How to configure TFTP Server in your Linux Machine (Debian), and how to solve Permission Denied Error (Error Code 2)

I personally use a Virtualized Kali Linux in my Windows 7 machine to do a lot of things. Primarily to do IT security analysis and research for the companies I work with. But mostly, I find maintaining a Linux machine in an image comes in handy for a lot of things: I can use the Kali/Linux machine as an tftp/scp server to backup devices;

So suppose you want to copy startup-config files from your Cisco to your laptop running a virtual machine of  Kali Linux, (Debian). Let us suppose further that your Cisco router/switch cannot do SSH otherwise, we'll just use scp which is safer, and does not need any further special configuration for Linux devices.

Here's how to do it:  

1. Make sure you have the Virtual Machine in Bridged Adapter to your WIndows 7 machine's ethernet adapter. I'm using virtual box so in my case, I have to create a bridged adapter first. In Virtuabox (not in the Guest OS or Virtual Machine's Window) click File >> preferences >> Network. Then under tha tabe Bridged Adapters, create at least one adapter. 
             

           Then , in your Guest / Virtual Machine, click Machine >> Settings >> Network >> choose bridged (not NAT). After which, you need to do an ifdown eth0 and ifup eth0 inside your Kali / Linux OS console.

** Bridging will not work when you hav eport-security configured in the switchport where the computer is plugged. This is the case in most enterprise networks. If you are doing this inside your office and you are not getting a DHCP IP address, you better ask your network engineer/corporate IT if port-security is enabled.

How to Install Windows 7 on a UEFI enabled Computer

We recently bought a Lenovo T-440s amd immediately loved it, except it came with a Windows 8 Professional, 64-bit. It had "downgrade rights" for Windows 7 Pro 64-bit. Unfortuantely, our corporate IT environment does not (yet) encourage Windows 8 especially in laptops nor desktops, so I really was obligated to downgrade it to Windows 7 Pro/Enterprise.

The T-440s is Windows 8 optimized and is UEFI and secure-boot enabled. As an IT professional, I am also interested in how UEFI works (later I'll write a blog after I successfully installed Kali Linux on dual-boot in a UEFI system) and if it indeed delivers to is promise. UEFI is explained in detail here. Microsoft also explains UEFI and how it is here.

Do note that UEFI systems behave differently depending on the model and brand of the computer. This how-to post is specifc to the T-440s. While the concept and the general procedures may be the same as with other laptops (i.e. Acer, Asus, HP, Dell, etc.) the behavior may differ slightly.

The Objective:  Install Windows 7 Professional 64-bit on a UEFI enabled Lenovo T-440s.

Before we begin, let us first discuss what are the differences between installing Windows OS in UEFI and in non-UEFI mode (aka Legacy Boot Mode)

1. UEFI installation of Windows 7 only works in 64-bit installations. 
2. UEFI does not work in Win XP. 
3. By default T-440s ships with Windows 8 and with UEFI and Secure Boot enabled. However Windows 7 normally is not for UEFI systems.  If your Lenovo Thinkpad T-440s ships with Windows 7, the settings may have been changed. 
4. The Lenovo Thinkpad T-440 does not have a CD/DVD Drive, you have to either attach a removable drive, or create a EFI-bootable Windows 7 USB Stick. 

Here's how:

1. Go to the BIOS Setup by rebooting your Lenovo Thinkpad T-440s then, repeatedly press F1 until you get to the BIOS Set-up Screen. 

Configuring Cisco WLAN with multiple SSIDs in different VLANs - Part 1

note: Screenshots and configuration examples are using a Cisco 2500 series WLAN controller (aka WLC). The Cisco 2500 series controller is connected to a cisco 3750 or 3650 L3 switch. This article assumes that inter-VLAN routing is already working and only the WLAN controller needs to be configured. 

Usually, enterprise networks are on multiple VLAN environment. The Wifi access points provide access to each of these different VLANs by broadcasting different SSIDs attached to different WLAN profiles. Let's say we want to configure our WLAN controller to broadcast two SSIDs namely:

1. GUEST on VLAN 5 (10.8.5.0/24);
2. IT-Department on VLAN 13 (10.8.6.0/24);

Also, let's assume VLAN 219 is pre-configured with the following information:

1. VLAN 219 is NETWORK-VLAN @10.8.219.0/24)
2. interface vlan 219 IP address is 10.8.219.1
3. a DHCP server located in VLAN 219 with IP address 10.8.219.50/24.
4. WLAN controller will be configured with IP address 10.8.219.251 in VLAN 219
5. the Access Points (APs) 10.8.219.248-250, also in VLAN 219.

There are two parts to this task. First is the VLAN configuration required in our 3750/3650 layer 3 switch which will be discussed in this article. Part 2 is configuring our WLAN controller with the WLAN profiles, SSID, and interfaces. For brevity, I will skip discussion on inter-VLAN configuration and assume that that the network converges, and inter-VLAN routing is configured properly.

Part 1: Configure the 3750/3650 layer 3

1. Configure the port interface in our L3 switch as a trunk:


  interface GigabitEthernet1/0/23
   description *** LINK TO WIRELESS-CONTROLER ***
   switchport trunk encapsulation dot1q
   switchport trunk allowed vlan 5, 13
   switchport mode trunk
   !The next commands are optional
   switchport trunk native vlan 219
   udld port aggressive

• "switchport trunk allowed VLAN <ID>"  command explicitly defines what VLANs are only allowed in the interface. In this case, only VLANs 5 (Guest) and 13 (IT-Department) are allowed.  This can be optional but I would recommend you do this to minimize broadcasts traversing through the trunk. 
• "switchport trunk native vlan <ID>" command changes the native VLAN. By default, the Native VLAN is 1. But this is already expected so we change it. The native VLAN is where all vlan traffic converges and traverses. This command is optional. 
• "udld port aggressive" is an optional configuration. It detects if the link is  uni-directional and adjusts accordingly to avoid spanning-tree loops. All ports should support UDLD aggressive mode in order to work.  

Configuring Cisco WLAN with multiple SSIDs in different VLANs - Part 2

This is part 2/2 of the series.  Part 1 discussed the assumptions and the required layer 3 switch configurations. Please read part 1 prior to reading part 2 You can view part 1 here.
======================================================================
 note: Screenshots and configuration examples are using a Cisco 2500 series WLAN controller (aka WLC). The Cisco 2500 series controller is connected to a cisco 3750 or 3650 L3 switch. This article assumes that inter-VLAN routing is already working and only the WLAN controller needs to be configured.


======================================================================
IMPORTANT REMINDER: before you do all the configuration, note that the LWAPP image version cannot be higher than that of the WLAN controller. a quick "show version" command on both the WLC and the LWAPP will save you all the time and effort. 


From LWAPP: the default username is "Cisco" and password is "Cisco": 

output of show version: 

cisco AIR-CAP702I-F-K9 (MIPS74k) processor (revision 01) with 73728K/57344K bytes of memory.
Processor board ID KWC184402C5
MIPS74k CPU at 40Mhz, revision number 0x0000
Last reset from power-on
LWAPP image version 7.5.1.33
1 Gigabit Ethernet interface

AIR-CAP means this is a Lightweight Access Point (aka a Controller-based Access Point). If it says AIR-WAP, then this is not a controller-based access point and will therefore not associate to the Controller. 

From the Controller:

(Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.

Product Name..................................... Cisco Controller

Product Version.................................. 7.4.121.0

Bootloader Version............................... 1.0.20

Field Recovery Image Version..................... 1.0.0

Firmware Version................................. PIC 16.0

In this case, configuring the WLAN controller and the LWAPP will not work. the LWAPP will not associate. We will need to either downgrade the image of the LWAPP, or upgrade the image of the WLAN Controller. 

=======================================================================

Part 2: Configure the WLAN Controller

In the first part, we discussed the Layer 3 switch configuration requirements. In case you missed it, please read the first part of this article here: Configuring Cisco WLAN with multiple SSIDs in different VLANs - Part 1

As usual, the first thing to do is plug the WLAN Controller's port 1 to the trunk-configured port in the L3 switch (discussed in part 1). Port 1 is the green colored portin the figure below.

The other 3 ports will be connected to your APs (Access Points).  For brevity, we will not discuss configuring licenses and upgrading firmware in this article.