Fortigate error The cmdb add entry failed.

We still see this one occasionally. Had one case where we needed to get a policy on but couldn't reboot the firewall.


So, tried a few things and found we could get a policy on by killing IPS. This may cause all sorts of random results so only use this if you're desperate!


You can try the nice way

diagnose test application ipsmonitor 99 

a
and then try adding the policy but I had to go further: in the CLI console type


get sys perf top


Look for ipsengine..

       ipsengine     6085      S     0.0    22.6

Then you can kill it..

diagnose sys kill 9 6085

the 9 is the signal and 9 means kill it dead.

It should come back. Check with the get sys perf top again.

Then you should be ok to put in a  few commands without the cmdb add entry failed error.

Fibre (Fiber) optics and you

This is a great article on history and how-tos for optic cabling..


Making the switch from 62.5- to 50-micron fiber - Cabling Installation & Maintenance

Fortigate MR3 VPN to Cisco

So I'm doing a lot more Fortigate work in a new job.  Got to grips with most of the Forti foibles but this is a new one..

We've got a site with a Fortigate at the head office and Ciscos at the remote sites.  They're in construction so the Ciscos get kicked, dropped, spiked etc but just keep going.

I was adding a new site after recently updating the Fortigate to MR 3 PL1 and it would not work. The VPN just would not come up. Identical Cisco config (bar IP addresses) and the HO Forti VPN config looked identical too.  Until you get to the CLI...

Seems now there is a mode-cfg setting that defaults to enabled and the Cisco's don't like being told what to do.  Turn that off in the CLI and the VPN came up. By the way the VPNs on the Cisco end are VTIs using routes as these seem to play better and you don't have to specify and match proxies.

Reformed Orcon user

This is a New Zealand specific thing so not relevant to most.

I finally had had a guts full of our previous ISP Orcon and changed to Telecom several weeks ago.

Talk about night and day!  We can use youtube etc.  Even two of us at the same time!  This was unheard of on Orcon.  It took tens of minutes to load a 30 second clip. Downloads were regularly 2KB per second.  Whoever set up their shaping needs castrating.

Speed test shows not quite as dramatic results.  Download is up about 30 to 50 per cent depending on the day, and this is on ADSL 1 as I'm still using an old Cisco 1751 router. Ping is usually about half what it was.

To be fair Orcon quite quite good at 5AM.  We could watch youtube and download at hundreds of KB per second.So I'm guessing they just not good at the shaping and over subscribed.  A shame given they used to be one of the best 5 years ago.  Seems change of leadership a while back has led to more flash ('cuse the pun) and less substance.

Useful Cisco Links

Useful Cisco links...

Easy place to keep them so I don't forget and maybe helpful for others...


http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gtpsscer.html#wp1027265

Generate self sign cert for http secure-server trustpoint.

Linux keyboard madness

This happens to me every so often so it I put it here I'll know where it is...

Something changes on the box and I can't type ', ", ` etc. I type ' twice and get ´ and other accents on characters.

Just seems to be /etc/X11/xorg.conf having

Option "XkbVariant" "intl"

Under the keyboard input device. Remove that and it works as normal...

Epiphany opening pages twice on crash recovery

I have this happen all the time and it really annoys me but found an easy fix this morning.

Typically I log in and every time I log in I get a dialog Ephiphany crashed do you want to recover or cancel. You click recover and every window that was open is now duplicated.

Just by chance this morning I closed the dialog. Not cancelled but 'X'ed it and I got one copy of all my windows from last time.

Give it a whirl.