So many problem, yeah.. its so many..
But I entertain myself by say, “Yeah, its the art of the field work”
Hahaha..

But like ones said, no problem no lesson.
I’ve got so many lessons from this “OJT”.
Lessons, both in technical matter or psychological..

Hmmmm…
For example, yesterday I myself ask to XL PIC, Mr. Anshar, to wait till tomorrow
morning to do the LSA Crimping..
But, what’s happened then?
In the morning, I couldnt call him, and when I could, he said, “I ve got an on
call to go to Lamasi..” zzzzz…
yeah, and I have to wait till really afternoon to see my jobs done..
*hmmm.. I got a leasson, “Dont wait till tomorrow what you can do today!”

But it isn’t finished though..
The LSA isnt done well by previous team from ICON+ and XL.
And its really made me headache for a day..
*zzzzzzz again..
But, I coordinated with ICON+ team in Makassar and also XL team in here (Palopo),
and insya Allah, today it will be fixed..
*Yeah, communication is extremely important in work

Hmmm..
But so far, its fun..
yeah, its painful, and psychologically tortured me.. hahaha..
But its fun for new knowledges, new experiences, and perhaps new nuances I got
from different cities..

Yeah, its really the art of the field work..

Tutorial ini menjelaskan secara ringkas konfigurasi NAT (Network Address Translation) pada router CISCO dengan menggunakan simulator GNS3. Tutorial ini juga menjelaskan cara konfigurasi qemu-host pada GNS3.

Pembahasan

1. Instalasi qemu-host pada GNS3.

Instalasi qemu-host pada GNS3 diperlukan untuk simulasi PC virtual. Instalasinya cukup mudah, yaitu :

1. Download dan simpan linux-microcore.
2. Jalankan GNS3, lalu buka konfigurasi qemu-host (edit->preference->qemu->qemu-host)
3. Atur konfigurasi seperti pada gambar.

4. Save -> OK.
5. Konfigurasi NAT

Konfigurasi NAT pada GNS3 dapat dilakukan dengan cara sbb :

1. Buat topologi

Topologi yang akan dibuat adalah sbb :

2. Nyalakan semua device
3. Secara otomatis, qemu-host akan mulai booting, sementara Router (R1 dan R2) harus di console terlebih dahulu (klik kanan -> console / klik symbol console pada menu bar)
4. Setting IP pada masing-masing device

a. R2 (serial 0/0 : 10.10.10.2/29 –> (config-if)#ip add 10.10.10.2 255.255.255.248)
b. R1 (serial 0/0 : 10.10.10.3/29 –> (config-if)#ip add 10.10.10.3 255.255.255.248) (fastEthernet0/0  : 192.168.0.1 –> (config-if)#ip add 192.168.0.1 255.255.255.0)
c. Qemu-host (eth0 : 192.168.0.2/24 –> ifconfig eth0 192.168.0.2 netmask 255.255.255.0 à route add default gw 192.168.0.1)

5. Setting NAT pada R1

a. (config)#ip nat inside source static 192.168.0.2 10.10.10.2
b. (config-if)#ip nat inside  <- pada interface fastEthernet0/0 (yang terkoneksi kedalam/jaringan lokal)
c. (config-if)#ip nat outside <- pada interface serial0/0 (yang terkoneksi keluar/ jaringan global)

6. Verifikasi NAT

#show ip nat translation

7. Tes ping

Coba ping dari qemu-host ke router R2 (ping 10.10.10.2) –> sukses

Coba sebaliknya (dari router R2 ke qemu host) (ping 192.168.0.2) –>gagal

Kesimpulan

Dari hasil tes ping, diketahui bahwa jaringan local dapat terhubung ke jaringan luar, sementara jaringan luar/global tidak dapat mengakses jaringan local. Artinya, simulasi NAT kita telah berhasil.

Referensi

http://networkingtips-tricks.blogspot.com/2010/09/add-qemu-host-in-gns3.html
Saputro, Joko. 2010. Praktikum CCNA di Komputer Sendiri Menggunakan GNS3. Jakarta : Mediakita.

Lampiran

Konfigurasi Router R1

version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
ip cef
no ip domain lookup
!
!
!
!
!
interface FastEthernet0/0
ip address 192.168.0.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
interface Serial0/0
ip address 10.10.10.3 255.255.255.248
ip nat outside
clockrate 2000000
!
interface FastEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/1
no ip address
shutdown
clockrate 2000000
!
ip nat inside source static 192.168.0.2 10.10.10.2
no ip http server
ip classless
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
!
end

At that point, the traffic is label-switched across that interface. Basically, OSPF does not form an adjacency across a link if the Label Distribution Protocol session is not established first across that link. (OSPF does not send out Hellos on the link.) Until the Label Distribution Protocol session is established or until the synchronization Holddown timer has expired, the OSPF adjacency is not established.

Synchronized here means that the local label bindings have been sent over the Label Distribution Protocol session to the Label Distribution Protocol peer. However, when the synchronization is turned on at router A and that router has only one link to router B and no other IP connectivity to router B via another path (this means via other routers), the OSPF adjacency never comes up. OSPF waits for the Label Distribution Protocol session to come up, but the Label Distribution Protocol session cannot come up because router A cannot have the route for the Label Distribution Protocol router ID of router B in its routing table.

The OSPF and Label Distribution Protocol adjacency can stay down forever in this situation! If router A has only router B as a neighbor, the Label Distribution Protocol router ID of router B is not reachable; this means that no route exists for it in the routing table of router A. In that case, the Label Distribution Protocol-IGP synchronization detects that the peer is not reachable and lets OSPF bring up the adjacency anyway. In this instance, the link is advertised with maximum metric until the synchronization occurs.

This makes the path through that link a path of last resort. In some instances, the problem with the Label Distribution Protocol session might be a persistent one; therefore, it is probably not desirable to keep waiting for the IGP adjacency to be established. The solution for this is to configure a Holddown timer for the synchronization. If the timer expires before the Label Distribution Protocol session is established, the OSPF adjacency is built anyway. If everything is fine with Label Distribution Protocol across that link, Label Distribution Protocol also forms a session across the link. While OSPF is waiting to bring up its adjacency until Label Distribution Protocol synchronizes, the OSPF interface state is down and OSPF does not send Hellos onto that link.

Multiprotocol Label Switching Label Distribution Protocol-IGP Synchronization Configuration

Multiprotocol Label Switching Label Distribution Protocol-IGP Synchronization is enabled for the IGP process. This means that it is configured for an IGP, and it applies to all the interfaces on which the IGP is running. The command to enable it for the IGP is Multiprotocol Label Switching ldp sync, which is configured under the router process. You can disable Multiprotocol Label Switching Label Distribution Protocol-IGP Synchronization on one particular interface with the command no Multiprotocol Label Switching ldp igp sync.

By default, if synchronization is not achieved, the IGP waits indefinitely to bring up the adjacency. You can change this with the global command Multiprotocol Label Switching ldp igp sync holddown msecs, which instructs the IGP to wait only for the configured time. After the synchronization Holddown timer expires, the IGP forms an adjacency across the link. So long as the IGP adjacency is up, while the Label Distribution Protocol session is not synchronized, the IGP advertises the link with maximum metric.

Multiprotocol Label Switching Label Distribution Protocol Session Protection

A common problem in networks is flapping links. The flapping of links can have several causes, but it’s not the aim of this article to look deeper into this. Flapping links do have an important impact on the convergence of the network. Because the IGP adjacency and the Label Distribution Protocol session are running across the link, they go down when the link goes down.

This is unfortunate, especially because the link is usually not down for long. The impact is pretty severe though, because the routing protocol and Label Distribution Protocol can remember to rebuild the neighborship. Label Distribution Protocol has to rebuild the Label Distribution Protocol session and must exchange the label bindings again. To avoid having to rebuild the Label Distribution Protocol session altogether, you can protect it.

When the Label Distribution Protocol session between two directly connected Label Switch Routers is protected, a targeted Label Distribution Protocol session is built between the two Label Switch Routers. When the directly connected link does go down between the two Label Switch Routers, the targeted Label Distribution Protocol session is kept up so long as an alternative path exists between the two Label Switch Routers. The Label Distribution Protocol link adjacency is removed when the link goes down, but the targeted adjacency keeps the Label Distribution Protocol session up. When the link comes back up, the Label Switch Router doesn’t have to re-establish the Label Distribution Protocol session; therefore, the convergence is better.

The access list (acl) you can configure lets you specify the Label Distribution Protocol peers that should be protected. It should hold the Label Distribution Protocol Router Identifier of the Label Distribution Protocol neighbors that need protection. The duration it’s time that the protection (the targeted Label Distribution Protocol session) should remain in place after the Label Distribution Protocol link adjacency has gone down.

The default value is infinite. For the protection to work, you have to enable it on both the Label Switch Routers. If this isn’t possible, you can enable it on one Label Switch Router, and the other Label Switch Router can accept the targeted Label Distribution Protocol Hellos by configuring the command Multiprotocol Label Switching ldp discovery targeted-hello accept. Label Distribution Protocol Session Protection is enabled on all four routers. The Label Switch Router madrid has two Label Distribution Protocol sessions: one with london and one with sydney.

When the link madridsydney fails, the targeted Label Distribution Protocol session is held up as it reroutes over the path madrid-london-romesydney. Example 4-30 shows the Label Distribution Protocol session on madrid to router sydney before the link went down. The link madrid-sydney then goes down. You can observe a logging message for the Label Distribution Protocol session when the link goes down and when the link comes back up. The first logging message indicates that the Label Distribution Protocol session has gone into protecting state; the second indicates that the Label Distribution Protocol session has been recovered successfully.

sumber

Those two paths are then shown in the CEF table as outgoing paths. In CEF, the two main load balancing schemes are per-packet or per-destination. If you configure the per-packet load balancing scheme, the load balancing of all packets is round-robin packet per packet on the outgoing links. The per-packet load balancing is configured with the interface command ip load-sharing per-packet.

You have to configure this command on all the outbound interfaces if you wish to configure per-packet CEF load balancing. The default CEF load balancing scheme is per-destination. This terminology is misleading, though, because the CEF per-destination load balancing is done by hashing the destination and source IP address. In contrast, the per-destination load balancing that fast switching does is strictly by exploring the destination IP address. Per-destination load sharing is the default load sharing scheme for CEF.

It’s the default load sharing method for CEF because the per-packet load sharing scheme can send consecutive packets of the identical flow (this means the same source/destination IP address pair) across different paths and hence could trigger a reordering problem of the IP packets at the destination. This leads to problems for traffic such as VoIP because a performance hit or quality degradation can occur if the packets arrive out of sequence, as packets are lost. In addition, it adds jitter.

Per-packet load sharing, however, gives a perfect load sharing distribution on the outgoing paths, whereas the per-destination load sharing is just a statistical method of distributing flows per pairs of (source IP address, destination IP address). Therefore, the load sharing of traffic with the perdestination method can only give a good result (a good distribution among all possible outgoing links) if enough different pairs of source and destination addresses make up the traffic toward the different destinations that are outbound on the outgoing links. Even then, if some flows are present, with considerably more traffic on than some others, which are on one path, the distribution might still be uneven.

Unequal Cost Load Balancing

You’ll be able to have unequal cost load balancing in CEF. In that case, the 16 hash buckets are not evenly distributed among all possible paths. Example 6-9 shows a router running Enhanced Interior Gateway Routing Protocol (EIGRP) as the routing protocol and variance being configured for EIGRP. Variance allows EIGRP to perform unequal cost load balancing because it enables routes to be installed in the routing table that are not the best. (These routes don’t have the lowest metric.) In short, the variance number allows all routes that have a metric that is smaller than that of the finest route multiplied by the variance to be installed in the routing table.

One additional check is needed: The reported distance (metric of the route as reported by the EIGRP neighbor) of a route needs to be smaller than the feasible distance (FD) in EIGRP it to be eligible for installation in the routing table. In Example 6-9, the best route for prefix 10.200.254.4/32 has a metric of 2323456, and the second best route has a metric of 8697856. This latter metric is 3.74 times bigger than the metric of the finest route, and this is reflected in the amount of hash buckets assigned to each one of the two paths. This ratio is also seen in the traffic share count in the routing table for the prefix (15/4). The best path pointing to Ethernet 1/2 has 13 hash buckets, whereas the path pointing to Ethernet 1/3 has 3 hash buckets. Obviously, 16 is a small number; consequently, a perfect distribution of the hash buckets based on the metric is not always possible. The distribution will be approximate.

Load Balancing Labeled Packets

If the Multiprotocol Label Switching payload is an IPv4 or IPv6 packet, Cisco IOS uses the CEF hashing algorithm to determine the outgoing interface, regarding per-destination load balancing. The load balancing is done only between labeled paths. This means that if an IP (unlabeled) and a labeled path have a similar cost, only the labeled path is used to forward the packets. The command to verify which path a labeled IPv4 packet will take regarding per-destination load balancing is show Multiprotocol Label Switching forwarding-table labels label exact-path ipv4 source-address destination-address. Following are the general rules for load balancing labeled packets on a non-IPv6-capable Cisco IOS router:

- If the Multiprotocol Label Switching payload is an IPv4 packet, the load balancing is done by hashing the source and destination IP address of the IPv4 header.

- If the Multiprotocol Label Switching payload is not an IPv4 packet, the load balancing is done by exploring the value of the bottom label.

How does an Multiprotocol Label Switching-enabled router know what the Multiprotocol Label Switching payload is? The router that assigned the label can figure this out by exploring the label, because this router assigned a label to the particular Forwarding Equivalence Class that the packet belongs to. However, if the stack holds more than one label, the P router in the Multiprotocol Label Switching network did not assign the bottom label. Because Multiprotocol Label Switching does not yet have a protocol identifier field in the label stack, the P router cannot easily identify what the Multiprotocol Label Switching payload is. In Cisco IOS, the router can consider the first nibble following the Multiprotocol Label Switching label stack. If the first nibble has the value 4, Cisco IOS considers this an IPv4 packet and performs IPv4 CEF hashing.

Newer Cisco IOS software that is also capable of running IPv6 can check whether the first nibble is 6. If so, the Multiprotocol Label Switching payload is considered IPv6, and the router performs IPv6 CEF hashing. The load balancing is then based on the source and destination address in the IPv6 header. The algorithm for load balancing the Multiprotocol Label Switching packets becomes as follows:

- If the Multiprotocol Label Switching payload is an IPv4 packet, the load balancing is done by hashing the source and destination IP address of the IPv4 header.

- If the Multiprotocol Label Switching payload is not an IPv4 or IPv6 packet, the load balancing is done by exploring the value of the bottom label.

Troubleshooting CEF

When packets don’t get to their destination in an Multiprotocol Label Switching network, it may be because CEF failed to label the packets correctly on the ingress PE router or forwarded them to the wrong adjacent router. You ought to have some technical troubleshooting skills to debug such CEF problems. You can disable and enable CEF on the interface using the command ip route-cache cef. Toggling CEF on the interface can often indicate whether the thing is with CEF. If the problem lies with the Layer 2 rewrite of the packets, you can examine the adjacency information with the show adjacency command or clear the adjacency with the clear adjacency command. The debug command debug ip cef drops [access-list[]|] tells you if IP packets are dropped on the ingress PE router. You can specify an access list 1 to 99 to help narrow the debug output to one or more specific prefixes.

sumber

its so fun to play with many OS.. he3..
Its simulation of my task, which is “How to build an Internet Network in the Campus”. Sound so wow! right? Ya, if it can be build properly, it can be such Wow! But.. ha3.. its difficult though..

Lalala.. lets play this game! Lets make some fun dude!

What you need to know is the path. Since their function are for configuring, the paths are relative to my own. So, If you want to use it, change the path first.

• DHCP Configurer
• CI Muyassar
• Java Muyassar
• XHTML Muyassar
• JavaScript Muyassar

• Code completion or code insight: The ability of an IDE to know a language’s
keywords and function names is crucial. The IDE may use this knowledge to do such
things as highlight typographic errors, suggest a list of available functions based on the
appropriate situation, or offer a function’s definition from the official documentation.

• Resource management: When creating applications, languages often rely on
certain resources, like library or header files, to be at specific locations. IDEs
should be able to manage these resources. An IDE should be aware of any required
resources so that errors can be spotted at the development stage and not later, in
the compile or build stage.

• Debugging tools: In an IDE, you should be able to thoroughly test your application
before release. The IDE may be able to give variable values at certain points, connect
to different data repositories, or accept different run-time parameters.

• Compile and build: For languages that require a compile or build stage, IDEs
translate code from high-level languages to the object code of the targeted platform.
Requirements for these features vary substantially from language to language. Thus, traditionally,
an IDE specializes in one language or a set of similar languages. Some famous IDEs and their
languages include: JBuilder for Java; Metrowerks CodeWarrior suite for Java, C, and C++; and
Microsoft’s Visual Studio for its Visual Basic and C# family of languages.

Advantages of Using an IDE

Using an IDE will save you a lot of effort in writing a program. Some advantages include:

1. Less time and effort: The entire purpose of an IDE is to make developing faster and
easier. Its tools and features are supposed to help you organize resources, prevent
mistakes, and provide shortcuts.

2. Enforce project or company standards: Simply by working in the same
development environment, a group of programmers will adhere to a standard way of
doing things. Standards can be further enforced if the IDE offers predefined
templates, or if code libraries are shared between different team members/teams
working on the same project.

3. Project management: This can be twofold. First, many IDEs have documentation
tools that either automate the entry of developer comments, or may actually force
developers to write comments in different areas. Second, simply by having a visual
presentation of resources, it should be a lot easier to know how an application is laid
out as opposed to traversing the file system for arcane files in the file system.

Disadvantages of Using an IDE

Be careful of some of the pitfalls of using an IDE as it may not be ideal for everyone and might
not be suitable in every situation.

1. Learning curve: IDEs are complicated tools. Maximizing their benefit will require
time and patience.

2. A sophisticated IDE may not be a good tool for beginning programmers: If you
throw the learning curve of an IDE on top of learning how to program, it can be quite
frustrating. Further, features and shortcuts for experienced programmers often hide
crucial but mundane details of a language. Details should not be overlooked when
learning a new language. Using an IDE may hamper the learning of a new language.

3. Will not fix bad code, practices, or design: You still need to be proficient and
meticulous. An IDE will not eliminate efficiency or performance problems in your
application. IDEs are like paintbrushes. Whether you create a Van Gogh or a Velvet
Elvis is dictated by your skill and decisions.

source : http://e-articles.info/e/a/title/Advantages-and-Disadvantages-of-using-IDE-~-Integrated-Development-Environments/

A lot of people refer to every single backdoor as a Trojan horse or simply a Trojan. This mixing together of the terms backdoor and Trojan horse is quite confusing and should be avoided. Backdoors simply give access. Trojan horses, pretend to be some useful program. Don’t mix the terms up. If a program just gives backdoor access, it’s just a backdoor. If it pretends to be some useful program, it’s a Trojan horse. Of course some tools are both backdoors and Trojan horses at the same time. However, a backdoor is only a Trojan horse if the attacker attempts to dress it up as some useful program. We label such tools with the unambiguous phrase Trojan horse backdoors, because they give access while pretending to be some benign program. Using the terminology properly will help people understand what types of tools and attacks you are talking about.

As you can see in our definition, backdoors are focused on giving the attacker access to the target machine. This access could take many different forms, depending on the attacker’s goals and the particular backdoor in use. Backdoors could give the attacker many different types of access, including the following:

• Local Escalation of Privilege: This type of backdoor lets attackers with an account on the system suddenly change their privilege level to root or administrator. With these superuser privileges, the attacker can reconfigure the box or access any files stored on it.
• Remote Execution of Individual Commands: Using this type of backdoor, an attacker can send a message to the target machine to execute a single command at a time. The backdoor runs the attacker’s command and returns the output to the attacker.
• Remote Command-Line Access: Also known as remote shell, this type of backdoor lets the attacker type directly into a command prompt of the victim machine from across the network. The attacker can utilize all of the features of the command line, including the ability to run a series of commands, write scripts, and select groups of files to manipulate. Remote shells are more powerful than simple remote execution of individual commands because they simulate the attacker having direct access to the keyboard of the target system.
• Remote Control of the GUI: Rather than messing around with command lines, some backdoors let an attacker see the GUI of the victim machine, control mouse movements, and enter keystrokes, all across the network. With remote control of the GUI, the attacker can watch all of a victim’s actions on the machine or even remotely control the GUI.

Regardless of which type of access the backdoor provides, we can see that each of these methods is focused on control. Backdoors let the attacker control the box, usually remotely across a network. With a backdoor installed on the target, an attacker can use this control to search the machine for sensitive files, to alter any data stored on the system, to reconfigure the box, or even to trash the system. Using a backdoor, the attacker could have just as much control of the victim machine as that machine’s own administrator. Topping it off, an attacker can exercise this control from anywhere in the world across the Internet.

source : http://e-articles.info/e/a/title/Different-Kinds-of-Backdoor-Access/

Saya mengasumsikan setiap router, kecuali router penghubung, telah terkonfigurasi dengan routing dynamic masing-masing (RIP, OSPF, EIGRP).

Untuk menghubungkan 3 protokol tersebut, konfigurasi untuk router penghubung adalah sebagai berikut :
Router(config)#router rip
Router(config-router)#network 192.168.2.0
Router(config-router)#redistribute eigrp 1 metric 1
Router(config-router)#redistribute ospf 1 metric 1
Router(config-router)#exit

Router(config)#router eigrp 1
Router(config-router)#network 192.168.3.0
Router(config-router)#redistribute rip metric 10000 100 255 1 1500
Router(config-router)#redistribute ospf 1 metric 10000 100 255 1 1500
Router(config-router)#exit

Router(config)#router ospf 1
Router(config-router)#network 192.168.4.0 0.0.0.255 area 1
Router(config-router)#redistribute rip
% Only classful networks will be redistributed
Router(config-router)#redistribute eigrp 1
% Only classful networks will be redistributed
Router(config-router)#exit

note : konfigurasi terakhir memang menampilkan pesan error (yang dicetak miring). Tetapi ini tidak mengganggu fungsionalitas router itu sendiri (sepertinya ini bug di packet tracer ini).

Selamat mencoba dan semoga bermanfaat.
Salam..

Setelah itu, upload halaman web yang akan divalidasi
Lalu tekan tombol Check
Jika halaman web anda valid, maka akan muncul keterangan “Passed”

Jika tidak, maka akan muncul keterangan error, dan lokasi errornya.

Silahkan perbaiki error tersebut, dan klik Revalidate.
Ulangi proses ini sampai halaman web anda “Passed”, alias valid. :D

Semoga bermanfaat.
Salam..