 |
7200emu.hacki.at Dynamips, Dynagen and all that stuff
|
 |
|
|
| View previous topic :: View next topic |
| Author |
Message |
Hamid
Joined: 29 Jan 2007 Posts: 74
|
Posted: Tue Apr 17, 2007 12:27 am Post subject: PIXEMU / Dynamips / Dynagen HowTo |
|
|
Hello ,
After playing a little bit with pixemu and qemu I got my lab with one PIX and four routers up and running. I have tested this on OpenSUSE 10.2, but other distros should be fine as long as you could bring up the tap interfaces. Bellow comes the howto. The lab diagram is attached:
A) Running PIXEMU:
I have placed all the pixemu files in /pixemu, and run it as follows:
| Code: |
cd /pixemu
sudo ./pixemu -no-kqemu -net nic,vlan=1,macaddr=00:a0:00:00:11:aa -net tap,vlan=1,script=if1up,ifname=tap1 -net nic,vlan=2,macaddr=00:a0:00:00:00:aa -net tap,vlan=2,script=if0up,ifname=tap0 -net nic,vlan=3,macaddr=00:a0:00:00:22:aa -net tap,vlan=3,script=if2up,ifname=tap2 -net nic,vlan=4,macaddr=00:a0:00:00:33:aa -net tap,vlan=4,script=if3up,ifname=tap3 -serial telnet::2051,server,nowait -m 128 FLASH |
Note that tap1 is initialized before tap0. This is to prevent the confusion between the tap interfaces and the ethernet interfaces on PIX. If you initialize tap0 first and then tap1, tap0 will be connected to ethernet1 on the PIX and tap1 will be connected to ethernet0.
-serial telnet::2051,server,nowait redirects the PIX console to a telnet server on TCP port 2051. Besides that it looks what you have seen with Dynamips/Dynagen, when connecting to the console via telnet, Ctrl+Z and Ctrl+C won't stop the pixemu process. (although I prefer the telnet server since it allows me to remotely connect to the PIX console, this is the ONLY way I could prevent pixemu to stop when pressing Ctrl+Z)
if0up, if1up, if2up and if3up are basically the same but with different ip addresses (first column). In my lab they have been setup as follows:
Tap Interface PIX Interface
---------------------------------------------------------------------------
tap0 (10.0.1.1) Ethernet0 (10.0.1.250) - outside
tap1 (10.1.1.1) Ethernet1 (10.1.1.250) - inside
tap2 (10.2.1.1) Ethernet2 (10.2.1.250) - dmz
tap3 (10.3.1.1) Ethernet3 (10.3.1.250) - dmz3
You can connect to the PIX console with telnet and configure it:
| Code: |
telnet localhost 2051
|
B) Creating the Dynagen Network Configuration File:
Here is the network configuration:
| Quote: |
[[3660]]
image = /windows/d/My Labs/IOS/unzipped/c3660-jk9o3s-mz.123-21.extracted.bin
ram = 128
rom = 4
nvram = 256
cnfg = None
confreg = 0x2102
mmap = false # My own preference since I have 2G of RAM. You could you mmap = true to reduce your lab's memory usage if you are short on memory.
[[ROUTER R0]]
model = 3660
console = 2000
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap0
[[ROUTER R1]]
model = 3660
console = 2001
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap1
[[ROUTER R2]]
model = 3660
console = 2002
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap2
[[ROUTER R3]]
model = 3660
console = 2003
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap3
|
Note that FastEthernet0/1 on each router (RX) is connected to corresponding interface on the PIX (EthernetX). I have intentionally left FastEthernet0/0 unused, so it could be used in to connect to the rest of your lab.
C) Run your Lab!
Assuming that pixemu is still running, you have to run your lab:
| Code: |
sudo dynamips -H 7200
dynagen pix-lab.net
|
NOTE:
Since dynagen uses the tap interfaces in the config, they have to exist before you reference them, meaning that you have to run pixemu before running dynagen!
Any inputs would be welcome.
Hope this helps and
Enjoy!
Hamid
Last edited by Hamid on Tue Apr 17, 2007 8:10 pm; edited 1 time in total |
|
| Back to top |
|
 |
vex
Joined: 17 Feb 2007 Posts: 61 Location: Boston, MA
|
Posted: Tue Apr 17, 2007 12:44 am Post subject: |
|
|
Excellent work Hamid.
What is your CPU usage like with this configuration?
I'm definately going to try this on some of lab modules in Khawar Butt's new CCIE Security workbook.
It should be fairly easy to integrate it with the ethernet of my linux host and the 2950 switch I have in the lab to accomodate dot1q and other external lab devices like Cisco IPS, an ACS server etc. |
|
| Back to top |
|
 |
greg Site Admin
Joined: 17 Jul 2006 Posts: 704 Location: USA
|
Posted: Tue Apr 17, 2007 1:55 pm Post subject: |
|
|
| Very nice writeup Hamid. Thanks. |
|
| Back to top |
|
 |
bzzjh
Joined: 15 Apr 2007 Posts: 50 Location: China
|
Posted: Tue Apr 17, 2007 5:00 pm Post subject: |
|
|
great works
but you made a mistake
| Quote: |
cd /pixemu
sudo ./pixemu -no-kqemu -net nic,vlan=1,macaddr=00:a0:00:00:11:aa -net tap,vlan=1,script=if1up,ifname=tap1 -net nic,vlan=2,macaddr=00:a0:00:00:00:aa -net tap,vlan=2,script=if0up,ifname=tap0 -net nic,vlan=3,macaddr=00:a0:00:00:22:aa -net tap,vlan=3,script=if2up,ifname=tap2 -net nic,vlan=4,macaddr=00:a0:00:00:33:aa -net tap,vlan=4,script=if3up,ifname=tap3 -serial telnet::2051,server,nowait -m 128 FLASH |
|
|
| Back to top |
|
 |
Hamid
Joined: 29 Jan 2007 Posts: 74
|
Posted: Tue Apr 17, 2007 8:11 pm Post subject: |
|
|
| Corrected it, thanks. |
|
| Back to top |
|
 |
tempnet
Joined: 02 Jan 2007 Posts: 106
|
Posted: Wed Apr 18, 2007 3:17 am Post subject: |
|
|
I followed hamid's instruction; however, i got the following error message when I tried to start
dynagen with the network config file, I did make sure the pix started with tap0, tap1, tap2 and tap3.
[root@localhost pixlab]# dynagen pixlab.net
Reading configuration file...
*** Error: Connecting R1 f0/0 to NIO_linux_eth:tap0 resulted in
206-unable to create Linux raw ethernet NIO
Press ENTER to continue
Here is my config file:
# Pix Lab
autostart = false
sparsesmem = true
[localhost:7200]
[[3640]]
image = /home/jtan/ios/c3640-jk9o3s-mz.123-10.extracted.BIN
idlepc = 0x60458c7c
mmap = false
[[ROUTER R1]]
model = 3640
slot0 = NM-1FE-TX
f0/0 = NIO_linux_eth:tap0
[[ROUTER R2]]
model = 3640
slot0 = NM-1FE-TX
f0/0 = NIO_linux_eth:tap1
[[ROUTER R3]]
model = 3640
slot0 = NM-1FE-TX
f0/0 = NIO_linux_eth:tap2
[[ROUTER R4]]
model = 3640
slot0 = NM-1FE-TX
f0/0 = NIO_linux_eth:tap3
Can someone tell me how to fix the error? Thanks! |
|
| Back to top |
|
 |
tempnet
Joined: 02 Jan 2007 Posts: 106
|
Posted: Wed Apr 18, 2007 3:47 am Post subject: |
|
|
never mind, it works now!  |
|
| Back to top |
|
 |
Hamid
Joined: 29 Jan 2007 Posts: 74
|
Posted: Wed Apr 18, 2007 11:36 am Post subject: |
|
|
| Quote: | [root@localhost pixlab]# dynagen pixlab.net
Reading configuration file...
*** Error: Connecting R1 f0/0 to NIO_linux_eth:tap0 resulted in
206-unable to create Linux raw ethernet NIO
Press ENTER to continue
|
I got this problem once, the reason was that linux (the host) was not seeing my ethernet interface on my notebook(the cable was unpluged when booting up), restarted and everything worked fine. I am not sure and maybe greg could clarify the dependencies in between, but as long as the ethernet interface is up, I don't see any problems. |
|
| Back to top |
|
 |
hacki Site Admin
Joined: 16 Jul 2006 Posts: 479 Location: Austria
|
Posted: Wed Apr 18, 2007 12:38 pm Post subject: |
|
|
Hamid:
did you start the hypervisor as root ?
h. |
|
| Back to top |
|
 |
Hamid
Joined: 29 Jan 2007 Posts: 74
|
Posted: Wed Apr 18, 2007 1:02 pm Post subject: |
|
|
| Yes, AFAIK dynamips should be run as root , but correct me if I am wrong. |
|
| Back to top |
|
 |
hacki Site Admin
Joined: 16 Jul 2006 Posts: 479 Location: Austria
|
Posted: Wed Apr 18, 2007 1:25 pm Post subject: |
|
|
Yes and I received a similar error message before starting dynamips as root. That's why I asked.
h. |
|
| Back to top |
|
 |
Hamid
Joined: 29 Jan 2007 Posts: 74
|
Posted: Wed Apr 18, 2007 1:49 pm Post subject: |
|
|
| I guess you need to be root since dynamips uses pcap to communicate with real networks. Sniffing data (pcap) requires root permission. |
|
| Back to top |
|
 |
tempnet
Joined: 02 Jan 2007 Posts: 106
|
Posted: Wed Apr 18, 2007 5:33 pm Post subject: |
|
|
[[3640]]
image = /home/jtan/ios/c3640-jk9o3s-mz.123-10.extracted.BIN
idlepc = 0x60458c7c
mmap = false
[[ROUTER R1]]
model = 3640
slot0 = NM-1FE-TX
f0/0 = NIO_linux_eth:tap0
I didn't know what was wrong, I changed slot0 = NM-4E and e0/1 = NIO_linux_eth:tap0 and then it works.
Pixemu works fine with Dynamips; however, for some reason, Pixemu hangs pretty often, I have to press Ctrl + C to kill the process and then restart Pixemu again. |
|
| Back to top |
|
 |
mmm123
Joined: 05 Apr 2007 Posts: 302
|
Posted: Wed Apr 18, 2007 6:20 pm Post subject: |
|
|
That is strange, do you use compiled version or source code?
in both cases, try the opposite to see if it changes something.
Also If you use relatively slow CPU, sometimes pixemu looks like it is not responding, but you just need to wait. This usually happens when you try to connect to web interface, or some other CPU-intensive operations like generating keys or connecting to it via ssh. In all these cases it doesn't hang permanently, it is just slow to respond to console. |
|
| Back to top |
|
 |
tempnet
Joined: 02 Jan 2007 Posts: 106
|
Posted: Wed Apr 18, 2007 6:53 pm Post subject: |
|
|
I use the latest compiled version which you provided. I use Fedora Core 5, CPU 2.4 P4 with 750 MB of RAM.
I am new to linux, does anyone know how to start pixemu with a script. Everytime when I start it i have to copy the long string of commands from a backup text file and paste it on prompt.
Thanks! |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You cannot download files in this forum
|
|