Michael McNamara

technology, networking, virtualization and IP telephony

Changing SNMP Community Strings

by

In this day and age it’s not a very good idea to leave the default SNMP community strings configured in any network electronics. The general default configuration uses public for read-only and private for read-write, these defaults apply to  the Nortel Ethernet Switch and the Nortel Ethernet Routing Switch.

You can certainly do this from Nortel’s Java Device Manager, however, you need to be careful that you don’t saw off the branch you’re standing on when you change the SNMP community string. It’s best to configure the SNMP community strings from the CLI interface to avoid any potential issues.

Here are the CLI commands to configure the SNMP community strings on the ERS 8600 and 1600 switch. In the example below we’ll set the read-only string to open and the read-write string to lock.

ERS-8610:5# config snmp-v3 community commname first new-commname open
ERS-8610:5# config snmp-v3 community commname second new-commname lock

Here are the CLI commands to configure the SNMP community strings on the ERS 4500, ERS 5500 and ES460/470 switches. In the example below we’ll set the read-only string to open and the read-write string to lock.

5520-48T-PWR (config)# snmp-server community open ro
5520-48T-PWR (config)# snmp-server community lock rw

Cheers!

Nortel ERS 8600 Software 5.1, 5.1.1 Pulled

by

In a move that I support Nortel has pulled 5.1 and 5.1.1 software for the Nortel Ethernet Routing Switch 8600 from their support website. The purpose behind removing the older software releases is to help remove the confusion surrounding which software folks should be upgrading to. I’m personally running 5.1.1 on two ERS8606 switches which have been running for almost 60 days now and I haven’t seen any issues or problems.

You can find the bulletin here.

Cheers!

Nortel ERS 8600 Software 5.1.1.1 Available

by

Nortel has released software 5.1.1.1 for the Ethernet Routing Switch 8600. Here some highlights from the release notes;

  • Previously certain IST message handling could be delayed by other system functions, thereby potentially causing IST instability (up/down/up). As well, system instability associated with SMLT (IST Peers) in association with high CPU utilization and potentially SLPP operations have both now been resolved. For those who disabled SLPP on their systems/network, SLPP can now be re-enabled with the 5.1.1.1 release. (Q02055292-02/Q02053200/Q02055101/Q02066500)
  • Static routes usage in a VRF configured system for non-default VRFs (non-VRF 0 usage) will no longer cause a spike in CPU utilization. Now even after reboot all the static routes will remain active and CPU utilization will remain normal. This situation was introduced in 5.1.1.0 code, so only applies to that specific release. (Q02060978-03)
  • Previously unicast traffic could be flooded with the VLAN when some SMLT/RSMLT associated link failed; this is now resolved. (Q02037171)

There were two additional items of interest in the release notes that were included under the “Important Notes” section. The first reference the configuration of the system-monitor flag, it should be set in the enabled position and can only be set via SNMP by Nortel’s Java Device Manager (JDM) or by sending the proper SNMP command. The second item referenced a possible crash of the SNMP task within the 8600 software if the retry value for SNMP trap hosts was set greater than 0. I would suggest everyone reference the release notes for additinoal information on both of those items.

You can find the complete release notes here.

Cheers!

Nortel ES 460/470 Software 3.7.4 Released

by

Nortel has released software 3.7.4 for the Ethernet Switch 460 and Ethernet Switch 470.  You’ll probably recall that Nortel pulled the 3.7.3 software release in May 2009 after several software memory leaks were discovered.

I should point out that you can’t just load 3.7.4 software if you are running software older than 3.5.4. You must upgrade the software in steps. Here’s the different versions that you need to step through; 2.x to 2.5 to 3.0 to 3.2.1 to 3.5.4 to 3.7.4.

Also of interest in the release notes is a comment regarding VLACP;

VLACP operation has been changed to match implementation on ERS modular and other stackable platforms with the latest software releases. A link for which VLACP is configured will remain in a blocked state until partnership is correctly formed with the VLACP partner (Q01799355).

I’m not sure what difference they are referring to… the wording makes it sound as though VLACP would initial start in forwarding mode and would only block the port once the timeout and retries had reached the configured threshold. I might need to dig a little deeper just out of curiosity.

You can find the release notes here.

Norton 360 and Juniper SSL VPN WSAM

by

Update: Thursday, October 8, 2009 I decided to rewrite this post to include all the information I’ve accumulated while troubleshooting the issues I’ve encountered deploying software release 6.5R1 for my organization. I can’t tell you how valuable it is to have access to a virtual machine with snapshot capability while testing all the different possible anti-virus, anti-spyware, and security software that’s out there in the wild with Juniper’s Windows Secure Application Manager. Since Juniper has yet to really release any useful information I thought I would add some additional notes to this post around the different software products that I’ve discovered can interfere with Juniper’s Windows Secure Application Manager (WSAM) client software.

If you’re a regular follower you know that we recently upgraded our Juniper Secure Access 4000 SSL VPN appliances from 6.2R1 to 6.5R1. You also know that we discovered that the old Juniper Installer Service from 6.2R1 is unable to upgrade the Juniper software components for non-Administrator users. You’ll need to manually install the Juniper Installer Service if your users are non-Administrators of the local computer they work on.

norton360Norton 360, Norton Internet Security, Norton AntiVirus 2010

We’ve been successful in duplicating customer reported issues between Norton 360 or Norton Internet Security or Norton AntiVirus 2010 and Juniper’s Windows Secure Application Manager (WSAM). Windows XP users running any of the above Norton products will generally experience a blue screen of death crash (IRQL_NOT_LESS_OR_EQUAL) when clicking on a bookmark that relies on the WSAM client. Windows Vista users running any of the above Norton products will generally hang the machine (only after the first reboot from the time the product was installed) when launching the WSAM client software upon logging into the Juniper appliance. As a side note to this problem, users running Norton 360 (v3.0.0.135) do not experience this problem, only users running Norton 360 (v3.5.2.11). Juniper Technical Assistance Center (JTAC) has acknowledged that a problem exists and is working to release 6.5R2 in November 2009 to address the problems with Norton.

Symantec AntiVirus v10.x

Users running Symantec Corporate Edition AntiVirus v10.0, v10.2 experience intermittent local name resolution issues from DNS, WINS and local NetBIOS name broadcasts while the WSAM client software is running. The name resolution issues are not present when WSAM is not running. A possible workaround is to create static HOST entries in the local HOSTS file (C:\Windows\System32\drivers\etc\hosts). JTAC has acknowledged that a problem exists, I’m still waiting for additional information from JTAC.

esetnod32ESET NOD32 Smart Security 4 and Antivirus 4

The testing in our lab has shown varied results. In some instances the latest and greatest release of NOD32 appears to work fine with WSAM. The later versions of NOD32 appear to add exceptions for the Juniper software components in the advanced configuration section under ‘Web Access Protection’. Older versions of NOD32 appear to block WSAM from communicating with the Juniper Secure Access Appliances even though the application indicates that it’s ‘Connected’. In our testing we did find that JSAM and NC both appeared to function properly with the latest version of ESET NOD32 installed. We’ve implemented a workaround for our customers using JSAM and that appears to be working for our users.

zonealarmCheck Point ZoneAlarm Security Suite

We’ve been able to re-create this problem and also have a ticket open with JTAC. We’ve tried adding exceptions and making IP addresses ‘trusted’ in Check Point’s language. We’ve been completely unsuccessful in getting this product to work with WSAM. The symptoms are identical to NOD32, where the WSAM application launches successfully and indicates that it’s ‘Connected’ but your unable to connect to any WSAM applications. In our testing we did find that JSAM and NC both appeared to function properly with ZoneAlarm installed. I have a support ticket open with JTAC but I haven’t received any feedback yet. We’ve implemented a workaround for our customers using JSAM.

I also learned from a user that Spybot Search & Destroy has a feature that can ‘lock’ the local host file on a computer preventing Java Secure Application Manager (JSAM) from operating properly.

Anyone else having any issues of findings they care to share?

Recent Posts

Categories

SUBSCRIBE BY EMAIL