12.12.12.0/24 list=LAN
/ip firewall layer7-protocol
add name=zenmate regexp=”^.+(zenguard.biz|zenmate.io|zenguard.zendesk.com|zendesk.com|zenguard.org).*\$”
/ip firewall filter

add action=drop chain=forward disabled=yes layer7-protocol=zenmate src-address-list=LAN

PaloAlto:

SonicWall:

FortiClient IPSec VPN

Image

1. Create 2 users, User1 and User2
go to User & Device/User/User Definition
2. Create 1 group named vpn and add User1 and User2 into vpn group
go to User & Device/User/User Groups
3. Create a Policy to allow LAN address to WAN1 address
go to Policy & Objects/Policy/IPv4

Image

4. Create VPN Wizard for Windows, Mac or Android
go to VPN/IPSec/Wizard

Image

Image

Image

Image

Image

5. Create VPN Wizard for IOS
go to VPN/IPSec/Wizard
 Image
Image
Image
Image
6. Policy & Objects/Policy/IPv4
 Image
7. FortiClient Windows Setup
-download and install FortiClient for Windows from http://www.forticlient.com
Image
8. FortiClient Android Setup
-download and install FortiClient from PlayStore

9. IOS Native Client Setup
-open Settings/VPN/
click Add VPN Configuration
click IPSec
Server: 10.0.10.54
Account: user1
Password: password
Secret: password

Site-to-Site IPsec VPN Cisco Router to FortiGate

Image

SOURCE: http://blog.webernetz.net/2015/02/02/ipsec-site-to-site-vpn-fortigate-cisco-router/

ROUTER1
# sh run
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname RTR2811a
boot-start-marker
boot system flash:c2800nm-adventerprisek9-mz.151-4.M10.bin
warm-reboot count 10 uptime 7
boot-end-marker
aaa new-model
aaa session-id common
dot11 syslog
ip source-route
ip cef
ip dhcp excluded-address 10.0.31.201 10.0.31.254
ip dhcp excluded-address 10.0.31.1 10.0.31.100
ip dhcp pool pool10.0.31.0
network 10.0.31.0 255.255.255.0
default-router 10.0.31.1
dns-server 8.8.8.8 8.8.4.4
no ip domain lookup
ip domain name nbctcp.com
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
multilink bundle-name authenticated
redundancy
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28800
crypto isakmp key P@ssw0rd address 0.0.0.0 0.0.0.0
crypto ipsec transform-set TS esp-3des esp-md5-hmac
crypto ipsec profile 3DESMD5
set transform-set TS
set pfs group2
!
interface Tunnel1
ip unnumbered FastEthernet0/0.206
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.207
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel2
ip unnumbered FastEthernet0/0.221
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.221
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel3
ip unnumbered FastEthernet0/0.224
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.224
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel4
ip unnumbered FastEthernet0/0.226
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.226
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel5
ip unnumbered FastEthernet0/0.228
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.228
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel6
ip unnumbered FastEthernet0/0.230
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.230
tunnel protection ipsec profile 3DESMD5
!
interface Tunnel7
ip unnumbered FastEthernet0/0.232
tunnel source 10.0.10.206
tunnel mode ipsec ipv4
tunnel destination 10.0.10.232
tunnel protection ipsec profile 3DESMD5
!
interface FastEthernet0/0
ip address 10.0.10.206 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 10.0.31.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.0.10.1
ip route 10.0.41.0 255.255.255.0 Tunnel1
ip route 10.0.42.0 255.255.255.0 Tunnel2
ip route 10.0.43.0 255.255.255.0 Tunnel3
ip route 10.0.44.0 255.255.255.0 Tunnel4
ip route 10.0.45.0 255.255.255.0 Tunnel5
ip route 10.0.46.0 255.255.255.0 Tunnel6
ip route 10.0.47.0 255.255.255.0 Tunnel7
access-list 101 permit ip 10.0.31.0 0.0.0.255 any
!
control-plane
mgcp fax t38 ecm
mgcp profile default
line con 0
line aux 0
line vty 0 4
transport input all
line vty 5 15
transport input ssh
scheduler allocate 20000 1000
end

– refresh routing table if needed
# clear ip route *

FORTIGATE2
-create objects
Image

-create a vpn tunnel
Image

Image

Image

-create Policy/IPv4
Image
-create a static route
Image
-Back to Cisco1
make sure after 5min, 10.0.44.0 through Tunnel4 is appear
# clear ip route *
# sh ip route
S*    0.0.0.0/0 [1/0] via 10.0.10.1
10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks
C        10.0.10.0/24 is directly connected, FastEthernet0/0
L        10.0.10.206/32 is directly connected, FastEthernet0/0
C        10.0.31.0/24 is directly connected, FastEthernet0/1
L        10.0.31.1/32 is directly connected, FastEthernet0/1
S        10.0.41.0/24 is directly connected, Tunnel1
S        10.0.43.0/24 is directly connected, Tunnel3
S        10.0.44.0/24 is directly connected, Tunnel4
S        10.0.47.0/24 is directly connected, Tunnel7

You can try ping from PC1 to PC2 now

Site-to-Site IPsec VPN Cyberoam to FortiGate

Image

CYBEROAM1
-create FGT2LAN network
Image-create 2 Firewall rules
ImageImage-create a VPN IPsec Connection
Image

-click Activate on the new ipsec rule.

We will click Connection after FortiGate configured

FORTIGATE2
-create 2 objects address

Image

Image

-create a VPN tunnel
Image

Image

Image

-Create 2 Policy/IPv4
Image

Image

-create a Static route
Image

-back to CYBEROAM1
click Connection
Image

You can try ping from PC1 to PC2 now

Site-to-Site IPsec VPN FortiGate to SonicWall

Image

SOURCE: https://www.youtube.com/watch?v=EHXx3IQ6jb8
http://www.sysprobs.com/guide-to-setup-vpn-between-sonicwall-and-fortigate-ipsec-site-to-site-vpn

FORTIGATE1
-create 2 internal subnet objects address FGT1LAN and SW2LAN.
Image

-create a VPN tunnel
Image

Image

Image
Image

-create 2 policies rules
Image

Image

-create static route to SW2LAN through VPN tunnel
Image

SONICWALL2
-create 2 network objects SW2LAN and FGT1LAN
NOTE: FGT1LAN is in VPN Zone
Image-create a VPN/Settings

Image

Image

Image

Image

You can try ping from PC1 to PC2 now

Site-to-Site IPsec VPN Cisco ASA and FortiGate

Image

SOURCE: https://pinoyittechnotes.wordpress.com/2013/06/01/site-to-site-vpn-between-fortigate-and-asa/
http://socpuppet.blogspot.com/2014/05/site-2-site-vpn-fortinet-fortigate-to.html
http://socpuppet.blogspot.com/2013/10/site-2-site-routed-vpn-trouble-shooting.html
http://blog.webernetz.net/2015/02/05/ipsec-site-to-site-vpn-fortigate-cisco-asa/
http://kb.herator.se/index.php/article/fortigate-common-errors-when-debug-ipsec-tunnel
http://www.networkworld.com/article/2288666/lan-wan/chapter-4–common-ipsec-vpn-issues.html

ASA1
Image

Image

Image

Image

Image

Image

Image

Image

Image

Image

Image

09-Jul 09.09.27

Image

Image

Image

Image

Image

Image

Image
FORTIGATE2
Image

Image

Image

Image

Image

Image

Image

Image

Image

Image

Troubleshooting
ASA:
# diag debug app ike -1
# diag debug enable

FORTIGATE:
-check communication appear between ASA and FORTIGATE
# diag sniffer packet wan1 “udp and dst port 500”
-check in FortiGate GUI on Log & Report/Event Log/VPN

You can try ping from PC1 to PC2 now

Eve-NG Installation on ESXi

ESXi:
-check your CPU support virtualization
http://ark.intel.com/Products/VirtualizationTechnology

-check your hardware support virtualization
# esxcfg-info |grep “HV Support”
|—-HV Support……………………………………..3
|—-World Command Line……………………………grep HV Support
0 – VT/AMD-V indicates that support is not available for this hardware.
1 – VT/AMD-V indicates that VT or AMD-V might be available but it is not supported for this hardware.
2 – VT/AMD-V indicates that VT or AMD-V is available but is currently not enabled in the BIOS.
3 – VT/AMD-V indicates that VT or AMD-V is enabled in the BIOS and can be used.

-Edit the VM settings and go to VM settings > Options > CPUID mask > Advanced > Level 1, add the following CPU mask level
ECX —- —- —- —- —- —- –H- —-
NOTE: do above only if all else failed

-Edit the VM settings and go to VM settings > Options > CPU/MMU
Virtualization . Select
“Use Intel VT-x/AMD-V for instruction set virtualization and Intel EPT/AMD RVI for MMU virtualization”
Image

-vm hardware version must be version 9 or above
# vim-cmd vmsvc/getallvms
# vim-cmd vmsvc/upgrade unetlab-vmid vmx-09

-modify /etc/vmware/config
add in the last line then  logout and relogin from web gui
vhv.enable = “TRUE”
or better
modify /vmfs/volume/datastore1/UnetLab/UnetLab.vmx
add to the last line
vhv.enable = “TRUE”

-should show “nestedHVSupported true”
# vim-cmd vmsvc/get.capability 8

-test in ubuntu
# egrep -c ‘(vmx|svm)’ /proc/cpuinfo
the output should be 8

-to reconfigure network
# rm -f /opt/ovf/.configured
# exit
and login back

-if sometime you can’t login Web GUI, try this
# /etc/init.d/apache2 restart

Download Unetlab from: http://www.eve-ng.net/index.php/downloads

-check current version
# dpkg -l eve-ng
ii  eve-ng         2.0.3-53     amd64        A new generation software for net
# apt autoremove (answer Y)
# apt-get update
# apt-get install eve-ng
# apt-get dist-upgrade (answer Y)
# reboot ( if previous version < V84 )
-check new version
# dpkg -l eve-ng
ii  eve-ng         2.0.3-60     amd64        A new generation software for net

-to check what version are you running and what version is the freshest one
# cat /etc/apt/sources.list.d/unetlab.list
deb http://www.unetlab.com/apt trusty rrlabs
# apt-cache policy unetlab
unetlab:
Installed: 0.9.0-96
Candidate: 0.9.0-96
Version table:
*** 0.9.0-96 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
100 /var/lib/dpkg/status
0.9.0-94 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
0.9.0-92 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
0.9.0-88 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
0.9.0-76 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
0.9.0-70 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
0.9.0-68 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages
0.9.0-54 0
500 http://www.unetlab.com/apt/ trusty/rrlabs amd64 Packages

-Below is the reference node in UNL: “/opt/unetlab/html/includes/init.php”
‘a10’ => ‘A10 vThunder’,
‘osx’ => ‘Apple OSX’,
‘clearpass’ => ‘Aruba ClearPass’,
‘aruba’ => ‘Aruba WiFi Controller’,
‘veos’ => ‘Arista vEOS’,
‘barracuda’ => ‘Barraccuda NGIPS’,
‘brocadevadx’ => ‘Brocade vADX’,
‘cpsg’ => ‘CheckPoint Security Gateway VE’,
//’docker’ => ‘Docker.io’,
‘acs’ => ‘Cisco ACS’,
‘ampcloud’ => ‘Cisco AMP Cloud’,
‘asa’ => ‘Cisco ASA’,
‘asav’ => ‘Cisco ASAv’,
‘cda’ => ‘Cisco Context Directory Agent’,
‘csr1000v’ => ‘Cisco CSR 1000V’,
‘csr1000vng’ => ‘Cisco CSR 1000V (Denali and Everest)’,
‘cips’ => ‘Cisco IPS’,
‘cucm’ => ‘Cisco CUCM’,
‘ise’ => ‘Cisco ISE’,
‘c1710’ => ‘Cisco IOS 1710 (Dynamips)’,
‘c3725’ => ‘Cisco IOS 3725 (Dynamips)’,
‘c7200’ => ‘Cisco IOS 7206VXR (Dynamips)’,
‘iol’ => ‘Cisco IOL’,
‘titanium’ => ‘Cisco NX-OSv (Titanium)’,
‘nxosv9k’ => ‘Cisco NX-OSv 9K’,
‘firepower’ => ‘Cisco FirePower’,
‘firepower6’ => ‘Cisco FirePower 6′,
//’ucspe’ => ‘Cisco UCS-PE’,
‘vios’ => ‘Cisco vIOS’,
‘viosl2’ => ‘Cisco vIOS L2’,
‘vnam’ => ‘Cisco vNAM’,
‘vwlc’ => ‘Cisco vWLC’,
‘vwaas’ => ‘Cisco vWAAS’,
‘prime’ => ‘Cisco Prime Infra’,
‘phoebe’ => ‘Cisco Email Security Appliance (ESA)’,
‘coeus’ => ‘Cisco Web Security Appliance (WSA)’,
‘xrv’ => ‘Cisco XRv’,
‘xrv9k’ => ‘Cisco XRv 9000’,
‘nsvpx’ => ‘Citrix Netscaler’,
‘sonicwall’ => ‘Dell SonicWall’,
‘cumulus’ => ‘Cumulus VX’,
‘extremexos’ => ‘ExtremeXOS’,
‘bigip’ => ‘F5 BIG-IP LTM VE’,
‘fortinet’ => ‘Fortinet FortiGate’,
‘huaweiusg6kv’ => ‘Huawei USG6000v’,
‘hpvsr’ => ‘HP VSR1000’,
‘jspace’ => ‘Junos Space’,
‘olive’ => ‘Juniper Olive’,
‘vmx’ => ‘Juniper vMX’,
‘vmxvcp’ => ‘Juniper vMX VCP’,
‘vmxvfp’ => ‘Juniper vMX VFP’,
‘vsrx’ => ‘Juniper vSRX’,
‘vsrxng’ => ‘Juniper vSRX NextGen’,
‘vqfxre’ => ‘Juniper vQFX RE’,
‘vqfxpfe’ => ‘Juniper vQFX PFE’,
‘junipervrr’ => ‘Juniper RR’,
‘linux’ => ‘Linux’,
‘mikrotik’ => ‘MikroTik RouterOS’,
‘timos’ => ‘Nokia 7750 VSR-I’,
‘timoscpm’ => ‘Nokia 7750 CPM’,
‘timosiom’ => ‘Nokia 7750 IOM’,
‘ostinato’ => ‘Ostinato’,
‘paloalto’ => ‘Palo Alto VM-100 Firewall’,
‘pfsense’ => ‘pfSense Firewall’,
‘alteon’ => ‘Radware AlteonVA’,
‘riverbed’ => ‘Riverbed’,
‘sterra’ => ‘S-Terra’,
‘vyos’ => ‘VyOS’,
‘esxi’ => ‘VMWare ESXi’,
‘vcenter’ => ‘VMWare vCenter’,
‘win’ => ‘Windows’,
‘winserver’ => ‘Windows Server’,
‘vpcs’ => ‘Virtual PC (VPCS)’

Qemu folder name EVE Vendor Qemu image .qcow2 name
a10- A10-vthunder hda
osx- Apple OSX
clearpass- Aruba ClearPass hda
aruba- Aruba WiFi Controller hda, hdb
veos Arista vEOS hda, cdrom.iso
barracuda- Barraccuda NGIPS hda
brocadevadx- Brocade vADX virtioa
cpsg- CheckPoint Security Gateway VE hda
docker- Docker.io
acs- Cisco ACS hda
ampcloud Cisco AMP Cloud
asa- Cisco ASA hda
asav- Cisco ASAv virtioa
cda- Cisco Context Directory Agent hda
csr1000v- Cisco CSR 1000v virtioa
csr1000vng- Cisco CSR 1000v (Denali and Everest) virtioa
cips- Cisco IPS hda, hdb
cucm- Cisco CUCM virtioa
ise- Cisco ISE hda
titanium- Cisco NX-OSv (Titanium) virtioa
nxosv9k- Cisco NX-OSv 9k hda
firepower- Cisco FirePower scsia
firepower6- Cisco FirePower 6 hda
ucspe Cisco UCS-PE
vios- Cisco vIOS virtioa
viosl2- Cisco vIOS L2 virtioa
vnam- Cisco vNAM hda
vwlc- Cisco vWLC megasasa
vwaas- Cisco vWAAS virtioa
prime- Cisco Prime Infra
phoebe- Cisco Email Security Appliance (ESA) hda
coeus- Cisco Web Security Appliance (WSA) virtioa
xrv- Cisco XRv hda
xrv9k- Cisco XRv 9000 virtioa
nsvpx- Citrix Netscaler virtioa
sonicwall- DELL Sonicwall hda
cumulus- Cumulus VX hda
extremexos- ExtremeOS hda
bigip- F5 BIG-IP LTM VE hda, hdb
fortinet- Fortinet FW virtioa
fortinet- Fortinet SGT virtioa
fortinet- Fortinet mail virtioa, virtiob
fortinet- Fortinet manager virtioa
huaweiusg6kv Huawei USG6000v
hpvsr- HP VSR1000 hda
jspace- Junos Space hda
olive- Juniper Olive hda
vmx- Juniper vMX hda
vmxvcp- Juniper vMXVCP hda, hdb, hdc
vmxvfp- Juniper vMXVFP hda
vsrx- Juniper vSRX virtioa
vsrxng- Juniper vSRX NextGen hda
vqfxre- Juniper vQFXRE hda
vqfxpfe- Juniper vQFXPFE hda
junipervrr Juniper RR
linux- Linux hda
mikrotik- MikroTik RouterOS hda
timos- Nokia 7750 VSR-I hda
timoscpm- Nokia 7750 CPM
timosiom- Nokia 7750 IOM
ostinato- Ostinato traffic generator hda
paloalto- Palo Alto VM-100 Firewall virtioa
pfsense- pfSense Firewall hda
alteon- Radware AlteonVA virtioa
riverbed- Riverbed virtioa, virtiob
sterra- S-terra VPN hda
vyos- VyOS virtioa
esxi- VMWare ESXi
vcenter- VMWare Vcenter
win- Windows hda
winserver- Windows Server hda
vpcs Virtual PC (VPCS)

-to install ios image
scp c1710-bk9no3r2sy-mz.124-23.bin, c3725-adventerprisek9-mz.124-15.T14.bin and c7200-adventerprisek9-mz.152-4.S6.bin to /opt/unetlab/addons/dynamips
# cd /opt/unetlab/addons/dynamips
# unzip c1710-bk9no3r2sy-mz.124-23.bin
# unzip c3725-adventerprisek9-mz.124-15.T14.bin
# unzip c7200-adventerprisek9-mz.152-4.S6.bin
# mv C1710-BK.BIN c1710-bk9no3r2sy-mz.124-23.image
# mv C3725-AD.BIN c3725-adventerprisek9-mz.124-15.T14.image
# mv C7200-AD.BIN c7200-adventerprisek9-mz.152-4.S6.image
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install asa
# mkdir -p /opt/unetlab/addons/qemu/asa-8.42
scp ASA-8.42.vmdk and ASA-8.42-0.vmdk into /opt/unetlab/addons/qemu/asa-8.42
# cd /opt/unetlab/addons/qemu/asa-8.42
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 ASA-8.42.vmdk hda.qcow2
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 ASA-8.42-0.vmdk hdb.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
create two asa node with ram 1024mb
ASA1
# conf t
(config)# hostname asa1
(config)# int e0
(config-if)# ip add 10.0.0.101 255.255.255.0
(config-if)# nameif outside
(config-if)# no sh
ASA2
# conf t
(config)# hostname asa2
(config)# int e0
(config-if)# ip add 10.0.0.102 255.255.255.0
(config-if)# nameif outside
(config-if)# no sh
(config-if)# end
# ping 10.0.0.101# mkdir -p /opt/unetlab/addons/qemu/asa-9.15
scp hda.qcow2 and hdb.qcow2 into /opt/unetlab/addons/qemu/asa-9.15
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
NOTE:
Forum said only asa-9.15 can do Active/Active

-to install a10
# mkdir -p /opt/unetlab/addons/qemu/a10-4.0.1
# scp vThunder-4.0.1.ova into /opt/unetlab/addons/qemu/a10-4.0.1
# cd  /opt/unetlab/addons/qemu/a10-4.0.1
# tar xf vThunder-4.0.1.ova
# # /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 vThunder-4.0.1-disk1.vmdk hda.qcow2

# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

 -to install acs
download acs-5.7.0.15.iso
create acs vm in ESXi with 4GB RAM, 2x CPU core, 40GB thin disk, OS Other Linux 64bit
boot acs vm and attach acs-5.7.0.15.iso
Image
after install, reboot and remove detach acs.iso
login: setup
Enter hostname[]: acs
Enter IP address: 10.0.20.86
Enter IP netmask[]: 255.255.255.0
Enter IP default gateway[]: 10.0.20.1
Enter default DNS domain[]: poc.com
Enter primary nameserver[]: 8.8.8.8
Add seconday nameserver? Y/N [N}:
Enter NTP server[time.nist.gov]:
Add another NTP server? Y/N [N]:
Enter system timezone[UTC]: GMT
Enable SSH service? Y/N [N]: y
Enter username[admin]:
Enter password:
Enter password again:shutdown acs vm
ssh as root to unetlab
# mkdir -p /opt/unetlab/addons/qemu/acs-5.7.0.15
ssh as root into ESXi
# cd /vmfs/volume/datastore1/acs
# scp *vmdk root@10.0.20.71:/opt/unetlab/addons/qemu/acs-5.7.0.15
switch to unetlab
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 acs.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
-to install asav
# mkdir -p /opt/unetlab/addons/qemu/asav-932-200
scp asav932-200.qcow2 into /opt/unetlab/addons/qemu/asav-932-200
# cd /opt/unetlab/addons/qemu/asav-932-200
# cp -p asav932-200.qcow2 hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
create asav lab
Make sure console is vnc in unl file.
# cat /opt/unetlab/labs/LAB.unl

logout and relogin from web gui

-to install Aruba CX
# mkdir /opt/unetlab/addons/qemu/aruba-cx-10_02
scp ArubaOS-CX_10_02_0010_ova.zip into /tmp
# cd /tmp
# unzip ArubaOS-CX_10_02_0010_ova.zip
# tar xf ArubaOS-CX_10_02_0010.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 arubaoscx-disk-image-genericx86-p4-20190129201401.vmdk /opt/unetlab/addons/qemu/aruba-cx-10_02/hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
Wipe before Start node
L: admin
P:

-to install Aruba MM
# mkdir /opt/unetlab/addons/qemu/aruba-mm-8.2.0.2
scp ArubaOS_MM_8.2.0.2_62929.ova into /tmp
# cd /tmp
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 ArubaOS_MM_8.2.0.2_62929-disk1.vmdk /opt/unetlab/addons/qemu/aruba-mm-8.2.0.2 /hda.qcow2
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 ArubaOS_MM_8.2.0.2_62929-disk2.vmdk /opt/unetlab/addons/qemu/aruba-mm-8.2.0.2 /hdb.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
-set 6GB RAM and 3 CPU minimum. NICs must be 3 before turn on

-to install aruba vmc
# mkdir -p /opt/unetlab/addons/qemu/aruba-vmc-8.2.0.2
scp ArubaOS_VMC_8.2.0.2_62929.tar into /tmp
# tar xf ArubaOS_VMC_8.2.0.2_62929.tar
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 ArubaOS_VMC_8.2.0.2_62929-disk1.vmdk /opt/unetlab/addons/qemu/aruba-vmc-8.2.0.2/hda.qcow2
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 ArubaOS_VMC_8.2.0.2_62929-disk2.vmdk /opt/unetlab/addons/qemu/aruba-vmc-8.2.0.2/hdb.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install bigip-12.0
download BIGIP-12.0.0.1.0.628.LTM.qcow2.zip from
https://downloads.f5.com/esd/serveDownload.jsp?path=/big-ip/big-ip_v12.x/12.0.0/english/virtual-edition_base-plus-hf1/&sw=BIG-IP&pro=big-ip_v12.x&ver=12.0.0&container=Virtual-Edition_Base-Plus-HF1&file=BIGIP-12.0.0.1.0.628.LTM.qcow2.zip
# mkdir -p /opt/unetlab/addons/qemu/bigip-12.0/
scp BIGIP-12.0.0.1.0.628.LTM.qcow2.zip into /opt/unetlab/addons/qemu/bigip-12.0/
# cd /opt/unetlab/addons/qemu/bigip-12.0/
# unzip BIGIP-12.0.0.1.0.628.LTM.qcow2.zip
# rm BIGIP-12.0.0.1.0.628.LTM.qcow2.zip
# mv BIGIP-12.0.0.1.0.628.LTM.qcow2 hda.qcow2

# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install brocadevadx
# mkdir -p /opt/unetlab/addons/qemu/brocadevadx-3100
# scp SSR3100ESX_EVAL.zip into /opt/unetlab/addons/qemu/brocadevadx-3100
# cd /opt/unetlab/addons/qemu/brocadevadx-3100
# unzip SSR3100ESX_EVAL.zip
# tar xf SSR03100ESX.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 SSR1000ESX-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

Make sure console is vnc in unl file.
# cat /opt/unetlab/labs/LAB.unl

logout and relogin from web gui

-to install cda
open ESXi and prepare cda vm with minimum spec
OS: Windows 2003, 2008, 2008R2, 2012, 2012R2
Disk Size: 120GB
RAM: 2GB
CPU: 2 virtual core
NIC: 1pc
See p2-2

Click to access cda10.pdf

Download and install cda_1.0.0.011.i386.iso
see p2-12 pdf above
shutdown vm
ssh as root into unetlab
# mkdir -p /opt/unetlab/addons/qemu/cda-1.0
ssh as root into ESXi
# cd /vmfs/volume/datastore1/cda
# scp *vmdk root@10.0.20.71:/opt/unetlab/addons/qemu/cda-1.0
ssh as root to unetlab server
# cd /opt/unetlab/addons/qemu/cda-1.0
# /opt/qemu/bin/qemu-img create -f qcow cda-flat.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install cips
# mkdir -p /opt/unetlab/addons/qemu/cips-4240
scp IPS-4240.ova into /opt/unetlab/addons/qemu/cips-4240
# cd /opt/unetlab/addons/qemu/cips-4240
# tar xf IPS-4240.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 IPS-4240-disk1.vmdk hda.qcow2
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 IPS-4240-disk2.vmdk hdb.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
when you start cips for first time
L: cisco
P: cisco

-to install clearpass
scp CPPM-VM-x86_64-6.7.0.101814-ESX-ovf.zip into /tmp
# mkdir -p /opt/unetlab/addons/qemu/clearpass-6.7.0
# cd /tmp
# unzip CPPM-VM-x86_64-6.7.0.101814-ESX-ovf.zip
# cd CPPM-VM-x86_64-6.7.0.101814-ESX
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 CPPM-VM-x86_64-6.7.0.101814-ESX-CP-VA-disk1.vmdk /opt/unetlab/addons/qemu/clearpass-6.7.0/hda.qcow2
# cd /opt/unetlab/addons/qemu/clearpass-6.7.0
# /opt/qemu/bin/qemu-img create -f raw hdb.qcow2 80G
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install cnMaestro
download cnMaestro on-premise
https://www.cambiumnetworks.com/products/management/cnmaestro/
# mkdir -p /opt/unetlab/addons/qemu/linux-cnmaestro
scp cnmaestro-on-premises_2.1.0-r22_amd64.ova /opt/unetlab/addons/qemu/linux-cnmaestro
# cd /opt/unetlab/addons/qemu/linux-cnmaestro
# tar xvf cnmaestro-on-premises_2.1.0-r22_amd64.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 cnmaestro-on-premises_2.1.0-r22_amd64-disk1.vmdk qcow2 hda.qcow2
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 cnmaestro-on-premises_2.1.0-r22_amd64-disk2.vmdk hdb.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install coeus
# mkdir -p /opt/unetlab/addons/qemu/coeus-9.0.0.324
scp coeus-9-0-0-324-S100V.zip into /opt/unetlab/addons/qemu/coeus-9.0.0.324
# cd /opt/unetlab/addons/qemu/coeus-9.0.0.324
# unzip coeus-9-0-0-324-S100V.zip
# mv coeus-9-0-0-324-S100V/coeus-9-0-0-324-S100V-disk1.vmdk ..
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 coeus-9-0-0-324-S100V-disk1.vmdk virtioa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
# vi /opt/unetlab/html/templates/coeus.php
change
$p[‘console’] = ‘telnet’;
to
$p[‘console’] = ‘vnc’;

-to install cpsg
download CheckPoint GAIA R77-30 iso
create cpsg-r7730 vm in ESXI with 30GB HD, 2GB RAM, 4 nics and Other Linux 64bit
1. Install Gaia on this system
press Enter
2. Keyboard Selection
click US and OK
3. Partitions Configuration
click OK
4. Account Configuration
Password:
Confirm:
click OK
5. Management Port
choose your manament nic
click OK
6. Management Interface (eth0)
IP address:
Netmask:
Default gateway:
click OK
7. Confirmation
click OK
Shutdown vm and export as ova
# mkdir -p /opt/unetlab/addons/qemu/cpsg-r7730
scp cpsg-r7730.ova into /opt/unetlab/addons/qemu/cpsg-r7730
# tar xf cpsg-r7730.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 cpsg-r7730-disk1.vmdk hda.qcow2

# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install csr
# mkdir -p /opt/unetlab/addons/qemu/csr1000v-universalk9.03.14.00.S.155-1.S
scp csr1000v-universalk9.03.14.01.S.155-1.S1-std.ova into /opt/unetlab/addons/qemu/csr1000v-universalk9.03.14.00.S.155-1.S
# cd /opt/unetlab/addons/qemu/csr1000v-universalk9.03.14.00.S.155-1.S
# tar xf csr1000v-universalk9.03.14.01.S.155-1.S1-std.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 csr1000v_harddisk.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install cumulus
Download Cumulus VX for VMware from https://cumulusnetworks.com/cumulus-vx/download/
# mkdir -p /opt/unetlab/addons/qemu/cumulus-2.5.3
scp CumulusVX-2.5.3-4eb681f3df86c478.vmware.ova /opt/unetlab/addons/qemu/cumulus-2.5.3
# cd /opt/unetlab/addons/qemu/cumulus-2.5.3
# tar xf CumulusVX-2.5.3-4eb681f3df86c478.vmware.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 CumulusVX-2.5.3-4eb681f3df86c478-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install extremexos
# mkdir -p /opt/unetlab/addons/qemu/extremexos-15.3.2.11
scp extremexosvm.zip /opt/unetlab/addons/qemu/extremexos-15.3.2.11
# cd /opt/unetlab/addons/qemu/extremexos-15.3.2.11
# unzip extremexosvm.zip
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 “EXOS_VM_15.3.2.11 sw1.vmdk” hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install linux cyberoam
# cp linux-cyberoam.tar /opt/unetlab/addons/qemu/
# tar xf linux-cyberoam.tar
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
Set
CPU: 1
RAM: 1024MB
Ethernet: 3
QEMU Nic: E1000

Console: vnc

-to install fortinet
NOTE:
We must download fortios KVM version not VMware version. The hd name must be virtioa not hda otherwise you will get country error
# mkdir -p /opt/unetlab/addons/qemu/fortinet-5.2.3b670
scp fortios_5-2-3.qcow2 into /opt/unetlab/addons/qemu/fortinet-5.2.3b670
# cd /opt/unetlab/addons/qemu/fortinet-5.2.3b670
# mv fortios_5-2-3.qcow2 virtioa.qcow2

# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to add log disk
# cd /opt/unetlab/addons/qemu/fortinet-5.6
create 500MB log disk size
# /opt/qemu/bin/qemu-img create -f raw virtiob.qcow2 500M
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
on FortiGate
# get system status
Version: FortiGate-VM64-KVM v5.6.0,build1449,170330 (GA)
Virus-DB: 1.00123(2015-12-11 13:18)
Extended DB: 1.00000(2012-10-17 15:46)
IPS-DB: 6.00741(2015-12-01 02:30)
IPS-ETDB: 0.00000(2001-01-01 00:00)
APP-DB: 6.00741(2015-12-01 02:30)
INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)
Serial-Number: FGVMEV0000000000
IPS Malicious URL Database: 1.00001(2015-01-01 01:01)
Botnet DB: 1.00000(2012-05-28 22:51)
License Status: Valid
Evaluation License Expires: Sun May  7 05:35:13 2017
VM Resources: 1 CPU/1 allowed, 995 MB RAM/1024 MB allowed
BIOS version: 04000002
Log hard disk: Need format
Hostname: FortiGate-VM64-KVM
Operation Mode: NAT
Current virtual domain: root
Max number of virtual domains: 1
Virtual domains status: 1 in NAT mode, 0 in TP mode
Virtual domain configuration: disable
FIPS-CC mode: disable
Current HA mode: standalone
Branch point: 1449
Release Version Information: GA
FortiOS x86-64: Yes
System time: Sat Apr 22 05:46:50 2017
FortiGate-VM64-KVM # execute formatlogdisk
Log disk is /dev/vdb.
Formatting this storage will erase all data on it, including
  logs, quarantine files;
and require the unit to reboot.
Do you want to continue? (y/n)y
FortiGate-VM64-KVM # get hardware status
Model name: FortiGate-VM64-KVM
ASIC version: not available
CPU: QEMU Virtual CPU version 1.0
Number of CPUs: 1
RAM: 995 MB
Compact Flash: 2056 MB /dev/vda
Hard disk: 500 MB /dev/vdb

USB Flash: not available

NOTE:
Fortigate: You cannot create VDOMs, have a throughput limit, have some SSL limitation and has no Subscription signatures for IPS / App Control, AV, Web Filtering and Antispam.
   You cannot try FortiGate HA with trial version because the trial VM has the same S/N of the other and the Cluster could not form
FortiManager / FortiAnalyzer: Limit of log per day or management devices
FortiADC (VM and D series): I believe that latest version only release the GUI after upload the license. The older versions has no limitation.
FortiWeb: There’s no signature update
FortiSandbox: Did not download the Windows VM’s
FortiAuthenticator: Limit the number of users in database

FortiMail: There’s no signature (antivirus) and no antispam (cloud)

-to install hpvsr
Download hpvsr from https://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG811AAE&lang=en&cc=us&prodSeriesId=5443163

# mkdir /opt/unetlab/addons/qemu/hpvsr-1001-CMW710
scp VSR1000_HPE-CMW710-E0325-X64.zip into /tmp
# cd /tmp
# unzip VSR1000_HPE-CMW710-E0325-X64.zip
# tar xf VSR1000_HPE-CMW710-E0325-X64.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 VSR1000_HPE-CMW710-E0325-X64-disk1.vmdk /opt/unetlab/addons/qemu/hpvsr-1001-CMW710/hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install iol
find in google these 3 files
i86bi_linux-adventerprisek9-ms.154-2.T4
i86bi_linux_l2-adventerprisek9-ms.156-0.9.S
CiscoIOUKeygen.py.zip

copy above files into /opt/unetlab/addons/iol/bin
# cd /opt/unetlab/addons/iol/bin
# mv i86bi_linux-adventerprisek9-ms.154-2.T4 i86bi_linux-adventerprisek9-ms.154-2.T4.bin
# mv i86bi_linux_l2-adventerprisek9-ms.156-0.9.S i86bi_linux_l2-adventerprisek9-ms.156-0.9.S.bin
# unzip CiscoIOUKeygen.py.zip
# python CiscoIOUKeygen.py
# mv iourc.txt iourc
NOTE: don’t use .iourc, otherwise it won’t run

-to import iou lab
SOURCE: http://www.unetlab.com/2015/06/importing-iou-web-labs/
download IOU-WEB from
http://certcollection.org/forum/topic/236548-iou-web-vm-v22-rsv5-ud-compilation-august-2014-new-links/page__hl__%20iou
Download, extract and import v22VMIOU2014 into VMware
Power on the vm and modify its ip address
# cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=”eth0″
BOOTPROTO=”none”
NM_CONTROLLED=”yes”
ONBOOT=”yes”
TYPE=”Ethernet”
IPADDR=10.0.20.84
PREFIX=24
GATEWAY=10.0.20.1
DEFROUTE=yes
ONBOOT=yes

# service network restart
open web browser and go to http://10.0.10.84
click Downloads/database.sdb
scp database.sdb into unetlab server tmp

login as root into unetlab vm
# apt-get install php5-sqlite sqlite
# cd /opt/unetlab/scripts/
# wget https://raw.githubusercontent.com/dainok/unetlab/master/scripts/import_iou-web.php .
# chmod 755 /opt/unetlab/scripts/import_iou-web.php
# /opt/unetlab/scripts/import_iou-web.php /tmp/database.sdb
All labs will be imported under /opt/unetlab/labs/Imported

NOTE:
IOU assigns DCE/DTE on a per slot basis. Even slots are DTE, Odd slots are DCE

e.g. Slots 0, 2, 4.. = DTE; Slots 1, 3, 5.. = DCE

-to install ise
In ESXi import ISE-1.4.0.253-eval.ova
ssh as root to ESXi
# /vmfs/volumes/datastore1/ISE
# scp *vmdk root@10.0.20.71:/opt/unetlab/addons/qemu/ise-1.4.0.253
ssh as root to unetlab server
# mkdir -p /opt/unetlab/addons/qemu/ise-1.4.0.253
# cd /opt/unetlab/addons/qemu/ise-1.4.0.253
# /opt/qemu/bin/qemu-img convert -f qcow ISE-flat.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install mikrotik
Download latest chr vmdk from http://www.mikrotik.com/download
# mkdir /opt/unetlab/addons/qemu/mikrotik-6.34.3
scp chr-6.34.3.vmdk into /opt/unetlab/addons/qemu/mikrotik-6.34.3
# cd /opt/unetlab/addons/qemu/mikrotik-6.34.3
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 chr-6.34.3.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
L: admin
P:

-to install nsvpx
# mkdir -p /opt/unetlab/addons/qemu/nsvpx-11.0.55.20
scp NSVPX-ESX-11.0-55.20_nc.zip into /opt/unetlab/addons/qemu/nsvpx-11.0.55.20
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 NSVPX-ESX-11.0-55.20_nc-disk1.vmdk virtioa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install olive
# mkdir -p /opt/unetlab/addons/qemu/olive-12.1R1.9
scp “Juniper JunOS Olive12.1R1.9 Virtualbox image.ova” into /opt/unetlab/addons/qemu/olive-12.1R1.9
# cd /opt/unetlab/addons/qemu/olive-12.1R1.9
# tar xf “Juniper JunOS Olive12.1R1.9 Virtualbox image.ova”
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 “JunOS Olive-disk1.vmdk” hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install ostinato
Download ost-drone-0.7-v1.qcow2 from
http://www.bernhard-ehlers.de/projects/ostinato4gns3/install-qemu.html
# mkdir /opt/unetlab/addons/qemu/ostinato-0.7-v1
scp ost-drone-0.7-v1.qcow2 into /opt/unetlab/addons/qemu/ostinato-0.7-v1
# cd /opt/unetlab/addons/qemu/ostinato-0.7-v1
# mv ost-drone-0.7-v1.qcow2 hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install paloalto
# mkdir -p /opt/unetlab/addons/qemu/PA-VM-ESX-7.0.1
scp PA-VM-ESX-6.1.0.ova into /opt/unetlab/addons/qemu/paloalto-7.0.1
# cd /opt/unetlab/addons/qemu/paloalto-7.0.1
# tar xf PA-VM-ESX-7.0.1 .ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 PA-VM-ESX-7.0.1-disk1.vmdk virtioa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

NOTE:

PA in UNL no need license but no URL and threat signature updates, as well as fewer sessions through the firewall

-to install radware
SOURCE: http://www.unetlab.com/forum/viewtopic.php?f=7&t=39&sid=0ade6575a07ae6534a3fbce8dd7e3049
download alteon radware from https://www.radware.com/resources/softwaredownloads/network-admin-software/
Icon: Load Balancer.png
CPU: 2 (minimum)
RAM: 2560MB (minimum)
Ethernets: 3 (minimum)
console: VNC (since telnet won’t work)
# mkdir /opt/unetlab/addons/qemu/linux-radware
scp AlteonOS-30A-5-0-0.ova into /opt/unetlab/addons/qemu/linux-radware
# cd /opt/unetlab/addons/qemu/linux-radware
# tar xf AlteonOS-30-5-0-0.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 AlteonOS-30.5.0.0-disk1.vmdk virtioa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
Enter password: admin

-to install riverbed
# mkdir /opt/unetlab/addons/qemu/riverbed-vcx9.2.0/
scp image_rbt_vcx_9_2_0_n8_x86_64.ova into /opt/unetlab/addons/qemu/riverbed-vcx9.2.0/
# cd /opt/unetlab/addons/qemu/riverbed-vcx9.2.0/
# tar xf image_rbt_vcx_9_2_0_n8_x86_64.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 image-vcx-disk1.vmdk virtioa.qcow2
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 image-vcx-disk2.vmdk virtiob.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
L: admin
P: password
NOTE:
disregard cdrom complain when booting

it will probably boot 2x when power on for the first time and will take around 15min to get login prompt

-to install Ruckus SmartZone
Ruckus vSZ High-Scale
vSZ High-Scale min requirement
RAM: 13GB
CPU: 2 Cores
# mkdir /opt/unetlab/addon/qemu/linux-ruckuswireless
scp vscg-3.4.1.0.208.ova into /opt/unetlab/addon/qemu/linux-ruckuswireless
# cd /opt/unetlab/addon/qemu/linux-ruckuswireless
# tar xf vscg-3.4.1.0.208.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 vscg-3.4.1.0.208-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
follow this
L: admin
P: admin

# setup

-to install sophos XG
download latest sophos XG KVM from https://secure2.sophos.com/en-us/products/next-gen-firewall/free-trial.aspx#
# mkdir -p /opt/unetlab/addons/qemu/sophos-16.05
scp VI-SFOS_16.05.3_MR-3.KVM-183.zip into /opt/unetlab/addons/qemu/sophos-16.05
# cd /opt/unetlab/addons/qemu/sophos-16.05
# unzip VI-SFOS_16.05.3_MR-3.KVM-183.zip
# mv PRIMARY-DISK.qcow2 hda.qcow2
# mv AUXILIARY-DISK.qcow2 hdb.qcow2
# rm VI-SFOS_16.05.3_MR-3.KVM-183.zip
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
# cd /opt/unetlab/html/templates
# cp cpsg.php sophos.php
# sed -i ‘s/cpsg/sophos/g’ sophos.php
# sed -i ‘s/CP/sophos/g’ sophos.php
# cd ../includes
# vi init.php
add
‘sophos’ => ‘Sophos’,
after sterra line
LAN IP: 172.16.16.16 (default) port1
WAN IP: dhcp port2
WEB GUI: https://172.16.16.16:4444
L: admin
P: admin

-to install sourcefire
download from Cisco Cisco_Firepower_Management_Center_Virtual-6.1.0-330.qcow2
# mkdir -p /opt/unetlab/addons/qemu/sourcefire-6.1.0-330
scp Cisco_Firepower_Management_Center_Virtual-6.1.0-330.qcow2 into /opt/unetlab/addons/qemu/sourcefire-6.1.0-330
# cd /opt/unetlab/addons/qemu/sourcefire-6.1.0-330
# mv Cisco_Firepower_Management_Center_Virtual-6.1.0-330.qcow2 virtioa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install timos
# mkdir -p /opt/unetlab/addons/qemu/timos-12.0.R6
scp TiMOS-SR-12.0.R6-vm.zip into /opt/unetlab/addons/qemu/timos-12.0.R6
# cd /opt/unetlab/addons/qemu/timos-12.0.R6
# mv TiMOS-SR-12.0.R6-vm/vm/7xxx-i386/sros-vm.qcow2 hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install titanium
# mkdir -p /opt/unetlab/addons/qemu/titanium-7
scp hda.qcow2 into /opt/unetlab/addons/qemu/titanium-7
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install coeus
# mkdir -p /opt/unetlab/addons/qemu/coeus-9.0.0.324
scp coeus-9-0-0-324-S100V.zip into /opt/unetlab/addons/qemu/coeus-9.0.0.324
# cd /opt/unetlab/addons/qemu/coeus-9.0.0.324
# unzip coeus-9-0-0-324-S100V.zip
# mv coeus-9-0-0-324-S100V/coeus-9-0-0-324-S100V-disk1.vmdk ..
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 coeus-9-0-0-324-S100V-disk1.vmdk virtioa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
# vi /opt/unetlab/html/templates/coeus.php
change
$p[‘console’] = ‘telnet’;
to
$p[‘console’] = ‘vnc’;

-to install Force10
download OS10_Virtualization_10.4.1.0V.zip from https://www.cocheno.com/category/routing/
# mkdir /opt/unetlab/addons/qemu/linux-dellos10-10.4.1.0
scp OS10_Virtualization_10.4.1.0V.zip into /opt/unetlab/addons/qemu/linux-dellos10-10.4.1.0
# cd /opt/unetlab/addons/qemu/linux-dellos10-10.4.1.0
# unzip OS10_Virtualization_10.4.1.0V.zip
# mv OS10-Installer-10.4.1.0.qcow2 virtiob.qcow2
# mv OS10-Disk-1.0.0.vmdk sataa.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install vios
# mkdir -p /opt/unetlab/addons/qemu/vios-adventerprisek9-m-15.5
# mkdir -p /opt/unetlab/addons/qemu/viosl2-adventerprisek9-m-15.2
scp vIOS-L3.qcow2 into /opt/unetlab/addons/qemu/vios-adventerprisek9-m-15.5
scp vIOS-L2.qcow2 into /opt/unetlab/addons/qemu/viosl2-adventerprisek9-m-15.2
# cd /opt/unetlab/addons/qemu/vios-adventerprisek9-m-15.5
# mv vIOS-L3.qcow2 hda.qcow2
# cd /opt/unetlab/addons/qemu/viosl2-adventerprisek9-m-15.2
# mv vIOS-L2.qcow2 hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install vmx
# mkdir -p /opt/unetlab/addons/qemu/vmx-1.0
scp vMX.ova into /opt/unetlab/addons/qemu/vmx-1.0
# cd /opt/unetlab/addons/qemu/vmx-1.0
# tar xf vMX.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 vMX-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
NOTE: to speed up vmx
http://noshut.ru/2015/09/how-to-run-juniper-vmx-in-unetlab/
# vi /opt/unetlab/html/templates/vmx.php
change
$p[‘qemu_options’] = ‘ -serial mon:stdio -nographic’;
to
$p[‘qemu_options’] = ‘ -serial mon:stdio -nographic -enable-kvm’;

-to install vnam
# mkdir -p /opt/unetlab/addons/qemu/vnam-6.1.1
scp nam-app-x86_64.6-1-1.ova and nam-app-x86_64.6-1-1.iso into /opt/unetlab/addons/qemu/vnam-6.1.1
# cd /opt/unetlab/addons/qemu/vnam-6.1.1
# tar xf nam-app-x86_64.6-1-1.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 NAM-VX-6.1-disk1.vmdk hda.qcow2
# mv nam-app-x86_64.6-1-1.iso cdrom.iso
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

From UnetLab gui, Start vnam icon
Main menu
1 – Download application image and write to HDD
2 – Download application image and reformat HDD
3 – Install application image from CD and reformat HDD
4 – Display software versions
5 – Reset application image CLI passwords to default
6 – Send Ping
f – Check for and fix file system errors on local disk
s – Show upgrade log
n – Configure network
r – Exit and reset Services Engine
h – Exit and shutdown Services Engine
Selection [123456fsnrh]:

NOTE:
I have black screen problem with vnam 6.2.1. So I use 6.1.1 instead
Any idea what to do next after do you see menu above?

-to install vsrx
# mkdir -p /opt/unetlab/addons/qemu/vsrx-12.1X46-D10.2-domestic
scp junos-vsrx-12.1X46-D10.2-domestic.ova into /opt/unetlab/addons/qemu/vsrx-12.1X46-D10.2-domestic
# cd /opt/unetlab/addons/qemu/vsrx-12.1X46-D10.2-domestic
# tar xf junos-vsrx-12.1X46-D10.2-domestic.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 junos-vsrx-12.1X46-D10.2-domestic-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install vsrxng
NOTE:
for vSRX-NG can be downloaded here
# mkdir -p /opt/unetlab/addons/qemu/vsrxng-151x49d406
scp media-vsrx-vmdisk-15.1X49-D40.6.qcow2 into /opt/unetlab/addons/qemu/vsrxng-151x49d406
# cd /opt/unetlab/addons/qemu/vsrxng-151x49d406
# mv media-vsrx-vmdisk-15.1X49-D40.6.qcow2 virtioa.qcow2

# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install vwaas
download vwaas from
https://drive.google.com/folderview?id=0B-v2VUXWowDLYWRBcFJEcmtLQkE&usp=drive_web
# mkdir -p /opt/unetlab/addons/qemu/vwaas-200-5.5.3
scp virtioa.qcow2 into /opt/unetlab/addons/qemu/vwaas-200-5.5.3
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
L: admin
P:

-to install vwlc
# mkdir -p /opt/unetlab/addons/qemu/vwlc-8.1.102.0
scp AIR-CTVM-K9-8-1-102-0.ova and AIR-CTVM-k9-8-1-102-0.iso into /opt/unetlab/addons/qemu/vwlc-8.1.102.0
# cd /opt/unetlab/addons/qemu/vwlc-8.1.102.0
# tar xf AIR-CTVM-K9-8-1-102-0.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 AS_CTVM_8_1_102_0.vmdk hda.qcow2
# mv AIR-CTVM-k9-8-1-102-0.iso cdrom.iso
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install tinylinux
SOURCE: http://www.802101.com/2015/06/unetlab-ubuntu-guest-node.html
change dsl-4-4-10.doc to dsl-4-4-10.ova
ssh as root to unetlab server
# mkdir -p /opt/unetlab/addons/qemu/linux-dsl
# cd /opt/unetlab/addons/qemu/linux-dsl
scp dsl-4-4-10.ova into /opt/unetlab/addons/qemu/linux-dsl
# tar xf dsl-4-4-10.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 DSL-4.4.10-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
open UnetLab gui and add linux linux-dsl node
NOTE:
L: root

P: Password123!@#

-to install slitaz
download slitaz from
extract it in your pc
# mkdir -p /opt/unetlab/addons/qemu/linux-slitaz-3.0
scp slitaz-3.0-x86.vdi into /opt/unetlab/addons/qemu/linux-slitaz-3.0
# cd /opt/unetlab/addons/qemu/linux-slitaz-3.0
# qemu-img convert -f vdi -O qcow2 slitaz-3.0-x86.vdi hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
L: root
P: root

-to install win win7
SOURCE: http://www.802101.com/2015/06/windows-7-host-on-unetlab.html
install WIN7 in ESXi
update all patches
do not install vmware-tools
shutdown

ssh to ESXi server and cd to WIN7 directory
# cd /vmfs/volumes/datastore1/WIN7
# scp WIN7.vmdk root@10.0.20.71:/opt/unetlab/addons/qemu/win-win7
# scp WIN7-flat.vmdk root@10.0.20.71:/opt/unetlab/addons/qemu/win-win7

ssh as root to unetlab server
# cd /opt/unetlab/addons/qemu/win-win7
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 WIN7.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
open UnetLab gui and add win win-win7 node

-to install xrv
# mkdir -p /opt/unetlab/addons/qemu/xrv-k9-5.2.2
scp hda.qcow2 into /opt/unetlab/addons/qemu/xrv-k9-5.2.2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

-to install vyos
copy to unetlab
# mkdir -p /opt/unetlab/addons/qemu/vyos-117
# cd /opt/unetlab/addons/qemu/vyos-117
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 VyOS-1.1.7-signed-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
L: vyos

P: vyos

-to install zeroshell
SOURCE: http://www.802101.com/2015/08/running-zeroshell-in-unetlab.html
Download zeroshell iso from http://www.zeroshell.org/download/#
# mkdir -p /opt/unetlab/addons/qemu/linux-zeroshell
scp ZeroShell-3.3.2.iso into /opt/unetlab/addons/qemu/linux-zeroshell
# cd /opt/unetlab/addons/qemu/linux-zeroshell
# mv ZeroShell-3.3.2.iso cdrom.iso
# /opt/qemu/bin/qemu-img create -f qcow hda.qcow2 5G
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
I then added a new node to a test lab I had on the go, and fired it up. Once connected via VNC, you can then install it to the hard drive, by selecting option A from the menu:
Just accept all the defaults
# mv cdrom.iso ZeroShell-3.3.2.iso
from unetlab gui stop the node and start again

-to upgrade VMware-Tools
mount iso on datastore
click CD-ROM icon on ESXi console
click CD DVD drive 1/Connect to iso image on a datastore
open vmimages/tools-isoimages/linux.iso
# mkdir /mnt/cdrom
# mount /dev/cdrom /mnt/cdrom/
# tar xzvf /mnt/cdrom/VMwareTools-9.10.0-2476743.tar.gz -C /tmp/
# cd /tmp/vmware-tools-distrib
# perl vmware-install.pl
Do you still want to proceed with this legacy installer? [yes]
Uninstallation of previous install failed. Would you like to remove the install DB? [no] yes
# perl vmware-install.pl -d

-Log location
# cat /opt/unetlab/data/Logs/

WINDOWS:
-download and install UltraVNC from http://www.uvnc.com/downloads/ultravnc.html
-download and install Wireshark from https://www.wireshark.org/download.html
-download and extract http://UNLip/files/windows.zip
copy UNetLab into c:\Program Files
copy ultravnc_wrapper.bat into C:\Program Files\uvnc bvba\UltraVNC
run win7_64bit_ultravnc.reg
run win7_64bit_putty.reg

run win7_64bit_wireshark.reg

-to open multiple tab session in SecureCRT
run win7_64bit_crt.reg
edit C:\Users\username\AppData\Roaming\VanDyke\Config\Global.ini
change
D:”Single Instance”=00000000
to

D:”Single Instance”=00000001

-to open multiple tab with SuperPutty
   download and install SuperPutty from https://github.com/jimradford/superputty/releases
   open SuperPutty and tick Tools/Options/Advanced/Only allow single instance of SuperPuTTYy to run
   create SuperPutty.reg
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\telnet]
@=”URL:Telnet Protocol”
“URL Protocol”=””
[HKEY_CLASSES_ROOT\telnet\shell]
[HKEY_CLASSES_ROOT\telnet\shell\open]
[HKEY_CLASSES_ROOT\telnet\shell\open\command]

@=”\”C:\\Program Files (x86)\\SuperPuTTY\\SuperPutty.exe\” %1″

go to http://10.0.20.71 and Sign-in with
L: admin
P: unl

-to connect unetlab to the cloud
http://www.unetlab.com/2014/11/using-cloud-devices/

-to rename a lab file
clone or open existing file
click More Actions/Edit lab

change the Name

-to convert VirtualBox vdi to qcow2 format

# /opt/qemu/bin/qemu-img convert -f vdi -O qcow2 vm.vdi vm.qcow2

-cisco CSR 1000v take 2.5GB RAM per node, if you want less ram, use L3-ADVENTERPRISEK9-M-15.4-2T.bin instead

 

Bypass Firewall

 

Method 1: Opera Turbo
Test:
-open Opera and tick File/Opera Turbo menu
-test whether can access http://www.playboy.com

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam:
FortiGate: No filter for this app
Juniper SRX:
PaloAlto: FAILED
SonicWall:

Method 2: FireFox or Chrome Zenmate Extention
Test:
-open Chrome or FireFox and enable Zenmate extention
-test whether can access http://www.playboy.com

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
SonicWall:

Method 3: Block Torrent
Test:
a. utorrent
-download and install utorrent from http://www.utorrent.com
-download and open torrent magnet from kickass.to
-test whether utorrent can download

b. tor browser
-download and install tor browser from https://www.torproject.org/projects/torbrowser.html.en
-launch Tor browser and go to http://www.playboy.com

c. Tor Network
Test:
-launch Tor browser but leave it running
-open Chrome
-open Chrome Settings/Show advanced settings
-click Change proxy settings
-click LAN settings
-click Advanced
Socks: 127.0.0.1 Port 9150
-test whether can access http://www.playboy.com

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
SonicWall:

Method 4: Open Proxy
Test:
-search open proxy that using port 80 from http://proxylist.hidemyass.com/
-set Chrome using open proxy for example 107.167.21.243 port 80
-test whether can access http://www.playboy.com

Result:
BlueCoat:
CheckPoint:
Cisco ASA:
Cyberoam:
FortiGate: FAILED
Juniper SRX:
PaloAlto:
SonicWall:

Method 5: Psiphon
Test:
-download and install Psiphon from https://psiphon.ca
-run and choose SSH+
-test whether can access http://www.playboy.com

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto: PASS
https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-Blocking-PSiphon-3/ta-p/69359
SonicWall:

Method 6:  Soft-Ether
Test:
-download, install and run Soft-Ether from http://www.vpngate.net/en/
-connect to VPN Relay Server using UDP
-set dns to 4.2.2.2
-test whether can access http://www.playboy.com

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam: No filter for this app
FortiGate: SUCCESS with custom app signature
Juniper SRX:
PaloAlto:
SonicWall:

Method 7: Block Internet Download Manager
Test:
-download IDM from https://www.internetdownloadmanager.com/

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
SonicWall:

Method 8: Block Free Download Manager
Test:
-download and install FDM from http://www.freedownloadmanager.org

Result:
BlueCoat:
CheckPoint: PASS
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
SonicWall:

Method 9: Block Internet Download Accelerator
Test:
-download and install IDA from https://westbyte.com/ida/index.phtml?page=download

Result:
BlueCoat:
CheckPoint:
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
SonicWall:

If anyone success blocking above test, please email me your rule. Because either I don’t the device or I have the device but don’t have the license or my filter is wrong

Submit Missing Application Filter
BlueCoat:
CheckPoint:
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
Sangfor IAM:

SonicWall:

Method 10: DNS Over TLS
Test:
-download and install Technitium DNS Server

Result:
BlueCoat:
CheckPoint:
Cisco ASA:
Cyberoam:
FortiGate:
Juniper SRX:
PaloAlto:
SonicWall: