Geek fun

Special projects are usually short bus special, not "very special episode of Blossom" special.  Over the last two days, we were living the short bus variety....

 

We got a call that SECDEF was coming and a bunch of media were coming with him.  Reporters need "dirty Internet" to move their video and other sundry junk.  We have a dirty Internet connection on base for the Public Affairs Officer (PAO) who also has to move video and junk. So.........

 

Now this single computer connection needs to get spread out to over a dozen news agencies in a tiny room located over 100 ft from the satellite dish and modem.  Back in the US, you'd just buy a wireless router and run with it.  Not so much here.

 

First off, we don't have a government credit card to buy stuff because we don't have a Title 10 (Defense) budget -- we only have a Title 22 (Dept of State) budget since we do the training, equipping, advising, and mentoring of Afghanistan, not the kinetic mission with NATO.  So we can't go to the PX and buy a wireless router.  We have some really old routers and switches that we use for emergencies, but what can those old IOS's do?  Since we don't usually NAT (network address translation) in the military, who knows how to configure the router to do it? (All the NAT'ing I've ever seen has been through a firewall vice a router -- no spare Raptor firewall appliance laying around).

 

TECHIE ALERT: the fol discussion will be interesting to the geeks in the group, everybody else can just accept that the press has Internet, and it was very painful to get them to it.  Non-geeks can feel more than comfortable not reading any further)

 

We confgured a Cisco 3650 switch with only a default VLAN and no layer 3 functions (dumb switch. 

 

We had a 3U high Cisco 2600 (that's right, not even the 1U version that came out in 2004) router.

 

We set up DHCP on the router.  I'm used to setting up a scope in Linux or on Windows 2000, but this was a little different.  I could not exclusively set up a range, I had to define a subnet range, then exclude vital addresses from the scope like the identity (192.168.13.0) and the gateway (192.168.13.1).  We limited the scope to half a class C (255.255.255.128).  That went okay once I realized that you have to issue conf t -- service dhcp to start the damn thing.

 

Next up we moved to NAT.  That is where life got ugly.  (I'm not a fan of NAT since it limits your network management in a lot of scenarios, but I digress).

 

We downloaded the Cisco guidance on NAT.  Really good general guidance, but the wording is REALLY subtle about some key issues.

1) Your NAT Pool is a set of global addresses, not local.

2) Your access list is a set of local addresses, but don't use the "any" option, no translation table will generate if you do, but the IOS WILL let you make that mistake.

3) if you uber-focus on NAT, you will likely forget to create a default-gateway

4) even after you create a default-gateway, NAT is ignoring it.  You must make a manual (and ip-classless) 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx entry for NAT to build its translation table.

 

Okay, so all that evil is over.  From the console port on the router, you can ping www.google.com.  Yay!  You finally have Internet access on your router.  Let's check the laptop.  No joy.  The laptop can't even ping your modem.  That's bad.

 

Spend six hours reading every Cisco NAT article ever written (routergeek.com simply ROCKS!)  That guide taught us some valuable little details:

 

Static NAT is easy.

Dynamic one-to-one NAT is easy.

Dynamic one-to-many NAT is not so easy.

 

If you have many global IPs, make a NAT pool like in the Cisco article.  If you don't ignore the Cisco guidance.

 

If you have TWO gloabl IPS, make a NATO pool of ONE IP.  It looks pretty stupid when you configure it, but it can work.

 

If, like in most situations, you have one IP and one IP only, then DO NOT MAKE A NAT POOL.  DO NOT ASSIGN YOUR ONLY GLOBAL IP TO THE NAT STATEMENT.

 

You give your global IP address to your outside interface.  You then write your NAT statement to use the outside interface.

 

Okay, even then, we weren't working.  No NAT Translation table being generated.  NAT debug gave us an error only addressed in the CCIE manual.  Yep, not the CCNA, CCNP, CCDP, or CCDA manuals, the CCIE manual.  That's WAY over my head.

 

So, getting tired and frustrated, we enlisted the NOC's help.  They did the same stuff I did for a long while.  Then we collectively decided to build a static NAT to see if I f'd up the NATing or the routing.  BOOM!  The NAT table populated.  NAT debug gave us tons of positive info.  WFT?

 

We rebuilt the access list to include a whole class C vice just half the class C.  BOOM! the NAT kept working.

 

Here's what I did wrong: for my access-list statement, I used the wildcard filter of 0.0.0.128.  Looks nice, but if you do the math, it should have been 0.0.0.127 b/c the filter is a ones-complement 255-128.  My bad.

 

It all works now.  We lost power twice after gettign the thing to work due to the PAO's camera lights blowing fuses.  Each time before I could reload the config to NVRAM, so we got to rebuild the damn changes two more times.

 

Lot's of fun, below is the config file for your personal amusement....

 

Cheers,

Jody

PAO-Router#sh run                
Building configuration...                        

Current configuration : 1377 bytes                                 
!
! Standard stuff that came up after the mgr wiz
!
version 12.3           
service timestamps debug datetime msec                                     
service timestamps log datetime msec                                   
no service password-encryption                             
!
hostname PAO-Router                  
!
boot-start-marker                
boot-end-marker              
!
! Yes, I know the pw is in the open.  It's going away
!
enable secret 5 $1$Vtb4$Kb2vYuvJ9Kud22YI/PBME.                                             
enable password root                   
!
no network-clock-participate aim 0                                 
no network-clock-participate aim 1                                 
no aaa new-model               
ip subnet-zero             
ip cef     
!
! Set up DHCP services
! Pass gateway, one DNS (can't seem to enter another)
!
ip dhcp excluded-address 192.168.13.0 192.168.13.1                                                 
!
ip dhcp pool PAO-DHCP-POOL                         
   network 192.168.13.0 255.255.255.0                                    
   default-router 192.168.13.1                             
   dns-server 203.196.128.48                           
!
! Name server for the router, not to pass to DHCP
! I don't know what the ip ips.. is - more standard stuff
!
ip name-server 58.147.128.7                          
ip name-server 203.196.128.48                            
ip ips po max-events 100                       
! don't allow ftp
no ftp-server write-enable                         
!
! Outside interface to satellite modem
! IP taken from PAO computer
!
interface FastEthernet0/0                        
 ip address 58.147.150.178 255.255.255.240                                         
 ip nat outside              
 ip virtual-reassembly                     
 duplex auto           
 speed auto          
!
! Inside interface to switch
!
interface FastEthernet0/1                        
 ip address 192.168.13.1 255.255.255.0                                     
 ip nat inside             
 ip virtual-reassembly                     
 speed auto          
 half-duplex           
 no mop enabled              
!
! I know, you expect a default-gateway statement here
! I tried it, it didn't work
!
ip classless           
ip route 0.0.0.0 0.0.0.0 58.147.150.177                                      
!
! web servers turned off for security
! Yes, telnet is still on
!
no ip http server                
no ip http secure-server                       
!
!
! Since we have only one global IP, we designate fa0/0 as the global ip
! vice having an IP pool - THIS IS A KEY POINT TO REMEMBER
! Also, I know that "overload" is implied in the statement, but it
! is explicity written here for clarity
!
ip nat inside source list 13 interface FastEthernet0/0 overload                                                              
!
!This is the access list that cuased all the problems
! notice 0.0.0.127 vice 0.0.0.128
!
access-list 13 permit 192.168.13.0 0.0.0.127
!
!control-plane
!
line con 0
line aux 0
line vty 0 4
 password toor
 login
!
end

--
"...wrap your arms around your body armor, give it a big embrace, and LEARN TO LOVE THE SUCK!"
-- Sergeant First Class Jenkins, 13 JUL 08

...they tortured the monkey?!?!

Okay, people do dumb things, even in a warzone. The great thing about the military, is the story gets so twisted as it winds around that you can totally lose what really happened.

FACT: Two contractors got caught by the MPs smoking weed on the roof of their barrakcs (dumb).
FACT: After apprehension, their room was searched by the MPs. The MPs found that these two had a pet monkey in their room (bizarre).

So, just to make this tasty little tidbit kinda fun, two of my guys were relaying to the story to...... let's call him R.

"Hey R, did you hear that the MPs found a monkey in a couple of guys' room? Yeah, they waterboarded the monkey and he talked. He gave away that his owners were smoking weed on the roof. Man, when it comes to monkeys, the MPs aren't messing around!"

R lost his freakin' noodle that he just heard that the MPs waterboarded the monkey. He started going on and on about that poor monkey. My guys kept empahasizing, "Yeah, they got the monkey to TALK, R TALK." R was not hearing it.

They finally had to explain to him that:
1) They were joking, and here were the real facts of what happened
2) Monkeys don't talk, no matter if you waterboard them or not.

All in all, that makes for a fairly bizarre afternoon.

Pictures from the Flat Tire Day

Some blurry pix from our lovely day changing a blowout (last week).  Four pix of me sweating my butt off.  There's a pic of the tire and the gas station we were at while changing the tire.

9/11 in Kabul

We had a 9/11 Commemoration this morning at 0745. MG Cone laid a wreath at the base of the US flagpole, which stood at halfmast. The wreath was for the 89 American, NATO, and Coalition service members that CSTC-A has lost since the war here began. Pretty somber stuff.

The last 9/11 Commemoration I took part in was at sea. The NIMITZ Strike Group had dropped 18 bombs in Afghanistan and 18 bombs in Iraq. Our surface guys had interdicted untold numbers of ships & dhows and some destroyers got to do high speed, low drag ops in direct support of troops on the ground and in protection of Kaabot and Aabot. The NIMITZ CO came over the 1MC (announcing system for you civilian types) and said that there would be no traditional memorial service for us. There had been a time for mourning, but that time was over. Now was the time for killing. Our Strike Group had done its part to help with the killing, we wouldn't be mourning that day.

Two different approaches to the same day, interesting perspective. We were lucky during that deployment and didn't lose a single Sailor or Marine. CSTC-A hasn't been that fortunate. I think that colors things a lot.

I still have a goal to make sure I fly on a commercial airliner on 9/11. I havent' gotten that chance, yet. I hope to someday soon.

Aggressive Drivers Make Me Twitchy

Today I had a couple of more firsts. Today was my first time in lead vehicle without anyone else in the vehicle who knew the route. There were other people in the car, but they were riders/security, not drivers. That was pretty sporty for me. I didn't mess up any routes, but I did hit some potholes while I was nogginizing about where to turn next. That was on the way up to our destintation.

On the way back, we had a different flavor of sporty. A vehicle with a stubby antenna on his hood (not normal) came in directly behind my #3 vehicle and was staying 2-3 feet off #3's tail. The guy kept trying to get into the middle of our formation (it seemed). He had a couple of chances to use a side road to get around us, but he didn't act like he was passing. If he had wanted to pass, he could have used the side road and we'd have let him by. He kept this up until one of our major checkpoints.

I don't know if he was trying to pass us and being dumb about it, was an angry Afghan wanting to play road-rage with the Americans, trying to hurt us (his car wasn't low to the ground, he wasn't wearing bulky clothes), he thought he'd be safer by traveling in the American group, or he was probing us to determine our tactics. I'm personally going for angry Afghan in a road rage mood. He messed with us for almost 40 minutes. If I had known he was going to be around us, I wouldn't have drunk that coffee at our destination to help stay awake -- he kept us awake just fine.

Good times, hopefully just a snarky dude with a fairly fast car -- that IS the most likely scenario.

Earthquake

Earthquake --- schweet! More fun.