A Cloud Engineer who is Microsoft, VCP6.5 and CCNA, CyberOPS certified.
I have experience in various on-premise technologies ranging from VoIP Telephony systems, networking, Virtualization, security, servers and Cloud.
I have changed my career path to the Cloud since it is the path that utilizes all my skillsets learnt over the years. My ultimate goal is to become a Solutions Architect who uses technologies to improve and enhance business process.
In a virtual environment, there are scenarios where you would want to clone an existing Windows server virtual machine to provide redundancy for whatever application.
Having the ability to create duplicate virtual machines by cloning it is a great feature but it creates a problem in a Windows Active Directory environment. There is a unique identifier called Security ID also known as SID which is created during installation to identify each machine in a Windows environment.
Active Directory has a big problem when it discovers two machines with the same SID because it identify them as the same object. If the computer with the same SID attempts to join the same domain, it will generate an error and terminate the process. No worries, there is a solution for the Windows computer.
Microsoft has included a tool called Sysprep which is natively installed on Windows server which is located in the folder path:
%systemroot%\System32\Sysprep
To start the process, you will navigate to the folder and follow the steps below:
Right click and Run the System Preparation Tool (Sysprep.exe) as an administrator
Select the option Enter System Out-of-Box Experience (OOBE) for System Cleanup Action with the option Generalize ticked.
Select the Shutdown option: Reboot
Then select OK.
Once the virtual machine reboots, it will prompt to select the usually Microsoft settings during initialization, accept the EULA and to set the Administrator password.
Note that this method does not remove any installed applications except device drivers. It also removes the usually windows configuration such as IP address and machine name.
The SysPrep will work in other versions of Windows.
This article will be showing how to configure a Generic Encapsulation Tunnel also known as GRE Tunnel over IPSec.
disclaimer: note that this is a lab exercise only to show the configuration steps stated and may require additional modification based on your network environment.
The following network topology will be used to demonstrate this exercise.
Network Topology
The initial basic router configuration are below:
R1 configuration:
interface fastethernet 0/0 ip address 192.0.2.1 255.255.255.252 no shut ! int loopback 0 ip address 1.1.1.1 255.255.255.255 ! router ospf 1 network 0.0.0.0 0.0.0.0 area 0 ! R2 configuration:
interface fastethernet 0/0
ip address 192.0.2.2 255.255.255.252
no shut
!
interface fastethernet 0/1
ip address 203.0.113.1 255.255.255.252
no shut
!
int loopback 0
ip address 2.2.2.2 255.255.255.255
!
router ospf 1
network 0.0.0.0 0.0.0.0 area 0
!
R3 configuration:
interface fastethernet 0/1
ip address 198.51.100.1 255.255.255.252
no shut
!
interface fastethernet 0/0
ip address 203.0.113.2 255.255.255.252
no shut
!
int loopback 0
ip address 3.3.3.3 255.255.255.255
!
router ospf 1
network 0.0.0.0 0.0.0.0 area 0
!
R4 configuration:
interface fastethernet 0/0
ip address 198.51.100.2 255.255.255.252
no shut
!
int loopback 0
ip address 4.4.4.4 255.255.255.255
!
router ospf 1
network 0.0.0.0 0.0.0.0 area 0
!
Before going into the task, there are some information that is important to know why IPSec is with a GRE Tunnel:
GRE Tunnel
It is used to encapsulated the packets over a network between two network devices.
it does not provide encryption which makes it unsecure
IPSec
It is secure by providing encryption
it only supports uni-cast traffic which presents a problem for routing protocols that uses multicast to function.
What are the use cases for this technology?
Combining both technology makes it a suitable solution to create a secure connections over public or unsecured networks between two networks.
Lab Exercise
Once the routers has been configured accordingly using the initial base configuration, it is time to start the exercise.
In this exercise, two task are going to be done:
Configure a GRE Tunnel between R1 and R4
Configure a IPSec tunnel
Step 1 – Configure the GRE tunnel on R1and R4
Create a tunnel interface
R1(config)# interface tunnel 1
Assign an ip address to the tunnel interface
R1(config-if)# ip address 192.168.0.1 255.255.255.252
Set the source interface from where the tunnel will be connected
R1(config-if)# tunnel source fastethernet 0/0
Set the destination address of the router at the other end of the tunnel
Note: repeat the same steps on router R4 but replacing the respective source interface and destination address. It is important to note that the tunnel # is locally significant.
you can check the status of the tunnel after step 1 by running the show command as follows:
Sometimes you may want to run open Programs and Features without searching for it in the Control Panel. Another reason to require these commands is to run them with administrative privileges.
You can open the Run using [Windows KEY] + [R] or the cmd or even in PowerShell ISE
appwiz.cpl – open the Programs and Features window.
devmgmt.msc – open the device manager
compmgmt.msc – open the computer management
diskmgmt.msc – opens the disk management
lusrmgr.msc – opens the local users and groups management
I will update this article with more useful commands as I identify them.
Policy-based routing (PBR) is a process whereby the device puts packets through a route map before routing them. (Cisco Reference)
Policy Based Routing is applicable to scenarios where you want to route a source IP address through a specific gateway IP address to a specific destination. Policy Based Routing relies on route-map to performs it functions which then uses access-list or prefix list to identify the respective source or destination IP address.
Configure Policy Based Routing
Step 1 – Configure Access list
R1(config)# ip access-list standard PC1-INT
R1(config-access-list)# permit ip host [PC1-IPAddress] [DestinationIP-Subnet]
Step 2 – Configure the Route map
R1(config)# route-map ISP2-INT [Sequence#]
R1(config-route-map)# match ip address [ISP2-INT]
R1(config-route-map)# set ip next-hop [ISP2]
Step 3 – Apply the Route map on the inbound interface
R1(config)# interface f0/0
R1(config-f)# ip policy route-map ISP2-INT
That is it for the configuration example for the Policy Based Routing.
There are a number of points to note about PBR:
The implicit deny at the end of the route-map does not drop the packet but allow the traffic to be routed but the normal routing table.
There is an option to include a keyword “default” in the route-map set parameter which tells the router to check the routing table for this destination address before apply the next hop:
set ip default next-hop [IPAddress]
Match all parameter can be applied by not setting any match conditions in the route map.
This is it for the Policy Based Routing and you can refer to Cisco documentation for further information.
