Sreekumar Blog

Horizon Flex with Mirage for Virtual Machine Protection and Image Management

noreply@blogger.com (Unknown) — Tue, 03 Oct 2017 09:47:00 +0000

1 Introduction

Integrating VMware Horizon Mirage with Horizon FLEX Server will perform centralized Image management, with which we can take timely backups, apply patches etc to the restricted Horizon FLEX Virtual Machine.

2 VMware Horizon Mirage and Flex Lab Environment

Lab Environment is setup with a single VMware ESXi Host, Desktop, Laptop and Guest Machines.

Hardware

Dell Desktop OptiPlex 9020 : ESXi Host

Horizon Mirage & Flex Server : Virtual Machine

Flex Client (VMware Workstation Player) : Dell Desktop OptiPlex 9020 & Dell

Latitude E5540 Laptop

Network Connection : Physical Switch (Dell 2824) & VSwitch

Network Speed : Read: 500 Mbps

: Write: 700 Mbps

OS : Windows 2012 R2 & Windows 7

VMware ESXi : 6.0.0 Update 2

VMware Horizon Mirage : 5.8.0.30302

VMware Horizon Flex Server : 5.8.0.30302

VMware Workstation Player : 12.1.0

Lab Network

System Requirements

1. Virtual Machine for Mirage Server, Mirage Management Server, Mirage Web Manager & Flex Server
2. Virtual Machine for creating Flex Image and Reference CVD
3. Virtual Machine for creating App Layer.

3 VMware Mirage and Flex Integration Work Flow

4. The below flowchart shows the work flow to create a Flex Virtual machine and enable Image management through VMware Mirage.

4 Step to configured Flex Image and enable automatic backup in Mirage

4.1 STEP 1

The below process is to create a Virtual Machine Image with Encryption and Restriction Server. This process is done on VMware Workstation Pro. This Virtual Machine Image is used to register a Flex Virtual Machine for distributing to Clients.

Building Virtual Machine Image for Flex Server.

1. Install VMware Workstation pro

2. Create Virtual machine and Install Windows 7

3. Install VMware Tools and reboot

4. Enable Administrator Account and Log with Administrator Account

5. Delete all other users

6. Install VMware Mirage Client

7. Verify the Virtual machine is showing in Pending Device section of VMware Mirage Server

8. Sysprep the Virtual machine and Shutdown

9. Encrypt the Virtual machine with password

10. Enable Restriction password, configure Flex Server URL in Restriction server as https://<FlexserverFQDN> and Check Server.

11. Export the Virtual Machine to TAR file and extract the .VMX file

12. Upload the TAR file to Web server and copy the Link

Now we have a Virtual Machine Image to register in Horizon Flex Server

4.2 STEP 2

To protect the users Flex Virtual Machine using Image Management, we are integrating the Flex Image with Horizon Mirage Server. The Horizon Mirage Server will perform centralized Image management, with timely backups for the Flex Virtual Machine. We are creating a Base layer in Mirage Server and applying this Base Layer to the Flex Virtual machine during the Flex Virtual Machine Entitlement Policy creation.

For creating a Base Layer we required to create a Reference CVD in VMware Mirage Server. This Reference CVD is used in later to update the captured Base Layer. For Reference CVD we are using the same Virtual machine which was used to create Flex Virtual Machine Image.

Once the Virtual machine is Powered On and connected to Mirage Server, follow the bellow steps to create a Reference CVD.

1. Power on the Virtual Machine which was created for Flex Image

2. Proceed with the initial Configuration as it is SysPreped.

3. Verify the Virtual Machine is showing in Pending Device section of VMware Mirage Server web console.

4. Click Create Reference CVD and Choose Base Layer.

5. Select the CVD Policy and Continue.

6. In Base Layer Selection wizard, Choose “Do not use a base layer”.

Note: As we are creating the first Base Layer, there will be no Base layer in the List.

7. Select the Target Volume for storing Reference CVD as Automatic.

8. Validation process will be performed and if it passed then Continue.

9. Verify the summary for the new Reference CVD and Click Finish to Complete.

10. The Virtual machine will be moved to CVD Inventory and will start the Upload process.

11. Status can also be verify in Mirage Client.

12. Once the Virtual Machine is completely uploaded and sync with the Server, the progress Status will be “100 %” and Activity Status will be “Idle”

13. Shutdown the Virtual Machine and keep it for further Layer Update.

Note: Now we have a reference Image for creating a Base Layer Image. This Image is required for future Base Layer Updates.

4.3 Step 3

This Step is to create a Base Layer from the above created Reference CVD. Once the base layer is capture, we can assign this base layer to the Flex Virtual Machine.

Create Base Layer from Reference CVD

1. Navigate to CVD Inventory in Mirage Web console

2. Select the Created CVD Reference which was create on Step 2

3. Select Capture Base Layer from the options.

4. Proceed with the Window.

5. Create a New layer and Input the details.

Note: Same process is done for updating the layer. We can install the software updates, Patches, new Software’s in the Reference CVD and update the CVD. Capture Layer from the updated CVD and choose Option “Update an existing Layer and choose the existing layer.

6. Validation process will be executed and continue.

7. Verify the Summary and Click Finish to Complete.

8. Verify the progress in CVD Inventory Tab.

9. Captured Base layer progress can be verified under Task Tab

10. Once the process is completed and verify the Base Layer is created under Layers Tab.

Now we have a Base Layer Image for deploying to Flex Virtual Machines. The base layer is the first thing deployed to a client machine if it’s completely managed by Mirage.

4.4 Step 4.

Once the CVD Policy and Base Layer is configured in Mirage Server, next is to register the Flex Virtual Machine, entitle the users and configure the above created Base Layer to Flex Virtual Machine in Flex Server.

If the Virtual machine is configured with Mirage Client, then additional option “manage the virtual machine with Mirage” will be populated in new entitlement wizard.

This step involve the Registration of Flex Virtual Machine, creation of entitlement Policy and configure the Flex Virtual machine to manage with Mirage Server in Flex Server Web Console.

1. Log in to Flex Server Web Console and Navigate to Images Tab.

2. Click New to add a Virtual Machine Images

3. Click Select next to the Select Image File text box and browse to the virtual machine configuration (.vmx) file for the source virtual machine.

4. Enter the Virtual machine TAR file location in Image URL filed.

5. Click OK to Finish.

6. Navigate to Entitlement Tab.

7. Create new entitlement for the Flex Image

8. Add required Members and Choose the Flex Policy

9. As the Image is configured with Mirage Client, the wizard will ask an Option for Manage with VMware Mirage window.

Choose “Use VMware Mirage for disaster recovery and image management scenarios”.

10. Select the CVD Policy

11. Select the Base Layer (created on Step3 )

12. Select App Layer if applicable.

13. Validation Process will complete and continue to Finish the process.

Now we have a Flex Virtual Machine image which is managed by VMware Mirage for backup and disaster recovery.

4.5 Step 5

This step will provide the details, how clients access the Flex Virtual machine and auto assigned to Mirage Server for backup.

1. Install VMware Workstation Player in client machine

2. Connect to Horizon flex server from VMware Workstation Player

3. Download the Image.

4. Provide the Encryption password and Log into the Virtual machine.

5. Once the Virtual Machine is connected to Mirage Server, the Virtual Machine will be in the Pending Device tab of VMware Mirage Web Console and the status will be Pending Registration.

6. On the Virtual Machine a windows will prompt for Machine Registration in Mirage Server.

Provide the Domain credentials and Click OK

7. Verify the Virtual machine is registered, auto centralized and moved to CVD inventory Tab in Mirage Web Console.

8. Verify the Mirage Client Start updating the Layer Image and status in Mirage Server as initializing upload.

9. Once the Layer Update is completed, the Virtual machine will prompt for Reboot.

10. Click Restart Now

11. During the reboot, the Virtual Machine will be updated with base layer.

12. Once the Virtual Machine is active and sync with Mirage Server, CVD will be created for the Virtual Machine in the CVD Inventory and snapshot will be captured based on the Policy

This process will be perform for all Flex Virtual machine which is downloaded and connected to Flex Server. All the user Virtual Machines CVD will be created and these Virtual machines will be under Mirage Image Management.

5 Capturing an Application Layer

Creating and updating application layers is done in four steps.

1. Power on the Virtual machine which is prepared for App Layer Capture.

2. Once Virtual Machine is connected to Mirage Server, Virtual Machine will be in the Pending Device tab of VMware Mirage Web Console and the status will be Pending assignment.

3. Click Create Reference CVD and Choose App Layer

4. Select the CVD Policy

5. Choose the Target Volume to save the App Layer

6. Validation process will execute and continue to Finish.

7. Once the wizard is completed, Virtual Machine will be moved to CVD Inventory and start initializing the app layer recording.

8. Virtual Machine will pop up with a window initializing app layer recording

Note: During this time, the Mirage is capturing the system state which later compare to the system state after installation of application.

9. Once the initializing completed, Virtual Machine is ready to capture application installation.

10. Install the required application during the recording time.

As an example I have installed Libra Office and Windows Security Patch KB3170455.

11. Once the installation is completed, Click Finalize App Layer Capture.

12. Mirage will update the required information and will display the recorded Application

13. Create a New App layer and Input the details.

14. Continue the Wizard to Finish.

15. After that Mirage will start App layer Capture

16. Once the App layer is capture completed, the captured App layer will be in the Layers Tab.

6 Deploying an Application Layer

1. Select the Machine for App layer deployment from the CVD Inventory tab.

Note: Selected Machine is not installed with Libra Office and Windows Security Patch KB3170455.

2. Select Assign App Layer

3. Assign App Layer wizard will pop up and choose the Application Layer. Select Download option as Download and apply layer

4. Continue the wizard and Finish.

5. Once the App layer is assigned, Mirage will initialize Layer update.

6. Verify the update in Mirage Client

7. Once the App layer update is completed, Virtual Machine will prompt for reboot.

8. Once the Machine is rebooted, Application will be installed in the machine.

Note: Application Layer can’t deliver Windows OS components – such as .Net Framework, Windows Updates, Windows licenses, user accounts etc. In most cases, these can be covered through Base Layers though.

Application layers can only be deployed to Mirage clients which have a base layer deployed.

Above test shows that the Libre Office get installed, but Windows Patch KB3170455 not get deployed.

7 Migrate a CVD to a Replacement Device.

There will be situation where Virtual machine get crashed and not able to boot. In this situation we can utilize the option hardware migration to restore the CVD to another Virtual Machine, so that the user Data and all application will be restored without data loss. Later this Virtual machine can be assigned to the user and it will under protection.

Physical Machine migration also can be done with hardware migration, but this process require Driver profile to be created for the Physical machine driver. `

1. Log into VMware Mirage Web Console.

2. Select the CVD of Machine which need to be migrated to another Device.

3. Select Archive and Click Ok to archive.

4. Verify the CVD is in Archive status.

5. Power on the replacement Machine and connect to Mirage Server

6. Replacement Machine will be in the Pending Device Tab, Status as pending Assignment.

7. Choose Hardware Migration.

8. Select the Archived CVD from the list.

9. In Migration Option Choose “Full System Migration”, we can choose migrate application, user data and settings or only user data and settings.

10. Maintain current Base Layer

11. Keep same CVD name

12. Validation process will execute and continue next to Finish.

13. Machine will be moved to CVD Inventory and start initializing restore.

13. Once the restore process is completed, the Virtual machine will prompt for Reboot.

14. Click Restart Now

15. During the reboot, the Virtual Machine will get updated.

16. Once the Virtual Machine is rebooted, all user data and application in the CVD will be restored. Virtual machine will be in sync with Mirage Server and CVD will be created for the Virtual Machine in the CVD Inventory with same name. Snapshot will be captured based on the Policy.

Enable SNMP Monitoring on Ubuntu 12.04

noreply@blogger.com (Unknown) — Mon, 24 Feb 2014 05:10:00 +0000

SNMP is the Simple Network Management Protocol. It can allow you to keep an eye on various machines with tools like Nagios and Cacti. Watch for spikes of network activity, see how much memory is used in a day's time, or do some customization and compare spams to hams.A workstation can be watched, too. And that's what I hope to show here.

Installing the software
You'll need the package called snmpd (the daemon) and snmp (the tools).
Install SNMPD
$ sudo apt-get install snmpd
Create a backup file of snmpd.conf original file that we will edit later
$ sudo mv /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.ori
Create the new snmpd.conf file
$ sudo vim /etc/snmp/snmpd.conf
Add the file with these lines
rocommunity public
syslocation "Your Location"
syscontact admin@yourdomain.com
Then edit the /etc/default/snmpd file
$ sudo vim /etc/default/snmpd
Disable this line below by adding # in front of the line
#SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -g snmp -I -smux -p /var/run/snmpd.pid'
And add a new line
SNMPDOPTS='-Lsd -Lf /dev/null -u snmp -I -smux -p /var/run/snmpd.pid -c /etc/snmp/snmpd.conf'
Restart the SNMPD service
$ sudo /etc/init.d/snmpd restart
* Restarting network management services
Then you're done!

http://andrewpakpahan.blogspot.in/2012/09/how-to-enable-snmp-monitoring-on-ubuntu.html

DHCP Snooping Explained

noreply@blogger.com (Unknown) — Fri, 21 Feb 2014 04:22:00 +0000

What is DHCP Snooping ?

In computer networking DHCP snooping is a series of techniques applied to ensure the security of an existing DHCP infrastructure.DHCP snooping is a security feature inteneded to prevent rogue DHCP server from sending malicious DHCP replies.
DHCP snooping is a layer 2 security feature we can configure on our Catalyst switches that determines which switch ports can respond to DHCP requests. Ports are identified as trusted and untrusted.DHCP snooping will drop DHCP messages from a DHCP server that is not trusted. Trusted DHCP servers are identified by configuring a switchport’s DHCP snooping trust state. DHCP server messages can flow through switchports that have a DHCP snooping trusted state. DHCP server messages will be dropped if attempting to flow through a switchport that is not trusted.

Now let us look at a this diagram with a rogue DHCP server inside the network.

Attacker listens for DHCP Requests from clients and answers them with fake DHCP Response before the authorized DHCP Response comes to the clients. The fake DHCP Response often gives its IP address as the client default gateway -> all the traffic sent from the client will go through the attacker computer, the attacker becomes a “man-in-the-middle”.

The attacker can have some ways to make sure its fake DHCP Response arrives first. In fact, if the attacker is “closer” than the DHCP Server then he doesn’t need to do anything. Or he can DoS the DHCP Server so that it can’t send the DHCP Response.

DHCP snooping can prevent DHCP spoofing attacks.Only ports that connect to an authorized DHCP server are trusted, and allowed to send all types of DHCP messages. All other ports on the switch are untrusted and can send only DHCP requests. If a DHCP response is seen on an untrusted port, the port is shut down.

Configuring DHCP Snooping

Enable DHCP snooping globally on a switch
Switch(config)# ip dhcp snooping
Identify VLANs for DHCP snooping. In this case VLAN 1(default)
Switch(config)# ip dhcp snooping vlan 1
By default all ports are “untrusted”, so we have to add trusted ports.Here we are adding fa0/1 as trusted port
Switch(config)# interface fastethernet 0/1
Switch(config-if)# ip dhcp snooping trust

Verifying Configuration

Show DHCP snooping status
Switch# show ip dhcp snooping

This is all on can do for a simple DHCP SNOOPING option. This will prevent the ROGUE DHCP server to traverse DHCP packets to the VLAN1.

VLANs and Trunking Explained

noreply@blogger.com (Unknown) — Thu, 20 Feb 2014 04:29:00 +0000

VLANs and Trunking

What does Virtual Local Area Network (VLAN) mean?

Virtual LAN is a Layer 2 technique which allows you to divide your physical network into logical segments.The most beneficial elements of a VLAN is that it removes latency in the network, which saves network resources and increases network efficiency. In addition, VLANs are created to provide segmentation and assist in issues like security, network management and scalability. Furthermore, traffic patterns can easily be controlled by using VLANs.

Let’s see how to configure a simple virtual LAN .

Configuration

Switch 1		Ethernet Ports
Vlan 10 Interface IP	192.168.10.1	1-10
Vlan 10 Desktop IP	192.168.10.100	1-10
Vlan 20 Interface IP	192.168.20.1	11-18
Vlan 20 Desktop IP	192.168.20.100	11-18
Vlan 20 Interface IP	192.168.30.1	19-23
Vlan 10 Desktop IP	192.168.30.100	19-23

VLAN Configuration

Step 1
Create new VLANs 10, 20, 30 in Switch and assign an IP address to switched virtual interface or an SVI using the following sequence of configuration commands
To Create VLAN

Switch1(config)#vlan 10
Switch1(config-vlan)#name HR

Switch1(config-vlan)#vlan 20
Switch1(config-vlan)#name Sales

Switch1(config-vlan)#vlan 30
Switch1(config-vlan)#name IT

Assigning IP address to VLAN interface
Switch1(config)#interface vlan 10
Switch1(config-if)#ip address 192.168.10.1 255.255.255.0
Switch1(config-if)#no shutdown

Switch1(config)#interface vlan 20
Switch1(config-if)#ip address 192.168.20.1 255.255.255.0
Switch1(config-if)#no shutdown

Switch1(config)#interface vlan 30
Switch1(config-if)#ip address 192.168.30.1 255.255.255.0
Switch1(config-if)#no shutdown

Next step is to assign interfaces for VLANs 10,20,30 respectively

Switch1(config)#interface range fastEthernet 0/1-10
Switch1(config-if-range)#switchport mode access
Switch1(config-if-range)#switchport access vlan 10
Switch1(config-if-range)#exit

Switch1(config)#interface range fastEthernet 0/11-18
Switch1(config-if-range)#switchport mode access
Switch1(config-if-range)#switchport access vlan 20
Switch1(config-if-range)#exit

Switch1(config)#interface range fastEthernet 0/19-23
Switch1(config-if-range)#switchport mode access
Switch1(config-if-range)#switchport access vlan 30
Switch1(config-if-range)#exit

Vlan is configured and assigned interfaces for vlan.If you want to communicate between virtual LANs you need a enable ip routing in Layer 3 device.
To enable ip routing

Switch1(config)#ip routing

Test this Scenario

Do a ping test from vlan 10 to other Vlans or Vise Versa.

Consider your office is extend and you have another Floor.
Now you need to extend the VLAN to the second floor. Here you need to configure another layer 3 switch (switch 2) with the same configuration of switch 1 and need to connect cables from VLAN 10 ,VLAN 20 and VLAN 30 to the respective ports of switch 2.

Here you are wasting 3 port in switch 1 and 3 ports in switch 2,so total 6 ports. Also you are laying 3 cables. If you increase the VLAN then you waste more ports and cables. To over come this ,the better way is to setup a trunk port as described in the diagram.

A trunk is a point-to-point link between two network devices that carries more than one VLAN over a single link and the process known as trunking. With VLAN trunking, you can extend your configured VLAN across the entire network.

In this demonstration am using port 24 as trunk port.

Configure the Switch 2 same as we done in switch 1 (VLAN Configuration-Step 1)

Switch 2		Ethernet Ports
Vlan 10 Interface IP	192.168.10.2	1-10
Vlan 10 Desktop IP	192.168.10.200	1-10
Vlan 20 Interface IP	192.168.20.2	11-18
Vlan 20 Desktop IP	192.168.20.200	11-18
Vlan 20 Interface IP	192.168.30.2	19-23
Vlan 10 Desktop IP	192.168.30.200	19-23
Trunk Port		24

VLAN Trunking

Step 1
Switch 1
Switch1(config)#interface fastEthernet 0/24
Switch1(config-if)#switchport mode trunk
Switch1(config-if)#switchport trunk allowed vlan 1-99

Switch 2
Switch2(config)#interface fastEthernet 0/24
Switch2(config-if)#switchport mode trunk
Switch2(config-if)#switchport trunk allowed vlan 1-99
Note : When you try to configure trunk port you might see following error
"An interface whose trunk encapsulation is Auto can not be configured to trunk mode" .To fix this you need set encapsulation to 802.1q using the following command in interface fastEthernet 0/24
Switch1(config-if)#switchport trunk encapsulation dot1q
This should fix your issue.

Test this Scenario

Do a ping test from second floor vlan 10 to other Vlans in First Floor or Vise Versa.

Implementing Hub and Spoke Site-to-Site VPN

noreply@blogger.com (Unknown) — Tue, 18 Feb 2014 10:02:00 +0000

Implementing Hub and Spoke Site-to-Site VPN in Sonicwall

Background
We had a situation where we need to connect to one of our client side Servers through VPN.The client provided the details for configuring site to site VPN. But the problem we faced was that the client will only provide a single site to site VPN.
Our situation was our main office development users and branch office users need to access the same server.So I had to do some research on how to make it work.
Finnaly to achive the connection we established a Hub and Spoke method VPN connection where the main office firewall act as a hub and branches are able to communicate to the client VPN using the hub as an intermediary.

For this demonstration am using sonicwall firewall in all offices

The branch offices (Networks A) and Client Office (Network C) will connect to a hub at the corporate headquarters (Network B). Networks A and C will be able to exchange traffic through the hub. Review the specifications in the following table:
Branch Office A
LAN A Subnet 10.0.1.0/24
WAN A IP Address 192.168.1.1/24
Corporate Office (hub) B
LAN A Subnet 10.0.2.0/24
WAN B IP Address 192.168.2.1/24
Client Office C
Server IP 94.188.133.150
WAN C IP Address 192.168.3.1./24
To achieve Hub and Spoke VPN connection ,First we need to establish a site to site vpn with Client office and then create a site to site VPN with branch office including the Client Office IP Address.

Step 1

Creating Site to site VPN for Client Office.
For configuring site to site vpn ,we need to create some Address and Group Objects
Create Address and Group Objects
A number of address objects are needed in the implementation of any site to site VPN. This need is greater in a hub and spoke configuration. Group objects will also be required. The address objects will specify local and destination networks, which will be grouped together to permit hub and spoke communication

For that log in to the firewall web interface of Corporate Office Sonicwall .Access the Network > Address Objects page .

Click the Add button under the Address Objects table.

Address Object for Client Remote Server
Name: Client Remote Server IP
Zone: VPN
Type: Host
IP Address: 10.0.3.10

Address Object for Main Office Lan
Name: Main Office Lan
Zone: LAN
Type: Host
IP Address: 10.0.2.10
Netmask : 255.255.255.0

Address Object for Branch Office Lan
Name: Branch Office Lan
Zone: VPN
Type: Host
IP Address: 10.0.1.10
Netmask : 255.255.255.0

Create Address Group for main and brach office address objects

Click Add Group

Group name: Group for Client VPN
Members : Main Office Lan ,Branch Office Lan

Now we have created address objects and group for Site to site VPN with Client Office. Next will configure Site to site Vpn for Client Office .

Step 2

Navigate to VPN > Settings page and Click Add button. The VPN Policy window is displayed.
Click the General tab

- Select IKE using Preshared Secret from the Authentication Method menu.
- Enter a name for the policy in the Name field.
- Enter the WAN IP address of the remote connection :94.188.133.150

- Enter a Shared Secret password to be used to setup the Security Association the Shared Secret and Confirm Shared Secret fields. The Shared Secret must be at least 4 characters long, and should comprise both numbers and letters.

. Click the Network tab

Under Local Networks, select a local network from Choose local network from list: and select the address object Group for Client VPN (Main Office LAN and Branch Office Lan)

- Under Destination Networks, select Choose destination network from list: and select the address object Client Remote Server IP

4. Click the Proposals tab:
Note: Settings must be same as Client Remote VPN.
5. Click the Advanced tab
- Select Enable Keep Alive to use heartbeat messages between peers on this VPN tunnel. If one end of the tunnel fails, using Keepalives will allow for the automatic
renegotiation of the tunnel once both sides become available again without having to wait for the proposed Life Time to expire.
- Select Enable Windows Networking (NetBIOS) Broadcast to allow access to remote network resources by browsing the Windows® Network Neighborhood.
- Select an interface or zone from the VPN Policy bound to menu. A Zone WAN is the preferred selection if you are using WAN Load Balancing and you wish to allow the VPN to use either WAN interface.

- Click OK to apply the settings.

Create the VPN to VPN Access Rule

Follow these steps to create the access rule on each SonicWALL appliance allowing communication between VPN tunnels:

Click Firewall > Access rules > select Matrix.
Select the edit icon at the point of intersection for the “VPN to VPN” zone.
Add a new rule:

Action: Allow
Service: Any
Source: Any
Destination: Any
Click OK.

After following all of the above steps, a working VPN should be successfully established and a green light will be indicate in the vpn window.

Now we need to configure Site to site VPN for Main Office and Branch Office.
In branch office Sonicwall we need to create Address objects and Address group

Address Object for Client Remote Server
Name: Client Remote Server IP
Zone: VPN
Type: Host
IP Address: 10.0.3.10

Address Object for Main Office Lan
Name: Main Office Lan
Zone: LAN
Type: Host
IP Address: 10.0.2.10
Netmask : 255.255.255.0

Create Address Group for main , Client Server IP and brach office address objects
Group for Main Office VPN
Members : Main Office Lan & Client Remote Server IP

Now we have created address objects and group for Site to site VPN with Main Office. Next will configure Site to site Vpn for Main Office .

Do the same procedure in Step 2 ,only change will be in Network Tab

In Network tab ,Choose local network will be Branch Office LAN and Choose destination network will be Group for Main Office VPN
Create the VPN to VPN Access Rule
Follow these steps to create the access rule on each SonicWALL appliance allowing communication between VPN tunnels:
Click Firewall > Access rules > select Matrix.
Select the edit icon at the point of intersection for the “VPN to VPN” zone.
Add a new rule:

Action: Allow
Service: Any
Source: Any
Destination: Any
Click OK.
After following all of the above steps, a working VPN should be successfully established and a green light will be indicate in the vpn window.

Test this Scenario:

Try to ping Client Remote Server IP from Brach Office and Main Office or Vise Versa.

Setting up FTP on EC2 Windows Instances

noreply@blogger.com (Unknown) — Tue, 18 Feb 2014 06:36:00 +0000

Configuring FTP to a running Amazon AWS EC2 Windows instance without an elastic IP.

In this article i am going to configure Filezilla FTP Server on a Amazon AWS EC2 Windows instance.

Loginto your Amazon AWS Management Console and select EC2 . Once the instance is accessible, we will need to change some settings:

In AWS, select “Security Groups” from the left-hand menu.

Select the name of the security group for the instance you just created

In the window at the bottom of the screen select the “Inbound” tab from the small frame.

Pick “Custom TCP Rule” from the “Create a new rule” dropdown.

Enter 50000-51000 in the port range field.

In the source field, use discretion. Leaving the field at 0.0.0.0/0 will allow all.

(That may be ok depending on your intended use, I’m using it as a disposable server, so I’m not going to get into security in this article.)

Select “Add Rule” and the “Apply Rule Changes” (Make sure you do both!!!).

Now repeat the steps for port 21.

Finally you can see the inbound rules on the right side

The second step is to setup FileZilla Server.

Install FileZilla Server on the Amazon Instance and create a FTP user with password.

Click the settings icon on the interface.

On the general settings tab, “Listen on these ports:” will be defaulted to 21. Just leave it.

Select the “Passive mode settings” from the tree on the left.

Place a check mark next to “Use custom port range” and set the port range to “50000-51000”.

Now get your “Public DNS Name” from the Amazon AWS console. Your IP address will be in the Public DNS Name, .

Enter the IP into the “Use the Following IP” field on FileZilla’s “Passive mode settings” screen.

Now we are at the final step. You will now need to adjust the Windows Firewall settings to allow the ports we allowed in the AWS Security Group.

And you are done! Go ahead and connect with your favorite FTP client.

Cisco ASA Active-Standby Failover

noreply@blogger.com (Unknown) — Mon, 17 Feb 2014 13:19:00 +0000

Configuring Cisco ASA Active-Standby Failover using ASDM

In this post I will be configuring active –standby failover with Cisco ASA.I will using the wizard driven configuration which allows to understand each and every aspect of the configuration and it makes it easy to troubleshoot.

Prerequisites for Active/Standby Failover

Active/Standby failover has the following prerequisites:

•Both units must be identical ASAs that are connected to each other through a dedicated failover link and, optionally, a Stateful Failover link.

•Both units must have the same software configuration and the proper license.

•Both units must be in the same mode (single or multiple, transparent or routed).

I will be using the following simple topology to test my failover setup.

Configuration used in this topology

ASA 1(Active)

Public IP :- 192.168.50.100

Private IP : 10.10.10.1

Failover IP : 175.16.0.1

ASA 1(Active)

Public IP :- 192.168.50.200

Private IP : 10.10.10.2

Failover IP : 175.16.0.2

ASDM access is configured for 192.168.1.50 (Desktop PC).

Let’s begin the configuration by connecting the asdm to ASA and by going to Configuration > Device Management > High Availability

Click Launch High Availability and scalability Wizard

Choose Active/standby fail-over and Click Next

Enter the Peer IP address (Standby ASA Internal Interface) and Click Next

It will ask for the Standby ASA ASDM username and password, Once it provided and will complete the compatibility test.Click Next to continue

Select the Fail-over connection port. (In my case i connected the crossover through gigabit Ethernet 2 interface to the standby ASA gigabit Ethernet 2 )

Provide the IP address for Active and standby ASA. Provide Secret key and Click next to continue.

Choose the LAN link as the state link and click next to continue.

In this windows you need to provide the standby IP address of your ASA2 Device, both internal and external IP of ASA 2 .Select the interface need to be monitored .Click next to continue.

A summary window will appear and click Finish to start the fail-over process.

Click Stop waiting for continuing the process

Finally you will receive a fail-over configuration complected message

You can monitor the status of the failover setup in Monitoring > Properties > Failover > Status. You also have the option of manually making a particular ASA active or passive depending on your need.

The Manual configuration wizard also provided below and you can see the same details here.

Now we can access the device over the network and no longer need to worry about a single point of failure.

Redirect HTTP requests to HTTPS on IIS 7

noreply@blogger.com (Unknown) — Mon, 17 Feb 2014 05:24:00 +0000

Automatically Redirect HTTP requests to HTTPS on IIS 7 using URL Rewrite 2.0

Requirements

- SSL Certificate for site installed in IIS.
- Site properly installed and configured for SSL (site set up and binding in IIS configured).
- URL Rewrite 2.0 is installed on the sever.

Install URL Rewrite 2.0 on your webserver,

download url: http://www.iis.net/download/URLRewrite

This is a plug-in for IIS 7 that allows you to manipulate URL’s.

URL Rewrite has a GUI to allow you to enter rules within IIS 7; in the background all this does is edit the web.config file of the site. I will show you how to create a rule both ways.

- Select the website you wish to configure
- In the “Features View” panel, double click URL Rewrite

You will notice there are currently no rules configured for this site. Click “Add Rules…” in the Actions menu to the right of the “Features View” panel

Use the default “Blank rule” and press “OK”.

When editing a rule there are the “Name” field and 4 configuration pull down boxes.

- Enter “Redirect to HTTPS” in the name field.
- Next we will configure the first configuration pull down box called “Match URL”, on the right side of “Match URL” press the down arrow to expand the box.

Within the “Match URL” configuration box we will set the following settings:

Requested URL: Matches the Pattern
Using: Regular Expressions
Pattern: (.*)

We can now edit the next configuration pull down box which is “Conditions”, Press “Add…” to add a new condition to the configuration.

We will configure the condition with the following settings:

Condition Input: {HTTPS}
Check if input string: Matches the Pattern
Pattern: ^OFF$

Press “OK”

You should see your condition in the list of conditions.

Continue onto the “Action” configuration box and pull down the box by selecting the arrow on the right. We will configure the following settings for the “Action” configuration:

Action Type: Redirect
Redirect URL: https://{HTTP_HOST}/{R:1}
Redirect Type: See Other (303)

Press “Apply” then press “Back to Rules”

You should now see the rule configured on the main screen of the URL Rewrite module.

Test your site, it should now redirect from HTTP to HTTPS.

How to Hide Files in JPEG Pictures

noreply@blogger.com (Unknown) — Fri, 24 Jan 2014 09:41:00 +0000

Hide File in Picture

In order to accomplish this task, you will need to have either WinZip or WinRAR installed on your computer. You can download either of these two off the Internet and use them without having to pay anything. Here are the steps for creating your hidden stash:

Create a folder on your hard drive, i.e. C:\Test and put in all of the files that you want to hide into that folder. Also, place the image that you will be using to hide the files in.

Now select all of the files that you want to hide, right-click on them, and choose the option to add them to a compressed ZIP or RAR file. Only select the files you want to hide, not the picture. Name it whatever you want, i,e. “Hidden.rar”.

Now here’s the fun part! Click on Start, and then click on Run. Type in “CMD” without the quotes and press Enter. You should now see the command prompt window open. Type in “CD \” to get to the root directory. Then type CD and the directory name that you created, i.e. “CD Test“.

Now type in the following line: “copy /b DSC06578.JPG + Hidden.rar DSC06578.jpg” and press Enter. Do not use the quotes. You should get a response like below:

Just make sure that you check the file extension on the compressed file, whether it is .ZIP or .RAR as you have to type out the entire file name with extension in the command. I have heard that some people say that they have had problems doing this with a .ZIP extension, so if that doesn’t work, make sure to compress to a .RAR file.

And that’s it! The picture file will have been updated with the compressed archive inside! You can actually check the file size of the picture and see that it has increased by the same amount as the size of the archive.
You can access your hidden file in two ways. Firstly, simply change the extension to .RAR and open the file using WinRAR. Secondly, you can just right-click on the JPG image and choose Open With and then scroll down to WinRAR. Either way, you’ll see your hidden files show up that you can then extract out.

That’s it! That is all it takes to hide files inside JPG picture files! It’s a great way simply because not many people know it’s possible and no one even thinks about a picture as having to the ability to “hide” files. Enjoy!

HA-Hosting

noreply@blogger.com (Unknown) — Fri, 24 Jan 2014 08:49:00 +0000

TFS 2012: Comparison of Team Foundation Server’s Editions

noreply@blogger.com (Unknown) — Fri, 24 Jan 2014 08:44:00 +0000

This blog post is part of a blog series to introduce Team Foundation Server to new users. The blog series will also contain articles targeting intermediate and expert users. I will be using Team Foundation Server 2012 Update 1 and Visual Studio 2012 Update 1 throughout the series. If you have any questions or you want me to cover a specific topic, please don’t hesitate to contact me.

Expertise Level

Intermediate

Getting Started with Team Foundation Server

TFS comes in three flavours:

Team Foundation Server Service (tfs.VisualStudio.com)
Team Foundation Server Express
Team foundation Server

Choosing which flavour you need depends pretty much on your requirements. In this article I will shed light on each version and why you want to choose one vs the other.

Introducing Team Foundation Server’s Editions

Team Foundation Server Service

TFS Service is the cloud or the hosted version of the TFS. It is currently offered for free and supports up to 5 team users. Microsoft will disclose pricing for other plans in 2013. Microsoft has announced that a Free Plan will be offered. Microsoft will offer away to transition from the free service to the paid service when such a service is announced.
At the time of writing this article, the announced Free Plan includes:

Up to 5 users
Unlimited number of projects
Version control
Work item tracking (To manage Sprints, Storyboard, Tasks, Bugs, ..etc)
Agile planning tools (Backlog, Kanban and task boards, Sprint schedule,
Feedback management (Mechanism to get feedback from stakeholders)
Team build support

Pro’s

The following is a list of advantages of TFS service compared to the other versions of TFS:

No installation required. Can be up and running in matters of minutes
Don’t require purchasing hardware or software to host the TFS
Data is stored in triplicate on three physically distinct servers
Full backups are done everyday and with hourly incremental backups
Service is accessible from anywhere around the world
TFS Service receives the new TFS updates and features, every 3 weeks, before other versions of TFS
No licensing required when using the express versions of Visual Studio or none Microsoft platforms such as Eclipse or Xcode
Scalable, you can scale out the team build by hosting the build service in your enterprise

Con’s

Paid version plans are not out yet
Free for upto 5 users
Lack of Active Directory support
Maybe slow when getting too many files from the server depending on your connection speed
Data is not inside your network
Can’t customize process template or workitem templates
No SharePoint portal
Doesn’t come with lab environment. Such environments must must be setup on physical or virtual machines (including Cloud)
Limited reports and can’t deploy custom reports. You can still use Excel to connect to the service and have your custom reports locally
Limited migration path from TFS on premise to TFS Service and vise versa

Team Foundation Server Express

TFS Express is a free limited version of Team Foundation Server. It is great for small teams of up to 5 five users. TFS Express can be downloaded from the MSDN website and it is around 500MB. Here is a direct link to the TFS Express home page.

Pro’s

Free
Data stays inside your network
Comes with version control repository
Work item tracking
Build Automation
You have more control compared to the TFS Service
Can customize Process and Workitems template
CAL’s can be purchased in case your team grows beyond 5 users
Support for express versions of Visual Studio

Con’s

Must have own hardware or virtual machine
Not accessible from anywhere
Supports Basic installation only
Limited Agile Project management features and tools
No Reporting Integration
No SharePoint Integration
Supports only SQL Server Express Edition
Installed on one machine. Can’t scale out
Doesn’t support TFS Proxy
Excludes Preemptive analytics add-on
Need to manage your own database backups and downtimes in case of hardware failure
Buy license for the Operating System and CALs if required

Team Foundation Server

This is the full version of TFS. It has no limitations and supports more integration and configuration scenarios. You can buy TFS from the Microsoft Store or one of the Microsoft’s resellers or you could already have a license to use it if you have certain MSDN subscriptions. To read more about licensing, please check the MSDN website or click here to read the licensing white paper.

Pro’s

Full integration with many products such as SharePoint and reporting services
Supports higher end versions of SQL Server for the backend as well as Express version
Supports the express versions of Visual Studio and other Non-Microsoft products (CAL may be required)
CAL License is included with certain Visual Studio MSDN subscriptions (Professional, Premium and Ultimate)

Con’s

Must have own hardware and/or virtual machines
Need to install and configure
Make sure that all required CALs are purchased
Could be pricy for small teams
Not accessible from anywhere

Conclusion

For large and restrictive companies the full edition of TFS would probably be the best option because the data is stored in house, server can be scaled out, supports higher end database editions (standard and enterprise) and can integrate with SharePoint. It all comes with a cost depending on your team size and the number of servers and licenses needed for scaling out the server. But, if your development team(s) already have Visual Studio MSDN subscription, then your company may get a relief on CALs.
For smaller size teams of 5 users or less, it comes down to how much control you need to have over your data and the ability to customize process template and work item templates vs better Agile process and broader availability. If you are interested in the first scenario, TFS Express would be a better option, otherwise you are better off using TFS Service. In case your team can afford the full edition of TFS or your team already have Visual Studio MSDN subscription, you may want to take advantage of full version of TFS. There are programs offered by Microsoft for small businesses such as BizSpark. Check with your local Microsoft office, you may qualify for other offers.
For teams larger than 5 users, you want to calculate how many CALs you need and how much you are paying for them and is it worth it to upgrade to Full Version of TFS.
My conclusion is based on the state of TFS Service as of January 7, 2012 which was explained above.