A10 AX3000 firewall conversion - Revision history

Adj: /* Ethernet bypass port frustrations */

2019-01-11T19:32:31Z

Ethernet bypass port frustrations

← Older revision		Revision as of 19:32, 11 January 2019
Line 421:		Line 421:

	Lanner provides a hopefully useful manual here: https://www.lannerinc.com/category/1202-network-appliances?download=1720		Lanner provides a hopefully useful manual here: https://www.lannerinc.com/category/1202-network-appliances?download=1720

			'''Update 2019-01-11:''' No forward progress on this, unfortunately. I have verified that the 1000baseT cards have Lanner Gen 2 bypass modules and should be controllable with the Lanner <code>wdbp</code> or <code>wd_bp</code> program. I have not had success getting them to leave bypass mode. :( I do have an email correspondence with a Lanner rep and have asked for a stock (not A10 custom) BIOS image for the machine, which should be able to tweak the bypass settings at POST time.

			In the mean time, the eight 1000baseT ports and the eight GigE SFP ports are unused, the Comcast/Xfinity cable modem is connected to the switch and the Comcast/Xfinity WAN VLAN is passed to the A10 device on one of its 10G SFP+ ports.

Adj: /* un-mount all the stuffs */

2019-01-11T19:24:04Z

un-mount all the stuffs

← Older revision		Revision as of 19:24, 11 January 2019
Line 296:		Line 296:

	==== un-mount all the stuffs ====		==== un-mount all the stuffs ====
	root@new-optiplex:/# umount -av		root@new-optiplex:/# '''umount -av'''
	root@new-optiplex:/# exit		root@new-optiplex:/# '''exit'''
	$ sudo umount /media/warthog-0		$ '''sudo umount /media/warthog-0'''
	$ sudo vgchange -a n warthog-0-vg00		$ '''sudo vgchange -a n warthog-0-vg00'''
	$ sudo mdadm --stop /dev/md/warthog-0-md_boot		$ '''sudo mdadm --stop /dev/md/warthog-0-md_boot'''
	$ sudo mdadm --stop /dev/md/warthog-0-vg00-pv-0		$ '''sudo mdadm --stop /dev/md/warthog-0-vg00-pv-0'''

	== Make it go! ==		== Make it go! ==

Adj: /* make a user with admin privileges */

2019-01-11T19:23:15Z

make a user with admin privileges

← Older revision		Revision as of 19:23, 11 January 2019
Line 278:		Line 278:
	==== make a user with admin privileges ====		==== make a user with admin privileges ====
	Because it will be nice to say "root is locked" and still be able to log in, right?		Because it will be nice to say "root is locked" and still be able to log in, right?
	root@new-optiplex:/# adduser --home /home/itops --shell /bin/bash --uid 1000 --ingroup itops --gecos "IT operations account" itops		root@new-optiplex:/# '''adduser --home /home/itops --shell /bin/bash --uid 1000 --ingroup itops --gecos "IT operations account" itops'''
	Adding user `itops' ...		Adding user `itops' ...
	Adding new user `itops' (1000) with group `itops' ...		Adding new user `itops' (1000) with group `itops' ...
Line 286:		Line 286:
	Retype new UNIX password:		Retype new UNIX password:
	passwd: password updated successfully		passwd: password updated successfully
	root@new-optiplex:/# adduser itops sudo		root@new-optiplex:/# '''adduser itops sudo'''
	Adding user `itops' to group `sudo' ...		Adding user `itops' to group `sudo' ...
	Adding user itops to group sudo		Adding user itops to group sudo

Adj: /* a list of filesystems is important, too */

2018-10-05T21:01:57Z

a list of filesystems is important, too

← Older revision		Revision as of 21:01, 5 October 2018
Line 246:		Line 246:

	$ cat << _EOF_		$ cat << _EOF_
	/dev/warthog-0-vg00/root / ext4 errors=remount-ro 0 0		/dev/warthog-0-vg00/root / ext4 errors=remount-ro 0 0
	/dev/warthog-0-vg00/home /home ext4 defaults 0 0		/dev/warthog-0-vg00/home /home ext4 defaults 0 0
	/dev/warthog-0-vg00/opt /opt ext4 defaults 0 0		/dev/warthog-0-vg00/opt /opt ext4 defaults 0 0
	/dev/warthog-0-vg00/tmp /tmp ext4 defaults 0 0		/dev/warthog-0-vg00/tmp /tmp ext4 defaults 0 0
	/dev/warthog-0-vg00/usr /usr ext4 defaults 0 0		/dev/warthog-0-vg00/usr /usr ext4 defaults 0 0
	/dev/warthog-0-vg00/var /var ext4 defaults 0 0		/dev/warthog-0-vg00/var /var ext4 defaults 0 0
	/dev/warthog-0-vg00/swap none swap sw 0 0		/dev/warthog-0-vg00/swap none swap sw 0 0
	UUID=75dfffb8-1ab6-494d-a1bc-d70d30a135ba /boot ext4 defaults 0 0		UUID=75dfffb8-1ab6-494d-a1bc-d70d30a135ba /boot ext4 defaults 0 0
	__EOF__ \| sudo tee -a /media/warthog-0/etc/fstab		__EOF__ \| sudo tee -a /media/warthog-0/etc/fstab
			$

	==== make it bootable ====		==== make it bootable ====

Adj: /* console */

2018-10-05T21:01:03Z

console

← Older revision		Revision as of 21:01, 5 October 2018
Line 1:		Line 1:

	=== console ===		=== console ===
	Serial console with ~~8p8C~~ modular connector on front of box. Works with Cisco console cables. (Yay for that.) 9600bps, 8n1.		Serial console with 8P8C modular connector on front of box. Works with Cisco console cables. (Yay for that.) 9600bps, 8n1.

	=== Hardware inside ===		=== Hardware inside ===

Adj: /* Ethernet bypass port frustrations */

2018-10-05T20:59:53Z

Ethernet bypass port frustrations

← Older revision		Revision as of 20:59, 5 October 2018
Line 418:		Line 418:

	But... [https://www.lannerinc.com/ Lanner] (who makes the system for A10) does provide source for working with the LAN bypass modules. Watch this space for updates.		But... [https://www.lannerinc.com/ Lanner] (who makes the system for A10) does provide source for working with the LAN bypass modules. Watch this space for updates.

			Lanner provides a hopefully useful manual here: https://www.lannerinc.com/category/1202-network-appliances?download=1720

Adj: /* Make it less loud */

2018-10-05T20:58:19Z

Make it less loud

← Older revision		Revision as of 20:58, 5 October 2018
Line 333:		Line 333:

	No luck with this. Will have to see if ACOS does anything to moderate the fan speeds and if it can be pulled into a less specialised Linux distro.		No luck with this. Will have to see if ACOS does anything to moderate the fan speeds and if it can be pulled into a less specialised Linux distro.

			There is a BIOS setting that allows control of the fans by the OS. This needs to be set appropriately. Afterwards pwmconfig kinda works.

	== Lots of network interfaces, I need a map! ==		== Lots of network interfaces, I need a map! ==

Adj: /* Lots of network interfaces, I need a map! */

2018-07-04T20:22:27Z

Lots of network interfaces, I need a map!

← Older revision		Revision as of 20:22, 4 July 2018
Line 391:		Line 391:
	\|-		\|-
	\|17		\|17
	\|enp18s0f0		\|enp18s0f0 (10Gbits/sec SFP+)
	\|-		\|-
	\|18		\|18
	\|enp18s0f1		\|enp18s0f1 (10Gbits/sec SFP+)
	\|-		\|-
	\|19		\|19
	\|enp19s0f0		\|enp19s0f0 (10Gbits/sec SFP+)
	\|-		\|-
	\|20		\|20
	\|enp19s0f1		\|enp19s0f1 (10Gbits/sec SFP+)
	\|}		\|}

Adj: /* Lots of network interfaces, I need a map! */

2018-07-04T17:05:42Z

Lots of network interfaces, I need a map!

← Older revision		Revision as of 17:05, 4 July 2018
Line 391:		Line 391:
	\|-		\|-
	\|17		\|17
			\|enp18s0f0
	\|
	\|-		\|-
	\|18		\|18
			\|enp18s0f1
	\|
	\|-		\|-
	\|19		\|19
			\|enp19s0f0
	\|
	\|-		\|-
	\|20		\|20
			\|enp19s0f1
	\|
	\|}		\|}

	This looks like it's missing some stuff, doesn't it? Well, need to get the drivers for the Ethernet bypass ports sorted out. (Because things can't be too easy.)		This looks like it's missing some stuff, doesn't it? Well, need to get the drivers for the Ethernet bypass ports sorted out. (Because things can't be too easy.)

			'''Important Note:''' The stock Debian stretch 4.9 Linux kernel was unable to get the links on the 10GbE ports to come up. Upgrading to a 4.16 backports kernel had good results.

	== Other Debian packages you will want to install ==		== Other Debian packages you will want to install ==

Adj: /* Ethernet bypass port frustrations */

2018-05-11T22:32:27Z

Ethernet bypass port frustrations

← Older revision		Revision as of 22:32, 11 May 2018
Line 412:		Line 412:
	== Ethernet bypass port frustrations ==		== Ethernet bypass port frustrations ==
	Along with the fans... The 1000baseT ports numbered 1 through 8 are being recalcitrant. In the ACOS image, there is a custom driver for the chips called e1000_a10e. As far as I can tell, the A10 ACOS software doesn't really care about LAN bypass stuff at all and pretty much just turns on all the ports as separate units. (The LAN bypass idea here is that if power to the system goes away, a pair of ports can be electrically bound together and let traffic flow as though it were just a cable. A possibly nice feature in a firewall. But the hardware isn't standard and has to be dealt with.)		Along with the fans... The 1000baseT ports numbered 1 through 8 are being recalcitrant. In the ACOS image, there is a custom driver for the chips called e1000_a10e. As far as I can tell, the A10 ACOS software doesn't really care about LAN bypass stuff at all and pretty much just turns on all the ports as separate units. (The LAN bypass idea here is that if power to the system goes away, a pair of ports can be electrically bound together and let traffic flow as though it were just a cable. A possibly nice feature in a firewall. But the hardware isn't standard and has to be dealt with.)

			But... [https://www.lannerinc.com/ Lanner] (who makes the system for A10) does provide source for working with the LAN bypass modules. Watch this space for updates.