Followed this article (VMware KB1008658) then used the following batch file to remove linked clone data/AD…

@echo off

set “str1=W”
set num=0
set “str2=%num%”
set “str3=%str1%%str2%”

:VMstuff
set /a num=%num%+1
set “str2=%num%”
set “str3=%str1%%str2%”

echo.%str3%
SviConfig -operation=RemoveSviClone -AdminUser=Administrator -AdminPassword=yourpassword -VmName=%str3%

if %num%==999 goto :End
goto :VMstuff

:end
pause

Vegetable Omelet
Suitable for Stages 1, 2 and 3 of the diet.
2-3 organic eggs
2 tbsp olive oil
2 tbsp chopped onion
2 tbsp chopped green pepper
Handful of fresh spinach

Heat a skillet with olive oil, add onions and greens pepper, add spinach a few minutes later, stir fry until veggies are tender. Stir in the slightly beaten eggs until eggs are done. Serve immediately with sea salt.

=== Dinner ===

Coconut Curry

Suitable for Stages 1, 2 and 3 of the diet.
For 2 servings:

500g minced lamb
4 medium tomatoes, chopped
1 medium onion
1 can coconut milk
2 cloves garlic
1 tablespoon coconut oil
1 chili pepper (seeds removed)
1/2 teaspoon cayenne pepper
1/2 teaspoon turmeric powder
1/2 teaspoon curry powder
Salt to taste

Chop up the onions, garlic and chili pepper – you can use your food processor to save time. Add them to a frying pan with the lamb and a tablespoon of coconut oil for 5 minutes. Then add all the other ingredients, and simply leave it to simmer for 30 minutes on a low heat.

-

Red snapper with spinach

Suitable for Stages 1, 2 and 3 of the diet.
For 4 servings:

4 fillets red snapper (can substitute any fish really)
2 cloves garlic, minced
1/2 white onion diced
3-6 oz ( as desired) Fresh Spinach
2 tbsp. parsley, minced
lemon juice, freshly squeezed
olive oil

Preheat oven to 450 degrees. Season the fish with salt and rub with olive oil. Sprinkle the onions and garlic in an ovenproof dish. Add the fish, spinach and parsley and squeeze liberally with fresh lemon juice. Cook for six to eight minutes (depending on the thickness of the fish) or until just done. Remove to warmed plates.

-

Roasted Vegetable Salad with Boiled Egg

Suitable for Stages 1, 2 and 3 of the diet.
For 2 servings:

4 boiled eggs
2 Bell Peppers (any color)
2 tomatoes
6 shallots
3 cups of baby spinach
Olive oil
Salt and pepper

Heat the oven to 450 degrees F. Place chopped up peppers, tomatoes, zucchini and onions in a roasting pan. Toss with the olive oil, salt, and pepper to mix and coat. Spread in a single layer in the pan. Roast for 30 minutes, stirring occasionally, until the vegetables are lightly browned and tender.

Hard boil the eggs, peel, cut in half and set aside.

In a large bowl add 3 cups of baby spinach, chopped up vegetables, egg halves and serve. Add some extra olive oil and a squeeze of lemon if you like.

-

Grilled Chicken and Garlic Mashed Turnips

Suitable for Stages 1, 2 and 3 of the diet.
For 4 servings:

3 lbs. of chickens (breasts, legs, or thighs)
2 tablespoons chopped fresh basil
1/4 cup fresh lemon juice
2 tablespoons olive oil
3 cups diced turnip
2 cloves garlic, minced
3 tablespoons olive oil
Salt

Combine chicken, basil, lemon juice and olive oil in a large bowl and toss together. Refrigerate and let marinate 2 hours. The marinated chicken may also be baked for about 50 to 60 minutes at 425°, or until cooked through.

Cook turnip cubes and garlic cloves in boiling water 15 min or until soft. Mash turnips or (can use food processor), then add olive oil and salt.

-

Chicken Quinoa Salad

Suitable for Stages 1, 2 and 3 of the diet.
For 2 servings:

1 chicken breast
2/3 cup of cooked quinoa
2 cups of spinach
2 medium tomatoes
1/2 a cucumber
1 avocado
2 shallots
1 garlic clove
Juice of 1/2 lemon
2 tablespoons olive oil
Salt and pepper to taste

Cook the quinoa as directed. Chop up chicken, pan-fry until cooked, about 5 minutes. Now chop up the veggies, toss everything in a bowl and serve.

-

Marinated Grilled Lime Chicken

Suitable for Stages 1, 2 and 3 of the diet.
For 1 serving:

2 chicken breast
2 limes
3 garlic cloves
2 chilies
1 tablespoon olive oil

Add all ingredients (apart from the chicken) to a food processor. Pour into a Ziploc bag with the chicken breast, seal it and let it marinade in the refrigerator for 30 minutes.

On a hot pan or grill, cook the chicken for around 5 minutes on each side, or until it’s cooked thoroughly.

-

Coconut Chicken with Spinach

Suitable for Stages 1, 2 and 3 of the diet.
For 2 servings:

1 large chicken breast (chopped)
3 cups baby spinach
1 large onion (chopped)
1/2 cup coconut milk
3 tablespoons coconut oil
Handful of almonds
Salt and pepper to taste

Add almonds to the food processor to chop them up, then lightly brown in a pan with coconut oil. Set aside.

In a pot, add the coconut milk and spinach, then cover on a low heat to simmer.

Now add the onions to a pan for 2 minutes, then add chicken until thoroughly cooked. Take the chicken and onions and add them to the pot with the coconut milk and spinach. Stir and cover for 2 minutes. Served garnished with toasted almonds, salt and pepper.

==== Drinks ====

Mixed Veggie

Suitable for Stages 1, 2 and 3 of the diet.

1 tomato
1 stalks of celery
4 large spinach leaves
1 half cup parsley

Just put it through the juicer and serve.

-

Immune Booster

Suitable for Stages 1, 2 and 3 of the diet.

A handful of spinach
A handful of fresh herbs (cilantro, parsley or basil)
1 celery stalk
1 lemon (squeezed)
1 garlic clove or as much as desired (optional)
2 glasses of water

This a delicious, easy drink to make. Add all ingredients into the blender and voila! For a little variety, try it with some cilantro, parsley or basil as desired.

(config)# flow-export destination inside NetFlow Analyzer server IP address 9996
(config)# flow-export template timeout-rate1
(config)# flow-export delay flow-create60

(config)# service-policy netflow-export-policy global

Unknown host: Error when connecting to host localhost/127.0.0.1, port 1433: Connection refused: connect

When it does, here’s one way to fix it whilst learning some troubleshooting skills along the way.

1. Open up task manager > Select: View > Select Columns > PID (tick the box).

2. Local the sqlservr.exe process and note the PID. Mine is 2664

Now you have your PID, open up a command prompt window and execute:  netstat -ano

Locate your PID – scroll across and you’ll find the local address:port. In my case 1164.

Use this port to connect to the SQL database and it will connect fine.

7 / 12 – not bad.

8 days in to 2011 already. Time flies! Here’s my 2011 list.

New Years Resolutions 2011
DO Drink more water
DO Pickup and read a book once per week
DO Think before impulse buying
DO Buy healthier foods
DO Sleep before 10pm weeknights
DO Wake before 9am weekends
DO Find a good work/home balance
DO Tidy up each Sunday
DO Keep in touch with family once per month

LEARN the art of bush craft
LEARN to ride a horse
LEARN to play Oasis on the guitar

GO Climb Ben Nevis
GO Visit San Francisco
GO Snowboarding in Austria
GO Rock climbing
GO Survive in the wilderness for 4 days

- Build IT Infrastructure ‘idea’ project
OR
- Walk or bike around the world

A fantastic group of like minded people ( @kiwi_Si @stevedupe @HPStorageGuy @vinternals @storagebod @englishmdp @dncn @c_egge @mpoore @chrismevans ) coming together to chat about virtualisation, storage and even some football.

After reading some time ago about the monthly gathering which takes place at the The Cittie of Yorke pub, 22 High Holborn, London, WC1V 6BS, I have been trying to make time to attend. Luck has it I was working just around the corner so I had to check it out!

What I really liked about the event is that even though I initially thought I might be seen as an ‘outsider’, it really wasn’t the case at all. The guys made me feel really welcome and after a few minutes I felt completely at ease and part of the group.

The pub has a nice warm atmosphere and I hear they do great food, drinks are reasonably priced too.

All in all a very enjoyable evening which I will no doubt be attending more often.

Special thanks to @mpoore for spotting me wandering around in the beginning and @kiwi_Si for paying the taxi on the way home. I owe you both a drink

Cheers guys – looking forward to the next one.

Read up more at Simon Seagrave’s blog about the vBeers event - Ho, Ho, Ho – London Christmas vBeers (& Storage Beers) is Here!

Part 2 – The Cisco IOS VPN

Setup Interfaces

interface FastEthernet0/1
description inside_network
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface ATM0/1/0
no ip address
atm restart timer 300
no atm ilmi-keepalive
dsl operating-mode auto
hold-queue 224 in
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
interface Dialer0
ip address 2.2.2.2 255.255.255.248
ip mtu 1452
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap chap callin
ppp chap hostname username@domain.com
ppp chap password 0 ADSLPWD
ppp pap sent-username username@domain.com password 0 ADSLPWD
crypto map CMAP_1
!

As a bonus I will leave in the Dialer and ATM interfaces. These few lines will setup your Cisco IOS router for ADSL connectivity.

Different from the ASA. We have applied the crypto map to the interface here, instead of on the crypto map and crypto policy like with the ASA VPN config, using: crypto map CMAP_1

Other important parts to note are the external IP address (Dialer0) of 2.2.2.2 and the internal IP network you wish to give VPN access to, in this case (FastEthernet 0/1) 192.168.10.0/24.

Create our VPN specific access lists

access-list 100 permit ip 192.168.10.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 110 deny   ip 192.168.10.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 110 permit ip 192.168.10.0 0.0.0.255 any
dialer-list 1 protocol ip permit

As explained in the Cisco ASA VPN article these access lists are designed to ensure traffic destined for the remote host network travels the VPN first, before trying to go out over the regular internet.

The dialer-list line will permit ip traffic on the Dialer (ADSL WAN) interface.

Route Map

route-map nonat permit 10
match ip address 110

The route-map is named “nonat” and states. Match (by applying or denying) traffics in access-list 110. The nonat route-map will prevent our VPN traffic from being NAT’d.

NAT Translations

ip nat inside source route-map nonat interface Dialer0 overload

Different from the ASA. Just a single NAT overload (one external IP to many internal IP’s) command is required, and by embedding the nonat route-map we prevent the VPN traffic from being NAT’d.

Crypto ISAKMP (IKE) Policy

crypto isakmp policy 2
authentication pre-share
crypto isakmp key YOURSHAREDKEY address 1.1.1.1

Different from the ASA. Much easier here… no need to apply the map to the interface as with the ASA. Just create the policy, key, peer.

1 – Specify policy and give it a unique number
2 – Authentication type will be the same at both ends of the tunnel. Pre-share’d key in this case.
3 – Set YOURSHAREDKEY to be the same at either end, and specify the peer address of the remote external IP.

Crypto Map

crypto map CMAP_1 1 ipsec-isakmp
description Tunnel to 1.1.1.1
set peer 1.1.1.1
set transform-set IOS-IPSEC
match address 100

Different from the ASA. We map the crypto map to an access-list using match. Also we map the crypto map CMAP_1 on the interface as mentioned earlier, whereas in ASA world the crypto map interface is applied on the crypto map.

1 – Define the crypto map named CMAP_1 unique number 1 which is ipsec-isakmp type.
2 – Set a description if you wish.
3 – The remote host external IP address… or the peer.
4 – The name of the transform-set which we will be using.
5 – Match (allow/deny) traffic using access list 100.

Crypto Transform Set

crypto ipsec transform-set IOS-IPSEC esp-3des esp-sha-hmac

The crypto map states which encryption types to use for VPN tunnel creation. These must match at both VPN endpoints!

Conclusion

You now have a Cisco ASA to Cisco IOS VPN tunnel created using IPSec and should be able to ping between networks.

Post in the comments if you have any questions.

The VPN Config

interface FastEthernet0/1
description inside_network
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface ATM0/1/0
no ip address
atm restart timer 300
no atm ilmi-keepalive
dsl operating-mode auto
hold-queue 224 in
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
interface Dialer0
ip address 2.2.2.2 255.255.255.248
ip mtu 1452
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication pap chap callin
ppp chap hostname username@domain.com
ppp chap password 0 ADSLPWD
ppp pap sent-username username@domain.com password 0 ADSLPWD
crypto map CMAP_1
!
access-list 100 permit ip 192.168.10.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 110 deny ip 192.168.10.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 110 permit ip 192.168.10.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!
route-map nonat permit 10
match ip address 110
!
!
ip nat inside source route-map nonat interface Dialer0 overload
!
crypto isakmp policy 2
authentication pre-share
!
crypto isakmp key YOURSHAREDKEY address 1.1.1.1
!
crypto map CMAP_1 1 ipsec-isakmp
description Tunnel to 1.1.1.1
set peer 1.1.1.1
set transform-set IOS-IPSEC
match address 100
!
crypto ipsec transform-set IOS-IPSEC esp-3des esp-sha-hmac
!

Cisco IOS IPSec VPN tutorial available here.

Part 1 – The Cisco ASA VPN

In this 2 part series I will show you how to create an IPSec VPN between a Cisco IOS Router and Cisco ASA firewall. In this scenario we’ll be using a Cisco 1841 router and a Cisco ASA 5510.

Cisco ASA 5510 <—-> (IPSec VPN over Cloud) <—-> Cisco 1841 Router

Cisco ASA Config

Setup interfaces

hostname ASA07
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/1
no nameif
no security-level
no ip address
!
interface Ethernet0/1.5
vlan 5
nameif inside_CORE
security-level 100
ip address 10.5.0.254 255.255.0.0
!
interface Ethernet0/1.10
vlan 10
nameif inside_VTG
security-level 100
ip address 10.10.0.254 255.255.0.0
!

As a bonus I have left the interfaces as VLAN interfaces on Ethernet 0/1 which subsequently trunked to a switch. You could use a regular interface if you wish.

The important parts to note are the external IP address (Ethernet 0/0) of 1.1.1.1/24 and the internal IP network you wish to give VPN access to, in this case (Ethernet 0/1.10) 10.10.0.0/16.

Create our VPN specific access lists

access-list inside_nat0_outbound extended permit ip 10.10.0.0 255.255.0.0 192.168.10.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.10.0.0 255.255.0.0 192.168.10.0 255.255.255.0

The first access-list will be applied to outbound NAT traffic, to ensure traffic travels over the VPN instead of going out via the global NAT.

The second will be applied to the crypto map to permit traffic across the VPN tunnel.

Although both access-lists are the same it is best practice to create them separately, to give you greater flexibility in future.

NAT Translations

nat (inside_VTG) 0 access-list inside_nat0_outbound
nat (inside_VTG) 1 0.0.0.0 0.0.0.0 dns

Apply the VPN NAT access-list, send all over traffic to the global NAT route.

Crypto ISAKMP (IKE) Policy

crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400

Internet Key Exchange (IKE)—A hybrid protocol that uses part Oakley and part of another protocol suite called SKEME inside the Internet Security Association and Key Management Protocol (ISAKMP) framework. IKE is used to establish a shared security policy and authenticated keys for services, such as IPsec, that require keys. Before any IPsec traffic can be passed, each router/firewall/host must be able to verify the identity of its peer.

1 – Enable the policy on the outside (nameif outside) interface.
2 – Create the policy with a priority of 10. Priority 1 being the highest, 65535 the lowest.
3 – We would like our VPN to authenticate with a pre-share key.  Other options are rsa-sig (using RSA signatures) and crack (using RADIUS authentication).
4 – 3DES (168bit encryption) is the default and is adequate for most uses. Options of DES (56bit, less secure but faster) and AES 128, 192 and 256bit (can offer more security).
5 – Specify hash algorithm to ensure data integrity by checking the hash to see if the packet has been modified in data transit. The default is sha with option of md5. md5 is slightly faster but arguably is less secure.
6 – Set the diffie-hellman group to secure the preshared key with. The lower the CPU group the less CPU time is required. The higher the group the greater security. Default is 2.
7 – The default is 24 hours, or 86400 seconds. A lower number is more secure (to a point in time).

Phase 1 creates the first tunnel, which protects later ISAKMP negotiation messages. Phase 2 creates the tunnel that protects data.

Crypto Transform Set

crypto ipsec transform-set ESP-DES-SHA esp-3des esp-sha-hmac

The transform set NAMES and defines the method of encryption for IPSec traffic.

Crypto Map

crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 2.2.2.2
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside

Crypto map—This is a Cisco IOS software configuration entity that performs two primary functions. First, it selects data flows that need security processing. Second, it defines the policy for these flows and the crypto peer that traffic needs to go to.

1 – Create the crypto map named outside_map and match traffic from the earlier ACL of outside_1_cryptomap.
2 – Set the VPN peer (the device at the remote end).
3 – Specify the transform set we created earlier.
4 – Apply the crypto map to the outside interface.

Tunnel Group

tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key YOURSHAREDKEY

The tunnel group specifys the type of tunnel to create with attributes.

1 – The tunnel will be an ipsec-l2l (LAN 2 LAN) VPN. Another type option is remote-access for Cisco VPN Client or other endpoints.
2 – Lets configure additional attributes.
3 – The pre shared key for this tunnel will be YOURSHAREDKEY.

Debugging

Some useful commands for troubleshooting are.

show crypto isakmp sa (check if the VPN tunnel is up)
show crypto ipsec sa (IPSec endpoints local and remote and view packets stats)
debug crypto isakmp (show initial key negotiation)
debug crypto ipsec (show IPSec VPN tunnel output)
undebug all (disable debugging)

Be careful with debugging, especially ISAKMP. The router can be overwhelmed with debug information and freeze.

Conclusion

That’s it! We have created a VPN endpoint on the Cisco ASA device. A key part to Cisco VPN’s is IKE and IPSec. Study these in more depth over at Cisco.com

In Part 2 we will look at the Cisco 1841 (IOS based) VPN.

Update: 16/10/10 – Cisco IOS IPSec VPN tutorial now available!

I would be glad to answer any questions.

The VPN config

This is a trimmed down config… before you apply this config you should already have a working router on the internet with internet access to clients.

!
hostname ASA07
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/1
no nameif
no security-level
no ip address
!
interface Ethernet0/1.5
vlan 5
nameif inside_CORE
security-level 100
ip address 10.5.0.254 255.255.0.0
!
interface Ethernet0/1.10
vlan 10
nameif inside_VTG
security-level 100
ip address 10.10.0.254 255.255.0.0
!

access-list inside_nat0_outbound extended permit ip 10.10.0.0 255.255.0.0 192.168.10.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 10.10.0.0 255.255.0.0 192.168.10.0 255.255.255.0

nat (inside_VTG) 0 access-list inside_nat0_outbound
nat (inside_VTG) 1 0.0.0.0 0.0.0.0 dns

crypto ipsec transform-set 3ESP-DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 2.2.2.2
crypto map outside_map 1 set transform-set 3ESP-DES-SHA
crypto map outside_map interface outside

crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 1
lifetime 86400
!
tunnel-group 2.2.2.2 type ipsec-l2l
tunnel-group 2.2.2.2 ipsec-attributes
pre-shared-key YOURSHAREDKEY
!

For a more in-depth look at  how to install and configure VMware View 4.5 see Paul Slager’s Blog on Installing & Configuring VMware View 4.5

View Connection Server

• 2 CPU/vCPU recommended
• Windows 2008 R2 ST/EN – 4GB min – At least 10GB for 50+ Desktops
• Windows 2003 R2 ST/EN SP2 32bit – 2GB min – At least 3GB for 50+ Desktops
• Install Replicated View Connection Server locally before relocating out to WAN

View Administrator Portal

• IE 7 & 8, FF 3 & 3.5
• Adobe Flash 10

View Composer

• Install to vCenter VM/machine
• DO NOT override vCenter DB
• SQL 2005 Express, SQL 2005 SP3 ST/EN, SQL 2008 SP1 ST/EN, Oracle 10g/11g

View Transfer Server

• Domain not required
• 2 vCPU’s
• Windows 2008 R2 ST/EN
• Windows 2003 R2 ST/EN SP2 32bit
• 60 disks maximum
• Configure security for local mode desktops (View Admin > View Configuration > edit View Config instance)
• DRS automation level is set to manual
• Use LSI Logic Parallel SCSI controller. You cannot use a SAS or VMware paravirtual controller.

View Agent

• Windows 7 – EN/PRO
• Windows Vista / XP – BUS/EN/PRO (32bit only)
• Windows 2008/2008 R2 TS – ST
• Windows 2003/2003 R2 TS – ST (32bit only)

View Client

• Windows 7 – HO/EN/PRO/ULT (note: no MMR using PCoIP)
• Windows XP – HO/PRO (32 bit only)
• Windows Vista – HO/BUS/EN/ULT (32 bit only)

View Client Local Mode

• Windows XP local desktop, 1.3GHz or faster; 1.6 GHz recommended
• Windows 7 desktop, 1.6GHz or faster; for Aero effects, 2.2GHz or faster
• Pentium 4, Pentium M (with PAE), Core, Core 2, Core i3, Core i5, and Core i7 processors (For Windows 7 Aero: Intel Dual Core)
• Athlon, Athlon MP, Athlon XP, Athlon 64, Athlon X2, Duron, Opteron, Turion X2, Turion 64, Sempron, Phenom, and Phenom II (For Windows 7 Aero: Althon 4200+ and above)
• 64bit OS - Intel Pentium 4 and Core 2, and Core i7 processors with EM64T and Intel Virtualization Technology / Most AMD64 processors (except the earliest revision C Opteron processors)
• Windows 7 Aero - nVidia GeForce 8800GT and above ATI Radeon HD 2600 and above

Configuration Issues – Host esx01.vtg.lan currently has no management network redundancy.

Your management network may already be redundant at the HW level, as mine is. The fix is to apply the following to advanced options on the HA enabled cluster.

das.ignoreRedundantNetWarning – True

Re-enable HA on the cluster and the warnings should disappear.