7200emu.hacki.at Forum Index 7200emu.hacki.at
Dynamips, Dynagen and all that stuff
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 
7200emu.hacki.at Forum Index

hackibr>

PIXEMU / Dynamips / Dynagen HowTo
Goto page 1, 2  Next
 
Post new topic   Reply to topic    7200emu.hacki.at Forum Index -> PIX and ASA (old forum)
View previous topic :: View next topic  
Author Message
Hamid



Joined: 29 Jan 2007
Posts: 74

PostPosted: Tue Apr 17, 2007 12:27 am    Post subject: PIXEMU / Dynamips / Dynagen HowTo Reply with quote

Hello ,
After playing a little bit with pixemu and qemu I got my lab with one PIX and four routers up and running. I have tested this on OpenSUSE 10.2, but other distros should be fine as long as you could bring up the tap interfaces. Bellow comes the howto. The lab diagram is attached:

A) Running PIXEMU:
I have placed all the pixemu files in /pixemu, and run it as follows:
Code:

cd /pixemu
sudo ./pixemu -no-kqemu -net nic,vlan=1,macaddr=00:a0:00:00:11:aa -net tap,vlan=1,script=if1up,ifname=tap1 -net nic,vlan=2,macaddr=00:a0:00:00:00:aa -net tap,vlan=2,script=if0up,ifname=tap0 -net nic,vlan=3,macaddr=00:a0:00:00:22:aa -net tap,vlan=3,script=if2up,ifname=tap2 -net nic,vlan=4,macaddr=00:a0:00:00:33:aa -net tap,vlan=4,script=if3up,ifname=tap3 -serial telnet::2051,server,nowait -m 128 FLASH

Note that tap1 is initialized before tap0. This is to prevent the confusion between the tap interfaces and the ethernet interfaces on PIX. If you initialize tap0 first and then tap1, tap0 will be connected to ethernet1 on the PIX and tap1 will be connected to ethernet0.
-serial telnet::2051,server,nowait redirects the PIX console to a telnet server on TCP port 2051. Besides that it looks what you have seen with Dynamips/Dynagen, when connecting to the console via telnet, Ctrl+Z and Ctrl+C won't stop the pixemu process. (although I prefer the telnet server since it allows me to remotely connect to the PIX console, this is the ONLY way I could prevent pixemu to stop when pressing Ctrl+Z)
if0up, if1up, if2up and if3up are basically the same but with different ip addresses (first column). In my lab they have been setup as follows:

Tap Interface PIX Interface
---------------------------------------------------------------------------
tap0 (10.0.1.1) Ethernet0 (10.0.1.250) - outside
tap1 (10.1.1.1) Ethernet1 (10.1.1.250) - inside
tap2 (10.2.1.1) Ethernet2 (10.2.1.250) - dmz
tap3 (10.3.1.1) Ethernet3 (10.3.1.250) - dmz3

You can connect to the PIX console with telnet and configure it:
Code:

telnet localhost 2051


B) Creating the Dynagen Network Configuration File:
Here is the network configuration:
Quote:

[[3660]]
image = /windows/d/My Labs/IOS/unzipped/c3660-jk9o3s-mz.123-21.extracted.bin
ram = 128
rom = 4
nvram = 256
cnfg = None
confreg = 0x2102
mmap = false # My own preference since I have 2G of RAM. You could you mmap = true to reduce your lab's memory usage if you are short on memory.

[[ROUTER R0]]
model = 3660
console = 2000
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap0

[[ROUTER R1]]
model = 3660
console = 2001
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap1

[[ROUTER R2]]
model = 3660
console = 2002
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap2

[[ROUTER R3]]
model = 3660
console = 2003
slot1 = NM-4T
F0/1 = NIO_linux_eth:tap3

Note that FastEthernet0/1 on each router (RX) is connected to corresponding interface on the PIX (EthernetX). I have intentionally left FastEthernet0/0 unused, so it could be used in to connect to the rest of your lab.

C) Run your Lab!
Assuming that pixemu is still running, you have to run your lab:
Code:

sudo dynamips -H 7200
dynagen pix-lab.net


NOTE:
Since dynagen uses the tap interfaces in the config, they have to exist before you reference them, meaning that you have to run pixemu before running dynagen!

Any inputs would be welcome.

Hope this helps and
Enjoy!

Hamid


Last edited by Hamid on Tue Apr 17, 2007 8:10 pm; edited 1 time in total
Back to top
View user's profile Send private message
vex



Joined: 17 Feb 2007
Posts: 61
Location: Boston, MA

PostPosted: Tue Apr 17, 2007 12:44 am    Post subject: Reply with quote

Excellent work Hamid.

What is your CPU usage like with this configuration?

I'm definately going to try this on some of lab modules in Khawar Butt's new CCIE Security workbook.

It should be fairly easy to integrate it with the ethernet of my linux host and the 2950 switch I have in the lab to accomodate dot1q and other external lab devices like Cisco IPS, an ACS server etc.
Back to top
View user's profile Send private message Visit poster's website
greg
Site Admin


Joined: 17 Jul 2006
Posts: 704
Location: USA

PostPosted: Tue Apr 17, 2007 1:55 pm    Post subject: Reply with quote

Very nice writeup Hamid. Thanks.
Back to top
View user's profile Send private message Visit poster's website
bzzjh



Joined: 15 Apr 2007
Posts: 50
Location: China

PostPosted: Tue Apr 17, 2007 5:00 pm    Post subject: Reply with quote

great works
but you made a mistake
Quote:

cd /pixemu
sudo ./pixemu -no-kqemu -net nic,vlan=1,macaddr=00:a0:00:00:11:aa -net tap,vlan=1,script=if1up,ifname=tap1 -net nic,vlan=2,macaddr=00:a0:00:00:00:aa -net tap,vlan=2,script=if0up,ifname=tap0 -net nic,vlan=3,macaddr=00:a0:00:00:22:aa -net tap,vlan=3,script=if2up,ifname=tap2 -net nic,vlan=4,macaddr=00:a0:00:00:33:aa -net tap,vlan=4,script=if3up,ifname=tap3 -serial telnet::2051,server,nowait -m 128 FLASH
Back to top
View user's profile Send private message
Hamid



Joined: 29 Jan 2007
Posts: 74

PostPosted: Tue Apr 17, 2007 8:11 pm    Post subject: Reply with quote

Corrected it, thanks.
Back to top
View user's profile Send private message
tempnet



Joined: 02 Jan 2007
Posts: 106

PostPosted: Wed Apr 18, 2007 3:17 am    Post subject: Reply with quote

I followed hamid's instruction; however, i got the following error message when I tried to start
dynagen with the network config file, I did make sure the pix started with tap0, tap1, tap2 and tap3.

[root@localhost pixlab]# dynagen pixlab.net

Reading configuration file...


*** Error: Connecting R1 f0/0 to NIO_linux_eth:tap0 resulted in
206-unable to create Linux raw ethernet NIO
Press ENTER to continue

Here is my config file:

# Pix Lab



autostart = false

sparsesmem = true



[localhost:7200]



[[3640]]

image = /home/jtan/ios/c3640-jk9o3s-mz.123-10.extracted.BIN

idlepc = 0x60458c7c

mmap = false



[[ROUTER R1]]

model = 3640

slot0 = NM-1FE-TX

f0/0 = NIO_linux_eth:tap0





[[ROUTER R2]]

model = 3640

slot0 = NM-1FE-TX

f0/0 = NIO_linux_eth:tap1





[[ROUTER R3]]

model = 3640

slot0 = NM-1FE-TX

f0/0 = NIO_linux_eth:tap2





[[ROUTER R4]]

model = 3640

slot0 = NM-1FE-TX

f0/0 = NIO_linux_eth:tap3



Can someone tell me how to fix the error? Thanks!
Back to top
View user's profile Send private message
tempnet



Joined: 02 Jan 2007
Posts: 106

PostPosted: Wed Apr 18, 2007 3:47 am    Post subject: Reply with quote

never mind, it works now! Cool
Back to top
View user's profile Send private message
Hamid



Joined: 29 Jan 2007
Posts: 74

PostPosted: Wed Apr 18, 2007 11:36 am    Post subject: Reply with quote

Quote:
[root@localhost pixlab]# dynagen pixlab.net

Reading configuration file...


*** Error: Connecting R1 f0/0 to NIO_linux_eth:tap0 resulted in
206-unable to create Linux raw ethernet NIO
Press ENTER to continue

I got this problem once, the reason was that linux (the host) was not seeing my ethernet interface on my notebook(the cable was unpluged when booting up), restarted and everything worked fine. I am not sure and maybe greg could clarify the dependencies in between, but as long as the ethernet interface is up, I don't see any problems.
Back to top
View user's profile Send private message
hacki
Site Admin


Joined: 16 Jul 2006
Posts: 479
Location: Austria

PostPosted: Wed Apr 18, 2007 12:38 pm    Post subject: Reply with quote

Hamid:

did you start the hypervisor as root ?

h.
Back to top
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
Hamid



Joined: 29 Jan 2007
Posts: 74

PostPosted: Wed Apr 18, 2007 1:02 pm    Post subject: Reply with quote

Yes, AFAIK dynamips should be run as root , but correct me if I am wrong.
Back to top
View user's profile Send private message
hacki
Site Admin


Joined: 16 Jul 2006
Posts: 479
Location: Austria

PostPosted: Wed Apr 18, 2007 1:25 pm    Post subject: Reply with quote

Yes and I received a similar error message before starting dynamips as root. That's why I asked.

h.
Back to top
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
Hamid



Joined: 29 Jan 2007
Posts: 74

PostPosted: Wed Apr 18, 2007 1:49 pm    Post subject: Reply with quote

I guess you need to be root since dynamips uses pcap to communicate with real networks. Sniffing data (pcap) requires root permission.
Back to top
View user's profile Send private message
tempnet



Joined: 02 Jan 2007
Posts: 106

PostPosted: Wed Apr 18, 2007 5:33 pm    Post subject: Reply with quote

[[3640]]
image = /home/jtan/ios/c3640-jk9o3s-mz.123-10.extracted.BIN
idlepc = 0x60458c7c
mmap = false

[[ROUTER R1]]
model = 3640
slot0 = NM-1FE-TX
f0/0 = NIO_linux_eth:tap0

I didn't know what was wrong, I changed slot0 = NM-4E and e0/1 = NIO_linux_eth:tap0 and then it works.

Pixemu works fine with Dynamips; however, for some reason, Pixemu hangs pretty often, I have to press Ctrl + C to kill the process and then restart Pixemu again.
Back to top
View user's profile Send private message
mmm123



Joined: 05 Apr 2007
Posts: 302

PostPosted: Wed Apr 18, 2007 6:20 pm    Post subject: Reply with quote

That is strange, do you use compiled version or source code?
in both cases, try the opposite to see if it changes something.
Also If you use relatively slow CPU, sometimes pixemu looks like it is not responding, but you just need to wait. This usually happens when you try to connect to web interface, or some other CPU-intensive operations like generating keys or connecting to it via ssh. In all these cases it doesn't hang permanently, it is just slow to respond to console.
Back to top
View user's profile Send private message
tempnet



Joined: 02 Jan 2007
Posts: 106

PostPosted: Wed Apr 18, 2007 6:53 pm    Post subject: Reply with quote

I use the latest compiled version which you provided. I use Fedora Core 5, CPU 2.4 P4 with 750 MB of RAM.

I am new to linux, does anyone know how to start pixemu with a script. Everytime when I start it i have to copy the long string of commands from a backup text file and paste it on prompt.

Thanks!
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    7200emu.hacki.at Forum Index -> PIX and ASA (old forum) All times are GMT
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum


 

Cisco Training Course partner | Boot Camps | Cisco Certification Courses
http://www.coursefox.co.uk



Powered by phpBB © 2001, 2005 phpBB Group