Cloud Computing Infrastructure

Cisco ASA Static NAT Multiple Global IPs to Single Real IP

2013-04-29T11:52:00.005-05:00

I am finally getting comfortable with Cisco ASA Object NAT introduced with software version 8.3. I like that ACLs use the real IP address not the global/translated IP Address.

I am still struggling when in the CLI trying to parse the different elements of the of the object because there are two "object network XYX" references in the configuration, one for the host and one for the NAT mapping.

Now on to the NAT fun....

I had an interesting Static NAT configuration scenario with Cisco ASA software version 9.1(1) recently. A customer has a domain registered and hosts their own public DNS servers. Originally they had two Authoritative Name Servers (NS) with different IP Addresses.

NS1
Public IP X.X.X.1
Private IP Z.Z.Z.1

NS2
Public IP X.X.X.2
Private IP Z.Z.Z.2

The ASA had the standard object with static nat translations:

object network inside-NS1
host Z.Z.Z.1
nat (inside,outside) static X.X.X.1
!
object network inside-NS2
host Z.Z.Z.2
nat (inside,outside) static X.X.X.2

They wanted to decommission the NS2. The NS records with the Internet Domain Name Registrar where updated, NS2 was powered off, and object inside-NS2 NAT and access list references was removed from the ASA configuration.

After a few days I saw in the ASA logs, packets blocked for DNS requests to X.X.X.2/Z.Z.Z.2. Since there was no long a real server at Z.Z.Z.2 I could not recreate the NAT translation.

I found Cisco documentation for Static NAT with One-to-Many. This allows for multiple public/global/outside IP addresses to be mapped to a single real/internal address.

1st we have to remove the remaining NS1 translation

object network inside-NS1
host Z.Z.Z.1
no nat (inside,outside) static X.X.X.1

2nd we create the object range for the global/outside addresses

object network outside-ns1-ns2
range X.X.X.1 X.X.X.2

3rd we add a new nat statement

object network inside-ns1
host Z.Z.Z.1
nat (inside,outside) static outside-ns1-ns2

The nice thing about this solution is how it handles traffic flows. When Internet traffic sent to X.X.X.1, the returning traffic has a source IP of X.X.X.1, and Internet traffic sent to X.X.X.2, the returning traffic has a source IP of X.X.X.2.

Cisco ASA One to Many Static NAT

For this post:
X.X.X.# = external, public, Internet routable IP Addresses
Z.Z.Z.# = internal, private, IP Addresses.

References:
Cisco Support Forums ASA 8.3 Upgrade - What You Need to Know
Cisco ASA CLI Configuration Guide, 9.0

Home

A Network Engineer Jumps into VMware with The Official VCP5 Certification Guide

2013-04-27T19:16:00.000-05:00

My Assistant Network
Engineer Margo.

I have worked in the IT industry for 18 years. All this time I have been focused on the Network and Network Infrastructure. I have worked on everything network, from Token Ring to ATM, Frame Relay to MPLS, 10Mbps Ethernet to Fibre Channel over Ethernet, and even Fibre Channel over Token Ring.

I decided I was ready to officially jump into virtualization. I say officially because 1) I have been "touching" VMware for the last two years and 2) I'm ready to earn VCP5 certification.

To start my journey, I recently attended the vSphere 5.1 Install, Manage, and Configure class (the official class is required for VCP5 certification). The class was great for the lecture, lab, and discussion. I needed more. To prepare for the VCP5 Exam I also need a guide to further solidify my understanding.

I am making my way through The Official VCP5 Certification Guide (VMware Press Certification). This book is great! Each section provides thorough details and explanations.

Given my networking background, I enjoyed the section "Planning and Configuring vSphere Networking". I have to admit, I have felt a little out-of-the-loop when the Virtualization guys talk about virtual switches, virtual ports, virtual networks. I'm the networking guy!! I'm supposed to be working on anything with the word "network" in it. Here they are building virtual networks I know nothing about....Rude!

The book has also helped me understand storage (don't get me started on being left out with Fibre-Channel and iSCSI networking). Storage is an area that I felt was surprisingly complicated. I saw an enclosure with a bunch of hard drives connected to a mysterious box called a "Controller" and all was good. Storage admins started talking all "Zone this", "LUN that", "my HBA flogged the target via the WWN". I think the Jets and the Sharks have been replaced with the SANs and the LANs.

Thanks to Bill Ferguson's "The Official VCP5 Certification Guide" my studies in VMware vSphere are flourishing. The book is well written, provides thorough and precise explanations. I will schedule my VCP5 exam in the next few weeks and provide an update.

Thumbs Up, Great Book!!

Billy Carter

CCIE 5022

Meraki and the The Cisco Cloud Networking Group

2012-11-19T09:23:00.003-06:00

I think this is the most interesting part of the acquisition;

"Cisco’s strategy is to take Meraki’s cloud platform and business model and scale this within Cisco as our new Cloud Networking Group, led by Sanjit, John, and Hans."

I wonder if any existing Cisco groups will be moved into the Cloud Networking Group.

Cisco Announces Intent to Acquire Meraki

Hilton Romanski | November 18, 2012 at 5:34 pm PST

Cisco is dedicated to innovation as the path to growth as well as the key to sustaining our market leadership position. Our build, buy, partner strategy has always been driven by customer need and on capturing market transitions.

Today, we are excited to announce an important acquisition that addresses the rapidly occurring shift to cloud networking as a key part of Cisco’s overall strategy. San Francisco-based Meraki, a leader in cloud networking, offers customers on-premise networking solutions that are centrally managed from the cloud.

When compared to other opportunities, Meraki built a unique cloud-based business from the ground up that addresses the broader networking shift towards cloud, not just within wireless. Meraki created a massively scalable architecture that offers easy to deploy, secure, and manage networks. They didn’t obsess about the number of features, but instead focused on those that could be simplified or removed entirely. Customers liked what they saw, and today they are supporting 20,000 customers and hundreds of thousands of network devices on their cloud platform. This has resulted in a business that is growing exponentially with great margins.

Talent is one of the most important components of every Cisco acquisition. Meraki’s co-founders, Sanjit, John and Hans, are true visionaries and leaders. The founders began with the technology, and then experimented with different markets -- pivoting from a research project at MIT to a municipal Wi-Fi company to a leading cloud networking company focused on the midmarket. Along the way, they recruited experts and created a culture in San Francisco that attracted great talent. They have focused this team around a business model that combines a rapid development methodology tightly linked to a go to market engine.

During the course of our interactions, we quickly realized that Cisco and Meraki’s shared a vision of accelerating the adoption of cloud within networking as a means to simplify operations and enable new network applications. Sequoia Capital, an early investor in Cisco, also recognized the strength of the people at Meraki, and it’s great to see the technology ecosystem come full circle.

The Meraki acquisition is another example of Cisco’s focus on accelerating our adoption of software based business models. In fact, Cisco’s last seven acquisitions (Cloupia, vCider, ThinkSmart, Virtuata, Truviso, ClearAccess and NDS) have all been software companies. Cisco’s strategy is to take Meraki’s cloud platform and business model and scale this within Cisco as our new Cloud Networking Group, led by Sanjit, John, and Hans.

I am delighted to welcome the Meraki team to the Cisco family, and look forward to a prosperous and industry-transforming future together.

Home

Over 50 FREE VMware Instructional Videos Available at VMwareLearning.com

2012-10-24T22:16:00.000-05:00

Over 50 FREE VMware Instructional Videos Available at VMwareLearning.com

VMware Education has released a new video site with over 50 of our free instructional videos, on products including: vSphere, vCloud Director, Site Recovery Manager (SRM), vFabric, and more. Now you can grow your IT skills with free training, expertise, and insights on VMware products, all in one convenient location.

Instructional Videos – freely accessible, these short technical videos allow VMware technical experts to provide tips and step-by-step instructions on product features, design best practices, configuring, deploying and running your virtual infrastructure.

Home

Administering VMware Site Recovery Manager 5.0 - Book Review

2012-05-03T13:02:00.000-05:00

I received a copy of Mike Laverick's "Administering VMware Site Recovery Manager 5.0". This is a terrific book as the first book from VMware Press. Mike's has been providing terrific guides, white papers, and videos for years on his website RTFM Education.

To some the organization and presentation of this book may seem unconventional. Chapter 1 describes Site Recovery Manager, DR technologies, and addresses misconceptions of VMware technologies often thought of as DR technologies. Chapters 2 - 6 individually explain how to configure Dell, EMC Celerra, EMC CLARiiON, HP StorageWorks, and NetApp storage for VMware. Chapters 7 - 16 then cover the configuration and operation of VMware SRM. Chapters 1 plus one of 2 -6 make this book worthwhile to anyone installing a VMware solution with a SAN.

With my background being long in the teeth with networking and a little green in virtualization, Chapter 1 was most significant to me. I have been trying to understand the architectural differences and benefits of the different VMware technologies such as vMotion, High Availability Clusters, Fault Tolerance, and SRM.

Chapter 1, What is SRM, How Was DR Done Before SRM, and What VMware Technologies are Not DR

Chapter 1 provides an "Introduction to Site Recovery Manager". The chapter offers what is new in Site Recovery Manager 5.0 and, as Mike puts it, "what life was like before virtualization and before VMware SRM".

The original DR strategy was to have physical servers at the production and DR locations and rely on conventional backup and restore. For the next approach brought in virtualized servers, some suggested P2V technologies to synchronize physical servers with virtual servers. Either the production servers or the DR servers were virtualized. This approach requires the use of storage vendor's replication or snapshot technologies. This is needed to replicate the data files that make up the virtual machine's (VMX, VMDK, NVRAM, log, Snapshot, and/or swap files). Mike goes on to detail the other technology (changing IP addresses) and political issues (the storage group may not be the same people as the virtualization group) which need to be addressed. Again as Mike says, "It was again within this context that VMware engineers began working on the first release of SRM".

Next, this chapter discusses "What Is Not a DR Technology". The discussed VMware technologies provide some terrific benefits, and each have their place, but it is argued these should not be construed as DR Technologies.

As an example, some consider vMotion a DR technology. vMotion allows for virtual machines to be moved from one host to another. For vMotion to be remotely considered a DR technology, virtual servers need to be moved from one physical location to another. It is not acceptable DR design to have a DR data center within close proximity of a production data center (close enough to have your own fiber run, or where I live, to have two buildings along the same potential tornado path). To be considered a DR technology, vMotion needs to support moving virtual machines across some distance (I consider a minimum of 30 miles is necessary). Another necessary concept to understand is a vMotion is a planned event. That is, an administrator must initiate a vMotion, in a disaster scenario this is often not possible.

Finally (there is a lot in the 1st chapter) there is a discussion of the principles of storage management and replication. He does a great job of breaking through the "marketing speak" to generalize on the storage technologies most vendors support. In other words, Ford, GM, and Chrysler each offer Park, Reverse, Forward, and a radio, they may have entirely different methods of delivering these, but they all do it.

The Storage Vendors Chapters

Chapters 2 through 6 are dedicated to configuring specific vendors storage to work with VMware. Being somewhat new to VMware and also working in a place where I am exposed to multiple storage vendors, I really appreciated these chapters. These are great from those with limited experience configuring VMware to work with different vendors SANs. For me, these chapters were excellent. Mike provides terrific information for Dell, EMC, HP, and NetApp SAN platforms.While this doesn't cover every storage vendor, the basic principles apply to those not covered.

Installing, Configuring, and Customizing SRM
Chapter 7 explains installing SRM and thoroughly discusses planning and design, storage replication, and networking requirements. New VMware 5.0 features like automated failback, vSphere Replication, and bidirectional protection definitely add to the value and functionality of SRM. This chapter is very insightful for understanding the configuration of protected and recovery sites, storage replication planning and design, and configuring SRM workflow and recovery plans.

Mike walks the reader through the entire installation and configuration process with plenty of screenshots and real world examples. It is easy to follow along as he builds out a SRM solution. As the solution is built out, it covers advanced topics like customizations, scripting, and complex configurations.

The final chapter documents upgrading from SRM 4.1 to 5.0 which would be very helpful for readers still running VMware 4.1.

Summary
This is a terrific book from VMware Press. Mike Laverick has provided a well written and organized book. The chapters covering Dell, EMC, HP, and NetApp Storage Arrays are terrific. Administering VMware Site Recovery Manager 5.0 should be on the bookshelf of VMware and Storage admins.

Disclaimer: I received a complimentary copy of this book from VMware Press. I am not being compensated for this review. All views expressed are my own.

Cisco Unity vs. Unity Connection - Installation and Recovery Times

2012-04-25T13:17:00.001-05:00

Billy Carter Post Unity Restore

For several years Cisco has offered two Unified Communications voice messaging products. Unity, built on Windows Server, Exchange (or Lotus Domino), and MS SQL, and Unity Connection built on Linux and Informix.

I just spent 12 hours restoring a Cisco Unity system and thought this would be a good time to discuss the installation and disaster recovery process. I will skip the configuration steps to integrate with the phone system, create voice mail users, etc.

Overview of the Cisco Unity Installation Process

I have been building Cisco Unified Communications Systems (or VoIP systems for the ol'timers) since 2000. Regular Unity has always been a complicated and comprehensive installation. There are many steps including things like "click options 2,3 and 5", "before proceeding to the next step, install this patch on the Exchange server", "if the Partner Exchange server is version 20XX, install Engineering Special ES9".

There is really four installations; Windows Server install, MS SQL install, messaging platform install (either full Exchange for Voice mail only, minimal Exchange components for Unified Messaging, or Domino), and finally the Unity application install.

Thankfully Cisco provides separate Cisco Unity Installation Guides or each option. I have to say, after 12 years of Unity Installations, I still always have the guide right in front of me:

Unity Unified Messaging Configuration with Exchange (with Failover Configured)
Unity Unified Messaging Configuration with Exchange (without Failover Configured)
Unity Voice Messaging Configuration with Exchange (with Failover Configured)
Unity Voice Messaging Configuration with Exchange (without Failover Configured)
Unity Unified Messaging Configuration with IBM Lotus Domino (with Failover Configured)
Unity Unified Messaging Configuration with IBM Lotus Domino (without Failover Configured)

All of the guides have you install the operating system, SQL, and messaging backend, then they all have to be patched. The Cisco Unity Server Updates wizard automatically installs recommend updates. Depending on the server model, this step takes 1.5 to 2 hours (Prior to the wizard, this was a manual process that often included 93 reboots and took 4 to 8 hours.)

Now that the core components are installed, but before installing the Unity software, the Active Directory scheme is extended and special AD accounts are created (unityinstall, unityadmin, unitydir, and unitymsg).

The Permissions Wizard is run to give these new accounts special permissions in Active Directory. Then you have to manually delegate Exchange Administrative control to some of the special Unity AD accounts. In my experience, 90% of the time when Unity fails to work properly after installation, it is due problems with the Unity accounts and permissions not being properly assigned.

Note - You can see there is extensive changes made to Active Directory, and the Unity accounts have some significant and powerful rights to Active Directory. This DOES make the AD administrators nervous (as it should). After installation, if the Unity AD accounts have some permissions removed, it will break Unity.

Finally the Unity software is installed and connected to the messaging environment.

Total Unity Installation Time: 8 to 16 Hours

Overview of the Cisco Unity Connection Installation Process

There is a single Cisco Unity Connection Installation Guide per Unity Connection version. The installation is very simple:

Put the installation DVD in the server and boot it up
Follow the installation wizard to set IP Addressing, Primary DNS, NTP, Time Zone, DHCP settings, SMTP hostname, and X.509 Certificate information.
Set the application and operating system usernames and passwords
Identify if the server is the 1st server in the cluster.
To install a Unity Connection High Availability server, follow steps 1-4, but mark the systems as the 2nd server in a cluster and enter the information about the 1st system.
Patch the system buy uploading the single update file and click install.
If using Unified Messaging following the configuration steps.

Total Unity Connection Installation Time: 1 to 1.5 Hours

Overview of Cisco Unity and Unity Connection Restore Process

Unity uses the Disaster Recovery Tool (DiRT). DiRT allows you to back up and restore a Unity system. It is very important the exact same version of DiRT is used to backup and restore.

Cisco Unity Restore Process:

You should already have run a DiRT backup and stored the files off-box
Follow the complete installation process from above (8-16 hours). The version of Unity installed must be the EXACT SAME version that was backed up (major version and Engineering Specials)
Install and run DiRT restore (30 minutes to 1 hour)

Cisco Unity Connection Restore Process:

You should already have run the Disaster Recovery System backup
Follow the complete installation process from above (1 to 1.5 hours). The information entered in installation steps 2 and 3 must be the same.
The version of Unity Connection installed must be the EXACT SAME version that was backed up (major version and updates)
Sign into the Disaster Recovery System and run the Restore Wizard (~30 minutes)

Summary

Unity Connection has several advantages over Unity:

Much faster installation process, thus much shorter RTO
Automated installation eliminates many steps which could break the system
Less dependent on the Active Directory and Messaging environment
Almost complete feature parity with Unity (Cisco says they almost have feature parity, but I can find any features missing that I or my customers want). In fact Unity Connection has many features not available on Unity
Unity Connection is under active development with new features every release while Cisco has announced Unity End Of Life
Its just an easier system

What do you think about Unity vs. Unity Connection?

Radia Perlman Talk on TRILL and Spanning Tree

2012-03-07T09:52:00.001-06:00

I found this YouTube Google Tech Talks presentation by Radia Perlman. She is often referred to as the "Mother of the Internet". She invented the spanning tree algorithm. She also invented concepts that made "link state routing" stable, scalable, and easy to manage. The protocol was adopted and renamed IS-IS. She is credited as creating the original concept of TRILL.

Her presentation is titled "Routing Without Tears; Bridging Without Danger". She discusses the creation of spanning tree, link state routing protocols and finally TRILL or Transparent Interconnection of Lots of Links. Those of of working with network infrastructure and Cloud Computing can really appreciate everything she has done.

The Best Solution is the Simplest Solution

2012-03-01T23:08:00.000-06:00

As a consultant I am sometimes brought into, shall we say, challenging situations. Some situations are primarily politically challenging, others are technologically challenging.

Today I have met a technically challenging situation. I am working on a network that is not, on the surface, much different than many others. In this case, the problem is someone has, from the technology or geek standpoint, created a very complex network. We have OSPF, EIGRP, and static routes. OSPF and EIGRP redistributing each other, and each redistributing static routes, plus back door links.

Now this environment had some challenging networking issues to deal with. However I am thinking of my favorite philosophical law called Ockham's Razor. "It is a principle urging one to select among competing hypotheses that which makes the fewest assumptions and thereby offers the simplest explanation of the effect."

Sometimes the best solution is the simplest.

Cisco Configuration Tip - 3rd Party SFP Modules

2012-02-21T09:57:00.000-06:00

It is possible to use non-Cisco SPF modules in a Cisco Catalyst switch. By default this is ~~forbidden~~ not allowed, but a ~~top secret~~ hidden command can make this happen.

switch(config)#service unsupported-transceiver
switch(config)#no errdisable detect cause gbic-invalid

In the SFP modules EEPROM, a Serial Number, Vendor Name & ID, Security code and a CRC. The switch reads these values and if they are not "Cisco" values reports an error such as:

%PHY-4-UNSUPPORTED_TRANSCEIVER: Unsupported transceiver found in Gi1/0/1
%GBIC_SECURITY_CRYPT-4-VN_DATA_CRC_ERROR: GBIC in port 65538 has bad crc

The official position from Cisco is:

Q. Do the Cisco Catalyst 3750 Series Switches interoperate with SFPs from other vendors?
A. Yes, starting from 12.2(25)SE release, the user has the option via CLI to turn on the support for 3rd party SFPs. However, the Cisco TAC will not support such 3rd party SFPs. In the event of any link error involving such 3rd party SFPs the customer will have to replace 3rd party SFPs with Cisco SFPs before any troubleshooting can be done by TAC.

Cisco Press eBook Deal of the Day

Billy Carter

Cisco Configuration Tip - Command Macro To Change IP Address

2012-01-25T08:00:00.000-06:00

Remotely changing an IP address on a Cisco router or switch, or moving an IP from one interface to another can be a challenge.

Cisco allows you to use macros although I have not really worked with them. rekrowteN has a great blog post about using macros to move an IP address from one VLAN interface to another.

In a previous Configuration Tip I discussed using the reload in/at commands to prevent getting locked out of a router or switch.

In this scenario we need to move the IP Address assigned to interface VLAN 1 to VLAN 10.

For this tip start by entering reload in 15.

Next we create the macro

conf t
macro name mgmtchange
interface vlan 1
no ip address
shutdown
interface vlan 10
ip address 172.16.1.1 255.255.255.0
no shutdown
@

The "@" signifys at the end of the macro. To apply the macro enter:

conf t
macro global apply mgmtchange

Once the change is made and you can reconnect don't forget reload cancel.

Configuring Command Macros

Have you used macro's? What Macro scripts do you use?

Cisco Configuration Tip - Protect Your Tail

2012-01-24T11:41:00.000-06:00

I have long been a fan of the Cisco "reload in/at" commands. These have saved my tail a number of times. This enables a brave network engineer to schedule a device reload for either a specific amount of time from now, 15 minutes, or just a specific time such as 11:00pm.

Protect Your Tail

This has saved my tail a few times when working on a remote device. When changing ACLs or firewall rules there is always the potential of getting locked out. It has also saved me when debug messages flooded a device and I could not get the telnet/ssh session to respond.

Bonus Tip: When I have to debug a router or a switch I open a second telnet/ssh window. The primary window is set to terminal monitor so I can see the messages. In the second window I type in "undebug all" but don't press enter. If the debug messages get out of hand in the primary window, I switch to the second window and hit enter.

Before making configuration changes, do the following:

copy run start
terminal monitor (so you can see reload countdown warnings
reload in 15

You are now free to make changes. If you get locked out, sit back and wait for the reload.

When you have made changes and still have access type:

reload cancel
copy run start

Home

Configuration Tricks - Catalyst 4900M with CVR-X2-SFP and 1Gb SFP

2012-01-19T14:52:00.001-06:00

The Cisco Catalyst 4900M is a high performance, low latency, layer-3 switch suitable for Top of Rack 10Gb link aggregation or small data centers server connectivity. eWeek testing validated 320 Gbps throughput, or 16 10G ports running at full line speed with latency of ~2.6 microseconds.

The 4900M chassis includes 8 fixed wire-speed X2 ports. Two half-card module slots can be added for additional ports. Supported modules available are:

WS-X4920-GB-RJ45 - 20 port 10/100/1000 RJ45
WS-X4904-10GE - 4 port wire speed 10GE (X2)
WS-X4908-10GE - 8 PORT 2:1 over subscription 10GE (X2)
WS-X4908-10G-RJ45 - 8 PORT 2:1 over subscription 10GbaseT

I recently had a situation were we deployed a Catalyst 4900M with the WS-X4920-GB-RJ45 and WS-X4908-10GE modules. The switch needed to connect a 1GB metro Ethernet circuit. No problem, with the 20 port 10/100/1000 module we had it covered...So I thought.

#SMH

The service provider handed off 1GB multi-mode fiber.

How Do I Connect 1GB Multi-Mode Fiber To This Thing?

WS-X4908-10GE

The WS-X4908-10GE offers 8 10GE ports at a 2:1 over subscribed ratio. A feature of this card is the ability to convert 10GB ports to dual-1GB ports with SFP transceivers.

CVR-X2-SF

The CVR-X2-SFP Cisco TwinGig Converter is installed into an X2 port and 2 SFPs are plugged into the TwinGig

(Note: The CVR-X2-SFP10G can be used to convert a 10GB X2 port into a 10GB SFP+ port)

Pre-Sales - Cisco Dynamic Configuration Tool

The first step happens in the sales process. Using the Cisco Configuration tool, you choose the WS-X4908-10GE module.

Second, click the "+" next to the 4908 part number, click the "+" next to the Port Group 1, click "SFP options" then choose the GLC part needed.

Now you can't see it, but this adds the CVR-X2-SFP TwinGig Converter Module.

Using this method, the CVR-X2-SFP is included at no-cost. Otherwise the converter sells for $195 list price.

Installation - Good 'ol CLI

The half-card slot the WS-X4908-10GE is divided into 4 port-groups. 8 ports divided by 4 port groups = 2 ports per group. A command is required to convert a port-group into 1GB ports. Since an entire port-group is converted, two of the X2 ports are switched to 1GB.

The Catalyst 4900M is based on the Catalyst 4500 family of switches. the 4900M carries over the configuration concept of modules. Module 1 is the fixed 8 ports of 10GB, module 2 is the top left slot, and module 3 is the top right slot.

To see the current port-group can be seen with:

4900# show hw-module module 3 port-group
Module Port-group Active Inactive
-------------------------------------------------------------
3 1 Te3/1-2 Gi3/9-12
3 2 Te3/3-4 Gi3/13-16
3 3 Te3/5-6 Gi3/17-20
3 4 Te3/7-8 Gi3/21-24

To change the configuration the command is:

4900(config)# hw-module module 3 port-group 4 select gigabitethernet

Verify the configuration with:

Next a reboot is required.

We ran into a small caveat. We created interfaces G3/23 and G3/24, connected the 1GB SFP into G3/24 but the interface would not connect. We had to move the 1GB SFP to interface G3/23.

Cisco configuration guide reference.

Home

Cloud Computing and Data Center Predictions for 2012

2011-12-28T16:00:00.002-06:00

Solid State Drives Go Mainstream
The terrible flooding in Thailand has caused a shortage in hard drives. Hard drive prices have increased. I expect price increases from SAN manufactures such as NetApp, EMC, HP, and others. These shortages will also increase costs for Cloud Computing providers like Rackspace, Google, and Amazon.

Credit
www.soultravelmultimedia.com

As reported in the Wall Street Journal, LSI CEO Abhi Talwalker said that companies are turning to solid state drives to relieve some of the hard drive back log. SanDisk, Marvell, and Micron have stated they have seen or expect to see increasing demand for SSD. InfoWorld reported on IDC market research that SSD shipments increased 66% in Q3 with the biggest advances coming from Enterprise (storage and servers) and Client (PCs). Price increases in traditional hard drives will provide a boost to solid state drive adoption rates in consumer PCs and SANs deployed in enterprise and service provider clouds. Also the increasing volume of SSD shipments will be accompanied by lower SSD costs. Look for more SSD in the SANs.

Hybrid Cloud Computing
In-house solutions such as Cisco Flexpod, VCE, HP Cloud, Microsoft, and others will see accelerated growth as enterprises have seen the benefits of public Cloud Computing but prefer some of the comforts of in-house private Clouds. I expect growth in Hybrid Cloud Computing deployments.

With the Hybrid model specific aspects of IT infrastructure is moved to the cloud. This allows you to mix and match the resources between in-house infrastructure which is difficult to scale and cloud resources that’s scalable and can be provisioned on demand. An example would be a Business Intelligence application where the data is located in-house cloud and the processing is performed in the cloud.

Data Center Fabric Infrastructure Takes Hold
Cisco, Juniper, and Brocade have been touting the benefits of a data center “Fabric”. In 2012, I expect to see data center fabric networks, running over 10Gb Ethernet, to move from the “early adopter” phase to the “mass adoption” phase. (It could be argued that this is already happening).

Fibre Channel over Ethernet (FCoE) and Data Center Bridging (DCB) allows storage and network traffic to be transported across common lossless Ethernet links. Server adapters called Converged Network Adapters (CNA) unify storage and network I/O to FCoE data center switches.

Benefits of a Data Center Fabric infrastructure:

Consolidated server I/O
Reduced cabling
Reduced power consumption
Increased Virtual Machine mobility
High-Speed, low latency interconnectivity
Layer-2 connectivity

What do you think?

Home

Cisco Overtakes HP in Data Center Market

2011-12-21T09:00:00.001-06:00

The global data center infrastructure hit US$26.2 billion in the third quarter of 2011, with Cisco Systems overtaking HP on aggregated revenue to take pole position, according to Canalys.

http://www.zdnetasia.com/cisco-overtakes-hp-in-data-center-market-62303222.htm

In a report released Wednesday, the research firm said worldwide data center infrastructure market grew 2.7 percent from US$25.5 billion in second-quarter 2011. Data center virtualization and consolidation, as part of efforts to migrate to private cloud, data center refresh and optimization project helped drive overall growth.

Industry standard servers remained the biggest part of the market in the third quarter, accounting for 39 percent of total investment, followed by storage at 25 percent, and Ethernet networking at 21 percent, Canalys said.

On an annual basis, industry standard server revenue increased by about 9 percent, but the strongest growth was in server virtualization which rose by approximately 30 percent.

Delving into vendor analysis, in the third quarter, Canalys said Cisco overtook HP to take pole position in the data center infrastructure market, followed by IBM in third position, Dell in fourth and EMC in fifth. In the x86 blade server market segment, Cisco is currently third but is expected to be second to HP by the end of 2012, the research firm predicted.

Data center networking and security, including switches, routers, network security, storage networking and application delivery networking, grew sequentially in the third quarter. This had boosted Cisco's position in the overall market, Canalys said. Moving forward, growth in all types of data creation including video, sensor information, social media and transactional data as well as the increasing need to store, protect, archive and access this data, will continue to drive investment in storage within data centers.

"Following its restructuring earlier in the year as part of its strategy to focus on core activities and streamline operations, Cisco reported a strong improvement, especially in its switching business, while its growth in blade servers remained robust," said Matthew Ball, Canalys' director of enterprise services. "After a challenging last three quarters, Cisco's lead in network security and improving performance in switches, storage networking and application delivery networking, as well as its performance in blade servers, propelled it ahead of HP."

However, HP is expected to fight for the top place in the aggregated data center infrastructure market as it continues its expansion into networking storage, especially since the technology giant is building on its acquisitions of 3Com and 3Par, while establishing a converged channel to sell servers, storage and networking, Canalys said.

Ball added that HP's recognization of its security activities, including TippingPoint, ArcSight andFortify, into a single dedicated busines unit with centralized go-to-market and marketing processes, would aid its network security revenue.

While North America remained the largest market in the third quarter, accounting for 42 percent of data center infrastructure investment, emerging markets in Asia-Pacific and Latin America experienced the fastest growth rates, according to Canalys.

Previous Blog posts on Cisco, HP, and Data Center Infrastructure

Catalyst 4900m with HP Virtual Connect

VMware ESXi Optimizations for Cisco UC on UCS

Home

Putty Beta 0.62 Released

2011-12-13T10:32:00.002-06:00

Putty version 0.62 has been released by Simon Tatham. Putty is my favorite Telnet, SSH, Serial Terminal Emulation client.

These features are new in beta 0.62 (released 2011-12-10):

Security fix: PuTTY no longer retains passwords in memory by mistake.
Bug fix: Pageant now talks to both new-style clients (0.61 and above) and old-style (0.60 and below).
Bug fix: PuTTY no longer prints a spurious "Access denied" message when GSSAPI authentication fails.
Bug fix: PSCP and PSFTP now honour nonstandard port numbers in SSH saved sessions.
Bug fix: Pageant no longer leaks a file handle when an authentication fails.
Bug fix: PuTTYtel no longer crashes when saving a session.
Bug fix: PuTTY now draws underlines under the underlined text instead of sometimes putting them somewhere off to the right.
Bug fix: PuTTY now should not draw VT100 line drawing characters at the wrong vertical offset

Download Putty 0.62

Here are my previous posts on Putty and Putty Connection Manager.

Putty version 0.61 released

Home

Cisco UCS-C Servers Rack Mounting Adapter Kit

2011-09-29T13:55:00.001-05:00

The Cisco UCS-C Series servers come with a terrific tool-less slide rail kit. The rail kit is compatible with 3/8" square hole and 1/4" round hole racks. The rail kit does not work with 2post racks and threaded hole racks.

I found two adapter kits from The Server Rack.

The Threaded Hole Rack Adapter Kit

The 2Post Rack Adapter Kit

http://www.server-racks.com/ciscos-slide-rail-kit-for-ucs-c200-c210-c250.html

That is all...

Home

VMware ESXi 4.1 Optimizations for Cisco UC on UCS

2011-09-26T12:50:00.000-05:00

In my previous post I discussed the importance of installing the latest version of VMware Tools on UC virtual servers in a Cisco UC on UCS deployment. A second and equally important VMware 'tweak' is disabling Large Receive Offload (LRO) on VMware ESXi hosts.

VMware Knowledge Base Article 1027511 addresses some Linux TCP/IP stacks perform poorly when handling LRO-generated packets. This results in poor TCP performance.

Log into the ESXi host or its vCenter with vSphere Client.

Select the host > Configuration > Software:Advanced Settings.

Select Net and scroll down slightly more than half way.

Set the following parameters from 1 to 0:

Net.VmxnetSwLROSL
Net.Vmxnet3SwLRO
Net.Vmxnet3HwLRO
Net.Vmxnet2SwLRO
Net.Vmxnet2HwLRO

Reboot the ESXi host to activate these changes.

Your guest VMs should now have normal TCP networking performance.

References:
http://docwiki.cisco.com/wiki/Disable_LRO
VMware Knowledge Base - KB Article 1027511
Cisco UC on UCS - Don't Forget VMware Tools

Home

Cisco UC on UCS - Don't Forget VMware Tools

2011-09-19T13:21:00.000-05:00

Recently we upgraded a Cisco Unified Communications system running on physical HP servers, to Cisco UCS C-Series rack mount servers. Three days after the upgrade, all of the UC applications slowed down.

When users picked up their phone handset, there was a noticeable delay before dial tone. Delayed dial tone is a classic symptom of an overworked CallManager.

The Cisco UCS C210M2 servers were more than adequate for the load. Each UCS-C210M2 hosted VMware VMs of CallManager, Unity Connection, and UCCX. All of the VMs were deployed using the Cisco prescribed OVA templates.

Cisco UCS C210M2

So what is “VMware Tools”?

According to docwiki.cisco.com/wiki/VMware_Tools:

VMware Tools are specialized drivers for virtual hardware that is installed in the UC applications when they are running virtualized.

Now I understand Drivers. Up to date drivers are a good thing. Docwiki goes on to state:

It is very important that the VMware tools version running in the UC application be in sync with the version of ESXi being used.

Anyone who has read Cisco documentation before should realize, Cisco doesn’t often use the phrase “it is very important”. This is as close as Cisco gets to saying “you have to do this”.
So we installed VMware tools on all of the VMs and the Cisco voice system has been stable ever since.

Cisco has 3 methods for installing VMware Tools on Unified Communications Application VMs dependent on the UC Application version. Visit DocWiki-VMware Tools to find the appropriate method.

Please Note: VMware Tools will have to be re-installed anytime VMware ESXi is patched or upgraded.

Home

Touchpad Lack of Apps? I don't need no stinking apps

2011-09-13T21:30:00.000-05:00

I have had my Touchpad for about 4 weeks. It have spent most of this time tweaking and reading books with the Kindle App. For the last year I have been debating whether to get an iPad or Android tablet or an eReader such as a Kindle or Nook.

I have an iPhone which I really like. I like the vast array of applications. My favorite and most used iPhone apps are Echofon (twitter), Google+, Evernote, SkyGrid, AP Mobile, CNBC, YouTube, MLB.com, Zynga Poker, Yelp, Dropbox, USA Today, YouVersion Bible, and Amazon Kindle.

I primarily use my iPhone for, besides talking and texting, to keeping up with Twitter and Google+, news and stock information, reading books work related PDFs. I really enjoy the iPhone Kindle app. In the last year I have read about 10 books. The screen is small and I just get into a rhythm of turning the page every 5 seconds.

So I wanted a tablet type device specifically for reading. Being stubborn and difficult, I didn't want to forego the opportunity to surf the web. In short I wanted an eInk reader that could switch to an iPad. Well that device doesn't exist, so I kept reading on my iPhone.

Then we got a call in the office. Our company had purchased a quantity of HP Touchpads. These were made available for sale, one per employee. I did a Google search and saw the Kindle was available on the Touchpad. So I bought one.

After 4 weeks I can say I am love the Touchpad as an eReader, and I am adjusting to the new mindset of the WebOS. I love the Kindle app (enough about that). I keep thinking the WebOS is hindered by the lack of apps.

However, WebOS supports Flash. This causes a bit of a change in mind set. Many iPhone/iPad apps exist because a webpage running a Flash app isn't possible. So if a web site I frequent uses Flash, WebOS supports Flash, the Touchpad doesn't have an app for the site, and I can just go to the website and do what I want, do I care there isn't an app?

Here is a more concrete example....Sunday I was watching the NFL games and wanted to track my Yahoo Fantasy Football team. My iPhone doesn't support the flash based "stattracker" realtime interface. The iPhone Yahoo Fantasy Football app will show updated stats in a vanilla interface that reloads every minute. Basically the app is the same experience was the iPhone web page but with automatic reloads.

I pulled out the HP Touchpad, went to the web site, and launched the flash based stattracker and followed the beautiful realtime stats. Wow! The web page was great, no special app needed.

Home

9/11 - My Day

2011-09-11T23:07:00.001-05:00

9/11/2001 Started out as a normal day for me. I remember it was a beautiful day. Mid 70s and not a cloud in the sky. If things at work went well I was going to sneak out early.

I was at a customers integrating a firewall with a web content filter. I had the basics working and moved on to the more advanced parts. One of the customer's employees came into the room and announced two planes had crashed into the World Trade Center. She found a TV and moved it into the conference room.

I hurried to get my work done so I could get to watching TV. I felt numb. I remembered the previous attack on the WTC. I had assumed that was an isolated incident by a few radicalized, American hating, muslims whom learned how to build a "fertilizer" bomb from the Internet.

My phone rang a couple of times. It was my wife. I was thankful she called. We shared in our shock at what was happening and exchanged "I Love You's".

Then my phone rang again. I didn't recognize the number other than it was a downtown Chicago number. I answered the phone to hear an obviously crying female voice say hello. I recognized the voice as a customer.

The last couple of months I was doing some work for her company. Her office was in an unique location. Her office, and the computer systems she supported, was located within the Federal Reserve Bank of Chicago.

The Federal Reserve Bank of Chicago is a few blocks of the former Sears Tower.

Hearing her sobs I said, "Hello. Are you ok? What can I do for you?".

What she said stunned me....

Struggling to compose herself she said, "Two plans flew into the World Trade Center. We were just told a plane is flying towards the Sears Tower. The building is being evacuated. My boss told everyone to get out."

The gentle sobs erupted into a flood of fear, panic, and terror. "My boss told everyone to get out except me... I have to stay and watch our systems to make sure they are secure." "He said if someone else will watch the systems, I can leave!!"

"Go!!" I said. "Thank you" is all I heard.

I talked to her a couple of times in the next two or three days, but never after that. For the next week I monitored their systems and saw nothing unusual.

I was happy to learn she left her employer a few weeks later.

Putty Version 0.61 and Putty Connection Manager

2011-08-08T11:45:00.003-05:00

I use Putty for telnet, SSH, and serial connections to. Putty is an excellent terminal program. I also use Putty Connection Manager for Tabbed windows and login scripts.

Putty Connection Manager is a Free Putty Client add-on. http://puttycm.free.fr/cms/index.php

Simon Tatham has released version 0.61 of Putty. Putty 0.61 can be downloaded at: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html

2011-07-12 PuTTY 0.61 is released
PuTTY 0.61 is out, after over four years (sorry!), with new features, bug fixes, and compatibility updates for Windows 7 and various SSH server software.

These features are new in beta 0.61 (released 2011-07-12):

Kerberos/GSSAPI authentication in SSH-2.

Local X11 authorisation support on Windows. (Unix already had it, of course.)

Support for non-fixed-width fonts on Windows.

GTK 2 support on Unix.

Specifying the logical host name independently of the physical network address to connect to.

Crypto and flow control optimisations.

Support for the zlib@openssh.com SSH-2 compression method.

Support for new Windows 7 UI features: Aero resizing and jump lists.

Support for OpenSSH AES-encrypted private key files in PuTTYgen.

Bug fix: handles OpenSSH private keys with primes in either order.

Bug fix: corruption of port forwarding is fixed (we think).

Bug fix: various crashes and hangs when exiting on failure,

Bug fix: hang in the serial back end on Windows.

Bug fix: Windows clipboard is now read asynchronously, in case of deadlock due to the clipboard owner being at the far end of the same PuTTY's network connection (either via X forwarding or via tunnelled rdesktop).

Putty Connection Manager Features

Features

Tabs and dockable windows for PuTTY instances.

Fully compatible with PuTTY configuration (using registry).

Easily customizable to optimize workspace (fullscreen, minimze to tray, add/remove toolbar, etc...).

Automatic login feature regardless to protocol restrictions (user keyboard simulation).

Post-login commands (execute any shell command when logged).

Connection Manager : Manage a large number of connections with specific configuration (auto-login, specific PuTTY Session, post-command, etc...).

Quick connect toolbar to quickly launch a PuTTY connection.

Import/Export whole connections informations to XML format (generate your configuration automatically from another tool and import it, or export your configuration for backup purpose).

Encrypted configuration database option available to store connections informations safely (external library supporting AES algorithm used with key sizes of 128, 192 and 256 bits, please refer for the legal status of encryption software in your country).

Standalone executable, no setup required.

Localizable : English (default) and French available (only when using setup version, standalone is english only).

Completely free for commercial and personal use : PuTTY Connection Manager is freeware.

Home

How I passed the CCIE R&S Lab on my 1st Attempt

2011-07-24T23:29:00.004-05:00

I am studying for my CCIE Re-Certification. This has re-kindled my interest in many of the “CCIE Lab” study materials out in the Internet. With all of this material available, I wanted to share what I did to pass the CCIE R&S Exam.

I passed the CCIE Routing and Switching Lab 12 years ago on August 26, 1999. I took my lab exam in the beautiful Halifax, Nova Scotia. This was one of the most beautiful places I have ever visited. I took my exam on a Monday and a Tuesday (yes, back then it was a 2 day exam). My wife accompanied me; we arrived on Saturday and spent a day and a half being tourists.

When people in the “know” realize I am a CCIE I am often asked, “How many attempts until you passed”. My response is “one”. I say this, not to brag, but to give some credibility to what I am sharing.

When I started to study there was no study guides. People who had taken the exam would not talk about the test, even the number of routers they saw. The big rumor was there was a major Frame-Relay component, but no one would talk about this.

I found Bruce Caslow’s book “Cisco Certification: Bridges, Routers and Switches for CCIEs”. This was not a “how to pass the CCIE Exam”; it was a structured road map for preparing for the lab. From this book I discovered and learned how to study technologies inside and out.

I put together my CCIE lab rack. I quickly realized there was no need to constantly change the cabling. I needed a configuration that gave me a Frame-relay Point-to-Point connection and a Point-to-Multipoint connection. If I needed additional interfaces I could use Loopback interfaces. Quick tip, If you have an Ethernet interface, but no switch/hub to plug it into, “keepalive 0” will make the interface come up.

Combining the Caslow book with my own plans I did a couple of things structurally that helped:

Lab Time

Monday – Thursday 7:00pm-Midnight
Saturday or Sunday – 8hr
Stop Time
On Monday – Thursdays I had a hard stop time of midnight.
If I completed my tasks with lots of time to spare, I erased the configurations and did it again
Otherwise, I used the hard Midnight stop time to pressure me to get it done
This way I built in the time factor every day

Typical Study Week

Each week I had a “topic”
One week would be OSPF, the next IS-IS, the next IGRP/RIP redistribution into OSPF/EIGRP/RIP/IGRP, the next week BGP
For the week, I would spend the first two days on the easy stuff.
The next three days would be “advanced topics
On Saturday or Sunday for the 8hr session, I would configure the advanced scenarios from the week and add on other topics to fill out my time

To summarize what it took me to pass the CCIE Lab…

From day 1, I followed a regime that enforced timed deadlines. Every day I was pressured by time
Each week I focused on a topic learning each and every the nuance
I didn't have study guides that gave me a long string of “sample” test questions
I studied each of the protocols in detail to learn how they worked
I had a relaxing day and a half before my test

-Billy

Comcast, Skype announce partnership - Does this kill Cisco umi?

2011-07-13T09:43:00.000-05:00

I found this article by Larry Hettick at Network World. Comcast, Skype announce partnership

Comcast and Skype announced a strategic partnership that will bring HD video calls, audio calls, and messaging to Comcast customers' television sets. The announcement was timed to coincide with the annual National Cable & Telecommunications Association's "Cable Show" held in Chicago.

Under the arrangement, Comcast subscribers will be able to connect to each other and to the global base of Skype users. Video calls from the television using Skype will be able to connect to other TVs, PCs, compatible smartphones or tablets...

The service will be delivered to the HDTV through an adapter box, and it comes with an HD video camera and microphones that sit atop the TV set, along with a specially designed remote control that combines a keyboard for texting, TV controls and audio/visual communication controls. The other calling party does not need any special equipment beyond what is needed to use Skype.

So if Comcast customers can use Skype for HD video calls to their TVs, where does this leave the Cisco umi?

Skype already has solutions for SMB and Enterprises including SIP connectivity to IP-PBXs.

Home

The IT Conflict: The Network vs. Users. Part 1

2011-07-07T23:01:00.000-05:00

We can all agree, working in IT has its challenges. A friend recently asked me "What has been the most significant challenges in IT recently?"

To that I say "how much time do you have?"

Over the years we have seen many technology innovations. Some have been business focused while others have been consumer focused. Business focused innovations improved network performance and reliability, application intelligence, business efficiencies, and security. Consumer innovations have focused on features, functionality, and ease of use. Often, consumer innovations have created headaches for the IT department.

I remember, back in the day, installing VPN servers when dial-up modems were the norm. Who would use a VPN when they could just dial in? A short time later, broadband Internet connections exploded, end user signed up like mad, and nobody wanted to access corporate resources through a dial-up modem any more. We struggled to install VPN servers with enough capacity.

Then wireless Ethernet appeared. Business users could connect their company provided laptops to their home wireless networks, but still had to plug-in at work. Why did they have to plug-in at work? “Can’t the IT department implement wireless as easy as at home?”

So we struggled to install standalone wireless access points. They were cumbersome, then we figured out centrally managed wireless networks were much more efficient.

Today many organizations have deployed remote-access VPNs and centrally managed wireless networks. Business users, from home, hotel rooms, conference rooms, airports, Starbucks, or other locations, can securely connect to the corporate network. In the physical office, business users can connect with wired or wireless connections and easily access the same systems. We even can support “Guest” wireless connections

We could finally rest, IT finally caught up to the users. But, like Steve Jobs likes to say, “but there’s more”. ...Great!@$%

Now we have business users bringing in other devices not provided by the IT department. I have a customer who has a XBOX in a conference requiring wireless Internet access.

It is now a reality; IT Departments now have to support Smartphones. Business users expect “always on” connectivity. Users expect to not only have continuous access regardless of their platform.

Not only does the IT department have to pay for the Data plans, they now have to support the wireless Ethernet connectivity requirements. It would be easy to not support wireless Ethernet connectivity, but the cost of cellular data usage has to be considered. It is now financially prudent to allow Smartphones onto the business network.

Now, do we want the smartphones on the “Guest” wireless network, or the “internal”. Both have their advantages. “Guest” lets the user connect like they are at home but they may have to sign in to a “Guest” splash screen. An “internal” wireless connection may open up the network to security hazards.

And then someone in management had to go and get a tablet. It could be an iPad or an Android device, it doesn’t matter. The IT department didn’t buy it, but it needs to connect to the network. When the connection doesn’t work, we hear “what do you mean ‘no more IP addresses are available’”, “when I’m in my office, Angry Birds is slow”.

In my next installment; Unified Communications – home user features vs. business users’ functionalit

Home

As We May Think - Atlantic Mobile

2011-06-20T22:41:00.003-05:00

Director of the Office of Scientific Research and Development, Dr. Vannevar Bush, 1945

http://theatlantic.com/magazine/archive/1945/07/as-we-may-think/3881/

As Director of the Office of Scientific Research and Development, Dr. Vannevar Bush has coordinated the activities of some six thousand leading American scientists in the application of science to warfare. In this significant article he holds up an incentive for scientists when the fighting has ceased. He urges that men of science should then turn to the massive task of making more accessible our bewildering store of knowledge. For years inventions have extended man's physical powers rather than the powers of his mind. Trip hammers that multiply the fists, microscopes that sharpen the eye, and engines of destruction and detection are new results, but not the end results, of modern science. Now, says Dr. Bush, instruments are at hand which, if properly developed, will give man access to and command over the inherited knowledge of the ages. The perfection of these pacific instruments should be the first objective of our scientists as they emerge from their war work. Like Emerson's famous address of 1837 on "The American Scholar," this paper by Dr. Bush calls for a new relationship between thinking man and the sum of our knowledge. —THE EDITOR

By Vannevar Bush, 1945

Click here to read the full article

-Bill Carter