Presented at Cisco Live 2014 in San Francisco - TECRST-3614 session follow up

For those that attended the Cisco Live TECRST-3614 - Practical Knowledge for Enterprise IPv6 Deployments session yesterday (May 18, 2014), thank you for participating. I was unfortunately unable to present some of my IPv6 Windows host specific content. I wanted to provide some PowerShell examples along with some info from my demo because I had to skip all of that content.
So, to add a bit more value here are some of my demo scripts I planned to walk through as part of the session. The demos were based on my book chapters and the code from those so this is a quick way to get much of that information (it isn't a match one for one but it should still be useful).

Demo 1:
# - Chapter 5 - IPv6 and PowerShell
# - IPv6 only PowerShell cmdlets
Get-NetIPv6Protocol
Set-NetIPv6Protocol
#
# - Randomize IPv6 Addresses for Privacy
# turn off privacy addressing (make it do EUI-64)
Set-NetIPv6Protocol -RandomizeIdentifiers Disabled
# turn back on privacy addressing
Set-NetIPv6Protocol -RandomizeIdentifiers Enabled
#
# - Temporary IPv6 Address Behavior
# - turn off temporary addressing
Set-NetIPv6Protocol -UseTemporaryAddresses Disabled
# - turn back on temporary addressing
Set-NetIPv6Protocol -UseTemporaryAddresses Enabled
#
# - Physical and Logical Interfaces
Get-NetAdapter
Set-NetAdapter
Disable-NetAdapter
Enable-NetAdapter
Rename-NetAdapter 
Restart-NetAdapter
# - examples of the above cmdlets
# - Disable an example Wi-Fi adapter
Disable-NetAdapter -InterfaceDescription 'Intel(R) Centrino(R) Advanced-N 6205' -Confirm:$false
# - Enable the example Wi-Fi adapter
Enable-NetAdapter -InterfaceDescription 'Intel(R) Centrino(R) Advanced-N 6205' -Confirm:$false
# - Rename the adapter
Rename-NetAdapter  -Name <current name> -NewName <new name>
# - Disable then Enable the adapter
Restart-NetAdapter
#
# - Interface Management
Get-NetIPAddress
New-NetIPAddress
Set-NetIPAddress
Remove-NetIPAddress
Get-NetIPConfiguration
# - examples of the above cmdlets
# - see if any existing IP addresses are assigned to interface 20 (Wi-Fi)
Get-NetIPAddress –InterfaceIndex 20
# - Set the IP address on the interface for the first time using PowerShell
New-NetIPAddress -InterfaceIndex 12 -IPAddress 2001:0db8:cafe:0010::1 -PrefixLength 64 -DefaultGateway 2001:0db8:cafe:0010::254
# - If you are modifying an existing server IP stack you will need to use PowerShell
Set-NetIPAddress -InterfaceIndex 12 -IPAddress 2001:0db8:cafe:0010::2 -PrefixLength 64
# - Remove the IP address on the interface
Remove-NetIPAddress -InterfaceIndex 12 -Confirm:$false
#
# - Routing Management
Get-NetRoute
New-NetRoute
Remove-NetRoute
# - examples of the above cmdlets
# - see the existing IPv6 routing table
Get-NetRoute -AddressFamily IPv6
# - add an example IPv6 route to the routing table
New-NetRoute -DestinationPrefix 2600::/12 -InterfaceIndex 20 -NextHop fe80::5ef:b5a3:2ab1:54ce -Publish Yes -RouteMetric 256
# - remove an example IPv6 route to the routing table
Remove-NetRoute -DestinationPrefix 2600::/12 -Confirm:$false
#
# - DNS Client Management
Get-DnsClientServerAddress
Set-DnsClientServerAddress
# - see the existing DNS resolver IPv6 addresses on a Windows host
Get-DnsClientServerAddress -AddressFamily IPv6
# - set the IPv6 DNS resolvers to 2001:4860:4860::8888 and 2001:4860:4860::8844
Set-DnsClientServerAddress -InterfaceIndex 20 -ServerAddresses("2001:4860:4860::8888","2001:4860:4860::8844")
# - restore the DNS settings to what DHCP provided
Set-DnsClientServerAddress -InterfaceIndex 20 -ResetServerAddresses
#
# - 6to4 transition technology
Get-Net6to4Configuration
Set-Net6to4Configuration
Reset-Net6to4Configuration
# - first check the 6to4 status with PowerShell
Get-Net6to4Configuration
# - show the status with netsh
netsh interface ipv6 6to4 show state
# - turn off 6to4
Set-Net6to4Configuration -State Disabled 
# - same task with netsh
netsh interface ipv6 6to4 set state disable 
#
# - ISATAP transition technology
Get-NetIsatapConfiguration
Set-NetIsatapConfiguration
Reset-NetIsatapConfiguration
# - first check the ISATAP status
Get-NetIsatapConfiguration
# - show the status
netsh interface ipv6 isatap show state
# - turn off ISATAP
Set-NetIsatapConfiguration -State Disabled
Set-NetIsatapConfiguration -ResolutionState Disabled
# - same task with netsh
netsh interface isatap set state disable
netsh interface isatap set router state disable 
#
# - Teredo transition technology
Get-NetTeredoConfiguration
Get-NetTeredoState
Set-NetTeredoConfiguration
Reset-NetTeredoConfiguration
# - Teredo status
Get-NetTeredoConfiguration
Get-NetTeredoState
# - show the status with netsh
netsh interface teredo show state
# - turn off teredo 
Set-NetTeredoConfiguration -Type Disabled
# - same task with netsh
netsh interface teredo set state type=Disabled
#
# - EOF


Demo 2:
# - Chapter 3 - IPv6 Addressing
# - Enable ISATAP forwarding:
# - ISATAP Router PowerShell configuration example for Windows Server 2012 and 2012 R2
Set-NetIPInterface -InterfaceAlias <Name> -AddressFamily IPv6 -Forwarding Enabled -Advertising Enabled
# - ISATAP Router netsh configuration example for Windows Server 2008 and 2008 R2
netsh interface ipv6 set interface <ISATAP Interface Name or Index> forwarding=enabled advertise=enabled
#
# - Enable ISATAP routing and publish the route for the ISATAP prefix:
# - ISATAP PowerShell configuration example for Windows Server 2012 and 2012 R2
New-NetRoute -DestinationPrefix <Prefix> -InterfaceAlias <Name> -AddressFamily IPv6 -Publish Yes
# - ISATAP netsh configuration example for Windows Server 2008 and 2008 R2
netsh interface ipv6 add route <Address/Prefix> <ISATAP Interface Name or Index> publish=yes
#
# - Enable the ISATAP interface:
# - ISATAP PowerShell configuration example for Windows Server 2012 and 2012 R2
Set-NetIsatapConfiguration -Router <IPv4 address>
# - ISATAP netsh configuration example for Windows Server 2008 and 2008 R2
netsh interface isatap set router <IPv4 Address or name>
#
# - Teredo
# - Teredo status PowerShell example
Get-NetTeredoConfiguration 
# - Teredo status netsh example
netsh interface teredo show state 
#
# - Configure the Teredo Server in PowerShell
Set-NetTeredoConfiguration -Type server -ServerName <Name or IP Address>
# - Configure the Teredo Server in netsh
netsh interface teredo set state type=server servername=<Name or IP Address>
#
# - Configure the Teredo Relay with routing in PowerShell
Set-NetIPInterface -InterfaceAlias <Name> -AddressFamily IPv6 -Forwarding Enabled
# - Configure the Teredo Relay with routing in netsh
netsh interface ipv6 set interface <Interface Name or Index Number> forwarding=enabled
#
# - Turn on Shunt for Teredo
Set-NetTeredoConfiguration -ServerShunt $True
Reset-NetTeredoConfiguration -ServerShunt
# - Confirm Shunt is on for Teredo
Get-NetTeredoConfiguration
#
# - Configure Teredo Clients with PowerShell
Set-NetTeredoConfiguration -ServerName <name>
# - Configure Teredo Clients with netsh
netsh interface teredo set state servername=<IPv4 address>
#
# - Multicast
# - Display the multicast addresses on a host's interface
netsh interface ipv6 show joins <interface id>
# - Display the multicast neighbors on a host's interface
Get-NetNeighbor -AddressFamily IPv6 -InterfaceIndex <interface id> | ft
# - Remove the multicast neighbor entries on a host
Remove-NetNeighbor -AddressFamily IPv6 -Confirm:$false
#
# - Random IDs
# - turn off random addressing (make it do EUI-64) with PowerShell
Set-NetIPv6Protocol -RandomizeIdentifiers Disabled
# - turn back on random addressing with PowerShell
Set-NetIPv6Protocol -RandomizeIdentifiers Enabled    
#- shutting off random extension (force EUI-64) with netsh
netsh interface ipv6 set global randomizeidentifiers=disabled store=active
netsh interface ipv6 set global randomizeidentifiers=disabled store=persistent
#
# - Temporary IPv6 Address
# - turn off temporary addressing with PowerShell
Set-NetIPv6Protocol -UseTemporaryAddresses Disabled
# - turn back on temporary addressing with PowerShell
Set-NetIPv6Protocol -UseTemporaryAddresses Enabled
# - shutting off temporary addresses
netsh interface ipv6 set privacy state=disabled store=active
netsh interface ipv6 set privacy state=disabled store=persistent

# - Manually setting IPv6 Addresses
# Set the IP address on the interface for the first time using PowerShell
New-NetIPAddress -InterfaceIndex 12 -IPAddress 2001:0db8:cafe:0010::1 -PrefixLength 64 -DefaultGateway 2001:0db8:cafe:0010::254
# If you are modifying an existing server IP stack you will need to use PowerShell
Set-NetIPAddress -InterfaceIndex 12 -IPAddress 2001:0db8:cafe:0010::2 -PrefixLength 64
# - EOF

Demo 3:
# - Chapter 8 - IPv6 and DNS
# - Installing DNS
Add-WindowsFeature DNS
Get-WindowsFeature DNS
# - to modify the DNS listener IP address
Get-DnsServer | Export-Clixml -Path "c:\DnsServerConfig1.xml"
# - import the DNS listener file back in (it replaces the file)
$x = Import-Clixml "c:\DnsServerConfig1.xml"
Set-DnsServer -InputObject $x
#
# - IPv6 DNS resource entries
Add-DnsServerPrimaryZone
Add-DnsServerResourceRecordAAAA
Remove-DnsServerResourceRecord
# - build out the example.com zone
Add-DnsServerPrimaryZone -Name "example.com" -ZoneFile "example.com.dns"
# - build out an AAAA record
Add-DnsServerResourceRecordAAAA -Name "ipv6host" -ZoneName "example.com" -CreatePtr -AllowUpdateAny -IPv6Address "2001:db8:a::1" -TimeToLive 08:00:00
# - as an alternative do
Add-DnsServerResourceRecord -AAAA -Name "ipv6host" -ZoneName "example.com" -CreatePtr -AllowUpdateAny -IPv6Address "2001:db8:a::1" -TimeToLive 08:00:00
# - remove the record
Remove-DnsServerResourceRecord -name "ipv6host" -ZoneName "example.com" -RRType AAAA -Force
#
# - Get DNS query block list
Get-DnsServerGlobalQueryBlockList
# - Root Hint information
Get-DnsServerRootHint
Import-DnsServerRootHint
Add-DnsServerRootHint
Remove-DnsServerRootHint
# - example PowerShell cmdlet to see unique root level servers
Get-DnsServerRootHint | sort-object -property{$_.NameServer.RecordData.NameServer} -Unique
# - removing a.root-servers.net
Remove-DnsServerRootHint -NameServer "a.root-servers.net"
# - adding a new a.root-server.net entry
Add-DnsServerRootHint -NameServer "a.root-servers.net" -IPAddress 2001:503:ba3e::2:30
# - check for the change
Get-DnsServerRootHint | Where-Object {$_.NameServer.RecordData.NameServer -EQ "a.root-servers.net."} | Sort-Object -Unique
#
Get-DnsServerSetting
Test-DnsServer
# - example of testing DNS
Test-DnsServer -IPAddress ::1 -ZoneName "example.com"
# - check for the DNS Server module
Get-Command -Module DNSServer
#
# - DNS client settings
Get-DnsClientServerAddress
# - For IPv6 only
Get-DnsClientServerAddress -AddressFamily IPv6
# - set new DNS resolver server IPs
Set-DnsClientServerAddress -InterfaceIndex 4 -ServerAddresses("2001:4860:4860::8888","2001:4860:4860::8844")
# - check the DNS resolver settings
Get-DnsClientServerAddress -InterfaceIndex 4 -AddressFamily IPv6
# - test against the default DNS resolvers
Resolve-DnsName -Name www.cav6tf.org -Type AAAA
# - test against a specific DNS resolver
Resolve-DnsName -Name www.cav6tf.org -Type AAAA -Server 2001:4860:4860::8888
# - script to determine which interface a name resolver will use to connect to a resource
$rn = Resolve-DnsName -name www.cav6tf.org -type AAAA
Find-NetRoute -RemoteIPAddress $rn.ip6address
# - EOF

Demo 4:
# - Chapter 10 - Miscellaneous IPv6
# - NCSI
# - example that modifies the ncsi url location
Set-NCSIPolicyConfiguration -CorporateWebsiteProbeURL http://ipv6.ncsi.example.com -policystore Howfunky
# - get the ncsi policy
Get-NCSIPolicyConfiguration
# - reset back to default the ncsi policy on host "Howfunky"
Reset-NCSIPolicyConfiguration -PolicyStore Howfunky
#
# - prefix policy table
# - get the prefix policy table
Get-NetPrefixPolicy
# - netsh commands to manage the prefix policy table
netsh interface ipv6 show prefixpolicies
netsh interface ipv6 add prefixpolicy <prefix> <precedence> <label>
netsh interface ipv6 set prefixpolicy <prefix> <precedence> <label>
netsh interface ipv6 remove prefixpolicy <prefix> <precedence> <label>
# - sample script to get an RFC 3484 host to RFC 6724
netsh int ipv6 add prefixpolicy 3ffe::/16 1 12 store=persistent
netsh int ipv6 add prefixpolicy fec0::/10 1 11 store=persistent
netsh int ipv6 add prefixpolicy fc00::/8 4 13 store=persistent
netsh int ipv6 add prefixpolicy fd00::/8 3 14 store=persistent
netsh int ipv6 add prefixpolicy ::/96 1 3 store=persistent
netsh int ipv6 add prefixpolicy ::ffff:0:0/96 35 4 store=persistent
# - EOF

Demo 5:
#---
# multicast
# - mld vserion 2
Set-NetIPv6Protocol MldVersion=3
#
# netsh command
netsh interface ipv6 set global mldversion=version2
#
# - set igmp v2
Set-NetIPv6Protocol MldVersion=2
#
#
resolve-dnsname -name www.cav6tf.org -LlmnrOnly
#
#---
# multicast
netsh interface ipv6 show joins
Get-NetIPAddress -AddressFamily ipv6 -InterfaceIndex 4 | ft
netsh interface ipv6 show joins interface=4
#
#
# - script to determine which interface a name resolver will use to connect to a resource
$rn = Resolve-DnsName -name www.cav6tf.org -type AAAA
Find-NetRoute -RemoteIPAddress $rn.ip6address
# - EOF

Please let me know if you have any questions. I would like to know if folks are finding the examples useful.
- Ed

Some early lessons in PowerShell

I've been working on some practical uses of PowerShell for some testing in our lab (and as an excuse to start learning PowerShell too.) Specifically, we are testing the connection limitations of some firewalls (Cisco ASA's running in multi-context mode) and needed to use a cost effective tool (free) to make this all happen. I decided I can make all this work with iperf and use PowerShell to manage it all. So the challenge was to start an iperf session that increments the TCP port number for each instance which would also us to specifically measure the connection counts and get discrete sessions through the firewall.

I started off thinking I could use the Start-Job cmdlet to manage everything and built out the following working PowerShell:

#---

# - use a for loop to open 100 iperf server listeners

#

$i=1

for (; $i -le 100; $i++)

{ Start-Job -ScriptBlock { C:\users\ehorley\Downloads\java\jperf-2.0.0\bin\iperf.exe -s -p (5000 + $i) }

}

#

This sort of worked however there were some pretty big flaws that became obvious when executing it. First, was the fact that the PowerShell didn't do what I wanted, it didn't increment the iperf port number at all. I had no clue why until I started reading about global variable and scopes. It turns out that my variable wasn't passing into the ScriptBlock at all. So, after a bit of digging I figured out how to fix that and came up with:

# - just name the file iperf-servers.ps1 and you can execute it from PS by:

# - .\iperf-servers.ps1

# - starts $portcount # of iperf server sessions as background jobs

# - set the

$portcount = 1

$portcountmax = 100

for (; $portcount -le $portcountmax; $portcount++)

    { Start-Job -ScriptBlock {

    param(

        $portcount

    )

    cd "C:\users\ehorley\Downloads\java\jperf-2.0.0\bin"

    ./iperf.exe -s -p (5000 + $portcount)

    } -ArgumentList $portcount

}

This script actually worked! It incremented the TCP port number of the iperf session and I was able to verify that with a simple netstat -an -p TCP and I was able to remove all the jobs started by the script in a rather brute force as with:

Get-Job | Remove-Job -force

There were some big issues with this method though. Because I was using the start-job cmdlet PowerShell was starting a new PowerShell instance for each job that it runs. In addition, it is starting a cmd.exe process and an iperf.exe process which resulted in a lot of memory being consumed for a very small number of TCP ports being opened. In our testing on a Windows 7 client VM with 4GB of memory we could not push much past 150 to 200 jobs, really not very useful when you want to test 20,000 concurrent connections through a firewall.

So it was back to the drawing board to figure out a better way to do this. I decided that the jobs cmdlets was not the way to go and I had to figure out a more reasonable way that did not start multiple PowerShell sessions but instead just ran from the single PowerShell session but ran all the cmd.exe and iperf.exe processes.

After awhile I figured out that I could use the Start-Process cmdlet instead and came up with:

# - just name the file iperf-servers-2.ps1 and you can execute it from PS by:

# - .\iperf-servers-2.ps1

# - starts $portcount # of iperf server sessions as background jobs

# - set the $portcountmax variable to the high end of sessions

# - correct the path to iperf executable before running

# - modify the @iperfargs to match client or server role

# - to see all the jobs run:

# - get-process iperf

# - to kill all the sessions:

# - get-process iperf | stop-process

#

$portcount = 1

$portcountmax = 1000

for (; $portcount -le $portcountmax; $portcount++)

    {

    $iperfargs = "-s -p " + (5000 + $portcount)

    # $iperfargs = "-c <host ip> -t -p " + (5000 + $portcount) - or something like that for the client

    Start-Process -windowstyle Hidden -WorkingDirectory "C:\users\ehorley\Downloads\java\jperf-2.0.0\bin\" .\iperf.exe $iperfargs

    }

This script worked as expected and I was able to execute 1,000 sessions and confirm the TCP ports on my laptop without any issue. As is indicated in the script you could confirm the processes are running with:

Get-Process iperf

 

and you could kill all the sessions with:

Get-Process iperf | Stop-Process

Clearly there is a lot of work that could be done to automate the process to do this even more efficiently and perhaps I will do that but the scripts were functional enough for our engineers to use to do the testing. The Windows 7 VM's with 4GB of RAM were able to run over 1,750 TCP ports each which allowed for us to build out a reasonable test farm in our lab of virtual machines and test the firewalls.

Yes, I know I could likely do this easier with a simple javac or even just use linux and some perl or python but remember I was using the opportunity to learn PowerShell! I was grateful for having the incredibly useful book from Don Jones and Jeff Hicks - Learn Windows PowerShell 3 in a Month of Lunches, Second Edition by Manning. If you are at all interested in learning PowerShell I highly recommend it.
- Ed