IP inside zone config Vs IP using ifconfig

Hi,
I am able to communicate with the outside world from my zone when my IP is part of zone configuration. However, when I remove the IP from the zone config, but bring it up after I boot the zone (using the zone option to ifconfig), I can't communicate with the outside world. Any ping request comes back with "unknown host". There are no changes in any of the /etc files between the time when IP was part of zone config and when it was configured after zone was booted. What may be going wrong?
Thanks!

All the zones we have configured have thier own IP's since they need to be access as if they were separate computers.
The global has an IP as well and is used to deal with multi-zone backups etc..

Similar Messages

DNS ZONE Config on CSS

Hi All,
Is it possible to config DNS ZONE config on CISCO CSS.
Can anyone explain me what does this commands do
dns-server zone 1 tier1 "primary"
dns-server
dns-record a <Zone Name> <External IP> 1 single kal-icmp <VIP> 254 sticky-disabled weightedrr 1

How to Configure the CSS to Load Balance DNS Servers
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a00801d015a.shtml
For example,Basically we need to enter the following commands:
Configure the DNS server zone for zone-based DNS. Specify the zone, tier number, and an optional text description:
- CSS (config)# dns-server zone 0 tier1 ""
Configure the CSS to act as a DNS server:
- CSS (config)# dns-server
Add the DNS records as needed:
- CSS (config)# dns-record a www.home.com 192.x.1.1 15 single kal-ap 172.x.25.1 50
sticky-enabled
Configure DNS as primary to point to itself:
CSS (config)# dns primary 172.x.1.90
(circuit VLAN1 - ip address 172.3x.1.90 / 24)
This is just an example but it is basically all you need to configure DNS on the box.
DNS configuration commands:
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_710/cmdrefgd/cmdglobc.htm#wp1104782
A different use on the box for DNS would be basically to load balance the DNS traffic
between DNS servers. This is however something different to configure on the box and more
details can be found here:

How to delete a DAC block inside a sub-block by using script?

Hello,
how can I delete a DAC block that’s inside a sub-block diagram using a script?
The command
call SCHEMELOAD("xxx")
call BlDel("yyy")
only deletes blocks that are in the highest level of the actually loaded block diagram, not blocks that are in a sub-block diagram. (DIAdem 2012)
regards,
Eric

Hi Walter,
I don't need to delete a sub-block, I'd only like to delete blocks which are placed inside a sub-block.
All other commands I tried work for blocks no matter where they are inside a block diagram. For exaple: You can put a math formula block inside a sub-block wich is inside a sub-block which is inside a sub block and it does change the formula by script command.
But when using the command Bldel it deletes all blocks but not the ones inside a sub-block.
regards, Eric

[svn] 3037: Update flex-config. xml files used by the team and qa webapps to use the {targetPlayerMajorVersion} token instead of a hardcoded player version in the library-path and external-library-path .

Revision: 3037
Author: [email protected]
Date: 2008-08-29 06:54:15 -0700 (Fri, 29 Aug 2008)
Log Message:
Update flex-config.xml files used by the team and qa webapps to use the {targetPlayerMajorVersion} token instead of a hardcoded player version in the library-path and external-library-path. This will allow the correct playerglobal.swc to be located when the target player version is set in the flex-config.xml or passed to mxmlc or compc.
Modified Paths:
blazeds/trunk/apps/team/WEB-INF/flex/flex-config.xml
blazeds/trunk/qa/resources/config/flex-config.xml

Unfortunately I don't have the
"org.eclipse.swt.win32.win32.x86_3.1.2.jar" file. On my computer
the folder is not set up the same way (C:\Program Files\Adobe\Flex
Builder 2\plugins) instead it is set up as (C:\Program
Files\Adobe\Flex Builder 2\metadata\plugins) but I've looked in
everything and that file just isn't in there. I've re downloaded it
twice. Still not there. Is there anything else i can do.

I obtain error -10003 from AI hardware config when I use AC coupling

I am using a function generator to make a sine wave and I want to obtain the data. However, there is an error 10003 at AI hardware config when I use AC coupling and I am not sure why?
Attachments:
Motor_Current_Measurement2.vi ‏133 KB

What model DAQ board are you using. There's only a couple from NI that support AC coupling.

Question for register Oracle agent inside Zone

Hi All,
There is a question about register an Oracle agent inside zone:
Let�s say S1, S2 be the global zone for the hosts of a pair of Sun cluster, and zone1, zone2 as the non-global zone respectively.
Zone1 and zone2 with the zone path /dbzone, and the oracle binary is installed in zone1 and zone2�s local disk, with path /home/oracle/10.2 as the ORACLE_HOME.
Therefore, the corresponding path to the host S1 and S2 is /dbzone/root/home/oracle/10.2.
And when we register the Oracle HA resource, with input the oracle home as �/home/oracle/10.2�, it will prompt that the directory is not contain required Oracle file.
And if we change to �/dbzone/root/home/oracle/10.2�, it will prompt with error when create resource, with the message, S1:zone1, path �/dbzone/root/home/oracle/10.2� not exist.
We currently to solve the problem by moving the oracle binary to SAN disk, with mount point name �/u01/oradata/portal/oracle/10.2� on the both global and non-global zone.
I would like to ask that is there any missing syntax or any document about how to register ORACLE_HOME inside zone�s local disk?
Thanks,
Cheung

Cheung,
You probably haven't got the init<SID>.ora file in both ORACLE_HOME/dbs directories or something like that. Have a look at /var/adm/messages on both these zones and the global zone and see if there are any more hints as to what is missing.
Regards,
Tim
---

Unable to access the failure reason inside an SSIS flow, when using DQS Composite domains as part of an SSIS DQS Ceansing step.

Hi,
I have followed the discussions in the (now closed) post titled:
"Composite Domains in SSIS with spaces in the field"
re. how best to approach composite DQS domains when inside a SSIS flow.
I followed the approach recommended i.e.
" If
you map (in SSIS) your 2 individual source fields to both the (DQS) domains in your (DQS)Composite Domain, your composite domain automatically participates in the cleansing activity."
In the example I have, there would be a number of different validation rules , similiar
to the rules in that post which were called 'Circle', 'Square', etc.,, associated with the Shapes&Sides CD.
What I haven't figured out , is how to know from the output of the (SSIS) DQS Cleansing step when I get an
Invalid result
- which precise DQS rule (e.g.'Circle', 'Square'..etc) actually failed. ?
So for an input row (if we take the example from that post) with a 'Shapes' value of 'Square', and a
'Sides' value of '3', I would like to get 'Failed Square' (Square being the DQS rule name) as the reason for failure, and to be able to see that from inside SSIS.
If I use the derived column approach (as discussed at the start of the above discussions) I am able to get
this type of output by using the '...._Reason' DQS output corresponding to the derived column .
However I can't use the latter approach because of the issues with the derived column already highlighted
in that post.
I am also able to get the failed rule displayed when working fully inside the DQS client (no derived columns
of course, just working with the DQS Composite Domains).
However , as I say, I don't seem to be able to find out how to get it (the failed rule) when I map the individual
cols separately to the individual domains.
I do get an SSIS overall 'Record Status' = 'Invalid' but I dont know which rule failed.
I hope I am missing something, as otherwise I don't see how a user is going to figure out why the record is
'Invalid', given that there would typically be multiple rules, any one of which could be causing the record's 'Invalid' status.
Any help would be much appreciated.
Thanks,
Martin

I raised a similar question on the DQS forum. My domain (not a composite) was failing a rule but I didn't know which. I looked a bit further and was able to answer my own question. I've pasted my answer below. Hope it helps.
The SSIS DQS component does specify the domain rule that caused a failure in the 'reason' output column from the DQS SSIS component. It was my mistake.
I added a domain and added 2 domain rules. My source data in my SSIS process failed one of these rules. However, my source data value was already in the Domain Values list in DQS, and so when I ran the SSIS process, it highlighted the fact that my SSIS source
data was an existing domain value but that domain value was invalid as it failed domain rules, hence the 'domain' value in the DQS SSIS component output column.
I removed the value from the Domain Values in DQS, re-ran my package and this time my 'new' value failed but in the SSIS 'Reason' output column from the DQS SSIS component, it told me the rule that it failed on.
One thing to note. If it fails more than 1 rule, the SSIS 'reason' output column concatenates the rule names together.
So, for example, I had a domain with 3 rules. Length>2, Length>9 and Length>10. My new value was 3 characters in length and so it passed the first rule but failed the next two. The SSIS reason column had a value of 'Failed rule: 'Length >9 Length
>10'.

Running faces config file without using internet

hi
i m new to JSF
how i can run faces config file without using live internet
i have put "web-facesconfig_1_1.dtd" file at local path
while i run the jboss,it will throw exception of fileNotFoundException

Which version of JBoss are you using? I have successfully run 4.2.x off the grid but I typically use schema:<faces-config xmlns="http://java.sun.com/xml/ns/javaee"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_1_2.xsd"
              version="1.2">Note that I did not need to obtain copies of the files myself for use locally.

Can I convert the optical output to analog for a zone 2 audio? I would continue using the HDMI for the main zone. Can I use both of these simultaneously? Zone 2 only supports analog on this receiver.

Can I convert the optical output to analog via a converter for zone 2 audio? I would continue using the HDMI for the main zone. Can I use both of these simultaneously? Zone 2 only supports analog on this receiver.

These will probably help.
[http://www.jsresources.org/examples/audio_conversion.html]

Clicking magnets inside of iPad Air after using Smart Cover for some time

I have read that many people experience clicking magnets inside of iPad Air after using Apple Smart Cover for some time.
I experienced the same thing and returned the device to the shop where i bought it, while still having the warranty.
They wrote me after 11 days of having my iPad that it is fixed and i can come for it, i was not yet there.
Please tell me, how can i realize that they warranty serviced my iPad?
I have read that many people get new device with same issue, and mine just got fixed somehow...
It is not Apple Store it is Apple Premium Reseller, was their service OK or they just did not wanted to give me new device?
How can i get to know they were acting correctly?
Thanks for the answer

Everything is OK, they gave my whole new iPad Air

Prepare asa config to be used at next reboot

Hello,
For a customer I have to move the ASA 5505 firewall to a new internet connection. I have modified the config in a notepad textfile and want to put it on flash or so, so that it will be loaded at next reboot. I believe this is possible but does anyone know how to do this?
Best regards,
Ralph Willemsen
Arnhem, Netherlands

Use any method to copy the file to the ASA's flash (SCP, TFTP, etc). Once the file exists, you have two options:
(1) Set the new file as the config file to use on boot up using the boot config command (more details are in Ralph Willemsen's link). However, this file will now always be used as the new "startup-configuration". So issuing configuration changes and then write memory will write to your new configuration file. And using copy running-config startup-config will not work (as it is saving the running-config to a file called startup-config as opposed to whatever file you have set as your boot config file.
(2) Once the file is copied, issue a write erase to clear out the current startup-config and then issue copy flash:/myfile.txt startup-config to copy your file's contents into the startup-config. Now at next reboot, it will be the "new" config you intend to use. (just make sure you don't save the config before you reboot )
Personally, I suggest option 2. Hope this helps.

Using NAS devices inside zone clusters

I was reading the docs regarding using NAS devices with Sun Cluster. It mentioned installing a vendor supplied package onto each cluster node to support their NAS, for example, NetApp has the NTAPclnas package. We are using Hitachi HNAS and I doubt they have a an equivalent package. (I'm looking into this but my hopes are not high)
What exactly do I need this for? Are there any problems with simply adding the NFS mounts I need to the /etc/vfstab of each zone cluster node?
In my case I will be running our oracle dev/test databases on NFS file-systems and our production clusters will use NFS file-systems for writing RMAN backups into. We aren't using RAC (today) but quite possibly will be moving to RAC in the future.
I was just curious what the level of integration detailed in http://download.oracle.com/docs/cd/E19680-01/html/821-1556/ewplp.html#eyprn provided? Also will using a vanilla /etc/vfstab approach work if Hitachi doesn't have such a package available.
Thanks for any info.

IIRC, that package provides locking and fencing support. You need to be able to ensure that nodes that are not supposed to be able to write to a piece of shared storage cannot do so. With an NFS server, this is done by revoking the share. The second part is NFS lock release.
So, if you don't have this package, you don't have these features. Without fencing control, you risk data integrity. Without lock release, you risk not being able to access your files.
That said, there are some circumstances when you probably don't need them. Just dumping RMAN backups to a dump area may be OK. I don't know quite enough about RMAN to comment.
Tim
---

How to mount NFS into a zone or how to use the same IP in every zone?

Hi,
we are using a NFS server in a different subnet (= different network interface; nxge1) than our 'normal' network (= nxge0).
Now I want to mount serveral NFS directories into our zones.
First I thought the follwoing is possible:
In the global zone I just mount the filesystem into its place:
mount 10.11.3.1:/vol/vol_nfs_zones/zoneNNN_mnt /zones/zoneNNN/root/mnt
When the zone is halted this mount works, but when I start the zone, I receive the error:
# zoneadm -z zoneNNN boot
zoneadm: zone 'zoneNNN': These file-systems are mounted on subdirectories of /zones/zoneNNN/root:
zoneadm: zone 'zoneNNN': /zones/zoneNNN/root/mnt
zoneadm: zone 'zoneNNN': call to zoneadmd failed
When zoneNNN is already running and I try to mount it, I receive
nfs mount: mount: /zones/zoneNNN/root/mnt: Device busy
So the question is: How do I mount something in the gloabl zone from a NFS server into a zone?
The only alternative I see is to make the interface nxge1 available in every zone and give each an own IP in our storage network... But sadly this isn't an alternative because we don't have so many free IPs in that net! (Or is there a trick to use the same IP in the global and non-global zones for only this interface??)
Does anyone have a solution for our problem? I cannot believe that SUN misses this!
Any hints are more than welcome!

Mounting it by NFS in the global zone and trying to add this by the "add fs" and "type=lofs"-option yields to an error, when installing the zone:
cannot verify fs /data: NFS mounted file-system.
A local file-system must be used.
zoneadm: zone zoneNNN failed to verifyOur storage network is not accessable from other nets. (And I think it is a very bad idea to route storage network traffic...)
So I think we def. have to increase our storage network. :-(

Replacing Time Capsule - can I save my old config file to use with new one?

I have a Time Capsule backing up 3 of my Macs. A couple of nights ago, I started receiving the following: "sparsebundle” could not be created error 22
on all 3 Macs.Time Machine application fails due to this error and if I access the Time Machine in Finder, I can see the 3 volumes but cannot go any deeper. I get the same sparsebundle error.
A few minutes ago, my wife called me stating that her MBP gave her a backup error stating that the backup Volume name changed, continue or don't backup. Something weird is obviously going on. I also noticed that the TM fan was kicked up into high gear. I'm suspecting a hardware failure of some sort.
Thoughts?
If I do need to replace my TC, is there a way to save the config file from my old one and import/use it on a new TC if I have to purchase one? Would save me from entering a lot of wireless access devices since I use MAC filtering.

Yes you can easily import/export settings ( I have 6 base stations so do this quite a lot - in fact I always export the configs as a backup anyway)
As to your TC can you connect it locally and run Disk Utils to see if it need some repairs?
Regards,
Shawn

Howto: Zones in private subnets using ipfilter's NAT and Port forwarding

This setup supports the following features:
* Requires 1 Network interface total.
* Supports 1 or more public ips.
* Allows Zone to Zone private network traffic.
* Allows internet access from the global zones.
* Allows direct (via ipfilter) internet access to ports in non-global zones.
(change networks to suit your needs, the number of public and private ip was lowered to simplify this doc)
Network setup:
iprb0 65.38.103.1/24
defaultrouter 65.38.103.254
iprb0:1 192.168.1.1/24 (in global zone)
Create a zone on iprb0 with an ip of 192.168.1.2
### Example /etc/ipf/ipnat.conf
# forward from a public port to a private zone port
rdr iprb0 65.38.103.1/32 port 2222 -> 192.168.1.2 port 22
# force outbound zone traffic thru a certain ip address
# required for mail servers because of reverse lookup
map iprb0 192.168.1.2/32 -> 65.38.103.1/32 proxy port ftp ftp/tcp
map iprb0 192.168.1.2/32 -> 65.38.103.1/32 portmap tcp/udp auto
map iprb0 192.168.1.2/32 -> 65.38.103.1
# allow any 192.168.1.x zone to use the internet
map iprb0 192.168.1.0/24 -> 0/32 proxy port ftp ftp/tcp
map iprb0 192.168.1.0/24 -> 0/32 portmap tcp/udp auto
map iprb0 192.168.1.0/24 -> 0/32For testing purposes you can leave /etc/ipf/ipf.conf empty.
Be aware the you must "svcadm disable ipfilter; svcadm enable ipfilter" to reload rules and the rules stay loaded if they are just disabled(bug).
Zones can't modify their routes and inherit the default routes of the global zone. Because of this we have to trick the non-global zones into using a router that doesn't exist.
Create /etc/init.d/zone_route_hack
Link this file to /etc/rc3.d/S99zone_route_hack.
#/bin/sh
# based on information found at
# http://blogs.sun.com/roller/page/edp?entry=using_branded_zones_on_a
# http://forum.sun.com/jive/thread.jspa?threadID=75669&messageID=275741
fake_router=192.168.1.254
public_net=65.38.103.0
router=`netstat -rn | grep default | grep -v " $fake_router " | nawk '{print $2}'`
# send some data to the real network router so we look up it's arp address
ping -sn $router 1 1 >/dev/null
# record the arp address of the real router
router_arp=`arp $router | nawk '{print $4}'`
# delete any existing arp address entry for our fake private subnet router
arp -d $fake_router >/dev/null
# assign the real routers arp address to our fake private subnet router
arp -s $fake_router $router_arp
# route our private subnet through our fake private subnet router
route add default $fake_router
# Can't create this route until the zone/interface are loaded
# Adjust this based on your hardware and number of zones
sleep 300
# Duplicate this line for every non-global zone with a private ip that
# will have ipfilter rdr (redirects) pointing to it
route add -net $public_net 192.168.1.2 -ifaceNow we have both public and private ip addresses on our one iprb0 interface. If we'd really like our private zone network to really be private we don't want any non-NAT'ed 192.168.1.x traffic leaving the interface. Since ipfilter can't block traffic between zones because they use loopbacks we can just block the 192.168.1.x traffic and the zones can still talk.
The following /etc/ipf/ipf.conf defaults to deny.
# ipf.conf
# IP Filter rules to be loaded during startup
# See ipf(4) manpage for more information on
# IP Filter rules syntax.
# INCOMING DEFAULT DENY
block in all
block return-rst in proto tcp all
# two open ports one of which is redirected in ipnat.conf
pass in quick on iprb0 proto tcp from any to any port = 22 flags S keep state keep frags
pass in quick on iprb0 proto tcp from any to any port = 2222 flags S keep state keep frags
# INCOMING PING
pass in quick on iprb0 proto icmp from any to 65.38.103.0/24 icmp-type 8 keep state
# INCOMING GLOBAL ZONE UNIX TRACEROUTE FIX PART 1
#pass in quick on iprb0 proto udp from any to 65.38.103.0/24 keep state
# OUTGOING RULES
block out all
# ALL INTERNAL TRAFFIC STAYS INTERNAL (Zones use non-filtered loopback)
# remove/edit as needed to actually talk to local private physical networks
block out quick from any to 192.168.0.0/16
block out quick from any to 172.16.0.0/12
block out quick from any to 10.0.0.0/8
block out quick from any to 0.0.0.0/8
block out quick from any to 127.0.0.0/8
block out quick from any to 169.254.0.0/16
block out quick from any to 192.0.2.0/24
block out quick from any to 204.152.64.0/23
block out quick from any to 224.0.0.0/3
# Allow traffic out the public interface on the public address
pass out quick on iprb0 from 65.38.103.1/32 to any flags S keep state keep frags
# OUTGOING PING
pass out quick on iprb0 proto icmp from 65.38.103.1/32 to any icmp-type 8 keep state
# Allow traffic out the public interface on the private address (needs nat and router arp hack)
pass out quick on iprb0 from 192.168.1.0/24 to any flags S keep state keep frags
# OUTGOING PING
pass out quick on iprb0 proto icmp from 192.168.1.0/24 to any icmp-type 8 keep state
# INCOMING TRACEROUTE FIX PART 2
#pass out quick on iprb0 proto icmp from 65.38.103.1/32 to any icmp-type 3 keep stateIf you want incoming and outgoing internet in your zones it is easier if you just give them public ips and setup a firewall in the global zone. If you have limited public ip address(I'm setting up a colocation 1u server) then you might take this approach. One of the best things about doing thing this way is that any software configured in the non-global zones will never be configured to listen on an ip address that might change if you change public ips.

Instead of using the script as a legacy_run script, set it up in SMF.
First create the file /var/svc/manifest/system/ip-route-hack.xml with
the following
---Start---
<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM
"/usr/share/lib/xml/dtd/service_bundle.dtd.1">

<service_bundle type='manifest' name='NATtrans:ip-route-hack'>
<service
name='system/ip-route-hack'
type='service'
version='1'>
<create_default_instance enabled='true' />
<single_instance />
<dependency
name='physical'
grouping='require_all'
type='service'
restart_on='none'>
<service_fmri value='svc:/network/physical:default' />
</dependency>
<dependency
name='loopback'
grouping='require_all'
type='service'
restart_on='none'>
<service_fmri value='svc:/network/loopback:default' />
</dependency>
<exec_method
type='method'
name='start'
exec='/lib/svc/method/svc-ip-route-hack start'
timeout_seconds='0' />
<property_group name='startd' type='framework'>
<propval name='duration' type='astring'
value='transient' />
</property_group>
<stability value='Unstable' />
<template>
<common_name>
<loctext xml:lang='C'>
Hack to allow zone to NAT translate.
</loctext>
</common_name>
<documentation>
<manpage
title='zones'
section='1M'
manpath='/usr/share/man' />
</documentation>
</template>
</service>
</service_bundle>
---End---
then modify /var/svc/manfiest/system/zones.xml and add the following
dependancy
---Start---
<dependency
name='inet-ip-route-hack'
type='service'
grouping='require_all'
restart_on='none'>
<service_fmri value='svc:/system/ip-route-hack' />
</dependency>
---End---
Finally create the file /lib/svc/method/svc-ip-route-hack with the
contents of S99zone_route_hack, minus the sleep timer (perms 0755). Run
'svccfg import /var/svc/manifest/system/ip-route-hack.xml' and 'svccfg
import /var/svc/manifest/system/zones.xml'.
This will guarantee that ip-route-hack is run before zones are started,
but after the interfaces are brought on line. It is worth noting that
zones.xml may get overwritten during a patch, so if it suddenly stops
working, that could be why.

IP inside zone config Vs IP using ifconfig

Similar Messages

Maybe you are looking for