Michael McNamara

HPE/Aruba Activate goes rogue?

Michael McNamara — Sun, 22 Oct 2023 14:59:43 +0000

It’s been a while… just been busy like everyone else, doing my best to keep the ship moving while not capsizing. I thought I would take an hour here on a Sunday morning and tell you another story. It’s a cautionary tail about the cloud and what can happen when vendors they have hooks into your infrastructure.

We use HPE/Aruba Instant APs at many of our locations globally. A while back we had an interesting issue. We had a site reporting that their wireless was down and the team performing the initial troubleshooting reported that they were unable to log into any of the Aruba Instant APs or the virtual controller. I ended up taking the case myself and what I found was troubling. While the VC IP address was still responding to ICMP pings, it appeared as if our enter configuration was wiped and overlaid with a different configuration.

I would factory reset the IAP to get it back online and shortly after I loose access to it again once it contacted Aruba Active – I verified this via my firewall logs.

Ultimately I found that the IAPs appeared to have adopted a configuration from Aruba Activate – the cloud solution from HPE/Aruba to help solve zero touch provisioning and configuration. These IAPs were originally purchased by my organization and had no configuration in Activate but somehow someone else in Aruba Activate pushed a configuration to our IAPs? I never did learn the answer to who or how that happened but my HPE/Aruba sales engineer was extremely help working internally within HPE/Aruba to address the issue. For a short term solution I blocked access to the HPE Activate at my firewall and then had to factory reset and reconfigure all the Instant Access Points.

There is an option in Instant AOS 8.4.x and later that allows you to disable Activate.

activate-disable

Unfortunately this wouldn’t have worked for us as we’re still running 6.5.4.x on a large number of our IAPs.

Question: Do you know what really happens to your gear when that cloud subscription runs out?

Cheers!

Avaya 1200 Series IP Phone Configuration Options

Michael McNamara — Wed, 19 Jan 2011 04:41:54 +0000

While working with the Avaya 1220 IP Phones over this past week I discovered a few tricks that I thought I would share with everyone. It can be very difficult and time consuming to troubleshoot configuration issues and the 5 line LCD display makes scrolling through all the configuration options painful to say the least. While working with the provisioning files I recalled that the 1200 series IP phone supports SSH so I logged into the IP phone via SSH and I found a great little command. prtcfg. This command appears to print the entire configuration of the IP phone. I’ve noticed that the documentation is sometimes lacking so this is a great little resource to not only see how the phone is configured but to see all the available options.

[root@centos ~]# ssh -l admin 192.168.100.99
admin@192.168.100.99's password:

Welcome to Avaya problem determination tool.

You are connected to IP Phone 1220.
HW version: 1800247F9984E9662A
FW version 04.00.04.00
MAC Address = 00247F99FFFF
IP = 192.168.100.99
Type "bye" to exit current shell.
PDT> prtcfg
*********************SYSTEM CONFIG************************
*** SIPdomain1 asterisk.home
***   defUser user1
***   S1 IP: 192.168.1.6
***   S1 Ports: (UDP:5060, TCP:0, TLS:0)
***   S1 Proto: 2
***   S2 IP: 0.0.0.0
***   S2 Ports: (UDP:5060, TCP:0, TLS:0)
***   S2 Proto: 2
*** CONFERENCE_URI: conference@avaya.com
*** ADHOC_ENABLED: 0
*** MAX_ADHOC_PORTS: 0
*** SIPdomain2
***   defUser user2
***   S1 IP: 0.0.0.0
***   S1 Ports: (UDP:5060, TCP:0, TLS:0)
***   S1 Proto: 2
***   S2 IP: 0.0.0.0
***   S2 Ports: (UDP:5060, TCP:0, TLS:0)
***   S2 Proto: 2
*** CONFERENCE_URI: conference@avaya.com
*** ADHOC_ENABLED: 0
*** MAX_ADHOC_PORTS: 0
*** SIPdomain3
***   defUser user3
***   S1 IP: 0.0.0.0
***   S1 Ports: (UDP:5060, TCP:0, TLS:0)
***   S1 Proto: 2
***   S2 IP: 0.0.0.0
***   S2 Ports: (UDP:5060, TCP:0, TLS:0)
***   S2 Proto: 2
*** CONFERENCE_URI: conference@avaya.com
*** ADHOC_ENABLED: 0
*** MAX_ADHOC_PORTS: 0
*** SIPdomain4
***   defUser user4
***   S1 IP: 0.0.0.0
***   S1 Ports: (UDP:5060, TCP:0, TLS:0)
***   S1 Proto: 2
***   S2 IP: 0.0.0.0
***   S2 Ports: (UDP:5060, TCP:0, TLS:0)
***   S2 Proto: 2
*** CONFERENCE_URI: conference@avaya.com
*** ADHOC_ENABLED: 0
*** MAX_ADHOC_PORTS: 0
*** SIPdomain5
***   defUser user5
***   S1 IP: 0.0.0.0
***   S1 Ports: (UDP:5060, TCP:0, TLS:0)
***   S1 Proto: 2
***   S2 IP: 0.0.0.0
***   S2 Ports: (UDP:5060, TCP:0, TLS:0)
***   S2 Proto: 2
*** CONFERENCE_URI: conference@avaya.com
*** ADHOC_ENABLED: 0
*** MAX_ADHOC_PORTS: 0
*** DNSdomain asterisk.home
*** Config version 000005
*** User Config version 000001
*** Language version 000001
*** Image version 000001
*** Tone version 000001
*** Licensing file version 000001
*** User keys version 000001
*** CTL file version 000001
*** Boot version 000001
*** Security Policy version 000001
*** CRL file version 000001
*** Nortel Key version 000001
*** Misc version 000001
*** Service Pack version 000001
*** SIP_PING 1
*** VMAIL 5000
*** VMAIL_DELAY 300
*** BANNER Avaya SIP Client
*** FORCE_BANNER 0
*** DST_ENABLED 1
*** TIMEZONE_OFFSET 0
*** MAX_INBOX_ENTRIES 100
*** MAX_OUTBOX_ENTRIES 100
*** MAX_REJECTREASONS 20
*** MAX_CALLSUBJECT 20
*** MAX_PRESENCENOTE 20
*** DEF_LANG English
*** DSCP_CONTROL 0
*** 802.1P_CONTROL -1
*** DSCP_MEDIA 0
*** 802.1P_MEDIA -1
*** DSCP_DATA -1
*** 802.1P_DATA -1
*** LOG_LEVEL 255
*** RECOVERY_LEVEL 2
*** AUTO_UPDATE 0
*** AUTO_UPDATE_TIME 0
*** AUTO_UPDATE_TIME_RANGE 1
*** DOS_PACKET_RATE 5
*** DOS_MAX_LIMIT 100
*** DOS_LOCK_TIME 20
*** DEF_AUDIO_QUALITY High
*** DEF_DISPLAY_IM NO
*** MAX_IM_ENTRIES 999
*** MAX_ADDR_BOOK_ENTRIES 100
*** ADDR_BOOK_MODE NETWORK
*** IM_MODE DISABLED
*** ADMIN_PASSWORD 26567*738
*** ADMIN_PASSWORD Expiry Time 0
*** ENABLE_LOCAL_ADMIN_UI 1
*** HASHED_ADMIN_PASSWORD 0
*** HASH_ALGORITHM SHA1
*** HOLD_TYPE rfc3261
*** AUTH_METHOD AUTH
*** ENABLE_3WAY_CALL 1
*** DISABLE_PRIVACY_UI 0
*** DIALTONE
*** RINGINGTONE
*** BUSYTONE
*** FASTBUSYTONE
*** CONGESTIONTONE
*** DISTINCTIVE_RINGING 1
*** CALL_WAITING SPEAKER
*** PCPORT_ENABLE 1
*** LLDP_ENABLE 0
*** BLUE TOOTH Disable
*** NAT_SIGNALLING NONE
*** NAT_MEDIA NONE
*** NAT_TYPE NONE
*** NAT_TTL 120
*** STUN_SERVER_IP1 0.0.0.0
*** STUN_SERVER_IP2 0.0.0.0
*** STUN_SERVER_PORT1 3478
*** STUN_SERVER_PORT2 3478
*** USE_RPORT 0

*** VQMON PUBLISH ADDRESS: 0.0.0.0
***   PUBLISH ENABLE: 0
***   LISTENING R ENABLE [0:= No, 1:=Yes]: 0
***   LISTENING R WARNING: 0 [0:= 80]
***   LISTENING R EXECSSIVE: 0 [0:= 70]
***   PACKET LOSS ENABLE [0:= No, 1:=Yes]: 0
***   PACKET LOSS WARNING : 0 [0:= 1]
***   PACKET LOSS EXECSSIVE: 0 [0:= 5]
***   DELAY ENABLE [0:= No, 1:=Yes]: 0
***   DELAY WARNING: 0 [0:= 300]
***   DELAY EXECSSIVE: 0 [0:= 500]
***   JITTER ENABLE [0:= No, 1:=Yes]: 0
***   JITTER WARNING: 0 [0:= 150]
***   JITTER EXECSSIVE: 0 [0:= 500]
***   SESSION_RPT_EN: 0
***   SESSION_RPT_INT: 60
***   VQMON CONFIG BLOCK *** END ***
***
*** TRANSFER_TYPE: rfc3261
*** ENABLE_PRACK: 0
*** ENABLE_UPDATE: 1
*** PROXY_CHECKING: 1
*** REDIRECT_TYPE: MCS
*** MADN_PRIVACY:
*** MADN_TIMER: 1800
*** MADN_DIALOG: 0
*** IM_NOTIFY: 1
*** DISABLE_OCT_ENDDIAL: 0
*** FORCE_OCT_ENDDIAL: 0
*** DISPLAY_CALL_SNDR_IM_KEY: 1
*** FORCE_CFWD_NOTIFY: 0
*** DEFAULT_CFWD_NOTIFY: 0
*** FORCE_TIME_ZONE: 0
*** SNTP_SERVER:
*** SNTP_ENABLE: 0
*** RTP_MIN_PORT: 50000
*** RTP_MAX_PORT: 50100
*** TOVM_SOFTKEY_ENABLE: 0
*** TOVM_VOICEMAIL_ALIAS: transfertovm
*** TOVM_VOICEMAIL_PARAM: mbid
*** AUTOLOGIN_ENABLE: 1
*** SCA_BROADWORKS: 0
*** SCA_LINE_SEIZE_EXPIRES: 15
*** SCA_HOLD_BEHAVIOR: PUBLIC
*** SCA_APPEARANCES: 12
*** MAX_RING_TIME: 0
*** EXP_MODULE_ENABLE: 0
*** PROMPT_ON_LOCATION_OTHER: 0
*** ENABLE_ANSWER_MODE: 0
*** ANSWER_MODE_MAXALLOWADDR: 100
*** ANSWER_MODE_MICMUTE: 0
*** AUDIO_CODEC1:
*** AUDIO_CODEC2:
*** AUDIO_CODEC3:
*** AUDIO_CODEC4:
*** AUDIO_CODEC5:
*** AUDIO_CODEC6:
*** AUDIO_CODEC7:
*** AUDIO_CODEC8:
*** AUDIO_CODEC9:
*** AUDIO_CODEC10:
*** AUDIO_CODEC11:
*** AUDIO_CODEC12:
*** AUDIO_CODEC13:
*** AUDIO_CODEC14:
*** AUDIO_CODEC15:
*** G729_ENABLE_ANNEXB: 0
*** G723_ENABLE_ANNEXA: 0
*** LOGOUT_WITHOUT_PASSWORD: 0
*** ENABLE_SERVICE_PACKAGE: 0
*** SECURE_INCALL_DIGITS: 0
*** AVAYA_AUTOMATIC_QOS: 0
*** REMOTE_CHECK_FOR_UPDATE: 0
*** INTERCOM_PAGING: 0
*** ALPHA_ORDER_LOC_LIST: 1
*** MAX_LOGINS: 1
*** AUTOCLEAR_NEWCALL_MSG: 0
*** E911_USERNAME: anonymous
*** E911_PROXY   :
*** E911_PASSWORD: 123456
*** E911_TXLOC   : INVITE
*** FM_PROFILES_ENABLE: 1
*** FM_LANGS_ENABLE: 1
*** FM_SOUNDS_ENABLE: 1
*** FM_IMAGES_ ENABLE: 1
*** FM_CERTS_ENABLE: 0
*** FM_CONFIG_ ENABLE: 0
*** FM_LOGS_ENABLE: 1
*** PORT_MIRROR_ENABLE: 0
*** LOGSIP_ENABLE: 0
*** MEMCHECK_PERIOD: 86400 secs
*** SIP_UDP_PORT: 5060
*** SIP_TCP_PORT: 5060
*** SIP_TLS_PORT: 0
*** KEEP_ALIVE_TYPE: OS
*** CONN_KEEP_ALIVE: 120
*** REGISTER_RETRY_TIME: 30
*** REGISTER_RETRY_MAXTIME: 1800
*** SECURE_UI_ENABLE: 0
*** LOGIN_NOTIFY: OFF
*** LOGIN_NOTIFY_TIME: 0
*** ENABLE_USB_PORT: Yes
*** USB_MOUSE: UNLOCK
*** USB_KEYBOARD: UNLOCK
*** USB_HEADSET: LOCK
*** USB_MEMORY_STICK: UNLOCK
*** USB_LOCK_OVERRIDE: No
*** ATA_REGION: NA
*** IPV6_ENABLE: 0
*** PREFER_IPV6: 0
*** IPV6_STATELESS: 1
*** SECONDARY_LOGOUT_ENABLE: 0
*** SRTP_ENABLED 0
*** SRTP_MODE BE-2MLines
*** SRTP_CIPHER_1 AES_CM_128_HMAC_SHA1_80
*** SRTP_CIPHER_2 AES_CM_128_HMAC_SHA1_32
*** SSH 1
*** SFTP 0
*** SSHID admin
*** SSHPWD ****
EAPConfigRead - migrating EAP Configuration data from TFFS
Failed to open file /flash0/EAPDATA.DAT
*** EAP DISABLED
*** EAPID1
*** EAPID2
*** EAPPWD ****
*** CA
*** CA_DOMAIN
*** HOST_NAME
*** SFTP_READ_PATTERNS .cfg,.dat
*** SFTP_WRITE_PATTERNS .cfg,.dat
*** DSCP_OAM: 18
*** DSCP_MEDIA_FLASHOVERRIDE: 41
*** DSCP_MEDIA_FLASH: 42
*** DSCP_MEDIA_IMMEDIATE: 44
*** DSCP_MEDIA_PRIORITY: 45
*** SESSION_TIMER_ENABLE: 1
*** SESSION_TIMER_DEFAULT_SE: 1800
*** SESSION_TIMER_MIN_SE: 1800
*** SET_REQ_REFRESHER: 0
*** SET_RESP_REFRESHER: 2
*** HOTLINE_ENABLE: 0
*** HOTLINE_URL: hotline
*** DoD_ENABLE: 0
*** MLPP_NETWORK_DOMAIN: DSN
*** MLPP_PRECEDENCE_DOMAIN: 000000
*** CALL_WAITING_TONE: 0
*** MAX_APEARANCE: 10
*** DISABLE_SPKRPHN: 0
*** CALL_ORIGIN_BUSY: 0
*** SLOW_START_200OK: 0
*** SPEEDLIST_KEY_INDEX: 0
*** SPEEDLIST_LABEL: SDL
*** SCRNSVR_ENABLE: 1
*** SCRNSVR_UNPRTCTD_ENABLE: 0
*** SCRNSVR_UPASS_ENABLE: 0
*** SCRNSVR_MODE: 0
*** SCRNSVR_DELAY: 10
*** SCRNSVR_TEXT: Screensaver active
*** SCRNSVR_IMAGE:
*** MENU_AUTO_BACKOUT: 30
*** LOGIN_BANNER_ENABLE: 0
*** BLF_ENABLE: 0
*** BLF_RESOURCE_LIST_URI:
*** BG_IMAGE_ENABLE: 1
*** BG_IMG_SELECT_ENABLE: 1
*** USE_BG_IMAGE:
*** USER_FILE_ENABLE: 0
*** USER_FILE_PATH: /
*** DEFAULT_ADDRESSBOOK_FILE:
*** DEFAULT_SPEEDDIALLIST_FILE:
*** DEFAULT_CUSTOMKEYS_FILE:
*** TECH_SUPPORT_LABEL:
*** TECH_SUPPORT_ADDRESS:
*** SERVICE_PACKAGE_PROTOCOL: HTTP
*** SELECT_LAST_INCOMING 0
*** MKI_ENABLE: 0
*** ALLOW_EMERGENCY_PRIORITY_HEADER: 0
*** CALLINFO_IMAGE_ENABLE 0
*** maskSectionDwnloaded 0x0
*** SURV_SIP_SVR_ENABLE: 0
*** REG_REFRESH_TIMER:  86400
*** OUTLINEFONT_ENABLE: 1
*** FONTSMOOTH_ENABLE: 0
*** FIPS_MODE: 0
*** LOGINALPHA_ENABLE: 0
*** PROMPT_AUTHNAME_ENABLE: 0
*** KEEPALIVE_RETRIES 3
*** IP_OFFICE_ENABLE 0
*** USE_PUBLISH_FOR_PRESENCE 0
*** FAIL_BACK_TO_PRIMARY 0
*** CONTACT_HDR_PORT_CS1K 0
*********************************************************

I should point out that this command is available for the 1100 and 1200 series IP phones.

Cheers!

ASCII Configuration Generator (ACG) for Nortel Switches

Michael McNamara — Tue, 28 Oct 2008 02:00:28 +0000

I wrote a Perl script a long time ago to backup the binary configuration files for all our Nortel Ethernet and Ethernet Routing Switches (including BayStack 350 and 450s, Ethernet Switch 460 and 470s, Ethernet Routing Switch 4500s and Ethernet Routing Switch 5500s, Ethernet Routing Switch 1600 and 8600s along with Motoroal WS5100 and RFS7000s and HP GbE2s). The Perl script was very simple and straightforward. The problem was that the Nortel configuraiton files were binary files that we as engineers were unable to review or analyze. There were no tools (at least not that I’m aware of) that could allow us to review those configurations. If we had a question about the configuration stored in the binary file we had to restore the configuration to a mock up switch(s) in our testlab in order to be able to review the actually configuration. It seems that Nortel finally heard our cries for help and added a new feature in v3.7.x (ES460/ES470) and v5.1.x (ERS5500) software that would allow us to TFTP upload the ASCII configuration from the ACG.

There was one problem though… the SNMP OID has yet to be documented in the Nortel SNMP MIBS. I had to run a packet trace against Nortel’s Device Manager to determine the OID that Device Manager was using to initiate the manual config upload. I found that the OID was ”
1.3.6.1.4.1.45.1.6.4.4.19.0″

I took my existing script and created a new subroutine and had everything working within about 30 minutes.

Here’s some of the code I wrote;

############################################################################
# Subroutine baystack_tftp_config_ascii
#
# Purpose: use SNMP to instruct BayStack switches to TFTP upload their
# ASCII configuration file to the central TFTP server
############################################################################
sub baystack_tftp_config_ascii {

#s5AgSysTftpServerAddress
#s5AgSysAsciiConfigFilename
#s5AgSysAsciiConfigManualUpload (NOT IN THE MIBS) USE 1.3.6.1.4.1.45.1.6.4.4.19.0
# snmpset -v2c -cprivate 10.1.1.100 1.3.6.1.4.1.45.1.6.4.4.19.0 i 4

   # Declare Local Variables
   my $setresult;

   $filename = "ascii/".$filename;

   my $sess = new SNMP::Session (  DestHost  => $snmphost,
                                   Community => $community,
                                   Version   => SNMPVER );

   my $vars = new SNMP::VarList(
                        ['s5AgSysTftpServerAddress', 0, "10.1.1.20",],
                        ['s5AgSysAsciiConfigFilename', 0, $filename,] );

   my $go = new SNMP::VarList(
                        ['.1.3.6.1.4.1.45.1.6.4.4.19', 0, 4, 'INTEGER'] );

   &check_filename($filename);

   # Set TFTP source and destination strings
   $setresult = $sess->set($vars);
   if ( $sess->{ErrorStr} ) {
      print "ERROR: {BayStack} problem setting the TFTP parameters (TFTP IP, FILENAME) for $snmphost\n";
      print "ERROR: {BayStack} sess->{ErrorStr} = $sess->{ErrorStr}\n";
   }

   # Start TFTP copy
   $setresult = $sess->set($go);
   if ( $sess->{ErrorStr} ) {
      print "ERROR: {BayStack} problem setting the TFTP action bit for $snmphost\n";
      print "ERROR: {BayStack} sess->{ErrorStr} = $sess->{ErrorStr}\n";
   }

   # Pause while the TFTP copy completes
   sleep $PAUSE;

   # Check to see if the TFTP copy completed
   $setresult = $sess->get('.1.3.6.1.4.1.45.1.6.4.4.19.0');
   if ( $sess->{ErrorStr} ) {
      print "ERROR: problem checking the TFTP result for $snmphost\n";
      print "ERROR: sess->{ErrorStr} = $sess->{ErrorStr}\n";
   }

   # If TFTP failed output error message
   if ($setresult != 1) {
        while ($setresult == 2) {
           print "DEBUG: config upload status = $setresult (waiting)\n" if (DEBUG);
           sleep $PAUSE;
           $setresult = $sess->get('.1.3.6.1.4.1.45.1.6.4.4.19.0');
        } #end while
   } #end if $test ne "success"

   # If the upload command failed let's try again
   if ($setresult == 3) {

      print "DEBUG: initial command returned $setresult\n" if (DEBUG);
      print "DEBUG: lets try the upload command again\n" if (DEBUG);

      # Let's pause here for a few seconds since the previous command failed
      sleep $PAUSE;

      # Start TFTP copy
      $setresult = $sess->set($go);
      if ( $sess->{ErrorStr} ) {
         print "ERROR: problem setting the TFTP action bit for $snmphost\n";
         print "ERROR: sess->{ErrorStr} = $sess->{ErrorStr}\n";
      }

      # Pause while the TFTP copy completes
      sleep $PAUSE;

      # Check to see if the TFTP copy completed
      $setresult = $sess->get('.1.3.6.1.4.1.45.1.6.4.4.19.0');
         if ( $sess->{ErrorStr} ) {
            print "ERROR: problem checking the TFTP result for $snmphost\n";
            print "ERROR: sess->{ErrorStr} = $sess->{ErrorStr}\n";
      }

      # If TFTP failed output error message
      if ($setresult != 1) {
         while ($setresult == 2) {
            print "DEBUG: config upload status = $setresult (waiting)\n" if (DEBUG);
            sleep $PAUSE;
            $setresult = $sess->get('.1.3.6.1.4.1.45.1.6.4.4.19.0');
         } #end while
      } #end if
   } #end if

   if ($setresult != 1) {
      print "DEBUG: $snmphost config upload *FAILED*!\n";
      print SENDMAIL "ERROR:$snmphost ($sysObjectID) config (ASCII) upload *FAILED*!
\n";
   } elsif ($setresult == 1) {
      print SENDMAIL "$snmphost ($sysObjectID) was successful (ASCII)
\n";
      print "DEBUG: $snmphost ($sysObjectID) was successful (ASCII)\n";
   } else {
      print "DEBUG: unknown error return = $setresult (ASCII)" if (DEBUG);
   } #end if

   print "DEBUG: upload config file results = $setresult (ASCII)\n" if (DEBUG);

   return 1;

} #end sub baystack_tftp_config_ascii

Cheers!
Update: Friday April 10, 2009

I’ve discovered a small issue using the MIB “s5AgSysAsciiConfigFilename”. While the MIB says the value can be between 0..128 characters long I’ve actually found that the value can’t be an longer than 30 characters. If you try to use a filename that is greater than 30 characters you’ll get an SNMP set error. I actually had quite a few switches failing to backup properly because I was prepending “ascii/” to the filename. I tested this with software v3.7.2.x and v3.7.3.x on a Ethernet Switch 470.

s5AgSysAsciiConfigFilename OBJECT-TYPE
        SYNTAX  DisplayString (SIZE (0..128))
        MAX-ACCESS      read-write
        STATUS  current
        DESCRIPTION
                "Name of the ascii configuration file that will be
             downloaded/uploaded either at boot time when the
             s5AgSysAsciiConfigAutoDownload object is set to
             useConfig(3), or when the s5AgSysAsciiConfigDownloadStatus
             object is set to startDownload(4).  When not used, the
             value is a zero length string."
        ::= { s5AgentSystem 6 }

Cheers!