PaloAlto UNL Basic config

20160809 22.09.jpg

NOTE:
-make sure all nics in UNL vm using vmxnet3 and not e1000
-I feel PA6.1 is more stable than PA7.0.1
-I don’t have URL Filtering license, so I can’t test blocking website

-set PA mgmt nic ip to 192.168.1.1
> configure
# set deviceconfig system ip-address 192.168.1.1 netmask 255.255.255.0
# commit

PC1:
MGMT NIC
   ip 192.168.1.10/24
LAN NIC
   ip 10.0.0.10/24
   gw 10.0.0.1
-open PC1 browser and go to https://192.168.1.1
L: admin
P: admin

set Device/Management section
Image.png

-set Service Route Configuration
Image.png

-set Network/Network Profiles/Interface Mgmt
Image.png

-set Network/Zones
Image.png

-set Network/Interfaces
Image.png

-set Network/DHCP

Image.png

-set Objects/Addresses

Image.png

-set Policies/Security

Image.png

-set Policies/NAT

14cf68d6570787bcc52ed77bbd863a68

-click Commit
-click Save
Now you can test whether you can surfing from PC1

Increasing allocated RAM for UNL in VMware Fusion

SOURCE:
  1. import unl ova and keep it off
  2. change hardware compatibility to 12
    – In the Apple menu bar, select Virtual Machine > Settings.
    – Select Compatibility
    – Select the hardware version to 12
  3. change “memsize” in unl vmx
    – right click unl vm and select ” Show Package Contents”
    – search for the ‘VMX’ file, right click and select open with ‘Text Edit’
    – change the memsize there and save
    – power on unl vm. If it complain about unsupported main memory size then just click OK

What didn’t work yet in Unetlab

NOTE:
These limitation is not because of Unetlab but because of limitation of the image
Base on input from UD. These didn’t work in UNL
-QinQ  (didn’t run in Cisco but run in Arista)
-SPAN, RSPAN
SPAN doesn’t work on any cisco switch
SPAN is ok on Arista, but RSPAN is not supportet on any switch
https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan
-WCCP
-L2VPN
-MAB (MAC Authentication Bypass)
for best results on L2 IRON image, need turn off ip cef
(config)#no ip cef
if turn off ip cef then:
-L3 Etherchannel ok
-PVLAN ok
-VACL, PACL ok
-dhcp snooping ok
-dot1x supported

Exporting/Importing Unetlab lab steps

Exporting Steps
1. click More actions/Start all nodes
2. click More actions/Export all CFGs
3. click More actions/Set all startup-cfg to exported
4. click More actions/Stop all nodes
5. click Close lab
6. click the lab and click ACTIONS/Export selected objects

Importing Steps
1. click ACTIONS/Import external labs
2. select target lab but don’t unzip it then import
3. click More actions/Start all nodes

How to export/import all labs
  1. Proper way
    Shift click your target lab and click menu ACTIONS/Export selected objects
  2. Unsupported but work
    copy your labs inside /opt/unetlab/labs/ and put into the same location in your target UNL

Importing IOU lab into Unetlab

  1. create simple IOU lab
    Image.png
  2. edit new lab
    Image.png

    Netmap: 1:0/0 2:0/0
    Image.png
    click Save

  3. configure both router
    Image.png

    R1#sh run
    hostname R1
    interface Ethernet0/0
     ip address 12.12.12.1 255.255.255.0
    R1#copy run unix:
    Destination filename [running-config]?
    R1#wr
    R2#sh run
    hostname R2
    interface Ethernet0/0
     ip address 12.12.12.2 255.255.255.0
    R2#copy run unix:
    Destination filename [running-config]?
    R2#wr
  4. copy all running config to database
    if you found error, then click each router and choose “Copy unix://running-config to database”
    sometime this happen because the router lost its config
    Image.png
  5. edit this lab again
    Image.png

    set both router initial config
    Image.png

  6. export the lab
    Image.png
    Select labs you want to export: tick labname
    Select initial config packs you want to export: tick labname
    click Export
  7. click Download
    Image.png
    rename the file name according to your lab name
  8. open Unetlab and import external lab
    Image.png
    Browse and click Import
    Image.png
  9. open the lab
    Image.png
  10. click More actions/Set all startup-cfg to exported
    click More actions/Wipe all nodes
    click More actions/Start all nodes

    Now all IOU config still intact in Unetlab

CheckPoint GAIA Installation on Unetlab

Image.png

-download CheckPoint R77.30 iso
-prepare VMware Workstation vm with Other Linux 64bit, 30GB HD, 2GB RAM and 4 nics
16-Jul 10.56.26.jpg

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

-open Chrome and go to https://10.0.10.61

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

Image.png

-shutdown vm and go to VMware Workstation
-click CheckPoint vm
-click File/Export to OVF
export as cpsg-r7730.ova
# mkdir -p /opt/unetlab/addons/qemu/cpsg-r7730
scp cpsg-r7730.ova into /opt/unetlab/addons/qemu/cpsg-r7730
# tar xf cpsg-r7730.ova
# /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 cpsg-r7730-disk1.vmdk hda.qcow2
# /opt/unetlab/wrappers/unl_wrapper -a fixpermissions
create CheckPoint unetlab lab above and start cp1
-open SmartDashboard and login as admin
-right click Edit Network Objects/CheckPoint/cp1
Image.png
Image.png
Image.png
-create Network Objects/Networks/LAN
Image.png
-create Firewall policy
Image.png
-create Application & URL Filtering policy
Image.png

 

 

 

 

 

 

ESXi 6.0 Unetlab to Cisco Catalyst trunk

I have problem with Unetlab inside ESXi with 2 trunk port.
Once 1 of the trunk cable disconnected, the issue fixed
The problems are:
-node (in the exmple below is Mikrotik) can’t ping gateway but unetlab vm can
-after ESXi restarted, I can’t ping ESXi anymore
The solution are
Image.png
Image.png
Cisco:
# sh run
port-channel load-balance src-dst-ip
interface Port-channel1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 flowcontrol receive desired
interface FastEthernet2/0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 speed 100
 duplex full
 flowcontrol receive desired
 channel-group 1 mode on
 spanning-tree portfast trunk
 spanning-tree bpdufilter enable
!
interface FastEthernet2/0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 speed 100
 duplex full
 flowcontrol receive desired
 channel-group 1 mode on
 spanning-tree portfast trunk
 spanning-tree bpdufilter enable
ESXi
Image.png
Image.png
Image.png
Image.png
Image.png
Image.png