• Configuring LACP on TP-Link SX3008F for RHEL 9/10

    Configuring LACP on TP-Link SX3008F for RHEL 9/10

    Goal here was to create 3 LACP Port-Channels on a tp-link SX3008F 10gbe switch connecting to RHEL 9/10 hosts also configured to use LACP.

    Specific Requirements

    • Jumbo Frames (mtu 9216)
    • LACP (802.3ad)
    • RHEL side = “xmit_hash_policy=layer3+4”
    • Switch side = src-dst-ip

    End result should be 20Gbe connectivity between hosts for fast NFS backups of Virtual Machines (SSD and HDD NFS) shares). Additional tuning was performed on the NFS host for optimum throughput


    Switch Side Config

    The tplink is Cisco like, but not exactly so commands were a bit of a challenge to nail down specific syntax.

    Jumbo Frames

    On this switch either jumbo frames in on or off for the switch, there is no per port config

    jumbo-size 9216

    Switch Port Config

    1st interface. Both ports added to channel-group 1 which we will define in a later step

    interface ten-gigabitEthernet 1/0/6
    description "columbia bond0 member"
    switchport general allowed vlan 10 untagged
    switchport pvid 10
    no switchport general allowed vlan 1
    channel-group 1 mode active
    exit

    2nd interface

    interface ten-gigabitEthernet 1/0/7
    description "columbia bond0 member"
    switchport general allowed vlan 10 untagged
    switchport pvid 10
    no switchport general allowed vlan 1
    channel-group 1 mode active
    exit

    Define Port-Channel (channel-group)

    interface port-channel 1
    description "columbia bond0"
    switchport general allowed vlan 10 untagged
    switchport pvid 10
    no switchport general allowed vlan 1
    exit

    Load Balance Mode

    The port-channel load-balance src-dst-ip command configures a network switch to distribute traffic across aggregated links (EtherChannel) based on a mathematical hash of both the source and destination IP addresses.

    This method ensures that traffic between the same two IP addresses consistently uses the same link while providing more even distribution compared to relying on MAC addresses alone.

    We will match this config on the server side via “xmit_hash_policy=layer3+4”

    port-channel load-balance src-dst-ip

    Don’t forget to save your work

    
    write memory

    Health Check

    # show etherchannel summary

    Here we can see both ports 6 and 7 are in PO1

    A command line interface output displaying network port flags, statuses, groups, port-channel details, and protocol information.

    # show lacp neighbor

    Command line output displaying LACP neighbor status, including flags, port details, and device information.

    # show vlan id 10

    Here we can see both ports 6 and 7 are in the correct vlan

    Command line output displaying VLAN configuration with ID 10, showing its name, status as active, and associated ports.

    # show interface status ten-gigabitEthernet 1/0/6

    Here we can see that we have 10G link and both ports have correct description

    Command line output displaying the status of two ten-gigabit Ethernet interfaces, including port number, status, speed, duplex, flow control, active medium, and description.

    # show lacp internal

    Terminal output showing LACP (Link Aggregation Control Protocol) internal status, including device flags, channel group information, and details for two ports with their respective states and settings.

    Configuring the RHEL Side

    Here we need to have the following

    • 2 interfaces in a bond
    • 1 bond
    • 1 bridge
      • IP is on bridge
      • bond is connected to bridge

    The Logical Order of Operations

    1. The Bridge (bridge0): The “Top Level” virtual switch that holds the IP address.
    2. The Bond (bond0): The logical aggregation of physical NICS. It is a “Port” of the bridge.
    3. The Bond Ports (enp...): The physical wires. These are “Ports” of the bond.

    Step 1: Create the Bridge (The Anchor)

    You create the bridge first because the bond needs a “controller (aka bond)” to point to.

    nmcli connection add type bridge con-name bridge0 ifname bridge0 \
    ipv4.method manual ipv4.addresses 10.1.10.21/24 ipv4.gateway 10.1.10.1 \
    ipv4.dns 10.1.10.74 ipv6.method disabled \
    802-3-ethernet.mtu 9216

    Step 2: Create the Bond (The Controller)

    Note that the controller is the bridge we just made. We specify LACP (802.3ad) and the hashing policy here.

    nmcli connection add type bond con-name bond0 ifname bond0 \
    connection.controller bridge0 connection.port-type bridge \
    bond.options "mode=802.3ad,xmit_hash_policy=layer3+4" \
    802-3-ethernet.mtu 9216

    Step 3: Attach the Physical Interfaces (The Slaves)

    Now we tell the physical hardware to report to the bond. Crucial: The MTU must be set at this level so the hardware buffers are sized correctly for jumbo frames.

    # First Port
    nmcli connection add type ethernet con-name bond0-port1 ifname enp130s0f0 \
    connection.controller bond0 connection.port-type bond \
    802-3-ethernet.mtu 9216
    # Second Port
    nmcli connection add type ethernet con-name bond0-port2 ifname enp130s0f1 \
    connection.controller bond0 connection.port-type bond \
    802-3-ethernet.mtu 9216

    Step 4: Verification Checklist

    Once created, we bring the stack up from the top. NetworkManager will automatically trigger the underlying ports.

    1. Bring it up: nmcli connection up bridge0
    2. Verify MTU Consistency: Every device in the chain must match.
      • ip link show | grep 9216
    3. Verify LACP Sync: The switch must see the server.
      • cat /proc/net/bonding/bond0 (Look for “Partner Mac Address”)
    4. Verify Bridge Membership:
      • bridge link show (The bond should be listed as a member of the bridge).

    Why this order matters

    • If you define the physical ports first without a controller, they might try to get a DHCP address on their own.
    • By setting MTU 9216 at every single stage of the nmcli command, you prevent the kernel from defaulting any segment to 1500, which causes the exact “packet loss” issue you experienced during the jumbo ping tests.

  • Moving Beyond OMSA: A Guide to Dell iSM Installation on RHEL 10 and PowerEdge R730

    Moving Beyond OMSA: A Guide to Dell iSM Installation on RHEL 10 and PowerEdge R730

    The shift from srvadmin (OMSA) to iSM (iDRAC Service Module) marks the end of bloated, “in-band” server management. This occurred between Dell 12th gen and Dell 13th gen server.

    If you have a 12th Gen Dell Server, you can still leverage Dell srvadmin (Idrac 7). I wrote a post on it here.

    While OMSA ran as a heavy suite of services directly on the host, the modern dcism acts as a lightweight bridge that offloads the heavy lifting to the dedicated iDRAC hardware.

    For RHEL 10 users, this transition is no longer optional but necessary, trading the aging omreport ecosystem for a more secure, stable, and kernel-friendly management experience.

    So in this post we are going to go through the install of DISM (Dell IDRAC Service Module), on RHEL 10, running on a Dell R730.


    Set Up the Dell Repository

    First we need to setup the official Dell System Update (DSU) utility. Install Dell GPG keys when prompted.

    curl -O https://linux.dell.com/repo/hardware/dsu/bootstrap.cgi
    bash bootstrap.cgi

    Install the ISM Package

    dnf install dcism

    Also install racadm

    sudo dnf install srvadmin-idracadm7

    Start and Enable the Service

    sudo systemctl enable --now dcismeng.service
    systemctl status dcismeng.service

    Example Commands

    This first command will make sure that DISM is healthy

    /opt/dell/srvadmin/iSM/bin/dcismcfg --getismstatus

    And ensure that racadm is functioning properly

    /opt/dell/srvadmin/sbin/racadm getsysinfo

    You can also reset the idrac from the OS

    /opt/dell/srvadmin/iSM/bin/Invoke-iDRACHardReset

    You can generate a full hardware diagnostic bundle directly from the (TSR).

    Note that the used Dell R730 that I just purchased on Ebay is actually under hardware support till October of 2026 – so if I need on-site hardware support a Dell technician will be dispatched to my house. I will provide snacks and a static strap.

    /opt/dell/srvadmin/iSM/bin/Invoke-SupportAssistCollection

    Note: The SupportAssist Collection feature is not supported on systems earlier than 14th generation. 🙁

    You can check your disks for SMART errors

    /opt/dell/srvadmin/iSM/bin/ismsmartlog --dev=/dev/sdb

    Local RAID & Storage Management

    Since omreport storage is gone, use racadm. With the iSM bridge active, Local RACADM is now your primary interface for your raid controller

    racadm storage get pdisks
    racadm storage get vdisks
    racadm storage get controllers

    The “Full Power Cycle” (The “Cold Boot” Tool) – Flea Power Drain

    On an R730, if you have a hardware component acting up (like a hung NIC), a standard OS reboot often isn’t enough because the motherboard stays powered.

    • What it does: It tells the iDRAC to perform a “virtual” AC power pull. The server will shut down, the flea power will be drained, and it will cold-boot. This is a powerful feature to have in a remote RHEL 10 environment.
     /opt/dell/srvadmin/iSM/bin/Invoke-FullPowerCycle

    Real-Time “Tech Support Report” (TSR)

    If you ever need to open a support ticket with Dell, they will ask for a TSR. Previously, you had to log into the iDRAC web UI and wait 10 minutes.

    • What it does: It triggers the iDRAC to gather every log, firmware version, and hardware event into a .zip file and saves it directly to the iDRAC (or can be pulled to the OS).
    /opt/dell/srvadmin/iSM/bin/Invoke-SupportAssistCollection

    Viewing Active Hardware Alerts

    The racadm utility (which uses the iSM bridge) is the best way to see why your server has an amber light or a “System Health” warning.

    • View the System Event Log (SEL): This is the “Hardware Event Viewer.” It shows power supply failures, memory errors, and thermal trips.
    /opt/dell/srvadmin/sbin/racadm getsel

    Installing perccli

    PERCCLI (PowerEdge RAID Controller Command Line Interface) is the specialized successor to the older MegaCLI tool. While RACADM is great for general server health, PERCCLI is the “surgical tool” specifically for your RAID controller (like the H730 in your R730).

    Install as shown below

    dnf -y install perccli.noarch

    Now you can show all controllers

     /opt/MegaRAID/perccli/perccli64 show

    Show events.

     /opt/MegaRAID/perccli/perccli64 /c0 show eventloginfo

    Show all disks

    /opt/MegaRAID/perccli/perccli64 /c0/eall/sall show

    Epilogue

    So in a nutshell. Dell srvadmin was replaced with DISM starting on Dell 13th gen servers. You have a couple powerful commands at your disposal with a ton of various ways to run both of them.

    Also available is perccli, which is also a nice tool on its own.

  • Dell OpenManage Server Administrator: Comprehensive Guide for Hardware Monitoring (RHEL)(Dell 12 Gen)

    Dell OpenManage Server Administrator: Comprehensive Guide for Hardware Monitoring (RHEL)(Dell 12 Gen)

    Dell OpenManage Server Administrator (OMSA) is Dell’s on-host hardware management and monitoring framework for PowerEdge servers. 

    It runs inside the operating system and provides direct visibility into system hardware such as RAID controllers, physical and virtual disks, power supplies, fans, temperatures, memory, processors, and chassis health. 

    OMSA communicates with the server’s iDRAC and hardware controllers to retrieve real-time status and exposes this information through command-line tools like omreport, optional web interfaces, and SNMP for monitoring systems.

     It is primarily used for hardware diagnostics, RAID and storage monitoring, fault detection, and health reporting, allowing administrators to verify system integrity and troubleshoot hardware issues without leaving the operating system.

    So now that we have an idea of what it is, lets install it.

    Note: Our system under test is a Dell R720. I probably should have lead with that.


    Installation

    First you will need to download the bootstrap script as shown below.

    curl -O https://linux.dell.com/repo/hardware/dsu/bootstrap.cgi

    Now we will make it executable.

    chmod +x bootstrap.cgi

    And then we run it.

    sudo ./bootstrap.cgi

    Now we have completed the following.

    • Added Dell’s official repo
    • Installed Dell signing keys
    • Configured OMSA package sources

    Now Install OpenManage (omreport)

    sudo dnf install srvadmin*

    This installs:

    • omreport
    • omconfig
    • Storage monitoring
    • RAID tools
    • CIM providers

    Starting and Enabling Services

    Apparently, service names can vary from OS to OS, so run the command below to verify the correct service names

    systemctl list-unit-files | grep -Ei 'dsm|omsa|srvadmin'
    dsm_om_connsvc.service enabled disabled
    dsm_om_shrsvc.service disabled disabled
    dsm_sa_datamgrd.service enabled disabled
    dsm_sa_eventmgrd.service enabled disabled
    dsm_sa_snmpd.service enabled disabled

    Now that we have the names of the services we can start and enable them as shown below

    # sudo systemctl enable --now dsm_om_connsvc dsm_sa_datamgrd dsm_sa_eventmgrd dsm_sa_snmpd dsm_om_shrsvc

    OpenManage Server Administrator (OMSA) Services
    Service NameFull NamePurposeRequired?Notes
    dsm_om_connsvcOMSA Connection ServiceProvides the web-based interface (HTTPS/1311) used to access OMSA remotely or locally✅ Yes (if using OMSA web UI)This is what allows access via https://<host&gt;:1311
    dsm_om_shrsvcOMSA Shared ServicesProvides shared libraries and backend support for other OMSA components⚠️ UsuallyRequired by other OMSA components; often left disabled unless needed
    dsm_sa_datamgrdSystems Management Data ManagerCollects and maintains hardware inventory and system data✅ YesRequired for hardware monitoring (disks, temps, fans, etc.)
    dsm_sa_eventmgrdSystems Management Event ManagerHandles hardware events, alerts, and logs✅ YesRequired for alerts and log reporting
    dsm_sa_snmpdOMSA SNMP AgentProvides SNMP interface for monitoring tools (LibreNMS, Zabbix, etc.)⚠️ OptionalNeeded only if using SNMP monitoring

    Service Review

    Now let’s review each service in detail, and see how we can leverage each one.


    dsm_om_connsvc

    First we need to ensure our Firewall allows this traffic. So run the commands below (RHEL), ubuntu may use ufw.

    # firewall-cmd --permanent --add-port=1311/tcp
    # firewall-cmd --reload

    Now in your web browser, navigate to https://viper.lab:1311/ (Note https, and change host name accordingly).

    Similar in appearance to the Idrac – you can find system information here, some of which does not appear in the Idrac itself. Everything is read-only.

    Screenshot of Dell OpenManage Server Administrator showing Fan Probes Information, including fan redundancy status and probe list with readings, thresholds, and status indicators.

    dsm_om_shrsvc

    (OMSA Shared Services) is a supporting service, not a management interface or monitoring agent.

    It provides:

    • Shared libraries
    • Inter-process communication
    • Authentication helpers
    • Common backend utilities

    These are required by other OMSA components to function correctly. So nothing really to see here.


    dsm_sa_datamgrd.service

    This is the service that collects all the data that is displayed in the WebUI (port 1311)


    dsm_sa_eventmgrd.service

    dsm_sa_snmpd.service is the OMSA component responsible for exposing Dell hardware monitoring data to external systems using the SNMP protocol

    This service does not collect or analyze hardware information itself; instead, it serves as the communication layer that allows remote systems to query or receive notifications about server health. When enabled, it allows OMSA to participate in centralized monitoring environments and enterprise alerting workflows, making it essential in environments where hardware status must be visible outside the server itself.

    This service relies entirely on the existing system SNMP configuration, so no need to modify anything if you already have snmp configured and running with your specfic community string.


    dsm_sa_snmpd.service

    dsm_sa_snmpd.service is the OMSA component responsible for exposing Dell hardware monitoring data to external systems using the SNMP protocol

    It acts as the interface between the data collected internally by OMSA and third-party monitoring platforms such as LibreNMS, Zabbix, or Nagios. 

    This service does not collect or analyze hardware information itself; instead, it serves as the communication layer that allows remote systems to query or receive notifications about server health. When enabled, it allows OMSA to participate in centralized monitoring environments and enterprise alerting workflows, making it essential in environments where hardware status must be visible outside the server itself.

    dsm_sa_snmpd.service acts as the Dell OMSA integration layer between the server’s hardware telemetry and the system’s SNMP stack, allowing Dell-specific health, storage, and sensor data to be exposed through standard SNMP queries. 

    It does not replace or conflict with existing monitoring agents such as Zabbix or LibreNMS (which I am using) Instead, it complements them by extending the SNMP data they can read

    dsm_sa_snmpd provides access to Dell-specific MIBs that Zabbix Agent and LibreNMS Agent (or any other agent you may use) can query via the system’s SNMP daemon. 

    Basically, dsm_sa_snmpd is the bridge that exposes OMSA’s hardware awareness to your existing monitoring stack.
    Note that if you are using Zabbix you will need to install additional templates. For example, this one, note that I have not tried it yet.

    Ompreport

    Omreport is the command-line interface (CLI) frontend for OMSA. It queries the OMSA backend services and formats the results for humans or scripts

    Note we have to use the absolute path to run this as the working dir is not in our $PATH.

    /opt/dell/srvadmin/sbin/omreport system summary

    If you want to add to your $PATH, run the command below

    echo 'export PATH=$PATH:/opt/dell/srvadmin/sbin' | sudo tee /etc/profile.d/dell-omsa.sh
    source /etc/profile

    Example usage below.

    omreport system summary
    omreport chassis temps
    omreport chassis fans
    omreport chassis power

    Here is an example I found useful. For some reason my raid controller keeps throwing these errors which do not seem to go away despite the fact that both SAS cables are connected (tried switching them) and all disks are healthy.

    # omreport system esmlog
    Severity : Critical
    Date and Time : Sat Jan 31 21:15:18 2026
    Description : The storage BP1 SAS B cable is not connected, or is improperly connected.
    Severity : Ok
    Date and Time : Sat Jan 31 21:15:20 2026
    Description : The chassis is closed while the power is off.
    Severity : Critical
    Date and Time : Sat Jan 31 21:15:21 2026
    Description : The storage BP1 SAS A cable is not connected, or is improperly connected.

    Enter omconfig.


    omconfig

    omconfig is the configuration and control interface for Dell OpenManage Server Administrator (OMSA). 

    Unlike omreport, which is strictly read-only, omconfig is used to change system and OMSA behavior—including alerting, storage actions, and certain hardware-related settings exposed by OMSA. 

    Omconfig It operates by issuing commands to the OMSA backend services (primarily dsm_sa_datamgrd and dsm_sa_eventmgrd) and applying those changes at the software management layer, not directly to hardware firmware. 

    Common uses include enabling or disabling alert actions, configuring storage-related behavior, managing notification settings, and triggering maintenance operations such as consistency checks. 
    Because omconfig can modify system behavior and suppress alerts, it should be used carefully—especially on production systems—and is best suited for controlled configuration changes rather than routine monitoring.

    Because omconfig can modify system behavior and suppress alerts, it should be used carefully—especially on production systems—and is best suited for controlled configuration changes rather than routine monitoring.

    So back to my two SAS cable alerts. Lets leverage omreport and omconfig to diagnose and hopefully ether determine that there is an actual issue, or suppress the alerts.


    OMCONFIG and OMREPORT – Real world Usage

    First lets take a sneaky-peak at my raid controller.

    omreport storage controller
    Controller PERC H730 Adapter(Slot 4)
    Controller
    ID : 0
    Status : Ok
    Name : PERC H730 Adapter
    Slot ID : PCIe Slot 4
    State : Ready
    Firmware Version : 25.5.9.0001
    -----truncated---

    According to chatgpt I am getting these errors because the system expects that I have an external enclosure connected. I do not think that is the case, as that seems dumb. More than likely this alert is due to the fact that I am using an H730 (a 13G controller) (and its cables) in an R720 (a 12G server) in Slot 4, which is a PCIe Adapter and not the integrated “mini” version.

    So let’s look at the disks and make sure all is well

    Here we can see that the PERC H730 adapter does not “See” the connector states as connected, rather just ready

    omreport storage connector controller=0
    List of Connector(s) on Controller PERC H730 Adapter (Slot 4)
    ID : 0
    Status : Ok
    Name : Connector 0
    State : Ready
    Connector Type : SAS Port RAID Mode
    Termination : Not Applicable
    SCSI Rate : Not Applicable
    ID : 1
    Status : Ok
    Name : Connector 1
    State : Ready
    Connector Type : SAS Port RAID Mode
    Termination : Not Applicable
    SCSI Rate : Not Applicable

    In order to use this 13th gen raid controller in a 12th gen Dell Server I could not use the original SAS cables. Rather I used SFF-8087 to SFF-8643 cables Which can cause the sideband signals (SGPIO / SES) which tell the iDRAC everything is okay which is why we are seeing the errors.

    As stated above this is not actually a problem as I can see my disks. Lets do that below.

    omreport storage pdisk controller=0 | awk '
    /^ID[[:space:]]*:/ {id=$3; state=""; status=""}
    /^State[[:space:]]*:/ {state=$3}
    /^Status[[:space:]]*:/ {status=$3}
    (state!="" && status!="" && id!="") {print id, state, status; id=""; state=""; status=""}
    '
    0:0 Online Non-Critical
    0:1 Online Non-Critical
    0:2 Online Non-Critical
    0:3 Online Non-Critical
    0:4 Online Non-Critical
    0:5 Online Non-Critical
    0:6 Online Non-Critical
    0:7 Online Non-Critical

    Here we can see we have 8 disks, no critical errors

    First lets clear the esmlog with omconfig – this will clear the error till we reboot

    omconfig system esmlog action=clear

    Sadly there is not a permanent fix. I would need to get a different raid controller that uses the original cables.


  • Install APC Netbotz Advanced View on Ubuntu 24.04

    Install APC Netbotz Advanced View on Ubuntu 24.04

    I recently picked up a Netbotz 450 for almost nothing on Ebay. I have always wanted one of these things since I first deployed one in a SunGard facility in Philly about 12-15 years ago.

    These devices allow you to connect environmental sensors to monitor temperatures, rack intrusion, humidity, noise. You can also connect a cool siren light (not cheap) to them and cameras (also super cheap).

    When I got mine up on my lab network, I was disappointing to find that there is no ssh or telnet available to connect to this device. There is a WebUI, but that interface is only for metrics and alerts. Any real configuration (beyond IP – which can be done on via serial console) has to be done in a Java app, and getting this app to run on a modern Linux is a bit of a pain. Fortunately I have a fix.


    First – The Linux Binary

    While the Linux binary is still available for download in some corners of the internet, I decided to make it available via Google Drive download. You can obtain the file here.

    Second – The Wrapper Script

    This script allowed me to install Netbotz Advanced View and and allowed me to configure the Netbotz on Ubuntu 24.04 in Gnome

    #!/bin/bash
    # Wrapper script to run APC NetBotz install.bin
    # This bypasses the LAX launcher which has encoding issues
    SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
    # Run the installer to extract files
    echo "Extracting installer files..."
    cd "$SCRIPT_DIR"
    ./install.bin 2>/dev/null
    # Find the most recent install.dir.* directory
    INSTALL_DIR=$(ls -td /tmp/install.dir.* 2>/dev/null | head -1)
    if [ -z "$INSTALL_DIR" ]; then
    echo "Error: Could not find extracted installer directory"
    exit 1
    fi
    echo "Found installer directory: $INSTALL_DIR"
    echo "Launching installer in GUI mode..."
    # Run the installer directly with bundled Java
    cd "$INSTALL_DIR"
    "$INSTALL_DIR/Linux/resource/jre/bin/java" \
    -Xmx50m \
    -Xms16m \
    -cp InstallerData:InstallerData/installer.zip \
    com.zerog.ia.installer.Main \
    -i gui
    echo "Installation complete!"


    I have also made the script available for download here.

    Screenshot of a software interface displaying sensor settings and appliance options, including alerts, configuration, and status readings for various sensors.


    Without ssh or telnet access to these things I am unsure of exactly they could be configured at scale, unless snmp-set can be used to utilized to enable snmp or setup ntp or alert destinations. This, I may or may not investigate.

    Epilogue

    Its also worth noting that snmp is apparently not available until you actually connect a sensor to the device, which makes leads me to believe any non-sensor data will not be available via snmp and there is no API

    nmap 10.1.10.9
    Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-31 13:32 EST
    Nmap scan report for 10.1.10.9
    Host is up (0.0054s latency).
    Not shown: 998 closed tcp ports (conn-refused)
    PORT STATE SERVICE
    80/tcp open http
    443/tcp open https

    If you are looking to pull data or automate actions, here are your 2 options:

    EcoStruxure IT / Data Center Expert (REST API)

    If you have a larger environment where your NetBotz 450 is managed by Schneider Electric’s Data Center Expert (DCE) software, you can use the DCE REST API.

    • How it works: You send API calls to the DCE server rather than the NetBotz appliance itself.
    • Capability: This allows you to pull data across all monitored devices (including the 450) through a modern JSON-based interface.

    Modbus/TCP

    For integration with Building Management Systems (BMS) or industrial controllers, the NetBotz 450 supports Modbus/TCP.

    Use case: Useful if you need to feed sensor data into a PLC or SCADA system rather than a custom web app or script.

    Other than these two options, you could possibly use python to “log” into urls and set configurations, but I think this would probably be problematic at best.

    Anyway, I should soon have a sensor arrive via mail, so I will get some more hands on with the device.

  • Fixing Weak SSH Ciphers On a Cisco ASAv

    Fixing Weak SSH Ciphers On a Cisco ASAv

    By default the Cisco ASAv has weak ssh config that many modern OS’s do not support.

    ssh admin@10.1.10.56
    Unable to negotiate with 10.1.10.56 port 22: no matching host key type found. Their offer: ssh-rsa
    

    This error is from the client side ssh client refusing to use any of the host key algorithms that are offered by the ASAv.

    To get around this you can try the following.

    ssh -o HostKeyAlgorithms=+ssh-rsa 
    -o PubkeyAcceptedAlgorithms=+ssh-rsa
    admin@10.1.10.56
    The authenticity of host '10.1.10.56 (10.1.10.56)' can't be established.
    RSA key fingerprint is SHA256:TIbF/exW4uqfmy/yf8JyxddX8DApYduK2NVXNHfRBXI.
    This key is not known by any other names.
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '10.1.10.56' (RSA) to the list of known hosts.
    ssh_dispatch_run_fatal: Connection to 10.1.10.56 port 22: error in libcrypto

    However as you can see from the above output there is another error. This error is also from the client side OS, as its enforcing its own crypto policy.

    One way around this is to enable legacy crypto on the OS side. Which you can do via the command below.

    sudo update-crypto-policies --set LEGACY
    

    However, this is a bad idea and can screw up a lot of other things on the client side. Rather than work around this we will fix.


    Fix SSH on the Cisco ASAv – Instead of Breaking my Workstation

    Cisco documents that starting in ASA 9.16(1), the ASAv added support for EDDSA and ECDSA SSH host keys, and the ASAv will prefer EDDSA → ECDSA → RSA if those keys exist.

    Given I’m on ASAv 9.20(4), I should be able to generate these keys and then connect with my normal ssh client settings. See commands below.

    enable
    configure terminal
    
    ! Generate an Ed25519 (EdDSA) host key (preferred)
    crypto key generate eddsa edwards-curve ed25519
    
    ! Also generate an ECDSA host key (good fallback)
    crypto key generate ecdsa elliptic-curve 256
    
    write memory
    

    Restarting SSH on the ASAv

    Now we need to restart SSH on the ASAv to switch the host key used by SSH. You will need to run these commands from the console.

    conf t
    no ssh 0.0.0.0 0.0.0.0 management
    ssh 0.0.0.0 0.0.0.0 management
    end

    Now we can verify that keys in use on the ASAv. Specifically we want to look at the EDDSA and ECDSA .

    # show crypto key mypubkey ecdsa
    # show crypto key mypubkey eddsa

    Now we can login normally via SSH from our Workstation

     ssh admin@10.1.10.56
    The authenticity of host '10.1.10.56 (10.1.10.56)' can't be established.
    ECDSA key fingerprint is SHA256:Z5+PHzIl6L9BvvdYl2bBrFGi2rlmefmuv0uc27UTBo4.
    This key is not known by any other names.
    Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
    Warning: Permanently added '10.1.10.56' (ECDSA) to the list of known hosts.
    admin@10.1.10.56's password: 
    User admin logged in to ciscoasa
    Logins over the last 1 days: 1.  
    Failed logins since the last login: 0.  
    Type help or '?' for a list of available commands.
    ciscoasa> 
    

    Further Configuration for SSH on the ASAv

    I did find that after all my changes to SSH on the ASAv, I was still unable to ssh to the asav from several VMs (new RHEL10 build for example).

    ssh admin@10.1.10.56
    kex_exchange_identification: read: Connection reset by peer

    In order to get ssh to work from RHEL 10, I ran the commands below on the ASAv

    conf t
    ssh key-exchange group dh-group14-sha256
    ssh key-exchange group curve25519-sha256

    Details below as to why this was required.

    Command AddedWhy RHEL 10 liked it
    dh-group14-sha256This moves the hashing from SHA-1 to SHA-256. RHEL 10 requires SHA-256 or higher for the handshake to be considered “safe.”
    curve25519-sha256This is the preferred algorithm for modern OpenSSH. It is extremely fast and mathematically robust. Once the ASA offered this, RHEL 10 stopped looking for other options and just connected.

  • TP-Link TL-SX3008F Features and Configuration Guide

    TP-Link TL-SX3008F Features and Configuration Guide
    Cheap and Quiet 10G Networking for the home
    TP-Link TL-SX3008F 8-Port 10GE SFP+ L2+ Managed Switch viewed from the front, showcasing the ports and interface.

    Introduction

    The TP-Link TL-SX3008F is a 8-Port 10GE SFP+ L2+ Managed Switch (with some Layer 3 capabilities.) Its not too expensive, not too cheap, has decent reviews, and its rackmountable and fanless which is nice for a homelab.

    Details below

    • 8× 10 Gbps SFP+ fiber/fiber-cage ports (for direct 10G links using SFP+ transceivers)
    • Web GUI, CLI Management (console, Telnet, SSH).
    • Omada SDN Integration – Zero-Touch Provisioning (ZTP) and centralized monitoring.
    • Layer 2
      • VLAN (802.1Q), IGMP Snooping, STP/RSTP/MSTP.
      • Link aggregation with LACP (up to 8 groups)
    • Layer 3: Static routing for simple inter-VLAN/intra-network routing (no dynamic routing like OSPF/BGP)

    Unboxing

    Arrived in a simple box and included the following

    • Nema 5-15p to c13 power cord (no wall wart/transformer)
    • Serial Cable
    • Rack Ears (and extra screws)
    • Rubber Feet (for desk/shelf)

    Serial Connection

    In order to configure via the cli, I will need to establish a console connection (cable included). For this I will use minicom on an adjacent RHEL Server. Below are the minicom settings.

    Baud Rate38400 bps
    Data Bits8
    Paritynone
    Stop Bits1
    Flow Controlnone

    I had to trial and error that specific serial port, but /dev/ttyS1 proved to be correct.


    Cli Configuration

    Default credentials are admin/admin and you will be prompted to change the password upon initial login.

    My Default vlan for my lab is VLAN10, so first we create this vlan on the switch

    SX3008F(config)#vlan 10
    SX3008F(config-vlan)#name DEFAULT
    SX3008F(config-vlan)#exit

    We next assign an unused IP from the subnet associated with vlan10.

    SX3008F(config)#interface vlan 10
    SX3008F(config-if)#ip address 10.1.10.48 255.255.255.0
    SX3008F(config-if)#exit

    Next we configure the default gateway (aka, next-hop).

    ip route 0.0.0.0 0.0.0.0 10.1.10.45

    Now we configure our uplink port.

    interface ten-gigabitEthernet 1/0/8
      description "Uplink-to-Cisco-3560G-Gi0/24"
      switchport general allowed vlan 10 untagged
      switchport pvid 10
      no switchport general allowed vlan 1
    

    We now check the interface.

    show interface configuration ten-gigabitEthernet 1/0/8
     Port      State       Speed     Duplex    FlowCtrl    Description
     ----      -----       -----     ------    --------    -----------
     Te1/0/8   Enable      10G       Full      Disable     Uplink-to-Cisco-3560G-Gi0/24
    
    

    And show our IP interfaces.

    show ip interface brief
     Interface            Status    Protocol  Shutdown  IP-Address         Type        Method  
     ---------            ------    --------  --------  ----------         ----        ------  
     VLAN10               up        up        no        10.1.10.48/24      Primary     Static  
     VLAN1                down      down      no        0.0.0.0/0          Primary     DHCP    
    

    And lets check out the routing table.

    how ip route
    Codes: C - connected, S - static
           * - candidate default
    S*      0.0.0.0/0 [1/0] via 10.1.10.45, VLAN10
            10.0.0.0/24 is subnetted, 1 subnets
    C           10.1.10.0/24 is directly connected, VLAN10
    

    Lets save the config

    SX3008F#copy running-config startup-config 
     Start to save user config as the Next Startup Config file......
     Saving user config OK!

    Web Interface

    Now that the new switch is pinging on our network, we can load its web interface and configure a couple more settings. First we will configure DNS.

    Screenshot of the TP-Link switch web interface displaying the DNS settings configuration page.

    Next we configure NTP.

    Screenshot of the TP-Link TL-SX3008F switch web interface displaying the System Time configuration settings, including options for time zone, primary and secondary NTP servers, and an update rate.

    You can view connected ports and port speeds as well

    Screenshot of the TP-Link TL-SX3008F managed switch web interface showing system information and port status.

    Click on any individual port and you can see its utlization

    Screenshot of a network switch management interface displaying port status and bandwidth utilization for port 1/0/8.

    Next Steps

    Next steps will be the following

    • Update Firmware
    • Configure SNMP
    • Configure and Connect Devices
    • Install Omada Cloud-Based Controller (maybe)

    Reference

  • Setting up Chrony/NTP Server with GPS on Ubuntu 22.04

    Setting up Chrony/NTP Server with GPS on Ubuntu 22.04

    Introduction

    In this post I will cover setting up a ntp/chrony server on Ubuntu 22.04 using a Satellite GPS Receiver. I have also recently published another post on Chrony, which goes a bit more into basic commands. That post can be found here.


    Hardware

    Note: the GlobalSat BU-353-W11 does not support 1pps. It’s designed primarily for positioning and navigation, not precision timing. We can use it as our timesource for chrony, with a typical accuracy: ±50–150 ms. Good enough for a lab.


    Hardware Detection

    After plugging in the USB cable on the GNSS module, check for a new USB device.

    # lsusb
    Bus 001 Device 004: ID 1546:01a7 U-Blox AG [u-blox 7]

    Output from dmegs also shows the device was detected properly

    [347055.572498] usb 1-2.4: new full-speed USB device number 4 using tegra-xusb
    [347055.768706] cdc_acm 1-2.4:1.0: ttyACM0: USB ACM device
    [347055.768784] usbcore: registered new interface driver cdc_acm
    [347055.768788] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters

    In the output above you can see the device was detected ttyACM0. Now we need to confirm how the device was enumerated. As you can see the device is owned by root and the group is dialout

    # ls -l /dev/ttyACM*
    crw-rw---- 1 root dialout 166, 0 Dec 29 13:40 /dev/ttyACM0
    
    

    You can run a quick check to confirm that the device is functioning as shown below

    # cat /dev/ttyACM0
    $GPTXT,01,01,02,u-blox ag - www.u-blox.com*50
    
    $GPTXT,01,01,02,HW  UBX-G70xx   00070000 FF7FFFFFo*69
    
    $GPTXT,01,01,02,ROM CORE 1.00 (59842) Jun 27 2012 17:43:52*59
    
    $GPGGA,201055.00,3356.15827,N,08345.15611,W,2,12,0.80,280.0,M,-31.5,M,,0000*67
    
    -----------truncated----------------

    GPSD

    To use a GPS/GNSS antenna with chronyd on Linux for time synchronization and location sharing, we will use the gpsd service to manage the GPS hardware and make its data accessible to other applications, including chronyd

    Package Installation

    # sudo apt update
    # sudo apt install gpsd gpsd-clients chrony pps-tools 

    GPSD Configuration

    Identify the GPS device: The device will likely be /dev/ttyUSB0/dev/ttyACM0, or similar. You can verify this by running cat /dev/ttyUSB0 (replace ttyUSB0 with your suspected device) and looking for NMEA strings (lines starting with $GPGGA$GNRMC, etc.).

    Edit the gpsd configuration file: Open /etc/default/gpsd and set the DEVICESGPSD_OPTIONS, and USBAUTO variables.

    START_DAEMON="true"
    GPSD_OPTIONS="-n -b"
    DEVICES="/dev/ttyACM0"
    USBAUTO="false"
    GPSD_SOCKET="/var/run/gpsd.sock"
    

    For reference here are configuration params for GPSD_OPTIONS

    FlagArgumentMeaningNotes
    -nnoneStart reading GPS immediatelyRequired for chrony/NTP
    -bnoneRead-only mode (no device writes)Recommended for USB pucks
    -NnoneRun in foregroundDebug only
    -D<level>Debug verbosityUse -D 2 or -D 3
    -F<path>Control socket pathNeeded for manual runs
    -s<baud>Force serial baud rateUART devices only
    -S<port>TCP listening portRare; usually disabled
    -GnoneAllow remote TCP clientsAvoid on servers
    -lnoneList drivers and exitDiagnostic
    -VnoneShow version and exitInformational
    -hnoneHelp outputReference

    Enable and start gpsd

    # sudo systemctl enable gpsd
    # sudo systemctl restart gpsd

    Verify gpsd is receiving data

    # cgps -s
    

    Output below

    Screen output from a GPSD client showing real-time GPS data, including time, latitude, longitude, altitude, speed, and satellite information.

    Interpreting the output from cgps

    High-Level Status (The Big Picture)

    • (Satellites) Seen / Used: 13 / 11
    • Fix: 3D DGPS FIX – means the receiver has solved all three spatial dimensions: (Latitude, Longitude, Altitude)
    • Time is valid
    • Position accuracy: ~5–10 feet horizontal

    Satellite Section (Right Pane)

    Seen 13 / Used 11
    

    This means:

    • The receiver can currently see 13 satellites
    • 11 of those are strong enough to be used in the solution

    This is quite a healthy signal for a device sitting inside up against a window.

    Anything above:

    • 4 used → valid 3D fix
    • 8+ used → very solid geometry
    • 10–12 used → excellent (we are here)

    Constellations

    • GP = GPS
      • U.S. GPS constellation
      • Medium Earth Orbit (≈20,200 km)
      • ~30 active satellites worldwide
    • SB = SBAS (WAAS corrections)
      • Satellite-Based Augmentation System
      • Broadcast correction data
      • Improve accuracy of GPS measurements
      • Do not provide independent position fixes

    The presence of SBAS satellites indicates differential reminder data is available, improving accuracy.

    Fix & Timing (Left Pane)

    Fix State

    Status: 3D DGPS FIX (1 secs)
    
    • 3D = Latitude, longitude, altitude solved
    • DGPS = WAAS corrections applied
    • (1 secs) = Fix age (very fresh)

    Time Quality

    Time: 2025-12-29T20:32:22.000Z
    Time offset: 0.078609772 s
    


    Chrony

    Install Chrony via apt

    # apt install chrony -y

    Configure Chrony

    Edit /etc/chrony/chrony.conf. This config has been tested on Ubuntu 22.04, YMMV on other Linux versions.

    ###############################################################################
    # Chrony configuration
    #
    # Purpose:
    # – Discipline system time using a USB GPS receiver via gpsd (NMEA-only)
    # – No PPS available, so accuracy is milliseconds (not microseconds)
    # – Act as a low-priority NTP server for the local network
    #
    # Notes:
    # – Chrony always operates internally in UTC
    # – GPS time is provided by gpsd over a UNIX socket
    ###############################################################################
    #——————————————————————————
    # Include additional configuration snippets
    #——————————————————————————
    # Allows drop-in configuration files (not required, but standard on Ubuntu)
    confdir /etc/chrony/conf.d
    ###############################################################################
    # Debug / observability
    ###############################################################################
    # Where chrony writes its own detailed log streams
    logdir /var/log/chrony
    # Enable detailed logs:
    # – tracking: disciplined clock state (offset/freq/skew, etc.)
    # – measurements: raw samples from sources (very useful for refclocks)
    # – statistics: aggregate stats per source
    log tracking measurements statistics
    # Log when chrony makes a clock correction bigger than the thresholds
    # (units: seconds). Helps correlate “why did time jump?” events.
    logchange 0.5
    #——————————————————————————
    # GPS reference clock (via gpsd)
    #——————————————————————————
    # Use gpsd's UNIX socket as a reference clock.
    #
    # SOCK /var/run/gpsd.sock
    # – Chrony does NOT talk to the GPS device directly
    # – gpsd parses NMEA and provides time samples
    #
    # refid GPS
    # – Human-readable label shown in chronyc output
    #
    # poll 4
    # – Poll interval = 2^4 seconds = 16 seconds
    #
    # precision 1e-1
    # – Declare expected precision (~100 ms)
    # – REQUIRED for NMEA-only GPS to avoid sample rejection
    #
    # delay 0.2
    # – Account for USB + NMEA sentence latency
    #
    # trust
    # – Explicitly allow chrony to accept this low-precision refclock
    #
    #refclock SOCK /run/gpsd.sock refid GPS poll 4 precision 1e-1 delay 0.2 trust prefer
    refclock SHM 0 refid GPS poll 4 precision 1e-1 delay 0.2 trust prefer
    #——————————————————————————
    # Standalone operation policy
    #——————————————————————————
    # Allow chrony to discipline the system clock even if:
    # – No network NTP servers are configured
    # – GPS is the only available reference
    #
    # Advertise this host as stratum 10 to NTP clients:
    # – Prevents it from being treated as an authoritative time source
    # – Avoids NTP loops
    # – Appropriate for NMEA-only GPS (no PPS)
    #
    local stratum 2
    #——————————————————————————
    # Clock stepping behavior
    #——————————————————————————
    # Allow the system clock to be stepped (jumped) instead of slewed
    # if the offset is larger than 1 second, but ONLY during startup
    # and only for the first 3 updates.
    #
    # This prevents long convergence times on boot while avoiding
    # disruptive time jumps during normal operation.
    #
    makestep 1.0 3
    #——————————————————————————
    # Frequency drift handling
    #——————————————————————————
    # Persist the measured frequency error of the system clock.
    #
    # This allows chrony to:
    # – Start with a good frequency estimate after reboot
    # – Converge faster
    # – Free-run more accurately if all time sources disappear
    #
    driftfile /var/lib/chrony/chrony.drift
    #——————————————————————————
    # NTP server behavior (serving time to clients)
    #——————————————————————————
    # Allow NTP clients from the local subnet to query this server
    #
    allow 10.1.10.0/24
    # Bind NTP service explicitly to this interface/address
    # (prevents listening on unintended interfaces)
    #
    bindaddress 10.1.10.11
    #——————————————————————————
    # Optional dynamic source handling
    #——————————————————————————
    # Allow chrony to use NTP servers provided via DHCP (if present)
    #
    sourcedir /run/chrony-dhcp
    # Allow additional NTP source files to be added modularly
    #
    sourcedir /etc/chrony/sources.d
    #——————————————————————————
    # Security and key material
    #——————————————————————————
    # File containing NTP authentication keys (if used)
    #
    keyfile /etc/chrony/chrony.keys
    # Directory used to store NTS (Network Time Security) cookies and keys
    #
    ntsdumpdir /var/lib/chrony
    #——————————————————————————
    # Logging
    #——————————————————————————
    # Directory where chrony logs are written
    #
    logdir /var/log/chrony
    # Uncomment the following line to enable detailed logging:
    # log tracking measurements statistics
    #——————————————————————————
    # Stability and safety controls
    #——————————————————————————
    # Prevent chrony from applying updates if clock estimates become unstable
    #
    maxupdateskew 100.0
    # Periodically sync the system time back to the hardware RTC
    # (every ~11 minutes)
    #
    rtcsync
    #——————————————————————————
    # Leap second handling
    #——————————————————————————
    # Obtain leap second and TAI-UTC offset information from the system
    # timezone database, operating in strict UTC mode.
    #
    leapsectz right/UTC
    view raw gistfile1.txt hosted with ❤ by GitHub

    Explanation of Chrony Config for GPSD

    OptionPurpose
    SOCK /var/run/gpsd.sockRead time from gpsd
    refid GPSLabel in chrony output
    poll 4Poll every 16 seconds
    precision 1e-1~100 ms accuracy (realistic for NMEA)
    delay 0.2USB + NMEA latency
    makestep 1.0 3Allow initial step corrections

    Start and Enable

    # systemctl enable chrony.service
    # systemctl start chrony.service

    After a few minutes, we should start to see pre-configured clients appear in the output of the command below

     # chronyc clients
    Hostname                      NTP   Drop Int IntL Last     Cmd   Drop Int  Last
    =============================================================================
    scar.lab                        5      0   6   -    30       0      0   -     -
    

    Chrony Client-side Setup

    Ubuntu Client

    $ sudo apt install chrony -y

    Configure the to listen to the chrony server address 10.1.10.10. Comment out any other server or pool directives in /etc/chrony/chrony.conf.

    server 10.1.10.11

    Start and enable the service.

    $ sudo systemctl enable chrony --now
    

    Check configured time source for chrony

    $ chronyc -n sources -v

    What the above output tells you

    • All NTP servers/pools configured for this client
    • Which source is currently selected
    • Reachability and time quality

    Key indicators

    SymbolMeaning
    ^*Current sync source
    ^+Candidate source
    ^-Reachable, not selected
    ^?Unusable / not trusted yet

    Cisco Catalyst Client Config

    Use the commands below to configure your Cisco switch to use the new timesource

    # Enter global configuration mode
    configure terminal
    
    # Define the NTP server
    ntp server 10.1.10.11
    
    # (Optional) Set the switch to use its own hardware clock if it loses sync
    ntp master 10
    
    # Exit and save
    end
    write memory