Category Archives: Hardware

Speed limit on Ubiquiti devices

Suppose we need to limit the speed on the client antenna.
Accordingly, it is in the station mode and is connected to the access point.

For restriction, we go to the web-based antenna management interface, open the Network tab, change the Configuration Mode: to Advanced, which will bring more parameters that you can configure .

At the very bottom, click on Traffic Shaping, check the Enable checkbox and specify the desired speed limit for WLAN0 or LAN0.
For example, you need to limit the reception speed to 5Mb/s and send up to 512Kbps, for reliability, we’ll specify a limit for both network interfaces, where Ingress is specified for WLAN0 5120, and for LAN0 512, respectively, for Egress, vice versa, WLAN0 – 512, and LAN0 – 5120, burst is left unchanged, that is, 0.

To apply the changes click below Change and then above Apply, after which the antenna configuration will reboot.

On the access point, alas, you can not limit the speed for each client, if you do the above settings (in reverse order), then the overall speed for all clients will be limited. In this case, you can cut the speed, for example billing, by turning on the Advanced tab Client Isolation in the Advanced tab so that clients do not see each other on the network and do not exchange traffic.

Done.

Configuring ACL on Ubiquiti devices

Let’s say we want to configure the ACL (access control list) on the Ubiquiti access point.

In the web interface of the device, open the tab “Wireless“.

At the very bottom opposite “MAC ACL:” tick the “Enable“.

And choose “Policy:“, on “Allow” (means that there will be devices on the list that are allowed to connect, all who are not registered – can not) or “Deny” (in the list of devices that can not be connected, and everyone else can).

By clicking on the button “ACL…“, in the opened window to add the device, in the first field we indicate its MAC, in the second one any desired description and click “Add“, later “Save“.
And the last stage is at the top click the button “Apply“, after which the changes are saved and applied without loss of communication with the device (without rebooting).

Resetting the iLO password via hponcfg on HP servers

On the test, I change the iLO password to the standard Administrator user on the HP ProLiant DL380 G7 server, the password is generated randomly from the manufacturer and installed in the BIOS, it can also be seen on the pull-out ribbon and attached to the server.

Therefore, in order not to restart the server to change the password, create a file with the name reset_password.xml for example and add content to it:

<RIBCL VERSION="2.0">
<LOGIN USER_LOGIN="Administrator" PASSWORD="password">
<USER_INFO MODE="write">
<MOD_USER USER_LOGIN="Administrator">
<PASSWORD value="password specify here only"/>
</MOD_USER>
</USER_INFO>
</LOGIN>
</RIBCL>

Where Administrator, this is the user name, password – do not touch, there can be any text, but only indicate the desired password to the user in the PASSWORD value.

We export the file:

sudo hponcfg -f reset_password.xml

In case of an error, you can output the report to the log.txt file with the command:

sudo hponcfg -f reset_password.xml -l log.txt

See also:
Configuring iLO through hponcfg

SNMP OID List for iLO4

I made a template for Zabbix today to monitor iLO 4 on the HP DL380p G8 server and had to investigate several OIDs.

You can check the OID from Linux with the command:
snmpwalk 192.168.1.5 -c КОМЬЮНИТИ -v 2c OID

Below is a list and description for OID coolers, processors, temperature sensors, logical drives (RAID), hard disks, network controller iLO, RAM.

Fans:
.1.3.6.1.4.1.232.6.2.6.7.1.2.0 (Fan Index)
.1.3.6.1.4.1.232.6.2.6.7.1.3.0 (Fan Locale (1=other, 2=unknown, 3=system, 4=systemBoard, 5=ioBoard, 6=cpu, 7=memory, 8=storage, 9=removable media, 10=power supply, 11=ambent, 12=chassis, 13=bridge card, 14=management board, 15=backplane, 16=network slot, 17=blade slot, 18=virtual)
.1.3.6.1.4.1.232.6.2.6.7.1.4.0 (Fan Present (1=other, 2=absent, 3=present)
.1.3.6.1.4.1.232.6.2.6.7.1.5.0 (Fan Present (1=other, 2=tachOutput, 3=spinDetect)
.1.3.6.1.4.1.232.6.2.6.7.1.6.0 (Fan Speed (1=other, 2=normal, 3=high)
.1.3.6.1.4.1.232.6.2.6.7.1.9.0 (Fan Condition (1=other, 2=ok, 3=degraded, 4=failed)

Temperature:
.1.3.6.1.4.1.232.6.2.6.8.1.2.0 (Temperature Sensor Index)
.1.3.6.1.4.1.232.6.2.6.8.1.3.0 (Temperature Sensor Locale (1=other, 2=unknown, 3=system, 4=systemBoard, 5=ioBoard, 6=cpu, 7=memory, 8=storage, 9=removable media, 10=power supply, 11=ambent, 12=chassis, 13=bridge card)
.1.3.6.1.4.1.232.6.2.6.8.1.7.0 (Threshold Type (1=other, 5=blowout, 9=caution, 15=critical, 16=noreaction)
.1.3.6.1.4.1.232.6.2.6.8.1.4.0 (Temperature Celsius)
.1.3.6.1.4.1.232.6.2.6.8.1.5.0 (TemperatureThreshold)
.1.3.6.1.4.1.232.6.2.6.8.1.6.0 (TemperatureCondition)

CPU:
.1.3.6.1.4.1.232.1.2.2.1.1.1 (CPU Index)
.1.3.6.1.4.1.232.1.2.2.1.1.3 (CPU Name)
.1.3.6.1.4.1.232.1.2.2.1.1.4 (CPU Speed in MHz)
.1.3.6.1.4.1.232.1.2.2.1.1.5 (CPU Step)
.1.3.6.1.4.1.232.1.2.2.1.1.6 (CPU status (1=unknown, 2=ok, 3=degraded, 4=failed, 5=disabled)
.1.3.6.1.4.1.232.1.2.2.1.1.15 (Number of enabled CPU cores)
.1.3.6.1.4.1.232.1.2.2.1.1.25 (Number of available CPU threads)
.1.3.6.1.4.1.232.1.2.2.1.1.26 (CPU power status (1=unknown, 2=Low Powered, 3=Normal Powered, 4=High Powered)

Logical Drives:
.1.3.6.1.4.1.232.3.2.3.1.1.2.0 (Logical Drive Index)
.1.3.6.1.4.1.232.3.2.3.1.1.1.0 (Logical Drive Controller)
.1.3.6.1.4.1.232.3.2.3.1.1.3.0 (Logical Drive Fault Tolerance (1=other, 2=none, 3=RAID 1/RAID 1+0 (Mirroring), 4=RAID 4 (Data Guard), 5=RAID 5 (Distributed Data Guard), 7=RAID 6 (Advanced Data Guarding), 8=RAID 50, 9=RAID 60, 10=RAID 1 ADM (Advanced Data Mirroring), 11=RAID 10 ADM (Advanced Data Mirroring with Striping))
.1.3.6.1.4.1.232.3.2.3.1.1.9.0 (Logical Drive Size in Mb)
.1.3.6.1.4.1.232.3.2.3.1.1.4.0 (Logical Drive Status (1=other, 2=ok, 3=Failed, 4=Unconfigured, 5=Recovering, 6=Ready Rebuild, 7=Rebuilding, 8=Wrong Drive, 9=Bad Connect, 10=Overheating, 11=Shutdown, 12=Expanding, 13=Not Available, 14=Queued For Expansion, 15=Multi-path Access Degraded, 16=Erasing, 17=Predictive Spare Rebuild Ready, 18=Rapid Parity Initialization In Progress, 19=Rapid Parity Initialization Pending, 20=No Access – Encrypted with No Controller Key, 21=Unencrypted to Encrypted Transformation in Progress, 22=New Logical Drive Key Rekey in Progress, 23=No Access – Encrypted with Controller Encryption Not Enabled, 24=Unencrypted To Encrypted Transformation Not Started, 25=New Logical Drive Key Rekey Request Received)
.1.3.6.1.4.1.232.3.2.3.1.1.11.0 (Logical Drive Condition (1=other, 2=ok, 3=degraded, 4=failed)

Drives:
.1.3.6.1.4.1.232.3.2.5.1.1.2.0 (Drive Index)
.1.3.6.1.4.1.232.3.2.5.1.1.5.0 (Drive Bay)
.1.3.6.1.4.1.232.3.2.5.1.1.64.0 (Drive Location)
.1.3.6.1.4.1.232.3.2.5.1.1.3.0 (Drive Vendor)
.1.3.6.1.4.1.232.3.2.5.1.1.51.0 (Drive Serial Number)
.1.3.6.1.4.1.232.3.2.5.1.1.45.0 (Drive Size in Mb)
.1.3.6.1.4.1.232.3.2.5.1.1.65.0 (Drive Link Rate (1=other, 2=1.5Gbps, 3=3.0Gbps, 4=6.0Gbps, 5=12.0Gbps))
.1.3.6.1.4.1.232.3.2.5.1.1.70.0 (Drive Current Temperature)
.1.3.6.1.4.1.232.3.2.5.1.1.71.0 (Drive Temperature Threshold)
.1.3.6.1.4.1.232.3.2.5.1.1.72.0 (Drive Maximum Temperature)
.1.3.6.1.4.1.232.3.2.5.1.1.6.0 (Drive Status (1=Other, 2=Ok, 3=Failed, 4=Predictive Failure, 5=Erasing, 6=Erase Done, 7=Erase Queued, 8=SSD Wear Out, 9=Not Authenticated)
.1.3.6.1.4.1.232.3.2.5.1.1.37.0 (Drive Condition (1=other, 2=ok, 3=degraded, 4=failed)
.1.3.6.1.4.1.232.3.2.5.1.1.9.0 (Drive Reference Time in hours)

iLO NIC:
.1.3.6.1.4.1.232.9.2.5.2.1.1 (iLO location)
.1.3.6.1.4.1.232.9.2.5.1.1.2 (iLO NIC model)
.1.3.6.1.4.1.232.9.2.5.1.1.4 (iLO NIC MAC)
.1.3.6.1.4.1.232.9.2.5.1.1.5 (iLO NIC IPv4)
.1.3.6.1.4.1.232.9.2.5.1.1.9 (iLO NIC speed)
.1.3.6.1.4.1.232.9.2.5.1.1.14 (iLO NIC FQDN)
.1.3.6.1.4.1.232.9.2.5.2.1.2 (Tx bytes)
.1.3.6.1.4.1.232.9.2.5.2.1.3 (Tx packets)
.1.3.6.1.4.1.232.9.2.5.2.1.6 (Tx discard packets)
.1.3.6.1.4.1.232.9.2.5.2.1.7 (Tx error packets)
.1.3.6.1.4.1.232.9.2.5.2.1.9 (Rx bytes)
.1.3.6.1.4.1.232.9.2.5.2.1.10 (Rx packets)
.1.3.6.1.4.1.232.9.2.5.2.1.13 (Rx discard packets)
.1.3.6.1.4.1.232.9.2.5.2.1.14 (Rx error packets)
.1.3.6.1.4.1.232.9.2.5.2.1.15 (Rx unknown packets)

Memory:
.1.3.6.1.4.1.232.6.2.14.13.1.1 (Memory Index)
.1.3.6.1.4.1.232.6.2.14.13.1.13 (Location)
.1.3.6.1.4.1.232.6.2.14.13.1.9 (Manufacturer)
.1.3.6.1.4.1.232.6.2.14.13.1.10 (Part Number)
.1.3.6.1.4.1.232.6.2.14.13.1.6 (Size in Kbytes)
.1.3.6.1.4.1.232.6.2.14.13.1.8 (Memory Technology)
.1.3.6.1.4.1.232.6.2.14.13.1.7 (Memory Type)
.1.3.6.1.4.1.232.6.2.14.13.1.19 (Memory status (1=other, 2=notPresent, 3=present, 4=good, 5=add, 6=upgrade, 7=missing, 8=doesNotMatch, 9=notSupported, 10=badConfig, 11=degraded, 12=spare, 13=partial)
.1.3.6.1.4.1.232.6.2.14.13.1.20 (Memory condition (1=other, 2=ok, 3=degraded, 4=degradedModuleIndexUnknown)

Configuring Protected Ports on Cisco

On the test, I will configure the Cisco Catalyst WS-C3750-48TS-S.

And so, all ports are configured as access, except for the first Gigabit uplink port, it is configured as a trunk and the Internet on the client vlan with the tag comes to it.
We need all the ports on this switch to not see each other and see only the first gigabit ulink port.

To do this, connect to the switch and go into the configuration mode:

enable
configure terminal

Then, we issue the switchport protected command for all access ports:

interface range fastEthernet 1/0/1-48
switchport protected
interface range gigabitEthernet 1/0/2-4
switchport protected
exit
exit

Save the configuration:

write

Apparently interface gigabitEthernet 1/0/1 we did not touch.
Now the ports on which the switchport protected command is registered do not see the other ports on which this command is also registered, they see only the ports where it is not registered, that is, in our case the first gigabit ulink port, and it sees all the ports with the command and without.

Information about ports can be viewed by the command:

show interfaces NAME switchport

View full configuration:

show running-config

See also:
Port isolation on Huawei switches
Port isolation on the ZyXEL MES-3528 switch

Port isolation on the ZyXEL MES-3528 switch

On the test, I isolate the ports from each other, allowing traffic to go only to uplink (the port from which the Internet comes), I have it 25.

Let’s connect to the switch and see the current configuration:

show running-config

Now go into the configuration mode:

configure

Isolate the necessary ports, except the uplink port:

interface port-channel 1-24,26-28
vlan1q port-isolation
exit
exit

Save the configuration:

write memory

The ports on which the vlan1q port-isolation command is written do not see other ports with the same command, but see the ports without it and the switch CPU. Ports without the command vlan1q port-isolation see the ports with it and without it.

See also:
Port isolation on Huawei switches
Configuring Protected Ports on Cisco

Port isolation on Huawei switches

On the test I’ll take the Huawei Quidway S2326TP-EI and Huawei Quidway S3928P-EI switches, in which the uplink Gigabit Ethernet port 0/0/1 (the Internet comes to it), all other ports are in the same VLAN and you need to prevent them from seeing each other. To do this, execute the port-isolate enable command for each interface (port), except uplink GigabitEthernet 0/0/1.

We connect to the switch through the console or telnet and switch to the mode of elevated privileges:

system-view

We execute the command for interfaces:

interface Ethernet 0/0/1
port-isolate enable
interface Ethernet 0/0/2
port-isolate enable
interface Ethernet 0/0/3
port-isolate enable
etc.
interface Ethernet 0/0/24
port-isolate enable
quit
interface GigabitEthernet 0/0/2
port-isolate enable

For Huawei Quidway S3928P-EI there will be other commands:

interface Ethernet1/0/1
port isolate
interface Ethernet1/0/2
port isolate
...
interface GigabitEthernet 1/1/2
port isolate
interface GigabitEthernet 1/1/3
port isolate
interface GigabitEthernet 1/1/4
port isolate

Leave the interface setup mode:

quit

Let’s leave the regime of elevated privileges:

quit

Save the configuration:

save

Now the ports on which the port-isolate enable command is written do not see the other ports on which this command is also registered, they see only the ports where it is not registered, that is, in our case uplink port GigabitEthernet 0/0/1, and it, as on It does not have this command, it sees all the ports with the command and without.

See also:
Configuring the Huawei Quidway Switch S2326TP-EI
Configuring Port isolation on Cisco
Port isolation on the ZyXEL switch

How to view the configuration of MikroTik

Recently I configured the next MikroTik and I had to share the configuration, so, to see it in the terminal, execute the command:

/export compact

To save the configuration to a file, execute the command:

/export compact file=config

After saving the file will be in the device’s memory, you can see it and download it from the Files menu via the web interface or winbox, ftp, smb, sftp.