BGP Peer Open-Sent issue in MikroTik and a Solution by BGP monitor

The “Open-Sent” state in BGP (Border Gateway Protocol) indicates that the router has sent an OPEN message and is waiting for an OPEN message from the peer. If your BGP peer is stuck in the “Open-Sent” state, it could be due to several reasons like:

Tunneling Issues: If you’re running a BGP session over an L2TP tunnel, the session might attempt to establish before the tunnel is up, and never times out1. When this happens, the BGP peer gets stuck in ‘open sent’. The common solution is to disable and then enable the BGP peer1.

Address Family Configuration: If you have selected both IP and IPv6 in the address families, but it only announces your IPv6 prefix and not also your IPv4 prefix, the IPv4 BGP session might not work and get stuck at "Open-Sent"2. You should create a unique session for each, IPv4 and IPv62.

Incorrect Details or Routing: The “Open-Sent” state can also occur due to incorrect details such as the remote-as on either side being wrong, or if the routing is incorrect2.

Software Bugs: In some versions of MikroTik, there might be bugs causing the BGP peering to get stuck in the “Open-Sent” state3. In such cases, you might need to manually disable and then enable the peer3.

This issue of “Open-Sent” is possible to resolve via Script and Scheduler in MikroTik.

Use following Script and Scheduler:

/system scheduler

add interval=30m name=BGP-MONITOR on-event=monitor-all-bgp-peers policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-date=may/30/2024 start-time=00:00:00

/system script

add dont-require-permissions=no name=monitor-all-bgp-peers owner=Shuvodip policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":foreach i in=[/routing bgp peer find] do={\r\

    \n  :local peerState [/routing bgp peer get \$i state]\r\

    \n  :if (\$peerState = \"opensent\") do={\r\

    \n    :local peerName [/routing bgp peer get \$i name]\r\

    \n    :log info \"BGP Peer \$peerName is in OpenSent state. Disabling and Enabling...\"\r\

    \n    /routing bgp peer disable \$i\r\

    \n    :delay 5s\r\

    \n    /routing bgp peer enable \$i\r\

    \n    :log info \"BGP Peer \$peerName has been disabled and enabled.\"\r\

    \n  }\r\

    \n}\r\

    \n\r\

    \n    }"

This script is designed to monitor the state of all BGP peers on your MikroTik router and automatically reset any that are stuck in the “Open-Sent” state. Here’s a brief explanation:

Scheduler: The /system scheduler command schedules the monitor-all-bgp-peers script to run every 30 minutes.

Script: The monitor-all-bgp-peers script does the following:

* It iterates over all BGP peers on the router.

* For each peer, it checks the current state.

* If a peer is in the “Open-Sent” state, it logs this event, disables the peer, waits for 5 seconds, and then enables the peer again. This is done to reset the state of the peer.

* It logs a message after the peer has been disabled and enabled.

This script can help in maintaining the stability of BGP sessions by ensuring that any peers that get stuck in the “Open-Sent” state are reset and can re-establish their sessions. 

It’s always a good idea to test scripts in a controlled environment before deploying them in a production network. If you have any more questions or need further clarification, feel free to ask! 😊

Leveraging Cisco Intent-Based Networking DNA Assurance Post-Assessment Question and Answer Rev Up to Recert: Network Assurance

 1.  What is a supported file format to import a Site from Cisco Prime into Cisco DNA Center?

 

    CSV file

 

    .bat file

 

    Python script

 

    Excel spreadsheet

 

2. Which IBN functional process best describes the meaning of “intent” when referring to intent-based networking?

 

    Transforming raw data into meaningful insights.

 

    Activating network policies into device configuration syntax.

 

    Assuring operations using network analytics.

 

    Translating business network behavior into a network policy.

 

 3. If you enable device controllability in Cisco DNA Center, describe what happens when a device is discovered, assigned to a site, and then deleted from Cisco DNA Center.

 

    Cisco DNA Center provisions the device with site attributes and then deprovisions the site attributes when you delete the device.

 

    Cisco DNA Center provisions the device with site attributes, but the site attributes remain provisioned after you delete the device. However, the option to deprovision the site attributes is presented.

 

    Cisco DNA Center does not provision or deprovision site attributes if you enable device controllability in Cisco DNA Center.

 

    If you enable device controllability in Cisco DNA Center, you cannot delete the device.

 

4. Which of the following best describes the role of Cisco CMX?

 

    Provides the exact location of the clients on a floor map within the Cisco DNA Center user interface.

 

    Provides Cisco DNA Center with the health of the wireless clients based on radio signal strength.

 

    Provides authentication and authorization of the wireless clients when attempting to connect to the network that Cisco DNA Center manages.

 

    Provides a graphical reporting and auditing tool of wireless clients for Cisco DNA Center.

 5. Which of the following external applications can help populate Cisco DNA Center with an inventory of network devices?

 

    Cisco Prime Infrastructure

 

    Cisco ISE

 

    Cisco CMX

 

    IPAM applications Infoblox and BlueCat

 6.  Which of the following best describes the Assurance component of Cisco DNA Center?

 

    Provides a web interface to configure access control for network devices and clients.

 

    Provides a web interface that accesses the NDP and displays at-a-glance health and issues dashboards, trends and insights, and guided remediation steps.

 

    Provides closed-loop automation and provisioning of devices to remediate issues based on calculated insights.

 

    Provides a web interface to design network locations, define and provision policies, assure network performance and health, and provide guided remediation steps for issues.

7.Which is the minimum license level necessary for Assurance?

 

    Basic

 

    Essentials

 

    Advantage

 

    Premier

7. Which of the following statements is true about Health scores in Assurance?

 

    The latest health score calculates every 5-minutes for devices, clients, and applications.

 

    The health score range for clients (wired and wireless) is from 0–10, and a healthy client has a score that ranges from 7–10.

 

    The overall health of applications is a percentage that is calculated by taking the total number of all healthy applications divided by the total number of applications.

 

    The health score calculation for network devices cannot be customized.

 8. Which two of the following are true statements in the calculation of Application Health scores? (Choose two.)

 

The application health score is based on network QoS KPIs and application QoE.

 

The network QoS KPIs are network utilization, network latency, application server latency, packet loss, and jitter.

 

The application QoE is based on VoS scores using Cisco Validated Design thresholds based on traffic class per KPI.

 

Application health scores are calculated every 15 minutes.

 

The health score calculation for applications cannot be customized.

9. Which three of the following are true statements regarding streaming telemetry? (Choose three.)

 

The streaming telemetry data collection mechanism is described as a pull instead of a push mechanism.

 

Network management platforms subscribe to the collection of streaming telemetry data; the devices publish the data to the platform based on the subscription.

 

Streaming telemetry publishes to network management platforms periodically or based on changes in the data.

 

Network devices use more compute resources to forward streaming telemetry, but the network management platforms update faster.

 

Streaming telemetry is available on Cisco wireless infrastructure devices with specific operating systems.

10. Which of the following statements is true about Cisco DNA Center Assurance?

 

    Assurance is a functional component within the Cisco DNA Center NDP.

 

    Assurance is a functional component within the Cisco DNA Center NCP.

 

    Assurance is a part of the data correlation and analysis stage in the data processing architecture.

 

    Assurance is an application that uses APIs to access the Cisco DNA Center datastores.

 11.Separate collectors ingest data from a variety of telemetry and contextual sources; which of the following collectors can you customize for its collected KPIs and adjusted polling interval?

 

    CLI

 

    Cisco ISE

 

    NetFlow

 

    SNMP

 

    syslog

 

    SNMP traps

 

    NCP

 12.Which of the following is a true statement regarding the calculation of Client Health scores?

 

    The latest client health scores are calculated every 15-minutes.

 

    The overall client health consists of both wired and wireless clients.

 

    Wired and wireless client health score is based on the onboarding score plus the connectivity score.

 

    A wireless client’s connectivity score is the minimum score of the RSSI score or SNR score.

 

    The health score calculation for clients can be customized.

 13. Which three of the following are necessary steps to configure AVC in WLCs? (Choose three.)

 

Add a description containing the keyword lan to the device interfaces that are used for application visibility, then resynchronize the network device.

 

Configure an IP address on the interfaces that are used for application visibility.

 

Configure SNMP read/write credentials on the device.

 

Apply the Optimal telemetry profile to the network device.

 

Apply the Maximal telemetry profile to the network device.

14. Which of the following is available with the on-premise and cloud-based Cisco AI Network Analytics feature, but significantly enhanced when the cloud-based AI/ML engine is connected?

 

    Baselining

 

    Anomaly Detection

 

    Insights and Trends

 

    Comparative Analytics

 

    Predictive Analytics

15. Which statement best describes the use of the Device 360 view for viewing and evaluating issues?

 

    View the device health score, KPIs, and events on a timeline and list of open, resolved, and ignored issues.

 

    View the device health score, KPIs, and events on a timeline and list of open issues.

 

    View the device health score and KPIs on a timeline and list of open, resolved, and ignored issues.

 

    View the device health score and KPIs on a timeline and list of open issues.

 

    View the device health score on a timeline and list of open issues.

16. Which four statements are true about beeswarm charts in Cisco DNA Center Assurance for interpreting network insights? (Choose four.)

 

Circles represent a building and polygons represent an AP radio.

 

Circles represent an AP radio, and polygons represent a building.

 

The number of issues is reflected by a change in color in the shape on the beeswarm chart.

 

Issues are not represented in a beeswarm chart; only network insights display.

 

Network insights display a 7-day time period.

 

Network insights display a 4-week time period.

 

An arrow between shapes indicates the traffic flow between AP devices and buildings.

 

An arrow between shapes indicates a deviation in a monitored KPI.

 17. Which two of the following issues are detected by the Cisco AI Network Analytics features? (Choose two.)

 

AP down or rebooted

 

WLC excessive time lag from Cisco DNA Center

 

Onboarding wireless client connection issues

 

Application experience issues

 

Layer 2 loop issues (switch or router)

18. Which statement best describes the Cisco AI Network Analytics feature?

 

    Applies advanced artificial intelligence to provide anomaly detection of wired and wireless issues.

 

    Applies advanced artificial intelligence to provide anomaly resolution of wired and wireless issues.

 

    Applies advanced artificial intelligence and machine learning technologies to provide anomaly detection, remediation, network insights and trends, and comparative benchmarking.

 

    Applies advanced artificial intelligence to provide network insights and trends and comparative benchmarking.

 

    Applies ML technology to provide network insights and trends and comparative benchmarking.

 19. What are the three parameters that Cisco DNA Center uses to create the network heatmap? (Choose three.)

 

Site

 

KPI

 

RF band

 

Period (month/year)

 

SNR value

 

RSSI

20. Which statement best describes the role of the Machine Reasoning Engine in Cisco AI Network Analytics?

 

    Gathers user feedback to learn relevance, dynamically adapts, and learns from mistakes.

 

    Performs validation of data, anonymizes the data, forwards to the Cisco cloud-based AI/ML engine for analysis of network insights and trends.

 

    Determines what is normal for a given network and highlights deviations from expected behavior.

 

    Computes insights based on the embedded knowledge base and evidence, automates complex remediation workflows, and performs complex root cause analysis.

 21. How do you launch the Auto Packet Analyzer feature to troubleshoot client onboarding issues?

 

    Open Intelligent Capture on Client 360 view, choose an anomaly event that is labeled with a PCAP icon.

 

    Open Intelligent Capture on the Client 360 view and use the Wireless Packet Application Analysis dashlet.

 

    Use the Assurance > Manage > Intelligent Capture Settings > Client Schedule Capture menu.

 

    Use the Assurance > Manage > Intelligent Capture Settings > Client Data Packet Capture menu.

 22. Which of the following statements best describes intent-based networking?

 

    Transforming raw data into meaningful insights.

 

    Activating network policies into device configuration syntax.

 

    Assuring operations using network analytics.

 

    Translating business intent into a network policy.

 23. Data collectors ingest data from a variety of telemetry and contextual sources; which of the following data collectors can you customize for its collected KPIs and adjusted polling interval?

 

    CLI

 

    NetFlow

 

    SNMP

 

    NCP

 

24. Which two of the following are true statements regarding streaming telemetry? (Choose two.)

 

The streaming telemetry data collection mechanism is described as a pull instead of a push mechanism.

 

Network management platforms subscribe to the collection of streaming telemetry data; the devices publish the data to the platform based on the subscription.

 

Streaming telemetry publishes to network management platforms periodically or based on changes in the data.

 

Network devices use more compute resources to forward streaming telemetry.

 

Streaming telemetry is not available on Cisco wireless infrastructure devices regardless of operating systems.

25. Which three statements are true about beeswarm charts in Cisco DNA Center Assurance for interpreting network insights? (Choose three.)

 

Circles represent a building and polygons represent an AP radio.

 

Circles represent an AP radio, and polygons represent a building.

 

The number of issues is reflected by a change in color in the shape on the beeswarm chart.

 

Issues are not represented in a beeswarm chart; only network insights display.

 

An arrow between shapes indicates the traffic flow between AP devices and buildings.

 

An arrow between shapes indicates a deviation in a monitored KPI.

 

26. Cisco DNA Center Assurance communicates with Cisco Aironet 1800 Active sensors through a wired or wireless backhaul channel with which protocol?

 

    HTTPS

 

    SSH

 

    SNMP

 

    JTAPI

27. Which two of the following must you enable in Cisco DNA Center or integrate with Cisco DNA Center to allow you to view coverage heatmaps with real-time wireless client location tracking? (Choose two.)

 

Cisco CMX Integration

 

Intelligent Capture

 

Cisco AI Network Analytics

 

Cisco ISE Integration

 

Cisco Aironet 1800s Active Sensor

 

·         What are three categories of AP stats that Intelligent Capture collects? (Choose three.)

 

Onboarding Events

 

Channel Utilization

 

Power and Noise

 

Application Analysis

 

Interference

 

Disassociations

28. Which of the following Assurance tools are only for troubleshooting the wireless infrastructure?

 

    Client 360 view

 

    Client Health dashboard

 

    Sensor tests

 

    Cisco AI Network Analytics

 29. Which of the following statements regarding sensor tests is true?

 

    A sensor test template can be configured to test only one SSID.

 

    A sensor test template can be configured to test only one radio band.

 

    A sensor can have only one test template applied at a time.

 

    Sensor tests can be scheduled only on specific days and times or run at periodic intervals.

 

    A sensor test template is always applied to all sensors located on the same building floor

Use "RouterOS Scanner" of Microsoft to find vulnerabilities of MikroTik

   On August Aug 24, 2022 Microsoft release "RouterOS Scanner" on GitHub, which is a storage and managing platforms for Developers owned by Microsoft itself.

RouterOS Scanner is a tool developed by Microsoft to scan for RouterOS (MikroTik) forensic artifacts and vulnerabilities. It is a Python script that connects to a MikroTik device via SSH and runs various commands to collect information about the device's configuration, security, and network activity. The tool can help users to identify and fix potential issues on their MikroTik devices, such as:

•  Outdated or vulnerable RouterOS versions

•  Scheduled tasks that may be malicious or unwanted

•  Traffic redirection rules that may be hijacking or intercepting network traffic

•  DNS cache poisoning that may be altering the DNS resolution of domains

•  Default ports change that may be hiding the device from detection

•  Non-default users that may have unauthorized access to the device

•  Suspicious files that may contain malware or backdoors

•  Proxy, socks and firewall rules that may be affecting the network performance or security

The tool outputs the results in a JSON or text format, with three sections for each test: raw data, suspicious, and recommendation. The raw data section shows all the data that the tool searched in. The suspicious section highlights the things that the tool found as suspicious and that should be checked if they are legitimate or malicious. The recommendation section suggests the things that the tool found as weak security points and how to fix them.

The tool is available on GitHub:

https://github.com/microsoft/routeros-scanner 

and PyPI:

https://pypi.org/project/routeros-scanner/ 

and can be easily installed and run with the following commands:

pip install -r requirements.txt

./main.py -i <ip_address> -u <username> -ps <password>

The tool also accepts other arguments, such as the port number, the output format, the update option, and the concise option. For more details, see the README file

https://github.com/microsoft/routeros-scanner on GitHub.

The tool was developed by researchers who investigated how MikroTik devices are used in Trickbot C2 infrastructure. Trickbot is a notorious malware that targets Windows machines and can steal credentials, encrypt files, and deliver other malicious payloads. The researchers found that Trickbot operators were exploiting Mikrotik devices to redirect network traffic and perform DNS cache poisoning. The tool can help users to detect and prevent such attacks on their MikroTik devices.

RouterOS Scanner is a useful tool for anyone who owns or manages MikroTik devices and wants to ensure their security and performance. It can help users to discover vulnerabilities, detect threats, and manage risks on their devices. It is also a good example of how Microsoft is contributing to the cybersecurity community by sharing its research and tools.

How to use "RouterOS Scanner" from a Windows PC

Step 1: Download "RouterOS Scanner" from GitHub link https://github.com/microsoft/routeros-scanner 

Step 2: Unzip the downloaded Zip file.

Step 3: Download and properly Install Python including path (if not already have) in the PC from https://www.python.org/downloads

Step 4: Open Command Prompt AKA CMD in your PC. Change Directory to your downloaded unzipped folder of RouterOS Scanner. Example:

C:\Users\ROY-LAPTOP>cd C:\routeros-scanner-main_2\routeros-scanner-main

C:\routeros-scanner-main_2\routeros-scanner-main>

Step 5: Then command following to install dependencies/requirements.

C:\routeros-scanner-main_2\routeros-scanner-main>pip install -r requirements.txt

Step 6: After successful installation of dependencies/requirements. Now it is possible to run the RouterOS Scanner commands to check Vulnerabilities.

Example (Need to add "python" to run in CMD):

 ./main.py -i 192.168.88.1 -u admin

 ./main.py -i 192.168.88.1 -p 22 -u admin

 ./main.py -i 192.168.88.1 -p 2000 -u admin -ps 123456

 ./main.py -i 192.168.88.1 -p 2000 -u admin -ps 123456 -J

Following arguments also can be added with command.

As Example, I run following for a MikroTik who's IP is 103.139.235.209:

C:\routeros-scanner-main_2\routeros-scanner-main>python .\main.py -i 103.139.235.209 -p 22 -u admin -ps password -concise -update

and it provides me following as result:

 "class": algorithms.Blowfish,

** Trying to update the CVE json file

** The CVE update process succeeded

** Mikrotik ip address: 103.139.235.209

DNS Cache:

        recommendation:

                "In case DNS cache is not required on your router - disable it"

Users:

        recommendation:

                "Add allowed ip address to user: shuvodip, to be the only address it can login from"

                "Add allowed ip address to user: ferdosh, to be the only address it can login from"

                "Add allowed ip address to user: pavel, to be the only address it can login from"

                "You are using the default \"admin\" user name- create new user in \"full\" group with a unique name, and delete the admin user"

                "Add allowed ip address to user: admin, to be the only address it can login from"

Ports:

        suspicious:

                "The port for www, has changed from 80 to 8088 - severity: low"

                "The port for winbox, has changed from 8291 to 9291 - severity: low"

        recommendation:

                "The port for ssh protocol is as ssh default port (22)- Mikrotik company recommended to change it"

*** So as per the result we are clearly observing it's scanning for Vulnerabilities also suggesting how to improve the security of RouterOS.

Note: If on MikroTik have such firewall like followings, before run keep disable it. Otherwise due to lack of proper established connection "RouterOS Scanner" might not work.

/ip firewall filter

add action=accept chain=forward comment="allow established connections" connection-state=established

add action=accept chain=forward comment="allow related connections" connection-state=related

add action=drop chain=forward comment="drop invalid connections" connection-state=invalid

*** Also remember by using "RouterOS Scanner" with proper environment including cron job or scripting we may scan MikroTik Vulnerabilities regularly and automatically.

Use Split-Tunnel with WireGaurd VPN

There are several benefits of using Split-Tunnel with WireGuard VPN. However, the best aspects are its provision of Flexibility and Control Over Traffic Routing and Improved Security for What Matters Most.

We often use a VPN to access private resources but we do not want all of the traffic to traverse through the VPN. A simple example is our Internet browsing.

Split-Tunneling defines which traffic will go via the VPN and which will not. Those that are not allowed in the VPN will use regular connectivity.

To configure Split-Tunneling in Windows or elsewhere, you need to do the following:

[Peer]

PublicKey = Your Key

PresharedKey = Your Mutual Authentication Key

AllowedIPs = 192.0.2.0/24, 198.51.100.0/24

Endpoint = 10.193.61.189:54330

Edit the [Peer] AllowedIPs. Here, do not use 0.0.0.0/0. Instead, use those destination IP Blocks which will be allowed to use the VPN.

Now, as shown in the example, only destination IP Blocks matching 192.0.2.0/24 and 198.51.100.0/24 will use the VPN, and other destination traffic will use the default or regular connection.

Note: The best thing about using Split-Tunneling with a private VPN is that you will get Internet access in other apps for destinations.

As everything comes with a cost, now using Split-Tunneling will use more processing power of the host machine than previously to define how destination traffic will pass by."

CISCO নেটওয়ার্ক সুইচের ( CISCO Ethernet Switch) গল্প

     আশির দশকে Ethernet বা Network Switch বলে কিছু ছিল না। সেই সময় আজকের Router কেও Router বলতো না, বলতো Gateway অথবা Server। যেমনঃ CISCO নির্মিত IGS (Integtrated Gateway Server) কিংবা AGS (Advanced Gateway Server)। 

সাইন্স মিউজিয়ামে সংরক্ষিত ১৯৮৬ সালে নির্মিত CISCO AGS+ 

যাই হোক আজকের গল্প Router নিয়ে না। সেই সময়টা Switch এর বদলে ব্যবহার হতো Ethernet HUB। Shared Medium/Common Channel, Single Large Collision Domain, Half-Duplex ইত্যাদি কারনে আশির দশকের শেষ দিকে Ethernet Switch এর প্রয়োজনীয়তা অনুভব হয়। তখনো CISCO Ethernet Switch নিয়ে গবেষনা পর্যন্ত করছে না। তো তখন CISCO'র সামনে দুইটা পথ খোলা, এক। Ethernet Switch নিয়ে CISCO'র নিজে গবেষণা করা, দুই। এমন কোনো কোম্পানির সাথে যুক্ত হওয়া বা কিনে ফেলা যারা Ethernet Switch নিয়ে গবেষণা করছে অথবা তৈরি করে ফেলেছে।

CISCO নিজে গবেষণা করার চেয়ে অন্য কোম্পানি কে কিনে নেয়াকে প্রাধান্য দিলো এবং Kalpana, Grand Junction, এবং সবচাইতে গুরুত্বপূর্ণ Crescendo Communications কে কিনে ফেললো। CISCO এর পর অনেক কোম্পানি কিনেছে, প্রকাশ্যে/গোপনে অন্য কোম্পানিতে টাকার লগ্নি করেছে। তবে Ethernet Switch এর জন্য অন্য কোম্পানি ক্রয় করাই ছিল CISCO এর ইতিহাসের প্রথমদিকের অধিগ্রহণ। CISCO এরপর প্রথম যে Ethernet Switch নিয়ে আসে তার নাম "CISCO Catalyst"। এরমধ্যে Catalyst 1700, 1900, and 2800 series আসে Grand Junction Networks এর প্রযুক্তির হাত ধরে। Catalyst 3000 series আসে Kalpana'র মাধ্যমে। আর তৎকালীন ডাটা সেন্টারগুলোতে ব্যবহৃত Catalyst 5000 and 6000 series আসে Crescendo Communications এর মাধ্যমে। 

CISCO Catalyst 3000 Ethernet Switch

CISCO Catalyst 5000/6000 Ethernet Switch

২৩ সেপ্টেম্বর, ১৯৯৩। ৮৯ মিলিয়ন মার্কিন ডলার দিয়ে CISCO সর্বপ্রথম Crescendo Communications কে অধিগ্রহণ করে। সাথে Crescendo Communications এর চার প্রতিষ্ঠাতা Mario Mazzola, Prem Jain, Luca Cafiero এবং Soni Jiandani কে CISCO নিজেদের কর্মচারী করে নেয়। এদের কে একসাথে বলতো "MPLS", যদিও আমরা MPLS বলতে Multi Protocol Label Switching কে । CISCO এর প্রাক্তন CEO, John Thomas Chambers এর মতে এই অধিগ্রহণ ছিল নব্বই এর দশকে ডাটা সেন্টার গুলোতে CISCO Catalyst Ethernet Switch এর সর্বে-সাকুল্যে ব্যবহার হওয়ার চাবিকাঠি। 

কিন্তু এই CISCO Catalyst Ethernet Switch গুলোতে তখনো Fiber Channel বা Fiber Port ছিল না। CISCO নিজেও সরাসরি এর জন্য গবেষণা করতে রাজি ছিল না। CISCO যেহেতু একটি পাবলিক লিমিটেড কোম্পানি ছিল, তাই তাকে সকল তথ্য প্রকাশ করতে হতো। তাই  CISCO গোপনে অন্য একটি কোম্পানিতে (Andiamo) অর্থ লগ্নি করলো। সেখানে In-charge হিসেবে Mario Mazzola, Prem Jain এবং Luca Cafiero কে নিয়োগ দিলো। অর্থাৎ Catalyst এর মূল কান্ডারীদের ঘুরিয়ে নিযুক্ত করলো Fiber Channel Switch এর জন্য। তারা যখন Fiber Channel Switch তৈরি করে ফেললো, তখন CISCO কোম্পানিটিকে (Andiamo) অধিগ্রহণ করলো। আর Fiber Channel Switch হিসেবে বাজারে আনলো CISCO MDS (Multi-layer Distribution Switch)। 

CISCO MDS 9000 Fiber Channel Switch

এখন দাড়ালো অন্য সমস্যা CISCO Catalyst হলো Ethernet Switch আর MDS হলো Fiber Channel Switch। তাই দরকার পড়লো এমন কিছু যেখানে Ethernet ও Fiber একসাথে কাজ করবে। এরজন্য পূর্বে গোপনে অর্থলগ্নি করা কোম্পানি (Nuova) কে অধিগ্রহণ করলো আর বাজারে নিয়ে আসলো CISCO Nexus 5000 Series। Nexus এ IOS এর পরিবর্তে ব্যবহৃত হলো NexOS, যা কিনা উচ্চগতির নেটওয়ার্ক ব্যান্ডউইডথ কে পরিবহনের সক্ষম করে তৈরী করা হয়।

CISCO Nexus 5000 Series Switches

তথ্যসূত্র (Source): 

১।  https://collection.sciencemuseumgroup.org.uk/objects/co8359070/cisco-ags-router-1986-computer-peripheral

২। https://collection.sciencemuseumgroup.org.uk/people/cp114968/cisco-systems-inc

৩। https://designated-router.com/ciscos-first-router-revisiting-the-venerable-ags-in-2021/

৪ । http://newsroom.cisco.com/dlls/1994/corp_102494.html

৫। https://pitchbook.com/profiles/company/52864-93#overview

৬। https://en.wikipedia.org/wiki/List_of_acquisitions_by_Cisco

৭। https://www.datacenterknowledge.com/startups/john-chambers-mpls-dream-team-behind-pensando-startup

৮। https://en.wikipedia.org/wiki/John_T._Chambers

৯। https://www.networkcomputing.com/careers-and-certifications/cisco-buys-andiamo-finally

১০। https://www.cisco.com/c/en/us/products/storage-networking/mds-9000-series-multilayer-switches/index.html

১১।  https://www.networkworld.com/article/2278259/cisco-acquires-nuova--unveils-new-data-center-switch.html

১২।  https://en.wikipedia.org/wiki/Cisco_Catalyst

১৩।  https://en.wikipedia.org/wiki/Cisco

১৪।  https://www.pcworld.idg.com.au/slideshow/419997/pictures-critical-milestones-cisco-history/

১৫। https://www.arnnet.com.au/slideshow/561768/pictures-30-years-cisco/

MikroTik launches "expired password"

In recent release 6.49 (Stable) MikroTik lunched "expired password" for user. It is better than never from MikroTik.

Although MikroTik always inspired it's users to change password in regular interval but often users do not follow. But, from now at least Network Administrator may force users to do it. There are no doubt "expired password" is not directly terms of security but certainly this cautious is very effective to ensure security. Mainly it is an Administration policy and it's effectiveness is so high.

As figured, "Expire Password" is added. If Network Administrator click it, the account will be declared as "expired" then in next login the particular user will be promoted to change his/her password as followed.

So, far it's seems good. But, I think MikroTik may do add more to it. Like as, "Expire Password" interval, "Inactive Login Expire" and so on. Then it will become more robust. I hope MikroTik will do it in next updates.

However, still we can do many things automatic so far by Scripting and Scheduling.

Suppose, we have 6 users in a MikroTik. We may do following Script for "expired password".

As Administration policy we thought after 30 days interval need to "expired password". Then we may count following Schedule.

Thanks for reading. Have a nice day!!!

 

Cloud backup is just get easier in MikroTik Stable release 6.48.4

 

Since RouterOS v6.44 it is possible to store MikroTik device's backup on MikroTik's Cloud server. The backup service allows you to upload an encrypted backup file, download it and apply the backup file to your device as long as your device is able to reach MikroTik's Cloud server. Below we can find operation details that are relevant to the IP/Cloud's backup service:

* Free backup slot for each device

* Allowed backup size: 15MB

* Sends encrypted packets to cloud2.mikrotik.com using UDP/15252 and TCP/15252 port

In previous the process was fully CLI based but in recent stable release 6.48.4 it gets GUI support in Winbox. It is now available in Winbox Files>Cloud Backup

As MikroTik use it's own Cloud Server and uploaded file can only be Encrypted and now available with GUI. It is much more safe, secure and easy now.

The process is very simple...

Go to Files>Cloud Backup>Upload Backup

If we are doing for the very first time all we need to do..

1. Choose 'Action' "create and upload"

2. 'Name' "Any Suitable Name" [A better choice for name could be device Identity]

3. 'Password' "A Strong Password"

and finally press Start.

After  the process start it will take a very short time to create Backup File and Upload, if no error happened. "Status" will inform the Success or Error report.

Now, let's look at the new cloud file. Remember that, yes we are watching the file but that file is not in this device. It is located on MikroTik Cloud.

So, here is the details of that file. We can 'Download' this file in this device and 'Remove' also. But, still downloading process in another device is based in CLI (I hope MikroTik Team, will work on it in next update). Download file will be available in file menu.

As only 1 slot available for each device, to create a new/updated file old one need to 'Remove/Replace' at first.

 Replace could be possible to do also in the process of creating a new one.

Now look at the the file. The significant change is done in the "Secret Download Key". Each time it will be change in the process.

But, knowing this ''Secret Download Key" is essential to download the Backup File in another device. Let's see it.

So, we are moving to another Router and open a Terminal and put following command.

/system backup cloud download-file secret-download-key=GTsWB1h7URm5VfJmiLyzwkK action=download

Thus, the file from the cloud will be download in another device.

So, it is very essential to know the "Secret Download key".

Notes:

1. As it is not .rsc Backup. Mikrotik recommend to restore the backup in same model device.

2. By scripting and scheduling the process could be fully automated and regular basis.

3. As knowing the "Secret Download Key" is important. To do,

Print the information of file on a text file in MikroTik and sending in Email is essential. The command to Print the file is simple.

/system backup cloud print file="File Name"

By scripting and scheduling the whole process can also be automated.

4. The information is also could be shared through API of Bot messenger of Telegram, Whatsapp and so on...

Thanks for Reading and have a nice day!!!

BR,

Shuvodip

Put your very own sign in MikroTik Teminal

 

Normally we do not see the Terminal of MikroTik like that. We are actually with very much familiar to this following Terminal.

Yes, this is the very classic MikroTik Terminal. Which comes with MikroTik ASCII Logo and all MikroTik users are very familiar with it. But, you may also change it and put your very own sign as Branding. 

To do it you first need to login in your MikroTik Account. Link: https://mikrotik.com/client

Login if you have account already or register now if you have not. 

After Login you will see in the left side Menu "Branding maker" as given picture.

Click it, it will open another page just like followed.

Now, Put your custom information as following.

For Telnet ASCII Logo you can use this link http://www.network-science.de/ascii/ or similar just like pictured. It is very easy.

Copy that custom created ASCII Logo and paste it and paste it in MikroTik Branding maker "Telnet ASCII Logo" section.

Note: Make sure it is not wider than the form above, or your logo will be distorted.

Now, go little bit down as illustrated. You will find make button. There are 2 options. One for comparatively new RouterOS and another is for older one. As mine was new, I selected the 1st option. You have to do as your one.

Then the custom branding package will be created with .dpk file extension. Now, download this file.

Now, as package is ready, it's time for installation. Login to your MikroTik through Winbox. As like other package installation in MikroTik follow these 2 simple steps. 

=> Upload the package in Files section of MikroTik.

=> Then reboot the system for installation.

After successful reboot, login again and open Terminal. Now, you are watching your Brand Sign with a happy smile. 😀😀😀 

Just not the ASCII logo but you may also can do change in followings by Branding package.

1. Webfig login page

2. Webfig logo

3. /hotspot

4. /skins

5. LCD logo

Where you can put your very own Brand sign. Default configuration can also be edited as like Flashfig through Branding package.