Note for myself (ignore it)

ISE disable AD encryption for query tshoot

TROUBLESHOOTING.EncryptionOffPeriod
30
test

ProxySG

Enable full coredump
https://support.symantec.com/en_US/article.TECH244735.html

Force Coredump
https://support.symantec.com/en_US/article.TECH241718.html

SSLVPN - timestamp formula

(((A1/60)/60)/24)+DATE(1970,1,1), 

Note - Fortianlyzer generate top sent byte

This topic is for my own reference/note only

Dataset to generate report which top user

select srcip, dstip, dstport, action, service, sum(sentbyte/1048576) as sent_MBps,sum(rcvdbyte/1048576) as receive_MBps, count(*) as sessions from $log where logid_to_int(logid) not in (4, 7, 14) GROUP BY srcip, dstip, dstport, action, service ORDER BY sent_MBps DESC

Note - Forti Analyzer Report

This topic is for my own reference/note only

Dataset to generate report which hit policy id xxxx

select srcip, dstip, dstport, policyid, action, service, count(*) as sessions from $log where policyid = xxxx GROUP BY srcip, dstip, dstport,policyid, action, service

Fortianalyzer with gmail setup

If you tried to setup Fortianalyzer sending alert via gmail but kept fail

p/s  if you tried setup with 3th party apps for send notification via gmail, this guide might suit too.

Current my analyzer running 5.2.5

Herewith the steps

1. Setup on Fortianalyzer mail server setup

for information about gmail setting
https://support.google.com/a/answer/176600?hl=en


2. SSH to Fortianalyzer , configure the secure option, this command make sure using starttls.

Example

config system mail
    edit "Gmail"
        set secure-option starttls
   next
end

below is the wireshark capture  using starttls, as the red arrow indicate the SSL handshake start

3. Login into your gmail account

4. Access the url https://www.google.com/settings/security/lesssecureapps , turn it on

You can skip steps 5 and 6 if you 1st time setup gmail smtp server, else continue

5. Access the url https://accounts.google.com/DisplayUnlockCaptcha, click continue

6. You will come to this page below

6. Let test the email setup, right click the email setup and key in the recipient email

7. You should successfully send the email

Windows 7 administrator

if you wish to reset password, you may skip this topic.


if you wish to gain *Ahem*  local administrator role for c**p*** laptop/pc *Ahem*

*Ahem* bypass G** and doing without 3th party software

yup you come to right place.

prerequisite

1 x same windows version CD/USB bootup image

1 x working CD room/ USB port

Follow the steps as below link until reset password

http://www.howtogeek.com/96630/how-to-reset-your-forgotten-windows-password-the-easy-way/

p/s if you unable to locate the windows/system32 directory, it might store at other drive, please try d,e,f,g drive and etc.

hit the shift key 5 times till pop out the command prompt.

1. Type net user

2. You will get a list of user

3. type net user <username> , example net user Administrator

4. Scroll till end, it will list local group memberships as per below

5. type net localgroup <local group membership> <username> /add , example net localgroup Administrator limvuihan /add (local group membership is key sensitive)

6. verify the username you had modify, type net user <username>, if success add should listed as below

Then recover back the file that overwrite as per link listed earlier or below

http://www.howtogeek.com/96630/how-to-reset-your-forgotten-windows-password-the-easy-way/

So, you has the administrator role.

Finally certify

Officially certify CCNA :)

CAUTION : reload stack switch

最阴Cisco :D

Sometimes habit/dependent lead to mistakes.

When reload 2960x stack switch (maybe apply to all stack switch), you might reload entire stack

Sometimes is too confident when execute command but shit happen

Normally reload member by execute reload slot x, 

So, when execute reload , less/missing 1 alphabet (reload slo 1) ; it still working fine, reload the member switch 

But when execute reload, example reload slor 2 !! It should prompt error as usual, but this time cisco prompt confirm, so just press enter ; 

Surprise !!!

It reload entire stack switch 

What if the switch is in production and design as below

At that moment,

Engineer

5 min downtime is not fun at all , my career is on chopping board or ban access to customer data center

Customer might lost  million dollars (trading) , or someone lost his life (if Hospital failed to authenticate patient medical card and missed the golden rescue period)

Lucky was in post migration environment

So, I posted something in community

herewith my post at Cisco community

https://supportforums.cisco.com/discussion/12732176/2960x-reload-command-issue

community member post it proper document about reload command, Cisco treat it as reason when execute wrong command LOL

herewith document 

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/stack_manager/command_reference/b_stck_152ex_2960-x_cr/b_stck_152ex_2960-x_cr_chapter_01.html#wp3486313748

But I look at it as defect coding. Confusing engineers/administrator and mislead engineer.

Although it proper document but doesn't make sense to me or any engineer because  used to it prompt error when execute wrong command, sadly in this case it doesn't 

Be caution when reload stack switches

Thanks

Han