ICT for Myanmar in English

If you're using Azure API Management (APIM) services, you've likely seen this message: "Support for the single-tenant v1 (STv1) platform ends on 8/31/24. Migrate instances before that date to the new platform version (STv2) for continued support and access to new features." This announcement highlights the urgency of migrating to STv2. To ensure a smooth transition, it's crucial to analyze our architecture, understand technical constraints, explore possible approaches, and assess risks. Here’s a summarized guide on how I managed the migration using the VNET-injection method. My Case: APIM with Dedicated Public IP and Subnet Configuration: APIM with a dedicated public IP and a dedicated subnet. Assigned private IP with NAT in a controlled VNET. Need to maintain IP addresses and DNS. Issues: APIM migration requires a new public IP, new subnet with private IP, new DNS, and new NSG. APIM instances acquire IP addresses randomly, complicating existing firewall rules, NS...

I've upgraded my AKS nodes in Cluster last night. After upgraded both nodes, all my apps went down and all my internal load balancers was not able to access. Spending many hours in troubleshooting and ends up with the miserable findings of root caused. That's it.... The Resource Tagging used in my Cluster and it's resource has exceed more than 50 tags. Microsoft recommendation is to maintain the tags less than 20. After I've removed over 30 tags and refresh the nodes then only all my resources are back up online as well as the applications. Currently, the resource sync the tags with cluster are below, AKS Cluster itself Router Table Pubic IP Load Balancer Network Security Group Virtual Network AKS managed kubelet msi AKS managed addon msi Private DNS zone Private endpoint So, beware this when you have more than 50 tags on your AKS Cluster. Cheer!  Have a good day. (Be knowledgeable, pass it on then)

TFTP server is sitting in subnet which can reach via global routing table and your network devices is configured OOB with vrf routing. You have no other ways to copy your files to your device except from TFTP server. What will you do then? 😊 Leaking vrf to global routing or vice versa?  The answer is ... configure terminal ip tftp source-interface (Your OOB interface IP) You’re done. Cheer!  Have a good day. (Be knowledgeable, pass it on then)

When you use External Block List for Malicious IP with your PaloAlto, you need API Key for your server to refresh the list whenever you update the content. The API key syntax for PAN OS 7 and 8 is different and it will take your time after you upgrade PAN OS. So here is the solution what I've tested. Syntax for 7 is https://<firewall IP>/api/?type=op&cmd=<request><system><external-list><refresh><name>Type your EBL Name Here</name></refresh></external-list></system></request>&key="API Key" Syntax for 8 is https://<firewall ip>/api/?type=op&cmd=<request><system><external-list><refresh><type><ip> <name>Type your EBL Name Here</name></ip> </type></refresh></external-list></system></request>&key="API Key" Have fun with PAN OS. Thanks. Have a good da...

Anyone of you having difficulty in troubleshooting MPLS as a beginner? I did some research and take notes for myself and now it is for you to do reference as well. MPLS troubleshooting can be divided into two main steps: 1) Verify routing information flow 2) Verify proper data flow - Routing information flow troubleshooting requires verification of end-to-end routing information propagation between CE routers. - Verification of the routing information flow should be done systematically, starting at the routing ingress CE and moving to the egress CE. - Verification of the data flow should be done systematically, starting at the data flow ingress CE and moving to the egress CE. There are three things to perform basic MPLS troubleshooting. They are, 1) Preliminary steps in MPLS VPN Troubleshooting: - Is CEF enabled? - Are labels for IGP routes generated and propagated? - Are large labeled packets propagated across the MPLS backbone (maximum transmission unit issues)? 2) Verify the routi...

I was encounter below error message when I tried to install HP Comware simulator (H3C cloud Lab). "The virtualbox version is lower than the HCL needed." My PC was installed with Virtualbox Version 5.0.16 and it is latest when I am writing this post. Below is the resolve method to skip this error. You just open registry editor and go to HKEY_LOCAL_MACHINE>SOFTWARE>Oracle>Virtualbox . Then change the Data Value of Version and VersionExt to 4.2.18 and try to reinstall Simulator. You will see no more error while installing it. Do not forget to revert to correct version data value in registry value after Simulator installation done. Have a good time. (Be knowledgeable, pass it on then)

As usual, online shopping website are discounting for year ends after ThanksGiving Day, Black Friday and Cyber Monday. As a result, spammer also launch spam campaign to find the victim via online shopping. Below are guide for "How to stay safe" at online and "Best practices for avoiding email scams". How to Stay Safe An important skill to stay safe online is how to identify fraudulent domain names used in malicious links in emails. Scammers will usually try to deceive end users by disguising the true second-level domain, by prepending legitimate, familiar names to the beginning of hostnames. Appearing to come from a legitimate sources, the malicious email will contain links to sites that host exploit code with the hope that the user have unpatched systems and vulnerable web browsers, and the goal of compromising the user's system. Other attack vectors come directly in email attachments--word docs, executables, and other infected files. Best practices for avoid...

If you want to disable the Wireless SSID from broadcasting and remove on all Access Points, please follow below steps in your Ruckus ZoneDirector. - Login to ZoneDirector - Click "Configure" and go to "WLANs" - Fine "WLAN Groups" under "WLANs" Section - If you are using "System Default Group", just select it and edit. Then uncheck the SSID which you want to disable from bradcast and remove from all APs and Click "OK". - If you are using "Custom Group", just same as above step. Now your SSID has been disabled and removed from all Access Points. You can verify by going to Dashboard and checking "Most Recent System Activities" . That's all. Have a good time. (Be knowledgeable, pass it on then)

I had to configure and install one Meg@POP router at site office. Configuration is very simple. Just WAN, LAN and Static Routing. After all configuration was done, I can PING from router and client to SingTel Side IP and HQ side IP but not from them. I had to reviewed simple configuration repeatedly and unable to find any wrong. But after check the Firewall setting since this router has security feature included. Then realized "Block WAN Request" option checkbox was checked and need to uncheck. After I unchecked it and save, SingTel and HQ can PING to this router successfully. Thanks God. So if you are having same issue like me while configuring Cisco RV215W Wireless VPN Router, just do no forget to uncheck that "Block WAN Request" and save to able to PING from outside. Have a good time. (Be knowledgeable, pass it on then)

There are some factors that we need to consider when we setup Site to Site VPN Tunnel with SonicWall Firewall. If we forgot to conside these factors, we will encounter frequent connection drop on your Tunnel. (e.g. RDP connection timeout) Below are those we should consider when we setup VPN Tunnels with SonicWall. 1) TCP Timeout TCP Connection Inactivity Timeout value of SonicWall and other Firewalls are 15 minutes by Default. In real world, this value can make your RDP connection drop frequently. So, Firewall Tech Support are recommended to set the TCP Timeout Value from 30minutes to 60minutes. Higher TCP Timeout Value are inviting some unnecessary security threats and that's why we should only allow for specific connection in your Policy-Based VPN Tunnels or Route-Based VPN Tunnels. 2) Packet Fragmentation As RDS is a streaming protocol, packet fragmentation should be avoided. Almost all Firewall including SonicWall has Fragmented Packet Handling and Ignore DF (Don...

I've wrote post about Network Attack previously and now I'd like to share how to configure IPS function in HP MSR Series Customer Edge Router. In general, this kind of router are provided by ISP and Engineer/Technician are configure for you if you pay for the service fees but they will not enable IPS function for you mostly. If you didn't expense extra service fees for router configuration, then it's fall on your responsibility. Anyway, the router must enable IPS function either you or they configure it. Why? It is easy to get our IP address and get attack my attacker nowadays. OK. Let's start it now. - First you have to configure attack defense policy - Then apply on router interfaces respectively. Use below commands to create Single-Packet Attack policy and prevent system-view attack-defense policy 1 signature-detect fraggle enable signature-detect icmp-redirect enable signature-detect large-icmp enable signature-detect route-record enable sign...

In general,we can classify the network attacks in three part as Single-Packet Attack, Scanning Attack and Flood Attack. Single-packet attack is also called malformed packet attack because many single-packet attacks use defective IP packets, such as overlapping IP fragments and packets with illegal TCP flags. A single-packet attack occurs when: • An attacker sends defective IP packets to a target, causing the target system to malfunction or crash. • An attacker sends large quantities of junk packets to the network, using up the network bandwidth. Single-Packet Attack has multipe types and below list are Single-Packet Attack types those can be found in real world. Smurf attack ICMP redirect attack ICMP unreachable attack Large ICMP attack TCP flag attack Tracert attack Fraggle attack WinNuke attack Land attack Source route attack Route record attack Scanning Attack is actually an attacker uses some scanning tools (like nmap,nessua, satan,ettercap) to scan host addresse...

Time is important for you to check logs. This time I'd like to show you how to configure NTP Server in HP Procurve Switches. HP Switches are only support less secure SNTP instead of NTP. OK. Let's Configure! Login to your switch with console/terminal and type following commands for your sntp server configuration. configure terminal timesync sntp sntp unicast (Use this command if you want to use only one NTP server) (or) sntp broadcast (Use this command if you want to use more than one NTP server) sntp server priority 1 218.186.3.36 (or) sntp server  218.186.3.36 (These above two commands are working on different model. Some model work first command and some model work second command. Please take note that you can configure maximum 3 NTP server for your switch. In my example, I use NTP server for Singapore) time timezone +480 (Formula for this command is GMT+Regional Time in Minute. I use Singapore Time and GMT+8. 8 hours in minute is 480. So result is GMT+48...

If you have many SonicWall Firewall, it is not easy to manage without SonicWall GMS. GMS have two logins for System Interface and Application Interface. System Interface is to manage your GMS Hardware Appliance or Virtual Appliance. Application Interface is to manage your SonicWall devices in your network. So, you can contact to SonicWall Technical Support if you forgot the login password of GMS System Interface. But to do so, you need valid support contract/license. (So take note it and do not forget if you didn’t renew support contract/license. :P) For application interface login password, you do not need Tech Support if you know how. As human being, I am sure you will forget your password sometimes and here is how to reset the GMS Application Interface Password. First, you will see like below if you forgot password. You need MySQL Query Browser to access GMS Database in order to reset the password. 1.       Download it from bel...

There are a lot of things to take note before we going to deploy 2.4GHz Wireless Network. If we select channel wrongly, stability and performance of our Wireless Network and it’s client will impact badly. As we know that we can get Channel 1 to 11 (1 to 13 in some devices) for 2.4GHz spectrum. A few channels are only non-overlap among these channel. Channel 1,6 and 11 for range between  1 to 11 are not overlap. Channel 1,5,9 and 13 for range between 1 to 13 are not overlap. Currently, many wireless routers automatically select the channel for you upon initial setup, where depending on your wireless environment, it could lead to slow Wi‑Fi speeds and interference.  It is not always right to configure Automation on channelization on Standlone or Controller Base Wireless devices. The following explanation will describe what interference you're dealing with and takes you through the steps to selecting the right channel, so you can understand why you should c...

It is not possible in SonicWall UTM Appliacnes to connect between Spoke to Spoke in Hub and Spoke IPSec VPN topology as Gateway in Spoke can only one time. We can solve this issue by using Route-Based VPN with Tunnel Interface. Take a look at below sample network diagram and let's configure route-based vpn in two sonicwall utm appliances. Step 1: Log into the SonicWALL Go to VPN > Settings and click on Add. The General tab of Tunnel Interface VPN named 'to 2' is shown w/ the IPSec Gateway equal to the other device's X1 IP address, 2.2.2.2 Step 2: Go to Network > routing and click Add . The Route Policy example shown below is one in which the source is Any, and the destination is the "2 Subnets", the service is Any, and the Interface is set to the name of the previously-created Tunnel Interface VPN, named 'to 2' ; note that the Gateway field is grayed out because SonicOS is smart enough to know that there is alrea...

Today, I'd like to share the steps to configure IPSec Site to Site VPN Tunnel with IKEv2 Mode between SonicWalls Please proceed below steps in Local and Remote site SonicWall Firewall to get your VPN Tunnel - Create Firewall Address Object and Assign them to the correct Zone Assignment - By default, VPN setting in SonicWall is disable. So, do not forget to Enable it. - Add VPN Policy with below details in correct. ( ၁။ Policy Type က Site to Site 1> Policy Type must be Site to Site 2> Authentication Method have to be IKE using Preshared Secret 3> Assign VPN name for ease of understanding. 4> IPSec Primary Gateway Name or Address must be the WAN IP Address of Remote Site Firewall 5> Key in complex and secure Shared Secret 6> Put correct Local and Peer (Remote) WAN IP Addresses as IKE ID for IKEv2 Mode in your two Firewalls 7> Local and Destination (Remote) Network Subnet should be correct in your Network Section of VPN Policy 8> Ensure Phase ...

Cisco Video Telepresence behind a SonicWall fail and timeout exactly at 15 minutes (900 seconds)?  This is usually due to a firewall rule (WAN to Cisco Telepresence) that closes open TCP connections after a set “timeout”. If you have a SonicWall, this is certainly the case as the default is 15 minutes. To fix this kind of issue, just edit the Access Rule and go to Advanced Tab. Modify default value 15 minutes from TCP Connection Inactivity Timeout (minutes): to the time setting as your requirement as shown below. After Access Rule has been modify, click OK and test again. Take note that modification must be done on both side Firewall. Well. You connection now should be run on the modified time setting which done by you as stated above step. I've tested on SonicWall NSA3600 with Firmware Version SonicOS Enhanced 6.1.1.5-19n. Have a good time. (Be knowledgeable, pass it on then)

If Client Load balancing is not working as expected in AP Level , Band Level, SSID Level Load Balancing, you still can configure Radio Level Load Balancing in you Ruckus Zone Director Controller for your APs. It is simple to do this. Login to the ZoneDirector with Command Line and go to Global Configuration Mode. Enter to Load-Balancing Mode and enable the Radio Level Load-Balancing. It is disable by default. Use wifi 0 for 2.4GHz and wifi 1 for 5GHz. You may adjust threshold level if you wish to. Check the below picture for your reference. Here I show with Ruckus Zone Director 1106 and AP R710. Zone Director Firmware is 9.8.2.0 build 27. Have a good time. (Be knowledgeable, pass it on then)

Normally you will see only asterisk when you are checking SNMP community string in your ASA firewall as below. To uncover the string, you can use below command. ciscoasa# more system:running-configuration So that you can check your SNMP Community String and can do some other task which related with SNMP. This is useful for checking your ASA Firewall which setup by other Engineer or the time you forgot your string. This command not only for SNMP Community String but also for ntp pre-shared-key , vpn pre-shared-key, etc. Have a good time. (Be knowledgeable, pass it on then)