fibre optic cables

fibre cables have different terminations. You need to select the right cable which can connect to your deivce and the the other end to fiber patch panel so you need to check both. Some times the cables are mixed up in the patch so you need to pop the cables out and swap them around

ST (straight tip)
SC (Subscriber connector)
LC (Local connector)
MT-RJ 

LR = long range / single mode

SR = short range / multimode

Have seen 10g LRM SFPs work on both multimode/singlemode cable.

You need to see how it is terminated at each patch point.
You need to have the correct SFP in your network device so you can plug the fibre in.
You also need to select the right cables SC-LC, ST-ST etc.

Look a bit into the SFP you should see a light on one side. This is the transmit side and needs to be the same all the way. You won't be able to see the light with single mode (its too narrow for the human eye). Need to use device db signals

-> red light transmit
<- no light receive

There are OM values that relate to cable distance will update more on that later

10Gig-Base-SR (closer to 0 is better)
Typical working transmit range: -1 to -7
Typical working transmit range: -1 to -9.9

When we see a Rx power around -14 dBm or lower there is typically some sort of fault in the cable plant (bad splice, dirty connector, poorly seated jumper etc.) that's causing excessive signal loss.

If either Tx or Rx is in the -30 dBm or lower range that's usually indicative of there being no actual signal received and the transceiver is reporting the "noise floor" of the receiver stage. (https://en.wikipedia.org/wiki/Noise_floor)

https://www.cisco.com/c/en/us/products/interfaces-modules/transceiver-modules/index.html

CLI commands:

Router:

sh hw-module subslot 0/0 transceiver 2 status

sh hw-module subslot 0/0 transceiver 2 idprom

Switch:

sh int g1/0/1 status

sh int gig1/0/1 capabilities

sh int gig1/0/1 transceiver

 

Let cisco switch use 3rd party SFPs

Cisco SFP 
Left side = transmit
Right side = Recieve
http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/installation/note/78_15160.html


Commands to allow using non Cisco SFPs
service unsupported-transceiver
no errdisable detect cause gbic-invalid


taken from:
http://www.firewall.cx/cisco-technical-knowledgebase/cisco-switches/866-cisco-switches-3rd-party-sfp.html

Check your sfp
sh int gigabitEthernet 0/3 status 
sh int gigabitEthernet 0/3 capabilities (check type)

VPN uptime

See how long a VPN is up
show vpn-sessiondb l2l filter name x.x.x.x

see what port ASDM is running on

You can port scan the firewall or

sh run | i http server enable

add a route on checkpoint CLI

route add -net 10.5.140.0/24 gw 192.168.0.1 (works for lgma need write mode on FW you are adding the route on open the correct policy for each fw before making the change)

Remove a route worked on PH
route del -net 192.168.80.0/20 gw 192.168.80.51


route add -net 192.168.80.0/20 dev eth15
gives this kind of route
192.168.80.0    0.0.0.0         255.255.240.0   U         0 0          0 eth15

Maybe this in newer versions
https://supportcenter.checkpoint.com/supportcenter/portal%3FeventSubmit_doGoviewsolutiondetails%3D%26solutionid%3Dsk39746

clish (enter clish if no already there)

set static-route 192.168.0.0/24 nexthop gateway address 10.0.0.1 priority 1 on

save config

exit

netstat -nr | grep 192.168.0.0

Run on both FWs

(works on REV fws)

*** If you get a cloning mode error enter the CLISH command with a space in front of it, don't ask me how that works

Watch out for NAT's you may need to add to grp_No_NAT

There may be a static server NAT for the server.

Show routes
netstat -nr - show all routes

netstat -nr | grep 10.5.140

185.5.241.204

Use nslookup to find the IP addresses of the domain controllers

You can use Nslookup is a command-line tool that displays information you can use to diagnose Domain Name System (DNS) infrastructure.

1. Click Start, and then click Run.
2. In the Open box, type cmd.
3. Type nslookup, and then press ENTER.
4. Type set type=all, and then press ENTER.
5. Type _ldap._tcp.dc._msdcs.

run ASA web interface on another port

ASDM 

ASA(config)#http server enable 8080

https://192.168.1.1:8080

WebVPN

ASA(config)#webvpn
ASA(config-webvpn)#enable outside
ASA(config-webvpn)#port 65010

https://192.168.1.1:65010 

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/118842-technote-asdm-00.html 

You also need to allow it under the ASDM config
http server enable 8080
http pub.pub.pub.pub 255.255.255.255 outside
http prv.prv.prv.prv 255.255.255.0 inside

Same for SSHssh pub.pub.pub.pub 255.255.255.255 outsides

ssh prv.prv.prv.prv 255.255.255.0 inside

Don't forget crypto key generate