F5 LTM 內部設備要存取Virtual Server

目的：
內部設備要存取Virtual Server
比如
172.16.2.1要存取10.2.2.222到172.16.2.200與172.16.2.100，
172.16.1.1要存取10.1.1.111到172.16.1.200與172.16.1.100。

如果不設定會不通，因為是去回不同路，過去會帶F5或virtual server的ip，但回來會回到原本的IP。

設定方式：
Virtual Server的source address translation選擇Auto Map、source port 選Preserve

如果選擇automap，那會帶outgoing floating IP (只有單台就是 outgoing interface IP)出去

LAB架構：

設定截圖：

參考：
pool members can't connect to their own Virtual Server

F5 LTM 路由問題(內對外)

一般來說，F5的LTM主要是服務外對內做附載平衡。
外面的人連F5的一個Virtual server IP，F5往Pool Member丟，Pool Member裡面有很多個Node Server，使用Round Robin或其他方式來達到附載平衡。

如果是內對外呢？可能Node Server或其他不是Node的設備要出去做其他服務。
這邊就要設定"IP forwarding virtual servers"。
官方KB→https://support.f5.com/csp/article/K7595

Creating an IP forwarding virtual server

1. Log in to the Configuration utility.
2. Navigate to Local Traffic > Virtual Servers.
3. Click Create.
4. Enter a Name for the virtual server.
5. From the Type menu, select Forwarding (IP). Enter the ip address in CIDR format (example: 192.168.0.100/24 or 192.168.0.100/255.255.255.0) in the Destination Address text box.
   
   Note: For BIG-IP versions prior to 11.6.0., if the destination is a single host, select Host, or if the destination is a network, select Network. Enter the IP address for the virtual server (enter a Netmask if the destination is a network.  
6. Enter a Service Port number, or Select a service from the adjacent menu (type an asterisk character to match all ports).
7. Clear the Notify Status to Virtual Address check box.
8. Click Finished.

LAB：

目的：172.16.1.0/24與172.16.2.0/24要互通

設定截圖：

Fortigate 登出自動備份

參考原廠KB
http://kb.fortinet.com/kb/viewContent.do?externalId=FD38725&sliceId=1

# config system global
# set revision-backup-on-logout enable
# end

 可以登出自動本機備份設定，設定比對

不懂為什麼預設是關閉的~"~

DMVPN

最近似乎有DMVPN的需求，網路找的資料記錄一下~

https://www.jannet.hk/zh-Hant/post/dynamic-multipoint-virtual-private-network-dmvpn/

http://www.china-ccie.com/doc/vpn/vpn.html#37

https://ccie.lol/knowledge-base/lab-dmvpn-ipsec-multicast/

Cisco IOS命名-Denali, Everest, Fuji

最近來了兩台4321，想說上cisco建議版本。

到cisco download看，發現改成好幾個版本號。

找到這篇文章留存紀錄一下

https://learningnetwork.cisco.com/thread/128311

Indeed you now have 4 code type visible
Denali / Everest / Fuji and 3.6.8E
So 3.6.8E is the original or OLD type of code that was on the 3850, that has a parallel in the 16.X.X
You kinda need to get off that and onto 16.X.X
Denali (16.3.X) is the supported / tried and tested version, denali is where you should be
Everest (16.6.X) is the latest version of denali code - still not fully tested (I have heard bad reports)
Fuji (16.8.X) is like the T image of old - new versions of code and extra / new features.
You should be on Denali unless there is a specific feature that you need that isnt on Denali -
Notice the 'STAR' next to denali ?? that is the recommended version - only Denali and 3.6.X version have this recommendation.

總之就是上Denali 星號版本就對了，如果要的特殊功能沒有在Denali 版本上，才轉向Everest或是Fuji。

順帶一提，Denali, Everest, Fuji都是山的名名稱喔~XD

Asymmetric routing 非對稱路由

config system settings

set asymroute enable

end

有vdom狀況下

config vdom

edit <vdom_name>

config system settings

set asymroute enable

end

end

If you enable asymmetric routing, antivirus and intrusion prevention systems will not be effective. Your FortiGate unit will be unaware of connections and treat each packet individually. It will become a stateless firewall.

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-networking-54/Interfaces/VLANs/Asymmetric%20routing.htm

Fortigate Application control

signature檢查流量時，Port也是其中的選項之一。





所以當程式改變預設使用的Port的時候，Fortiguard提供的signature就會無法識別出來。

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/IPS/Custom%20signature%20keywords.htm

cisco switch or router記錄登入登出

archive
log config
logging enable
notify syslog contenttype plaintext
hidekeys
logging on
logging 192.168.1.1
login block-for 60 attempts 3 within 60
login on-failure log every 1
login on-success log every 1

注意：如果在2960X的15.0(2a)EX5上使用，然後telnet進去，設備會直接重開!!!!!
15.2(2)E3就沒這問題!!!!