My Teneo!!!

Custom Functions for HP IMC

2013-06-18T18:57:36Z

One of the best features of HP's Intelligent Management Center is not that it's modular and can do so many different things. It's not that it's scalable, and can handle tens of thousands of managed devices. It's not even it's alarming and event system. No, the best feature of HP's IMC, is that you can do things that it wasn't programmed to do.

Take this use case for example. As a network administrator, you are constantly being blamed for poor access into the network. After drinking 3 cups of coffee and reviewing everything at your desk, you see nothing wrong. So, you decide to step out of your comfortable chair to go to the location with the problem. Upon arriving, you notice that there are 5 computers plugged into an old 10/100 hub that someone found lying around.

You decide it's time to take action, and start setting port-limits on your access-layer switches. In the course of a week, you realize that you should set your mac-learning tables per port to limit 2 devices, since many of your users use a VoIP phone in-line with their workstation. But, how do you do this? SSH into every switch? What if there are exceptions? Do you teach your helpdesk crew how to access a switch and change it? Do you trust them?

But, wait!! You have HP IMC to manage your network. Why not have it schedule your changes to all your switches simultaneously and after-hours? Better yet, why not give a pretty point-and-click interface for your helpdesk team to use? And, when you are done, have it backup the configuration.

That is EXACTLY what Lindsay and I are showing at HP Discover! It's a little overwhelming at first, but once you learn how the XML files are structured, and can write TCL scripts, you'll be extending IMC to no end!

If you missed the class at HP Discover in Vegas, we are hoping to be doing the same thing in Barcelona. In the mean-time, you can review my flow chart below. This shows how all the files are related. Believe it or not, what you see below is 98% of what you need to do, in order to accomplish my use-case above! No, I'm serious! Pretty cool, huh? Just a few files in the right places, a script, and VOILA!

HP Anywhere - Enterprise Mobility

2013-06-16T16:18:24Z

Fig 1 - HP Anywhere flow

Some time ago, HP’s software team was challenged with a task to manage up to 100,000+ mobile devices for a company. These devices needed secure access to business data and it’s apps, and allow the company to remotely wipe the device without affecting personal data. A significant challenge, and one that the group was not going to back down on. The customer? HP. Their own internal IT department needed a better way to manage mobile devices.

The solution is a common one. Build a container on the phone, and block any access from native applications to the business applications. The implementation is different. HP Anywhere, the mobility app, is an enterprise-grade app meant to deploy and access business apps. Built into the framework is a workflow and collaboration system that allows apps to notify you and to build approve and reject actions, among others.

During Discover 2013 Las Vegas, The HP Bloggers had a coffee talk discussion with John Jeremiah, Sr Product Marketing Manager, and Kobi Eisenberg, Product Manager of HP Anywhere. While the discussion kept taking tangents to other HP Software projects, I wanted to learn more about HP Anywhere. Mobility is on EVERYONE’s mind, and I wanted to know what HP is doing. Especially after Citrix announced XenMobile this year. I asked Kobi to give me a demo of the app outside of the talk, and he walked me through an Expense Report app.

I’ll admit, the collaboration features of the app really put you in your “virtual office” far better than other offerings. You can be more responsive and make decisions faster while mobile. After the XenMobile announcement, Citrix also has a mobile offering. The largest difference is that HP Anywhere is an SDK that requires developers, whereas XenMobile is a consumerized container utilizing native apps. No, HP Anywhere does not protect or “wrap” native IOS/Android apps from the store. It can launch them, but it doesn’t protect them. XenMobile does. I also could not see any support for Windows phones.

It’s worth noting, that because “HP Anywhere”, is itself, an app, the apps that you build into the app, is of course, under your control. You don’t have to publish individual apps into the “Store” for Apple or Google. Publishing more apps is simply nothing more than downloading an updated version of the HP Anywhere app.

HP Anywhere is an “enterprise-grade” mobile offering. In other words, it does not offer any self-registration or onboarding. All of it is handled from inside the company infrastructure. You must use your normal lines of communication to your IT Services team to request access and applications. This puts the control purely on IT. Doing so, protects your apps and data better, but could cause long delays and extra work for the service team. Overall, you choose what’s best for your business.

You can learn more about HP Anywhere from HP’s website, but there isn’t anything there with any real ‘meat’ to it. If you like marketing, then you’ll love it. I found you can get much more data from the developer site, than from the main site. The coffee talk did not mention, nor do I see it on the site, on how IT can manage these devices, or a support matrix of what devices are, or are not supported.

It will be interesting to see where HP takes this from here.

Servers aren't for big business anymore

2013-06-13T19:31:43Z

When people talk about servers, they visualize either the massive boxes with tons of processors, or a large chassis with many individual servers. Servers for small businesses usually mean a large desktop or workstation with large drives. Until now.

During HP Discover, Dave Donatelli showcased HP’s line of SMB servers to help them use a solid and stable hardware platform at an affordable price. One of the servers is so small and affordable, Donatelli referred to it as “baby’s first datacenter”, implying you can buy it for your children. The HP MicroServer is small and quiet enough to fit on a desk, but has the features and reliability we’ve all come to know on the Proliants, including iLO management. Some of the features are:

Stackable Managed Network Switch
B120i RAID Controller capable of RAID0, RAID1, and RAID10
4 3.5” SATA Drives
2 core processor
Up to 12GB of memory

The usability of this box doesn’t have to be for the SMB market. Use-cases such as home-labs and streaming/sharing at home comes to mind. Throw ESXi on it, and start slicing it up to your needs. And, starting at just $449, it’s truly remarkable.

Other servers showcased were the HP Proliant DL320e Gen8 v2 and Proliant ML310 Gen8 v2, which are the rack-mount and tower style, respectively.

The datasheet for the MicroServer can be found here:

HP Discover Tentative Schedule

2013-06-10T18:08:19Z

Below is my tentative schedule for HP Discover. If you are looking for me, there is an 85% chance I'll be in the below events/sessions. It's going to be one full week for me, if I ever get out of the airport.

Some are HP Sessions, and others are coffee talks with leading experts. I enjoy the coffee talks, but the sessions are practical usage. I'm still waiting to get in to the HP Insight management with VMware VCenter 5.1, but that has been at capacity (both classes) for weeks. :( Oh well.

I've been on standby all day in Nashville. Part of it was my fault. The other part, is because it's the end of Country Music Awards, and all the flights are overbooked.

Do you have Cloud Credibility?

2013-06-09T14:37:34Z

A few weeks ago, I was browsing Google+, and noticed that the Nashville VMUG community was posting various things to a site called "Cloud Credibility". Of course, I get a little curious, and click on the link. No, I was not transported to a virtual world where I would only have to take the red pill and do cool moves (sigh). But, I did reach a site that was pretty cool.

VMware recently published a site called "Cloud Credibility". It's a social task site, built to get you familiar with current cloud concepts and technologies. At the same time, it gives you recognition among your peers on how much you already have done and know. For example, if you are a blogger, you might want to do task 405 "Share a blog post that talks about a free service that an SMB could use" for 200 points. Or, maybe you want to start slow and do task 548 "Read the blog post 'Five reasons why VMware Virtualization is bettern than Microsoft Hyper-V'" for 30 points.

Getting points is only one perk. Based on the number of points you receive, you can get stuff too. Initially, you will get a pen, ball cap, t-shirt, etc. But, when you start really collecting the points, the rewards get much higher. Join up! Collect some points, some cool prizes, and learn!

Juniper Gear - Got some work to do

2013-06-09T13:40:53Z

Juniper gear just arrived last week. I know, I know... many of you are saying, "so what?" or "Big deal". You might even say, "I setup and eat QFabric for breakfast". I say, "good for you". But for guys like me who are still learning Juniper, it's an exciting time. Baby steps, and all.

So, that's 5 Juniper 2200's. Upgrading some wiring closets from old Cisco gear and building a better topology and speeds. There are also 3 SRX's that will be replacing Cisco ASA's. Well, 2 clustered, and one in a lab.

If you have been following my blog, you'll notice that I am probably getting a bit eccentric, and erratic when it comes to networking. I'm going for my Cisco certification (CCIE), but I've purchased HP gear for my core and 10gig, and Juniper for my access-layer and firewalls. What is this guy doing?

Well, I do have reasons. Some are costs, others are features, but both are best for the company.

Looking forward to HP Discover 2013

2013-06-07T03:14:13Z

HP Discover is a fantastic event. I’m not kidding! It is absolutely remarkable! You don’t have to be an avid HP-lover to attend. It’s not a requirement. But the technology, information, and people at these events ARE NOT to be missed! Not only does HP put on a massively impressive show, but I am ALWAYS geek’ing out with… well…. If I say “talented” people, I would be at a loss. They are beyond talented, and I learn so much at this event!

Truth be told, I probably would not attend this event on my own. I couldn’t afford it, and my company has better things to do than invest in some convention, when technology is not their business. However, this year, I’m being sponsored because I’m also a speaker.

Going to #HPDiscover? @northlandboy and I will talk about HP Intelligent Management Center Custom Scripting h30496.www3.hp.com/connect/sessio…
— Aaron Paxson (@Neelixx) April 29, 2013

Yep! How cool is that?! Lindsay Hill (@northlandboy) and myself will be teaching a class on extending HP’s network management system called “Intelligent Management Center”. I would put this side-by-side with Solarwind’s Orion (and in some ways, it’s better). Why talk about it? Well, people need to know how to do things on equipment other than HP. So, we will show you how to extend the system to include 3^rd party manufacturers. More specifically, Lindsay will show you how to get the system to backup a Fortinet device, and I will show how to set Port Security on a Juniper device.

Chris Young will also talk about the eAPI aspect, which I have blogged about previously. Using the eAPI, I was even able to get Cisco UCCX phone system to tell me my current alarms. Why? I dunno. I just sounded cool. To see if I could, I guess.

Other sessions I’m looking forward to? Well, I’m on a wait list, but I was really hoping for the 2 hour lab session “H0L2659 - Integration of HP Insight Control 7.2 and VMware vSphere 5”. But mostly BYOD and HP Insight sessions.

If you are going to be around, shoot me a tweet! I’ll either be in a session or chilling at the Blogger Lounge!

A short photocast of Citrix Synergy 2013

2013-06-08T20:24:41Z

Please enjoy a photocast slideshow of Citrix Synergy 2013. This includes the Keynote, area, and booths. http://www.flickr.com/photos/myteneo/sets/72157633584026795/

Created with flickr slideshow.

Is Adobe's Creative Cloud a Good Thing

2013-06-07T03:40:56Z

Adobe's Creative Suite (Photoshop, Illustrator, InDesign, Flash, etc) is probably the most pirated software in the world (my opinion). In many industries, it's considered the de-facto standard for today's graphics, video and media productivity tools. So, obviously, Adobe had to do something to get their piracy under control, and re-establish some of that missing monetary value.

The chosen route? Monthly subscriptions to their software. This has the benefit of only paying for what you need. You pay a monthly amount for each month you want it. New upgrades? No problem. Just get it as needed. It's not hosted on the internet, so you just download and install. Plus, the costs are usually lower over the lifespan of the product that you use.

Let's assume you want the latest Photoshop. One website listed it as $728. Also, within 3 years, you probably would have purchased an upgrade for $200. But, Creative Cloud would sell it to you for $20 per month. It would take 46 months of usage to equal that price, and you would get some cloud storage and upgrades out of it.

Sounds great. Why wouldn't you? Well, many smaller businesses (SMB market) that are privately owned are usually measured by their EBIDTA as to the health and profit of the company. Those businesses would rather spend Capex over Opex, since Capex is depreciated over time. And software licenses can be applied to Capital Purchases, since it gives value to the company.

However, now that Adobe has gone to a subscription-based model, you can no longer apply this to CapEx. It must be opex, and it hits your expense budget immediately. Now, for $20/month, you can probably afford it. Unless your company has a large adobe team.

Overall, I can see this being a benefit. But, I can also see this being a nightmare of IT centralization of license usage and purchasing, along with budgets. Especially since this came out of no-where, and in the middle of the year where many companies are only half-way through their already approved budgets.

It will be interesting to see how it all plays out.

**UPDATE** - Check out Terri White's 5 Myths to Adobe's Creative Cloud: http://terrywhite.com/5-myths-about-adobe-creative-cloud/

Citrix Netscaler, Synergy, and LPS Integration

2013-06-07T03:43:22Z

Last year, I decided it was time to start working on virtualization at the desktop. The reasons were numerous and plentiful, and beyond the scope of this writing. Needless to say, it is a good decision.

I decided on the Netscaler 8200 for it’s ability to scale, and for the Citrix Access Gateway features. Man, this device is quite powerful. Enough so, for me to question why I’m running an F5 for my load balancing. Sure, the F5 is really powerful and loaded with options. But, I don’t use those options. I just use regular load balancing algorithms.

After reviewing the costs, the maintenance on 2 Netscaler’s for High Availability hits roughly about the same cost as one F5. Wait, I can get high-availability, SSL VPN, Citrix App Delivery, AND still load balance without increasing my OpEx? Sign me up! So, do I really need an F5? Not really. The F5 is a fantastic box, and just works, but overall, I’m going for costs and usability.

So, since then, I’ve been deploying Citrix XenApp along with the mobile receivers and the HP t410/t510 clients. However, there have been quite a few hiccups on the road. Not necessarily from an implementation perspective, just common issues. And being illiterate in Citrix, resolutions have been incredibly slow. So, I reached out to a local provider for some Citrix training. Enter LPS Integration.

Now LPS Integration is a platinum partner in Citrix, and is local to me. They've got some really smart people, and very easy to talk to. After inquiring about some training, they decided I could get a better understanding of what they can do for me, if I go to Citrix’s annual tech conference, called Synergy. So, they are sponsoring me the conference pass.

Now, I’m super stoked. I can't wait to learn more about what the Netscaler can do at Synergy! I have signed up for as many sessions that are still open, and will blog about as many as I can. Thanks LPS!

If anyone is going, and want to hook up, send me a message! @Neelixx. You can also watch (or filter) my tweets using #CitrixSynergy

Flickr VS Instagram

2013-06-07T03:43:53Z

Everyone remembers Flickr, right? It used to be the primo photo sharing service out there. But, it was complex, slow to learn, and even slower to share. It really had a "Photographer" feel to it. In other words, if you weren't in the profession, Flickr didn't feel right.

When initially started, Instagram took off like wildfire? Why? It was easy. You take a picture, put a filter on it, and post it. Simple. And people love simple. So, why change?

If memory services, back in December of 2012, Instagram worded their new terms of services in a way that would allow them to use your photos for advertising, and possibly even sales. Would they? Who knows... but the legal jargon allowed them to. So, lots of people went into an uproar about it and got Instagram to put things back.

In my opinion, the damage was done. Then, it got me thinking about copyright, and how I loved the idea that Flickr gave me copyright options (Creative Commons). But, why would I go back to Flickr? It was not exactly easy. But, oh, so it is. They learned from Instagram and made their own mobile app just as easy (but using "advanced" can give you the more control). Click, Filter, Publish. Done! Need to share it to Facebook or Twitter or <insert social network service>? Yep, you can do that too. You can even embed the images into a website:

But, if you want to get more detailed, in the same post, you can filter, tag, assign sets, to multiple images at the same time. You can also browse your "contacts" images like Instagram.

While I am still learning and getting a "feel" for Flickr, I really like the changes, and have already started moving my images over. Will you? Tell me your thoughts.

Add a drive to an existing Linux LVM

2013-06-07T03:44:26Z

Had a problem where I ran out of disk space, and needed to increase it on a Linux server. Now, I'm not a Linux engineer, but I have used it for some time. As far as I know, there are 2 ways to extend a drive that is built using LVM (Logical Volume Manager).

Add an additional drive, add it to LVM, and expand the data to use the new drive. (physical and VMware)
Expand the drive in VMware, then expand the LVM (VMware only)

I'm going to discuss option 1, since it can be used for both physical and virtual.

First off, let's see what we have to work with, shall we? Let's do a "df -h" to see our current disk usage:

[root@www2 ~]# df -h

`Filesystem`	`Size`	`Used`	`Avail`	`Use%`	`Mounted on`
`/dev/mapper/VolGroup00-LogVol00`	`15G`	`14G`	`0`	`100%`	`/`
`/dev/sda1`	`99M`	`13M`	`82M`	`14%`	`/boot`
`tmpfs`	`1.7G`	`0`	`1.7G`	`0%`	`/dev/shm`

Now, do a scan of our volume group:

[root@www2 ~]# vgscan

Reading all physical volumes. This may take a while...

Found volume group "VolGroup00" using metadata type lvm2

Let's see what our LVM Disks are:

[root@www2 ~]# lvmdiskscan

/dev/ramdisk [ 16.00 MB]

/dev/root [ 15.00 GB]

/dev/ram [ 16.00 MB]

/dev/sda1 [ 101.94 MB]

/dev/VolGroup00/LogVol01 [ 768.00 MB]

/dev/ram2 [ 16.00 MB]

/dev/sda2 [ 7.90 GB] LVM physical volume

/dev/ram3 [ 16.00 MB]

/dev/ram4 [ 16.00 MB]

/dev/ram5 [ 16.00 MB]

/dev/ram6 [ 16.00 MB]

/dev/ram7 [ 16.00 MB]

/dev/ram8 [ 16.00 MB]

/dev/ram9 [ 16.00 MB]

/dev/ram10 [ 16.00 MB]

/dev/ram11 [ 16.00 MB]

/dev/ram12 [ 16.00 MB]

/dev/ram13 [ 16.00 MB]

/dev/ram14 [ 16.00 MB]

/dev/ram15 [ 16.00 MB]

/dev/sdb [ 8.00 GB] LVM physical volume

3 disks

16 partitions

1 LVM physical volume whole disk

1 LVM physical volume

[root@www2 ~]#

And finally, our hard drives:

[root@www2 ~]# fdisk -l

Disk /dev/sda: 8589 MB, 8589934592 bytes

255 heads, 63 sectors/track, 1044 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System

/dev/sda1 * 1 13 104391 83 Linux

/dev/sda2 14 1044 8281507+ 8e Linux LVM

Disk /dev/sdb: 8589 MB, 8589934592 bytes

255 heads, 63 sectors/track, 1044 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdb doesn't contain a valid partition table

[root@www2 ~]#

At this time, I insert the hard drive. This is done by adding another drive to the physical machine, or adding a drive using VMware. Either way, add it, and reboot.

Now, when you do a fdisk -l, you will see a listing of drives, and my new drive (which is /dev/sdc)

[root@www2 ~]# fdisk -l

Disk /dev/sda: 8589 MB, 8589934592 bytes

255 heads, 63 sectors/track, 1044 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System

/dev/sda1 * 1 13 104391 83 Linux

/dev/sda2 14 1044 8281507+ 8e Linux LVM

Disk /dev/sdb: 8589 MB, 8589934592 bytes

255 heads, 63 sectors/track, 1044 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdb doesn't contain a valid partition table

Disk /dev/sdc: 32.2 GB, 32212254720 bytes

255 heads, 63 sectors/track, 3916 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Disk /dev/sdc doesn't contain a valid partition table

Now, let's create a partition

[root@www2 ~]# fdisk /dev/sdc

Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel

Building a new DOS disklabel. Changes will remain in memory only,

until you decide to write them. After that, of course, the previous

content won't be recoverable.

The number of cylinders for this disk is set to 3916.

There is nothing wrong with that, but this is larger than 1024,

and could in certain setups cause problems with:

1) software that runs at boot time (e.g., old versions of LILO)

2) booting and partitioning software from other OSs

(e.g., DOS FDISK, OS/2 FDISK)

Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

Command (m for help): n

Command action

e extended

p primary partition (1-4)

>p

Partition number (1-4): 1

First cylinder (1-3916, default 1): 1

Using default value 1

Last cylinder or +size or +sizeM or +sizeK (1-3916, default 3916): 3916

Using default value 3916

Command (m for help): t

Selected partition 1

Hex code (type L to list codes): 8e

Changed system type of partition 1 to 8e (Linux LVM)

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

Syncing disks.

[root@www2 ~]#

Let's look at our disks, now that we have added a new drive and partitioned it. Did our LVM Disks change?

[root@www2 ~]# lvmdiskscan

/dev/ramdisk [ 16.00 MB]

/dev/root [ 15.00 GB]

/dev/ram [ 16.00 MB]

/dev/sda1 [ 101.94 MB]

/dev/VolGroup00/LogVol01 [ 768.00 MB]

/dev/ram2 [ 16.00 MB]

/dev/sda2 [ 7.90 GB] LVM physical volume

/dev/ram3 [ 16.00 MB]

/dev/ram4 [ 16.00 MB]

/dev/ram5 [ 16.00 MB]

/dev/ram6 [ 16.00 MB]

/dev/ram7 [ 16.00 MB]

/dev/ram8 [ 16.00 MB]

/dev/ram9 [ 16.00 MB]

/dev/ram10 [ 16.00 MB]

/dev/ram11 [ 16.00 MB]

/dev/ram12 [ 16.00 MB]

/dev/ram13 [ 16.00 MB]

/dev/ram14 [ 16.00 MB]

/dev/ram15 [ 16.00 MB]

/dev/sdb [ 8.00 GB] LVM physical volume

/dev/sdc1 [ 30.00 GB]

3 disks

17 partitions

1 LVM physical volume whole disk

1 LVM physical volume

Now, let's create a physical volume for the new partition of the new drive

[root@www2 ~]# pvcreate /dev/sdc1

Physical volume "/dev/sdc1" successfully created

Remind me again which Volume Groups we have? We need to extend it to cover the new drive

[root@www2 ~]# vgscan

Reading all physical volumes. This may take a while...

Found volume group "VolGroup00" using metadata type lvm2

Oh yeah, that's right. VolGroup00. Lets extend the volume to include the new partitioned drive.

[root@www2 ~]# vgextend VolGroup00 /dev/sdc1

Volume group "VolGroup00" successfully extended

Okay. The Volume Group has been extended. Now, we need to extend the Logical Volume. Where is this LogVol? I need to know what to expand.

[root@www2 ~]# lvdisplay

--- Logical volume ---

LV Name /dev/VolGroup00/LogVol00

VG Name VolGroup00

LV UUID O9VkzE-BOec-nvse-7yPD-ebuR-2BTK-2DYqWk

LV Write Access read/write

LV Status available

# open 1

LV Size 15.00 GB

Current LE 1440

Segments 3

Allocation inherit

Read ahead sectors auto

- currently set to 256

Block device 253:0

Here, I am adding 30GB ( -L+30G) to the logical volume. I know this, because I added a 30GB drive. There are other ways to extend it, but I'm just using size.

[root@www2 ~]# lvextend -L+30G /dev/VolGroup00/LogVol00

Extending logical volume LogVol00 to 45.00 GB

Logical volume LogVol00 successfully resized

Now that the Logical Volume is resized, we need to expand the current file system.

[root@www2 ~]# resize2fs /dev/VolGroup00/LogVol00

resize2fs 1.39 (29-May-2006)

Filesystem at /dev/VolGroup00/LogVol00 is mounted on /; on-line resizing required

Performing an on-line resize of /dev/VolGroup00/LogVol00 to 11796480 (4k) blocks.

The filesystem on /dev/VolGroup00/LogVol00 is now 11796480 blocks long.

Done!!

UCCX Scripting - Iterating Different Recordings

2013-06-07T18:55:59Z

When scripting UCCX call center queues, it's common to put a caller on hold for a defined period of time, then do something with them. Then, put them on hold again. This could be to hear a "Thanks for holding. We'll get with you shortly" every 2-3 minutes with hold music in between.

Basic

For example, here, you will see a basic call loop. A call gets queued if the resource (call center queue) is not available. I created a variable called "CallQueueHoldDelay". This is set to 90. Which means, the call is put on hold (hears hold music), waits 90 seconds, then goes off hold. I play a "Thanks for holding message", then, goes back to "QueueLoop", and does it all over again.

But, for the script I'm working on now, I have different prompts I want caller's to hear. Maybe different accouncements? Different sales going on? Any alerts caller's should be aware of? Well, you can play these back to back, but that's information overload. We want our callers to be calm and informed.

So, how do we space them out? Welcome to the math operator called Modulus (or Modulo). Using the %, you basically get the remainder from the result of division. For example, If I divide 2 / 3... I get 1 with a remainder of 1, right? If I divide 10 / 4, I get 2 with a remainder of 2 ( 4X2=8 with 2 remaining).

In other words, the modulus operator defines how many "options" we can have before going back to the start. Let's do some examples:

Even / Odd

This basically toggles between one or the other. 2 different options. So, let's say you have 2 announcements. You want someone to hear announcement one, hold, then hear announcement two. Looking at my script, you can see I am incrementing "CountQueueLoop" by 1 each time. So, assuming CountQueueLoop starts at 0, when I go on hold, I SWITCH based on the value of CountQueueLoop % 2 (which is 0%2 which is 0). That will hit "Iteration 1" (since the value is 0) and run those commands. The next time I come back, CountQueueLoop is now 1 (which is 1%2 which is 1). That will hit Iteration 2. The 3rd time, CountQueueLoop is 2 (which is 2%2 which is 0). So, the results are only 0 and 1.

3 options

Below, you can see the same thing, only I use 3 options ( CountQueueLoop % 3). Because I am dividing by 3, I have up to 2 remainders giving me 3 options. If I use CountQueueLoop % 5, how many options can I have? 5. That's right! See, you are a natural.

In my case, I am toggling between 2 announcements. However, I don't want them back to back, so I'm using 3 iterations so that the third iteration will just be more hold to space them out a bit more.

Good Luck!

Static Mapping of Serial Devices in Linux

2013-06-07T03:47:32Z

Some time ago, I wrote about how to setup a Linux-based console server. But, there is one problem… if you reboot, your serial devices may have moved. So, to fix that, we will use UDEV to statically map the serial devices to non-changing names.

Plug in your usb converter and run the command ‘dmesg’. Look for where it was mapped to. In my case, it is ttyUSB1

usb 3-2: new full speed USB device using uhci_hcd and address 5
usb 3-2: configuration #1 chosen from 1 choice
pl2303 3-2:1.0: pl2303 converter detected
usb 3-2: pl2303 converter now attached to ttyUSB1

Now, the problem is, I plan on mapping ttyUSB1 to be connected to Switch3, but the next time I reboot, this converter could be mapped to ttyUSB0 (which may go to SW1 in my configs), and everything would be befungled.

So, we need to map it to a static name that will always point to the right switch. I will call the devices ttyCon1 thru ttyCon6. Here is how, and we will use USB1 to start.

First, we need to find some attributes to use to uniquely identify this specific adapter. Since we have multiple adapters from the same Manufacturer, it’s best we use the SERIAL number assigned to these devices. Let’s get it from the command ‘lsusb -v’, which will list all USB devices verbosely.

We only care about the “Prolific” adapters, and the device descriptor (since we are identifying at the ‘device’ level)

Bus 002 Device 003: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x067b Prolific Technology, Inc.
  idProduct          0x2303 PL2303 Serial Port
  bcdDevice            4.00
  iManufacturer           1 Prolific Technology Inc. 
  iProduct                2 USB-Serial Controller D
  iSerial                 0 
  bNumConfigurations      1

Bus 003 Device 005: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x067b Prolific Technology, Inc.
  idProduct          0x2303 PL2303 Serial Port
  bcdDevice            4.00
  iManufacturer           1 Prolific Technology Inc. 
  iProduct                2 USB-Serial Controller D
  iSerial                 0 
  bNumConfigurations      1

Bus 004 Device 002: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x067b Prolific Technology, Inc.
  idProduct          0x2303 PL2303 Serial Port
  bcdDevice            4.00
  iManufacturer           1 Prolific Technology Inc. 
  iProduct                2 USB-Serial Controller D
  iSerial                 0 
  bNumConfigurations      1

Bus 004 Device 003: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x067b Prolific Technology, Inc.
  idProduct          0x2303 PL2303 Serial Port
  bcdDevice            4.00
  iManufacturer           1 Prolific Technology Inc. 
  iProduct                2 USB-Serial Controller D
  iSerial                 0 
  bNumConfigurations      1

Now, here is where you would look at the “iSerial” to uniquely identify each adapter. But, you can see, I have a problem. Looks like the everything is the same. Even the serial number (really cheap devices??). We need to use something UNIQUE to identify each adapter. I guess the only way is to use the ID or port that it’s plugged into.

It would probably be best to use the Vendor, Product, and Serial to identify your adapters.

We will use udevinfo for that. Use this for each ttyUSB# that you have attached to your system.

[root@sys1 ~]# udevinfo -a -p /sys/bus/usb-serial/devices/ttyUSB1

looking at device '/devices/pci0000:00/0000:00:1d.1/usb3/3-2/3-2:1.0/ttyUSB1':
  KERNEL=="ttyUSB1"
  SUBSYSTEM=="usb-serial"

looking at parent device '/devices/pci0000:00/0000:00:1d.1/usb3/3-2/3-2:1.0':
  ID=="3-2:1.0"
  BUS=="usb"
  DRIVER=="pl2303"
  SYSFS{modalias}=="usb:v067Bp2303d0400dc00dsc00dp00icFFisc00ip00"
  SYSFS{bInterfaceProtocol}=="00"
  SYSFS{bInterfaceSubClass}=="00"
  SYSFS{bInterfaceClass}=="ff"
  SYSFS{bNumEndpoints}=="03"
  SYSFS{bAlternateSetting}==" 0"
  SYSFS{bInterfaceNumber}=="00"

So, I’m going to use the ID==”3-2:1.0”. I could be wrong, but I read this as “Hub #3, port #2, device #1. Which means, I’m mapping the physical port, not the adapter. Of course, if I ever MOVE this adapter or hub, everything changes. This is why it’s best to use the Serial rather than the port. Since this is only for my lab, I’m ok with that.

UDEV Rules are put in the directory /etc/udev/rules.d/, and are processed alphabetically (and must end in .rules). So, I’m going to call mine 45-swcon.rules.

BUS=="usb", ID=="3-2:1.0", SYMLINK+="ttyCon2"

Doing this, maps the adapter in 3-2:1.0 to be /dev/ttyCon2. So, if my USB adapter changes to ttyUSB102, it will still be mapped to ttyCon2, and THAT is what I use in my configs.

I can now do this for my remaining adapters. My file /etc/udev/rules.d/45-swcon.rules file now looks like this:

BUS=="usb", ID=="2-2:1.0", SYMLINK+="ttyCon1"
BUS=="usb", ID=="3-2:1.0", SYMLINK+="ttyCon2"
BUS=="usb", ID=="4-1:1.0", SYMLINK+="ttyCon3"
BUS=="usb", ID=="4-2:1.0", SYMLINK+="ttyCon4"

Now, this maps the adapter based on port. Obviously, this isn’t very flexible, but it’s all I can do, since these are VERY cheap adapters. You get what you pay for, right? If your adapters have serial numbers, use that instead. Maybe something like:

BUS=="usb", SERIAL=="0a123bcd4e1cba", SYMLINK+="ttyCon1"

That way, no matter where you plug this bad boy in, it will always be mapped to ttyCon1.

Good luck!

Create your own Serial Terminal Server

2013-06-07T03:47:02Z

Have you ever had the need to have a terminal server to access your serial devices? Maybe it's a Cisco switch, a Juniper router, maybe some HP equipment. If it is accessed through a serial connection, you can make your own Linux-based serial terminal server, without having to purchase OpenGear or Perle, or building a Cisco terminal access server from an old 2500 octal cable. All you need is a Linux system, and some serial ports.

Now-a-days, 9-pin serial ports are hard to come by, even on today's desktop systems. Even if you are lucky to find an older system, chances are, you'll have at most, 2 ports. Here is where USB-to-Serial converters come into play. Buy some, and plug them in. Linux will recognize them, and create the serial devices for them. Don't have enough USB ports? Buy a 10-port USB hub! :)

Materials:

TRENDnet TU-S9 USB-to-Serial adapter - Ebay - $9.00 new
CentOS 5.8 desktop system

Step 1: Install SER2NET in CentOS/RHEL. This is a proxy service that allows your network telnet sessions to be redirected to locally attached serial devices

Install Extra Packages for Enterprise Linux (EPEL)

For CentOS/RHEL 5.x

rpm -Uvh http://dl.fedoraproject.org/pub/epel/5/i386/epel-release-5-4.noarch.rpm

For CentOS/RHEL 6.x

rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-5.noarch.rpm

Install ser2net
1. ```
yum install ser2net
```

Step 2: Identify your serial adapters in CentOS

This seems to be a bit of a frustration to some users. Finding *which* USB port goes to which device. There are a couple of ways to do this, but the easiest is to plug in one-at-a-time and identify what the Operating System identified it to be. As you plug in your usb device, within a second or two, you can run the following command:

  dmesg | grep tty

This will pull up all the messages associated with the serial ports. The last line would be the one you just added:

     [root@sys1 ~]# dmesg | grep tty 
                serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A 
                00:07: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A 
                usb 4-1: pl2303 converter now attached to ttyUSB0 
                usb 4-2: pl2303 converter now attached to ttyUSB1 
                usb 3-1: pl2303 converter now attached to ttyUSB2 
                usb 2-2: pl2303 converter now attached to ttyUSB3 
                usb 3-2: pl2303 converter now attached to ttyUSB4

In this case, the last device I added was attached to "ttyUSB4", which would make the virtual device /dev/ttyUSB4 used in the configuration steps below.

Step 3: Configure ser2net

The configuration files are located in /etc/ser2net.conf. Here is a snippet of my configuration:

NOTE: The "##" lines define comments, and are not needed

## This defines a banner called "cisco-sw1". Places some line breaks, tells me a message, and the device I'm connected to
BANNER:cisco-sw1:\r\n\r\n\r\nYou are connected to C-SW1 on device \d \r\n\r\n 
BANNER:cisco-sw2:\r\n\r\n\r\nYou are connected to C-SW2 on device \d \r\n\r\n 
BANNER:cisco-sw3:\r\n\r\n\r\nYou are connected to C-SW3 on device \d \r\n\r\n 
BANNER:juni-sw1:\r\n\r\n\r\nYou are connected to J-SW1 on device \d \r\n\r\n


## This creates a telnet port 4001, with no timeout, to go to /dev/ttyS0 with a speed of 9600 baud and use the banner named "cisco-sw1"
4001:telnet:0:/dev/ttyS0:9600 cisco-sw1 
4002:telnet:0:/dev/ttyUSB0:9600 cisco-sw2
4003:telnet:0:/dev/ttyUSB1:9600 cisco-sw3 
4004:telnet:0:/dev/ttyUSB2:9600 juni-sw1

The BANNER is optional, but it tells me what I've connected to, once I establish my telnet session. Be sure to restart ser2net service after changing your configuration file! "service ser2net restart"

So, now, I just: "telnet <ip of your server> 4001" to gain access to the console port of that switch/router. See below for tweaks.

Tweaks:

So, you want to use this in your production environment? Using Telnet may not be the best way, unencrypted passwords/text and all. Just use SSH into your system, and telnet to the local host port:

     telnet localhost 4001

Don't want to remember all those ports? Write up a quick alias:

     alias SW1="telnet localhost 4001"
        alias SW2="telnet localhost 4002"

If you don't remember what you called an alias, because you are a slacker and haven't console'd in awhile, just use the "alias" command by itself, and it will list all the entries for you.

Can't authenticate Cisco to HP iMC Tacacs

2013-06-07T03:59:15Z

I love TACACS+. I know there are those of you who prefer RADIUS, but there are a few reasons why I love Tacacs

It's tried and true. Stable
It's TCP not UDP (c'mon, you knew I'd use this...)
It's easiest to configure Group -> Command mapping

So, when HP iMC 5.1 came out with TAM (Tacacs Authentication Module), I just HAD to try it out! So, I grabbed a lab switch, downloaded the trial version of TAM, and started hacking away. It wasn't long before I was stuck. No matter what I did, I just couldn't authenticate to iMC.

I checked the host firewall. TCP49 should be open.
I made sure the device is listed in the "Device List" of iMC TAM Manager.
I made sure tam.exe is binding to the right IP Address, using "netstat -ban".
I made sure I have created a device user, and that device user is assigned the right device user group, and that group has the permitting authorization profile.

I checked my firewall, used Wireshark, even threw in some AAA / Tacacs debug commands. Still, nothing.

I still can't login. In order to troubleshoot more, I needed to dig a little deeper. Going to the log file for TAM (C:\Program Files\iMC\tam\log) I found the following entry:

% 2012-12-03 14:55:08 ; [WARNING (2)] ; [3872] ; TAM ; $SYS$ ; (NULL) ; (NULL) ; (NULL) ; Invalid Source IP or port number(from 192.168.1.253:49).

HP iMC apparently does not include ALL IP addresses of a device when matching. More than likely, iMC uses the numerically lowest IP Address as it's primary address to identify and collect on. This is the IP Address that it is expecting to see. No other address is valid. So, even though my device in iMC has the address of (VLAN 10: 10.10.10.1), TAM is denying it, because it is coming from the IP of 192.168.1.253 (which is on VLAN 1).

How to fix it? Manually tell Cisco to use the iMC defined IP Address:

ip tacacs source-interface vlan 10

Now, why is the Cisco using that IP Address in the first place? Well, in my lab, the iMC is on the same subnet as VLAN 1. So, logically, the Cisco will send out the packet from the closest interface.

How I label network cabling

2013-06-07T04:14:50Z

Recently, I was asked what the best way is to label your cable plant within an office/building/campus environment. Of course, my answer was, "it depends".

Scenarios

The first thing I think about is "scalabililty". When you come up with your own "scheme" to label your cables, it needs to expand well. It also needs to handle changes easily, and with the least amount of time to do. For example, lets say you have 1 wiring closet, and you start labeling your cables starting from 1 (or 001, if your OCD requires you to pad your numbers). After 3 months, you have 2 racks full and your cable numbers go up to 300, and had to start a new wiring closet on the other end of the building.

Lessons Learned:

It takes time to relabel each port of the patch panels with the new cable number.
You have to remember what cable number you left off at when terminating new cables.
No easy way to find out which wiring closet a jack goes to.
You spend more time labeling, than actually terminating the cables.

You modify your approach to include office and cube names, to make it easier to identify the location of the cable. You also setup a system, so that each new wiring closet will start with a number. (i.e. Wiring Closet 1 = 1xx, Wiring Closet 2 = 2xx, etc). You also start labeling your server cables at the switch ports, to identify which cable goes to which server / switch.

Lessions Learned:

Each wiring closet is limited to 99 cables. Ooops.
Office changes forced the removal of 3 cubes that were labeled. 1 office is now a conference room. The location labels no longer are accurate.
After installing a Cisco 6509 with 7 48-port blades, you can't even see your labels in the big blur of color. Even the best cable management can't seperate the cables far enough to see the labels you put on.

Conclusion

Here is how I do it. My way may not be the best way, but it has worked for me this long. Here are my stipulations:

Don't label the patch panel. Too many ports and it wastes too much time.
Try and be as generic as possible, while still being accurate. Using "Server1" or "Cube2" is too specific, and can change.
Count Patch Panels from top down. Each Panel that has a "Port 1" gets a count of "1". (Had to add this, because some places had 24-, 48-, and 96-port panels, and they didn't know how to count them).
When labeling cables at servers and switchports, bring the label back 3-6 inches from the end. It will make identifying the cable much easier in dense environments. But stay consistent. It is not very aesthetic to see some cables at 3 inches, and some at 6 inches.
Use a cable labeler, like Dymo or Brady IDXpert. IDXpert is my favorite, because it can print on heat shrink tubing (the best for labeling cables), or wrap-around labels.

Here is how I label.

Getting user-mode after logging in with aaa user at privilege 15

2013-06-07T03:59:56Z

Had an interesting issue today. I enabled AAA Authentication on a used Cisco 3560 switch. I then created a user with privilege 15. But, every time I used either telnet or SSH, I was always getting User Mode. I wanted Priveleged Mode.

Since the highest level of privilege commands is 15, I should be getting full permissions if my user is ALSO set at privilege 15, right? Well, it does, but first there was a tiny configuration that needs to happen. First, let's enable AAA on the device:

big-old-switch(config)# aaa new-model

Now, let's create a user:

big-old-switch (config)# username neteng privilege 15 secret blahblahblah

Now, I have a user account with privilege level 15. All I need to do is telnet to my device, and I'm golden, right? Let's do that:

[root@host ~] telnet 1.2.3.4 

Trying 1.2.3.4... 
Connected to big-old-switch (1.2.3.4). 
Escape character is '^]'. 

User Access Verification 
Username: neteng 
Password: 

big-old-switch>

Wait, what? Why am I not in enable mode? I should have privilege 15, right? Let's check:

big-old-switch>show priv
Current privilege level is 1
big-old-switch>

Now, hold on a sec. Cisco, have you gone stupid? I just created a user account with privilege 15. I know.... because I just logged in as him. What gives?

The Answer:

Well, for starters, I called Cisco stupid. These devices can be *very* temperamental. Once I got off my high horse (and asked on Twitter), I realized I didn't have any authorization statements. The winning statement here?

	
big-old-switch(config)# aaa authorization exec default local

This sets the exec shell level according to AAA, which, in my case is 15. NOW, let's try it again!

[root@host ~] telnet 1.2.3.4 
Trying 1.2.3.4... 

Connected to big-old-switch (1.2.3.4). 
Escape character is '^]'. 

User Access Verification 
Username: neteng 
Password:  

big-old-switch# 
big-old-switch#show priv 
Current privilege level is 15 
big-old-switch#

Eureka! Thanks Twitter! (actually @revolutionwifi and @xanthien). There were others, but these two got it first. I hope this helps someone else. I didn't see any posts, so either I'm the only one who has had this problem, or someone just hasn't written about it yet. Since AAA has been around for a long time, I'm willing to bet, it's just me having an off day. Yeah, that's it. I'm getting more coffee.

The use-case for PoE thin clients

2013-06-07T04:08:52Z

2 months ago, I started a project to move forward with Virtual Desktops at my company. Obviously, one of the components of that is the thin clients. Who to use? Why? The industry seems to be swarming with them. Wyse, HP, NComputing, IGEL, 10zig, etc. So, it becomes a tough call.

A discussion started about someone being at Citrix Synergy 2012 and saw a full PoE display and client! I was floored! Why? To run a 19" display WITH the client AND USB, and under 15 watts? That sounds unheard of. And, to be frank, I didn't believe it until I saw it for myself. Once I saw it, a twitter discussion was not long after that.

As I was talking to an NComputing guy about the sexiness of the HP T410, he then made the comment that no one really made a use-case for this type of product. Really? You can't see it? Well, here are my reasons why this is just too cool for words:

Greater Control - You will never need to ask the user to unplug the client's power. You can do it. No need to ask anymore.
Disaster Recovery - If your building goes dark due to a power outage, your UPS and/or generator for your equipment room will continue to power the devices.
Cheaper Move/Add/Changes - No need to call an electrician to run new electrical conduits. Just drop a Cat5. You are done! Moving offices? Your team can handle it, without the added expense or time for electricians.
Longetivity - By removing the power brick from the device, you are removing one more part to be faulty, or become loose. Therefore, the device *should* have a longer MTTF.
Cheaper Power - A desktop running at 15W instead of 250W? Can you imagine the power savings if you did all of your desktops this way?

If you want to know more about the HP t410, Chris has done a really nice writeup at http://kontrolissues.net

I purchased my first HP Switch!

2012-10-09T22:47:49Z

On Sept 12, I posted a tweet saying that I purchased my first HP Switch. Obviously, this caused some discussion between the HP lovers, and the Cisco loyalists (okay, that's an exaggeration). In this post, I hope to communicate to you *why* I chose to purchase 2 HP 5406's, even though I'm working on my CCIE and I have Juniper EX's running around.

First, let's talk about the current environment. I have an office that is running a Cisco 4510E with redundant 220 power supplies and dual sup's. This switch is acting as both an aggregate switch as well as a collapsed backbone. She's a good switch. No problems (other than both supervisors losing their configs 4 years ago) whatsoever {{knocks on wood}}. It just runs. So, why replace?

1). Maintenance - Maintenance is killing me! I work for a private company owned by an equity group. OpEx (SG&A) is taboo, and if the powers that be could run the business without it, I'm sure they would. Anyway, this single switch was costing me approx $10K in annual maintenance (yes, smartnet).

2). Future proof tech - I think we can all agree, that the 4510 won't be moving us into the future. I can just see it now... 6 months from now, a challenge presents itself, and I answer "We can do MPLS. All I have to do is........ ((sigh)) nevermind."

So, now that we identified why I wanted to get rid of it, let's get back to the question, why HP?

1). Cheaper. - Now, if you know me, I'm all about spending the money if I feel it's worth it. If there is value in it, I don't mind spending more. However, to me, I didn't see the value in the Cisco name anymore. The HP switch does everything I need it to, and it is reliable. How do I know? Because I've been running 2 5406's in Sweden for 3 years without a failure.

2). Maintenance - Anyone want to guess how much HP's maintenance is? Anyone? $0. Warranty covers it all.

3). Simple - No licensing images to choose from. One image has all the features. I don't have to worry about if I'm purchasing the L3-Lite or Advanced Security image. What the datasheet says the 5400 can do, that's what I'm getting. (well, at least, it looks that way).

4). Management and Familiarity - I'm already running HP iMC, which can manage the 5400's really really well. And, as I mentioned, I'm running 2 in another country, so I would like to get more familiar with them.

The only caveat I can put out there? Well, I have actually received them and installed them yet. So, maybe I will change my mind. I doubt it, but it's possible. I just wanted to tell you the reasons behind the choices. My only regret, was that I could not afford a bigger switch running Comware. Do I need it? Not for this case, but I would just really like to dig a little deeper under those covers.