Differences between revisions 2 and 63 (spanning 61 versions)
Revision 2 as of 2013-01-05 22:33:48
Size: 1316
Editor: fungi
Comment:
Revision 63 as of 2013-01-20 02:49:11
Size: 8847
Editor: fungi
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
Notes on the core switch build and configuration... This documents details of how the core switching infrastructure is built, in case it needs to be redone in the future.
Line 3: Line 3:
 * Cisco/Linksys E4200 v1
 * two for redundant operation
 * a third as a cold spare
 * DD-WRT standard
 * higher-capacity power supplies
 * heatsinks and thermal adhesive for switch chips
<<TableOfContents>>
Line 10: Line 5:
 #. perform 30/30/30 reset
 #. connect as 192.168.1.2/30 to [[http://192.168.1.1/|its WebUI]] through any LAN port
 #. initial login is root/admin
 #. upgrade flash with [[http://dd-wrt.com/dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/2012/03-19-12-r18777/broadcom_K26/dd-wrt.v24-18777_NEWD-2_K2.6_mini-e4200.bin|dd-wrt.v24-18777_NEWD-2_K2.6_mini-e4200.bin]]
 #. wait an additional five minutes for good measure
 #. perform 30/30/30 reset
 #. confirm [[http://192.168.1.1/|password reset page]] is displayed
 #. upgrade flash with [[http://dd-wrt.com/dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/2013/01-01-2013-r20453/broadcom_K26/dd-wrt.v24-20453_NEWD-2_K2.6_std_usb_nas-nv60k.bin|dd-wrt.v24-20453_NEWD-2_K2.6_std_usb_nas-nv60k.bin]]
 #. wait an additional five minutes for good measure
 #. perform 30/30/30 reset
 #. wait an additional five minutes for good measure
 #. confirm [[http://192.168.1.1/|password reset page]] is displayed and correct firmware load shows in the top-right corner
 #. set password
 #. disable both radios
= Highlights =

Some random notes on the core switch build and configuration...

 * two [[http://www.dd-wrt.com/wiki/index.php/Linksys_E4200|Cisco/Linksys E4200 v1]] ([[http://www.dd-wrt.com/phpBB2/viewtopic.php?p=661393&highlight=#661393|not v2]]) for redundant operation and a third as a cold spare
 * higher-capacity 5A power supplies for each (radio dropouts are suspected to be due to under-specified factory supplies)
 * remove the original housings and add heatsinks and thermal adhesive for the switch chips (similarly, stability issues are thought to come from overheating)
 * solder serial connectors to the boards for out-of-band access
 * [[http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51486|DD-WRT standard]] instead of mini (because it adds IPv6 and SNMP support)
 * [[http://www.dd-wrt.com/phpBB2/viewtopic.php?t=86919&postdays=0&postorder=asc&start=60|custom switch driver to allow 802.1q VLAN tag remapping]]
 * with modern Iceweasel/Firefox use ''Web Developer -> Get More Tools'' and install the ''Web Developer Extension'', then after restarting use ''Web Developer Extension -> Miscellaneous -> Clear Private Data -> Clear HTTP Authentication'' to clear HTTP Basic Auth credentials after changing DD-WRT management passwords (otherwise any attempts to Save/Apply changes just go to a failure error or blank page)
 * beer (yes, it ''is'' necessary to the process)

= Firmware Installation =

First perform these steps on each device to get the hardware up on the current DD-WRT firmware with desired features...

 1. perform a [[http://www.dd-wrt.com/wiki/index.php/Hard_reset_or_30/30/30|30/30/30 hard reset]] to make sure it's at factory defaults (note this is using the recessed red ''reset'' button, not the protruding blue one for WDS)
 1. plug your machine's wired interface into the ''Ethernet 4'' port
 1. set the interface to a static address of 192.168.1.2 and make sure you can reach the device at 192.168.1.1 (''sudo ip address add 192.168.1.2/30 dev eth0 ; sudo ip link set up dev eth0 ; ping -c1 192.168.1.1 >/dev/null ; ip neighbor show dev eth0'')
 1. connect to the [[http://192.168.1.1/|management WebUI]] (initial login is a username of ''root'' with the password ''admin'')
 1. upgrade the flash with a trailed E4200 mini build like [[http://dd-wrt.com/dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/2012/03-19-12-r18777/broadcom_K26/dd-wrt.v24-18777_NEWD-2_K2.6_mini-e4200.bin|dd-wrt.v24-18777_NEWD-2_K2.6_mini-e4200.bin]] (the Cisco/Linksys firmware updater looks for special headers, so this is the first in a two-stage load)
 1. wait five minutes to make sure everything's booted and written to NVRAM (now is a good time to grab a beer)
 1. perform another [[http://www.dd-wrt.com/wiki/index.php/Hard_reset_or_30/30/30|30/30/30]] to make sure any configuration artifacts are reset to the defaults for this build
 1. confirm the [[http://192.168.1.1/|DD-WRT password reset page]] is displayed
 1. set root/admin as the new login (yes, I know that's the same as the old login)
 1. [[http://192.168.1.1/backup/cfe.bin|backup the CFE]] as ''hostname_cfe.bin'' (it embeds the original interface MAC so you want one archived for each device) and stash it somewhere for long term safekeeping (see [[http://www.dd-wrt.com/wiki/index.php/CFE_backup|here]] for details)
 1. upgrade flash with a more featureful NV60K build like [[http://dd-wrt.com/dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/2013/01-01-2013-r20453/broadcom_K26/dd-wrt.v24-20453_NEWD-2_K2.6_std_usb_nas-nv60k.bin|dd-wrt.v24-20453_NEWD-2_K2.6_std_usb_nas-nv60k.bin]] (this adds IPv6 and SNMP support, which we'll want)
 1. wait an additional five minutes (and grab another beer if you like)
 1. perform yet another [[http://www.dd-wrt.com/wiki/index.php/Hard_reset_or_30/30/30|30/30/30]]
 1. wait five more minutes (another beer... why not?)
 1. confirm [[http://192.168.1.1/|password reset page]] is displayed and ''Firmware: DD-WRT v24-sp2 (12/31/12) std-usb-nas'' shows in the top-right corner
 1. set root/admin as the new login again (if you've managed not bricking it, congrats... celebrate your success with more beer)

= Initial Configuration =

After sobering up a bit, set these basic configuration options which deviate from the factory default configuration settings...

== Replace Telnet And HTTP With SSH And HTTPS ==

{{{
fungi@tsathoggua:~$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

DD-WRT v24-sp2 std (c) 2012 NewMedia-NET GmbH
Release: 12/31/12 (SVN revision: 20453)

DD-WRT login: root
Password: admin
==========================================================
 
 ____ ___ __ ______ _____ ____ _ _
 | _ \| _ \ \ \ / / _ \_ _| __ _|___ \| || |
 || | || ||____\ \ /\ / /| |_) || | \ \ / / __) | || |_
 ||_| ||_||_____\ V V / | _ < | | \ V / / __/|__ _|
 |___/|___/ \_/\_/ |_| \_\|_| \_/ |_____| |_|
 
                       DD-WRT v24-sp2
                   http://www.dd-wrt.com
 
==========================================================


BusyBox v1.20.2 (2012-12-31 04:45:18 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@DD-WRT:~# nvram set sshd_enable=1
root@DD-WRT:~# startservice sshd
root@DD-WRT:~# nvram set https_enable=1
root@DD-WRT:~# nvram set http_enable=0
root@DD-WRT:~# startstop httpd
root@DD-WRT:~# nvram set telnetd_enable=0
root@DD-WRT:~# stopservice telnetd
Connection closed by foreign host.
fungi@tsathoggua:~$ ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@192.168.1.1
Warning: Permanently added '192.168.1.1' (RSA) to the list of known hosts.
DD-WRT v24-sp2 std (c) 2012 NewMedia-NET GmbH
Release: 12/31/12 (SVN revision: 20453)
root@192.168.1.1's password: admin
==========================================================
 
 ____ ___ __ ______ _____ ____ _ _
 | _ \| _ \ \ \ / / _ \_ _| __ _|___ \| || |
 || | || ||____\ \ /\ / /| |_) || | \ \ / / __) | || |_
 ||_| ||_||_____\ V V / | _ < | | \ V / / __/|__ _|
 |___/|___/ \_/\_/ |_| \_\|_| \_/ |_____| |_|
 
                       DD-WRT v24-sp2
                   http://www.dd-wrt.com
 
==========================================================


BusyBox v1.20.2 (2012-12-31 04:45:18 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@DD-WRT:~# nvram commit
root@DD-WRT:~#
}}}

== Change Passwords ==

{{{
root@DD-WRT:~# setuserpasswd root somepassword
root@DD-WRT:~# setpasswd root somepassword
}}}

== Add A JFFS2 Filesystem ==

{{{
root@DD-WRT:~# nvram set clean_jffs2=1
root@DD-WRT:~# nvram set enable_jffs2=1
root@DD-WRT:~# nvram set sys_clean_jffs2=1
root@DD-WRT:~# nvram set sys_enable_jffs2=1
root@DD-WRT:~# nvram commit
}}}

== Use A Management VLAN ==

{{{
root@DD-WRT:~# nvram set rc_firewall="iptables -I INPUT 2 -i vlan9 -j ACCEPT"
root@DD-WRT:~# nvram set rc_startup="ifconfig vlan9 192.168.2.1 netmask 255.255.255.0"
root@DD-WRT:~# nvram set vlan1ports="0 1 2 8"
root@DD-WRT:~# nvram set vlan9hwname=et0
root@DD-WRT:~# nvram set vlan9ports="3t 8*"
root@DD-WRT:~# nvram commit
}}}

== Reboot ==

{{{
root@DD-WRT:~# reboot
root@DD-WRT:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.
}}}

== Connect Through The Management VLAN ==

{{{
fungi@tsathoggua:~$ sudo ip link add link eth0 name eth0.9 type vlan id 9
fungi@tsathoggua:~$ sudo ip link set up dev eth0.9
fungi@tsathoggua:~$ sudo ip address add 192.168.2.2/30 dev eth0.9
fungi@tsathoggua:~$ ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@192.168.2.1
Warning: Permanently added '192.168.2.1' (RSA) to the list of known hosts.
DD-WRT v24-sp2 std (c) 2012 NewMedia-NET GmbH
Release: 12/31/12 (SVN revision: 20453)
root@192.168.2.1's password: somepassword
==========================================================
 
 ____ ___ __ ______ _____ ____ _ _
 | _ \| _ \ \ \ / / _ \_ _| __ _|___ \| || |
 || | || ||____\ \ /\ / /| |_) || | \ \ / / __) | || |_
 ||_| ||_||_____\ V V / | _ < | | \ V / / __/|__ _|
 |___/|___/ \_/\_/ |_| \_\|_| \_/ |_____| |_|
 
                       DD-WRT v24-sp2
                   http://www.dd-wrt.com
 
==========================================================


BusyBox v1.20.2 (2012-12-31 04:45:18 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@DD-WRT:~#
}}}

== Remove Old Management Access ==

...still in progress...

This documents details of how the core switching infrastructure is built, in case it needs to be redone in the future.

Highlights

Some random notes on the core switch build and configuration...

  • two Cisco/Linksys E4200 v1 (not v2) for redundant operation and a third as a cold spare

  • higher-capacity 5A power supplies for each (radio dropouts are suspected to be due to under-specified factory supplies)
  • remove the original housings and add heatsinks and thermal adhesive for the switch chips (similarly, stability issues are thought to come from overheating)
  • solder serial connectors to the boards for out-of-band access
  • DD-WRT standard instead of mini (because it adds IPv6 and SNMP support)

  • custom switch driver to allow 802.1q VLAN tag remapping

  • with modern Iceweasel/Firefox use Web Developer -> Get More Tools and install the Web Developer Extension, then after restarting use Web Developer Extension -> Miscellaneous -> Clear Private Data -> Clear HTTP Authentication to clear HTTP Basic Auth credentials after changing DD-WRT management passwords (otherwise any attempts to Save/Apply changes just go to a failure error or blank page)

  • beer (yes, it is necessary to the process)

Firmware Installation

First perform these steps on each device to get the hardware up on the current DD-WRT firmware with desired features...

  1. perform a 30/30/30 hard reset to make sure it's at factory defaults (note this is using the recessed red reset button, not the protruding blue one for WDS)

  2. plug your machine's wired interface into the Ethernet 4 port

  3. set the interface to a static address of 192.168.1.2 and make sure you can reach the device at 192.168.1.1 (sudo ip address add 192.168.1.2/30 dev eth0 ; sudo ip link set up dev eth0 ; ping -c1 192.168.1.1 >/dev/null ; ip neighbor show dev eth0)

  4. connect to the management WebUI (initial login is a username of root with the password admin)

  5. upgrade the flash with a trailed E4200 mini build like dd-wrt.v24-18777_NEWD-2_K2.6_mini-e4200.bin (the Cisco/Linksys firmware updater looks for special headers, so this is the first in a two-stage load)

  6. wait five minutes to make sure everything's booted and written to NVRAM (now is a good time to grab a beer)
  7. perform another 30/30/30 to make sure any configuration artifacts are reset to the defaults for this build

  8. confirm the DD-WRT password reset page is displayed

  9. set root/admin as the new login (yes, I know that's the same as the old login)
  10. backup the CFE as hostname_cfe.bin (it embeds the original interface MAC so you want one archived for each device) and stash it somewhere for long term safekeeping (see here for details)

  11. upgrade flash with a more featureful NV60K build like dd-wrt.v24-20453_NEWD-2_K2.6_std_usb_nas-nv60k.bin (this adds IPv6 and SNMP support, which we'll want)

  12. wait an additional five minutes (and grab another beer if you like)
  13. perform yet another 30/30/30

  14. wait five more minutes (another beer... why not?)
  15. confirm password reset page is displayed and Firmware: DD-WRT v24-sp2 (12/31/12) std-usb-nas shows in the top-right corner

  16. set root/admin as the new login again (if you've managed not bricking it, congrats... celebrate your success with more beer)

Initial Configuration

After sobering up a bit, set these basic configuration options which deviate from the factory default configuration settings...

Replace Telnet And HTTP With SSH And HTTPS

fungi@tsathoggua:~$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

DD-WRT v24-sp2 std (c) 2012 NewMedia-NET GmbH
Release: 12/31/12 (SVN revision: 20453)

DD-WRT login: root
Password: admin
==========================================================
 
 ____  ___    __        ______ _____         ____  _  _ 
 | _ \| _ \   \ \      / /  _ \_   _| __   _|___ \| || | 
 || | || ||____\ \ /\ / /| |_) || |   \ \ / / __) | || |_ 
 ||_| ||_||_____\ V  V / |  _ < | |    \ V / / __/|__   _| 
 |___/|___/      \_/\_/  |_| \_\|_|     \_/ |_____|  |_| 
 
                       DD-WRT v24-sp2
                   http://www.dd-wrt.com
 
==========================================================


BusyBox v1.20.2 (2012-12-31 04:45:18 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@DD-WRT:~# nvram set sshd_enable=1
root@DD-WRT:~# startservice sshd
root@DD-WRT:~# nvram set https_enable=1
root@DD-WRT:~# nvram set http_enable=0
root@DD-WRT:~# startstop httpd
root@DD-WRT:~# nvram set telnetd_enable=0
root@DD-WRT:~# stopservice telnetd
Connection closed by foreign host.
fungi@tsathoggua:~$ ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@192.168.1.1
Warning: Permanently added '192.168.1.1' (RSA) to the list of known hosts.
DD-WRT v24-sp2 std (c) 2012 NewMedia-NET GmbH
Release: 12/31/12 (SVN revision: 20453)
root@192.168.1.1's password: admin
==========================================================
 
 ____  ___    __        ______ _____         ____  _  _ 
 | _ \| _ \   \ \      / /  _ \_   _| __   _|___ \| || | 
 || | || ||____\ \ /\ / /| |_) || |   \ \ / / __) | || |_ 
 ||_| ||_||_____\ V  V / |  _ < | |    \ V / / __/|__   _|
 |___/|___/      \_/\_/  |_| \_\|_|     \_/ |_____|  |_| 
 
                       DD-WRT v24-sp2
                   http://www.dd-wrt.com
 
==========================================================


BusyBox v1.20.2 (2012-12-31 04:45:18 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@DD-WRT:~# nvram commit
root@DD-WRT:~# 

Change Passwords

root@DD-WRT:~# setuserpasswd root somepassword
root@DD-WRT:~# setpasswd root somepassword

Add A JFFS2 Filesystem

root@DD-WRT:~# nvram set clean_jffs2=1
root@DD-WRT:~# nvram set enable_jffs2=1
root@DD-WRT:~# nvram set sys_clean_jffs2=1
root@DD-WRT:~# nvram set sys_enable_jffs2=1
root@DD-WRT:~# nvram commit

Use A Management VLAN

root@DD-WRT:~# nvram set rc_firewall="iptables -I INPUT 2 -i vlan9 -j ACCEPT"
root@DD-WRT:~# nvram set rc_startup="ifconfig vlan9 192.168.2.1 netmask 255.255.255.0"
root@DD-WRT:~# nvram set vlan1ports="0 1 2 8"
root@DD-WRT:~# nvram set vlan9hwname=et0
root@DD-WRT:~# nvram set vlan9ports="3t 8*"
root@DD-WRT:~# nvram commit

Reboot

root@DD-WRT:~# reboot
root@DD-WRT:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

Connect Through The Management VLAN

fungi@tsathoggua:~$ sudo ip link add link eth0 name eth0.9 type vlan id 9
fungi@tsathoggua:~$ sudo ip link set up dev eth0.9
fungi@tsathoggua:~$ sudo ip address add 192.168.2.2/30 dev eth0.9
fungi@tsathoggua:~$ ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@192.168.2.1
Warning: Permanently added '192.168.2.1' (RSA) to the list of known hosts.
DD-WRT v24-sp2 std (c) 2012 NewMedia-NET GmbH
Release: 12/31/12 (SVN revision: 20453)
root@192.168.2.1's password: somepassword
==========================================================
 
 ____  ___    __        ______ _____         ____  _  _ 
 | _ \| _ \   \ \      / /  _ \_   _| __   _|___ \| || | 
 || | || ||____\ \ /\ / /| |_) || |   \ \ / / __) | || |_ 
 ||_| ||_||_____\ V  V / |  _ < | |    \ V / / __/|__   _| 
 |___/|___/      \_/\_/  |_| \_\|_|     \_/ |_____|  |_| 
 
                       DD-WRT v24-sp2
                   http://www.dd-wrt.com
 
==========================================================


BusyBox v1.20.2 (2012-12-31 04:45:18 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@DD-WRT:~#

Remove Old Management Access

...still in progress...

CCL: Configuration/CoreSwitching (last edited 2014-08-31 23:32:39 by fungi)

CC0 To the extent possible under law, the creator of this work has waived all copyright and related or neighboring rights to it.