What is VSPEX? There has been a bit of speculation floating around the industry the past couple of weeks regarding what EMC will be releasing. I have heard rumors spreading from the extreme of EMC create a new super version of VPLEX, to EMC creating a product wholly and completely competitive with Vblock (mentioned here by CRN last week talking about a VMAX based VPLEX). A few people, notable the folks at the register (VSPEX article here) have come quite a bit closer to the truth by calling out that a new reference architecture positioned to address the mid-market in a similar fashion to NetApp’s FlexPod offering.

The truth about VSPEX

VSPEX is a pre-validated set of reference architectures currently focused around Server Virtualization (cloud computing if you want to church it up) as well as end-user computing (VDI/VXI/Application Presentation Solutions). It fills the gap in EMC’s solution offerings that exists between a design and build your own solutions and their converged infrastructure product (VCE Vblock).

What components create VSPEX

Networking – VSPEX will be featureing Cisco’s Nexus 5548 Unified Port Switch as the networking component. This is the standard 10 gig switch used in Cisco’s other Validated Designs and is the standard platform for an aggregation layer for most Cisco based Data Centers.

Compute – Cisco Unified Computing System will be featured as the compute platform for VSPEX. For the mid market solutions that feature VNX storage Cisco B-Series blade centers will be recommend. For SMB focused solutions featuring VNXe storage Cisco’s C-Series servers will be featured.

Unified Storage – EMC VNX 5500/5300 Unified storage, supporting Fibre Channel, NFS and iSCSI will be offered for Mid Market solutions and VNXe supporting only IP protocols will be specified for SMB solutions.

Server Virtualization – Both VMware vSphere or Microsoft Hyper-V based validated and tested designs will be released. This is very interesting as both NetApp and EMC now have included Hyper-V as a supported scalable hypervisor. I personally have been a huge fan of VMware over the years, however I think that signs like this show that Hyper-V is increasingly penetrating both EMC and NetApp’s customer base.

End-User Compute (VDI) – Two solutions will be initially released. VMware View or Citrix XenDesktop. Both of these products are featured in Cisco’s VXI architecture and will now be featured in VSPEX. Is this the year of VDI? I would say yes.

Data Protection – The often forgotten, but always need backup and recover solution tied into any virtualization project will be EMC Avamar and or Data Domai

How flexible is VSPEX

VSPEX is surprisingly flexible. The components specified in the architecture are explicitly called out as starting points to design around. You are allowed to substitute components as long as you stay within the sizing parameters and guidelines specified in each architecture document.

Personally this solves a big challenge that happens when selling a Vblock solution. Vblocks tend to be very rigid what your are allowed to do with them, and what and how something can be installed. This presents a challenge when a customer wants the speed of installation and single number support of a Vblock, but has requirements that drastically diverge from what Vblocks were designed for.  With VSPEX these customers can still have the safety and speed of delivery of a tested and validated solution, while benefiting from the flexibility of a reference architecture based solution.

Is VSPEX competitive with Vblock

There is technically a bit of overlap in the solutions, however the two offerings are really targeted to completely different customer and workloads. While there are some smaller Vblocks out there, the majority of Vblocks sold have been focused towards higher end solutions at Enterprise and Service Provider customers.

VSPEX is targeted to fill the gap that Vblocks tend to miss, which is the Mid-Market and SMB space. That Mid-Market space is the same space that NetApp has had so much success with the FlexPod offering. I expect VSPEX to provide these Mid-Market and SMB customers options that were not available to them from a Vblock solutions.

What is my verdict on VSPEX

EMC has brought together a strong reference architecture offering for the mid market with VSPEX. They are moving the ball one step forward by providing many of the benefits of Vblock in a flexible reference architecture delivered to Mid-Market customers. This is needed by EMC, Cisco and it’s channel partners and I fully expect it to be embraced by their joint customers.

 Similar Posts:

• VSPEX – EMC’s Flexible Reference Architecture Explained
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Cisco’s Cloud Computing Offering
• Cisco introduces the C-Series Rack Servers
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Update on the Cisco / Nuova connection

--Colin McNamara

VSPEX – EMC’s Flexible Reference Architecture Explained

What is VSPEX? There has been a bit of speculation floating around the industry the past couple of weeks regarding what EMC will be releasing. I have heard rumors spreading from the extreme of EMC create a new super version of VPLEX, to EMC creating a product wholly and completely competitive with Vblock (mentioned here by CRN last week talking about a VMAX based VPLEX). A few people, notable the folks at the register (VSPEX article here) have come quite a bit closer to the truth by calling out that a new reference architecture positioned to address the mid-market in a similar fashion to NetApp’s FlexPod offering.

The truth about VSPEX

VSPEX is a pre-validated set of reference architectures currently focused around Server Virtualization (cloud computing if you want to church it up) as well as end-user computing (VDI/VXI/Application Presentation Solutions). It fills the gap in EMC’s solution offerings that exists between a design and build your own solutions and their converged infrastructure product (VCE Vblock).

What components create VSPEX

Networking – VSPEX will be featureing Cisco’s Nexus 5548 Unified Port Switch as the networking component. This is the standard 10 gig switch used in Cisco’s other Validated Designs and is the standard platform for an aggregation layer for most Cisco based Data Centers.

Compute – Cisco Unified Computing System will be featured as the compute platform for VSPEX. For the mid market solutions that feature VNX storage Cisco B-Series blade centers will be recommend. For SMB focused solutions featuring VNXe storage Cisco’s C-Series servers will be featured.

Unified Storage – EMC VNX 5500/5300 Unified storage, supporting Fibre Channel, NFS and iSCSI will be offered for Mid Market solutions and VNXe supporting only IP protocols will be specified for SMB solutions.

Server Virtualization – Both VMware vSphere or Microsoft Hyper-V based validated and tested designs will be released. This is very interesting as both NetApp and EMC now have included Hyper-V as a supported scalable hypervisor. I personally have been a huge fan of VMware over the years, however I think that signs like this show that Hyper-V is increasingly penetrating both EMC and NetApp’s customer base.

End-User Compute (VDI) – Two solutions will be initially released. VMware View or Citrix XenDesktop. Both of these products are featured in Cisco’s VXI architecture and will now be featured in VSPEX. Is this the year of VDI? I would say yes.

Data Protection – The often forgotten, but always need backup and recover solution tied into any virtualization project will be EMC Avamar and or Data Domai

How flexible is VSPEX

VSPEX is surprisingly flexible. The components specified in the architecture are explicitly called out as starting points to design around. You are allowed to substitute components as long as you stay within the sizing parameters and guidelines specified in each architecture document.

Personally this solves a big challenge that happens when selling a Vblock solution. Vblocks tend to be very rigid what your are allowed to do with them, and what and how something can be installed. This presents a challenge when a customer wants the speed of installation and single number support of a Vblock, but has requirements that drastically diverge from what Vblocks were designed for.  With VSPEX these customers can still have the safety and speed of delivery of a tested and validated solution, while benefiting from the flexibility of a reference architecture based solution.

Is VSPEX competitive with Vblock

There is technically a bit of overlap in the solutions, however the two offerings are really targeted to completely different customer and workloads. While there are some smaller Vblocks out there, the majority of Vblocks sold have been focused towards higher end solutions at Enterprise and Service Provider customers.

VSPEX is targeted to fill the gap that Vblocks tend to miss, which is the Mid-Market and SMB space. That Mid-Market space is the same space that NetApp has had so much success with the FlexPod offering. I expect VSPEX to provide these Mid-Market and SMB customers options that were not available to them from a Vblock solutions.

What is my verdict on VSPEX

EMC has brought together a strong reference architecture offering for the mid market with VSPEX. They are moving the ball one step forward by providing many of the benefits of Vblock in a flexible reference architecture delivered to Mid-Market customers. This is needed by EMC, Cisco and it’s channel partners and I fully expect it to be embraced by their joint customers.

 Similar Posts:

• VSPEX – EMC’s Flexible Reference Architecture Explained
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Cisco’s Cloud Computing Offering
• Cisco introduces the C-Series Rack Servers
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Update on the Cisco / Nuova connection

--Colin McNamara

VSPEX – EMC’s Flexible Reference Architecture Explained

This is the second year that I have been a “shavee” for the St. Baldrick’s Foundation. This volunteer-driven charity funds more in childhood cancer research grants than any organization except the U. S. government.

This year I was able to not only involve myself and my friends in this charity, but I was also supported by the owners of Nexus who sponsored the bar tab at the Irvine St. Baldrick’s event.

I want to not only thank everyone who supported this great charity, but of course invite anyone else who is passionate about supporting cancer research to join in the fight and donate through my participant page linked below.

http://www.stbaldricks.org/participants/colinmcnamara

 Similar Posts:

• None Found

--Colin McNamara

I woke up shaved bald and with one eyebrow…

The picture on the left was taken back then. I was on staying in a hotel 110 nights a year and at on a flight at least twice a week. Living the jetset life was bringing me to a quick end to my life.

While I can talk all day about the journey from fat to skinny(er) I’d like to take the chance to share a couple key tools that helped me shed the pounds.

Getting back on the bike

I didn’t get to be 290 pounds in one day. I gained it one day at a time, while sitting at a desk typing on a computer (while eating something incredibly yummy). The human body is an amazing machine that reacts well to physical activity.

I personally found that getting back onto a bicycle provided a way for me to burn some calories while doing something that is very enjoyable. It also provided a physical activity that wasn’t as hard on my joints (which at 290 is a big risk) as running.

I ended up dragging one of my old racing bikes out of the garage, however that is not necessary for everybody. You burn just as many calories on a 150 dollar Walmart bike as you do riding 5000 dollar custom bike. What is important is that you are out being active, not what you are being active on.

What can’t be measured can’t be improved

Nobody wants to hear that you need to track your calories and weight to lose weight. But here it is – You have to track your calories and weight. Sorry, I know it sucks but you have to do it. Losing weight is simple math. Take in less calories then you need each day and you lose. Eat more then you need and you gain. How do you find out what your magic number of calories per day is? It is simple. You have what is called your Basal Metabolic Rate (BMR) and the calories burned during daily activity. Put those both together and that is your calorie budget for the day. Now you just have to find some tool to track it.

I have used a tool called the daily burn tracker for a couple years now. There is a free option that allows you to track via a webpage, and also a low cost iPhone app that allows you to look up foods and log them throughout the day. This allows me to keep an eye on my food intake, and make sure that calories aren’t sneaking up on me.

After measuring the calories you put into yourself, it is important to measure the results. When I started losing weight I just used a spreadsheet to track my progress. As time moved on I got introduced to the Withings scale.

I have to say, this scale is awesome for the inner geek in you. It measures your weight, your body fat, and your BMI (Body Mass Index) all automatically. Not only does it do that, but it upload your statistics via WiFI to a personal private account on www.withings.com . After your data is there you can set it up to sync to other services, (such as dailyburn listed before) or to twitter if you are up for some public support and/or embarrassment.

One other item that Withings makes, and I use it he blood pressure monitor.

This plugs into your iPhone or iPad and automatically takes your blood pressure and resting pulse. This is uploaded to the same interface that you use to view your weight and fat percentages. I find that it provides yet another window into the state of my health, and also provides a great feedback loop when I am training to hard (resting heart rate in the morning will be elevated).

You have to find balance and enjoy yourself

It is easy to become myopic in focus and become consumed with hitting a calorie goal each and every day.

While it is good to be focused it is important to remember that becoming fat didn’t happen in a day, it took time. The same is true with getting skinny. It is a long road, and it is ok to have fun for a day, enjoy some drinks and a good meal in moderation and have a good time. Just remember, the next day to get back on track, capture those calories and continue on the road to the skinny you.Similar Posts:

• None Found

--Colin McNamara

I used to be fat – How I beat the bulge

Hadoop is an open source framework for processing and querying big data on clusters of commodity hardware. It was originally developed by Yahoo in 2006 as a clone of Google File System (GFS) and MapReduce framework used to store web search indexes and crawl data for the search engine Nutch.

In the last few years however developers have embraced MapReduce (the ability to map key pairs, and reduce them into small byte size computing chunks to distribute across hybrid storage/processing nodes), and have begun developing a vast array of applications that can utilize the distributed storage and compute capacity.

My Background with Hadoop

Back in 2006 I working for a startup in San Diego that did high dimensional mathematical analysis of financial transactions to quantify identity theft risk. Over the time I was there we went from an scale up batch system to serving 10,000 transactions a day to a scale out web service (today you would call it a cloud) that served millions of transactions a day all served under 250 milliseconds each.

To scale to that size under such strict latency requirements it was necessary to experiment with and implement some pretty cutting edge open source technologies. I cheated off the notes of Jeremy Zawodny at Yahoo almost daily (thanks Jeremy, your knowledge and tools totally saved my butt many times). At that same time Jeremy’s team started doing some interesting work around distributed computing with Hadoop. Needless to say this was a technology I had to try. Hadoop was extremely young at the time, however for certain analytics workloads I was able to use 10 PC’s to outperform a half million dollars in compute and fibre channel storage.

Flash forward 6 years – Hadoop is all grown up

Over the past six years not only has Hadoops file system (HDFS) and processing (MapReduce) capabilities matured, but a suite of applications has been developed. These include tools to managed Hadoop clusters, large scale log analysis tools, scale out analytics packages and large scale distributed database applications.

The list of clients using hadoop has grown too. This ranges from Yahoo, Ebay and Facebook to enterprise customers like Fox, TMobile, Equifax and the New York Stock Exchange using Greenplum (Project R running on Hadoop). No longer is Hadoop a tool for a select few, it is now the next logical extension of the standard web service LAMP stack, and increasingly useful for Data Warehouse workloads.

Tuning the foundation – Hadoop and MapReduce

Many times when people talk about tuning parallel compute clusters like Hadoop, SunGrid or LSF they forget the obvious. They forget that the squeezing performance is about managing the delicate balance between applications and infrastructure.  When tuning that balance, you have to first segregate applications that directly access the hardware resources, and applications that access these apps. To create a frame of reference think of the relationship between Apache, MySQL and Disks in a LAMP architecture.

When dealing with Hadoop Distributed File System (HDFS) and the MapReduce jobs that run on it there are three primary dimensions of tuning. These are dimensions are -

1. Tuning keystones in the infrastructure such as optimizing NameNode and Job Tracker server performance. (note memory sizing, tcp performance, cpu scaling)

2. Optimizing transfer of data between slave nodes in the HDFS cluster (note, bundled 1 gig / CPU)

3. Balancing I/O systems in slave nodes such as memory, server side flash, and spinning disk.

Optimizing NameNode and Job Tracker server performance

The NameNode in a Hadoop cluster is used to track the locations of the different file shards distributed across all slave nodes in the cluster. It is also used to house metadata for certain applications that reside in the Hadoop cluster. This puts specific strain on CPU, Memory and Network interfaces.

CPU / Network Interface

Certain processes inside of the name node do not take advantage of the multitude of cores available on today’s servers. The biggest offender in this case is the RPC server which processes network requests in a serial manner. Utilizing the fastest CPU as possible in conjunction with low latency network adapters such as Mellanox MNPH29D-XTR 10 Gig NIC, and low latency fabric switches such as the Nexus 5548. Optimizing the CPU and Network interface has significant effect on minimizing bottlenecks due to serialization delay of RPC requests.

Memory

NameNodes can use a lot of memory when servicing HDFS alone. The addition of layered applications on top of HDFS that utilize the NameNode as well as the increase in file numbers in HDFS only increase the importance of sufficient amounts of high speed memory.

Optimizing transfers between nodes in the HDFS cluster

Certain types of jobs such as sorts and greps (the basis for index generation) move significant amounts of data between nodes in the Hadoop cluster. Since the inception of Intel’s Nehalem processor family, single gigabit interface have presented bottlenecks when transmitting and receiving data. This inserts “slack time” in the cluster minimizing the time that slave node is actually processing data. The net result of this equals either slower job completion / response times or the unnecessary addition of additional nodes to the cluster (increasing your cost per job/transaction).

Impact of server bandwidth on job completion time

To illustrate this point please reference this test done by Intel on their own Hadoop cluster with a first generation Nehalem processor. Even then a single gigabit interface was not sufficient to service a node. In this case doubling the bandwidth to two gigabit by bonding interfaces together rebalanced the node. However if you follow Moore’s law, nodes utilizing Sandy Bridge CPU’s (due to release some time in 2012) will need four plus gigabit of network during a data transfer to avoid unnecessary wait times. Luckily this generation of server will have 10 Gig adapters built into the motherboard.

Network bandwidth and design

HDFS and the many of the applications that reside on top of it have the notion of a Rack ID. This can be used for fault isolation. For example if you had A/B racks on different power feeds you could ensure that redundant data shards are stored on nodes in different racks, and therefore increase the systems tolerance of faults.

This Rack Id can also be queried by higher level applications to ensure that jobs requiring high bandwidth data transfers are localized within say a pair of Nexus 5500′s with 10 gig fabric extenders. This would minimize the utilization of typically oversubscribed uplinks north of the access layer ensuring again, that nodes are not sitting idle while receiving data.

If however your application requirements do force you to expand jobs beyond the scaling capacity of a pair of low latency fabric extended switches. Maximizing your active paths between pods (groupings with the same rack.id) utilizing tools like Fabric Path create a layer two mesh between your pods can help in minimizing the wait time that a node may experience.

Minimizing I/O wait times in disk subsystems

There are many places where RAID or higher performance disk systems can yield benefits in the Hadoop cluster. One place is the MapReduce local directory. This is the place that mapped files are stored locally, adding multiple disks to this mount is one option. A second option which is gaining more and more traction is utilizing Solid State Disk (SSD) or PCIe based flash cards to present optimal IO for certain functions.

The graphic above, again from Intel demonstrates in a very simple fashion the impact of going from two to four disks in a node (doubling the IO). The result was completing the required job in one half the time. In simple terms, increasing the cost of the server by 10% increased its sort performance by 100%. Again performance increases vary by workload. However in a strict sense this increases the per server cost while decreasing the cost per job / transaction.

Reducing the Impact of Disk Spill

Disk spill is the result of the majority of the servers buffer being full of data during the map operation. Once a certain percentage of utilization is hit (normally 80%) a job is kicked off to write this data to disk, making room for more data. Adding more memory to the server to be used as a buffer for the Map operation minimizes disk spill ratio’s. This may increase the per server costs, but depending on your workload may end up your cost per job/transaction due to more efficient operation of your nodes. A second option, first explored by Intel in their chipset design clusters is to extend RAM into solid state cards inside of their servers.

Bringing it all together

Hadoop  supports a suite of applications that are used from the worlds largest web service providers to large enterprises. Uses include Data Warehousing, Analytics, Log analysis and large horizontally scaled databases.

Similar to other parallel compute systems such as Sun Grid Engine, or Platform LSF, a system wide approach to performance tuning must be used to ensure optimal performance as measured by cost per job / transaction. This system wide approach include server optimizations for specific server roles server roles such as large memory and PCIe Flash cards. As well as utilization of network equipment and topologies such as Nexus 5500 and fabric extenders to create low latency high bandwidth back planes ideally suited for Hadoop clusters.

Want to learn more?

Yahoo developers network Hadoop blog – http://developer.yahoo.com/hadoop/

Hadoop Distributed File Systems Architecture Guide – http://hadoop.apache.org/common/docs/current/hdfs_design.html

Big Data Network Design Considerations (Cisco) – http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9670/white_paper_c11-690561.html

Hadoop and Hbase applications for read intensive search – http://software.intel.com/en-us/articles/hadoop-and-hbase-optimization-for-read-intensive-search-applications/

Evolution of Google File System – http://queue.acm.org/detail.cfm?id=1594206

Similar Posts:

• None Found

--Colin McNamara

Tuning Hadoop and Hadoop driven applications

For the last two years I have been training with a goal of finishing the oldest bicycling event in history, Paris-Brest-Paris. This event has been held every 4 years since 1896, and is 1200 kilometers (roughly 750 miles) long. Roughly 700 of us Americans qualified to go this time, and I am one of them.

For those of you that want to track my progress while I am on the road ACP (the group who runs PBP) has implemented a RFID tracking system that will track me as I move between checkpoints on the course. You can monitor my progress starting on Aug 21st at 6:00 pm CEST (Paris Time) by going to the page below and entering in the frame number 4500.

http://www.paris-brest-paris.org/pbp2011/index2.php?lang=en&cat=accueil&page=edito

Frame number = 4500

Bonne Route!  –Colin

—-UPDATE —-

My results are below – I came in at 76 hours and 57 minutes (well under the 90 hour time limit for my group).

Similar Posts:

• None Found

--Colin McNamara

Tracking my progress during PBP 2011

After an awesome four and a half years I have decided to leave ePlus. My last day was June 8th.

I have to admit, it was an extremely hard decision. Of the past half of a decade ePlus has provided unquestioned support for “crazy” ideas like using service provider technology in enterprise designs, or focusing on this new and crazy “Data Center” thing four years ago. Having support to explore and thrive on the bleeding edge of technology while working with some of the largest customers in the world made every day an adventure.

The most transformational experiment for me personally was implementing an overlay model in the western area. I have to thank the Area VP and corporate leadership for taking the risk and allowing us to transform the business from Voice and R/S partner to the top Data Center partner in the west. Trusting and empowering us with this change was a huge opportunity, and I wouldn’t be where I am today without that experience. Thank you.

Over the years as people have changed employers I have always said that teams span corporate boundaries. I hope that as I embark on my next challenge that we continue that tradition and keep in touch.

I can be reached by the following methods -
Linkedin     http://www.linkedin.com/in/colinmcnamara
My blog       http://www.colinmcnamara.com
Twitter        http://www.twitter.com/colinmcnamara
Facebook    http://www.facebook.com/colin.mcnamara1
yahoo im    op_colin_mcnamara
google chat  mcnamara.colin

Thanks again for everything, It has been a blast.

–Colin McNamaraSimilar Posts:

• About Colin McNamara
• Twitter Updates for 2008-06-05
• Resume – Colin McNamara, CCIE #18233
• Cisco releases Nexus 1000V virtual switch for VMware
• Reader question – Why are corporations looking for BGP experience?
• Cisco Storage Partners – California… a very small list

--Colin McNamara

Colin has left ePlus Technology

So many people linked, tweeted and posted on Facebook about my VMworld presentation submition #3221 Built to Fail. I just wanted to say thanks to everyone for spreading the word. I should find out on June 1st whether I am presenting.

Again, thanks to everyone for all of your support.Similar Posts:

• How to succede in 2007 – By Tim O’Reilly
• VMworld 2009 Schedule
• New Buzzword Enterprise Service Bus
• Witch fire in San Diego – Notes from an evacuee
• New features in VMware 3.1
• What does it take to pass the CCIE exam?

--Colin McNamara

Thank you for voting (VMworld Presentation)

for Tier 1 Virtualized Environments

Today’s virtualized Data Centers are not stand-alone environments. The availability and performance of these environments depends on complex inter-dependencies of networking, server, virtualization and storage vendor components. Behaviors of which can vary by vendor or even firmware version.

Not only are end to end configuration guides that encompass every element in these infrastructures rare, but there are so many elements that one minor mis-configuration may result in your virtualized datacenter not performing deterministically under all conditions. The same rigorous testing that is required for Tier 1 systems and networks in the physical work must now be mapped into the virtual infrastructure.

In this session we will explore testing tools and methodologies to validate a virtualized environments ability to meet SLA’s, and also track performance changes over time as new hardware, firmware, and software is introduced.

**Special needs of Tier 1 applications**

Availability –

Applications have a small window that you can lose packets before the application breaks. Is your convergence time under that? Voice apps require even stricter controls then this. Requirements include minimums among overall latency as well as the variation of latency as well as a maximum percentage of packet loss that can be sustained.

Quality Of Service –

Voice and video servers are starting to make their way into your virtualized infrastructures. There are specific prioritizations that need to occur at many physical and logical points in your infrastructure. Luckily these can be tested before you get a call about call quality issues.

Throughput –

Will that new app bring your cluster to its knees? Good thing to test first.

**Areas of increasing complexity in virtualized DC infrastructures**

What new components are showing up in our virtual infrastructure that can affect our SLA’s

-        Networking Components

-        Storage

-        Security

A single mis-configuration of bug in firmware of any one of these items can stop you from meeting your SLA’s. We will highlight common components that we need to test in Tier 1 virtualized infrastructures.

**QA and Acceptance testing methodology**

There is no need to reinvent the wheel when it comes to QA and Acceptance testing. We will discuss common tests such as SRLG (Single Resource Link Group) failure tests along with common testing and report frameworks.

**Test tools and procedures **

It doesn’t take a million dollar test set to validate your infrastructure. We will review some great open source tools out there that use can use to validate Availability, Quality of Service, and Throughput as well as show a couple of my favorites in action.

Call to Action - If you want to hear all this and more, vote for my VMworld presentation here

http://www.vmworld.com/cfp.jspaSimilar Posts:

• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Cisco Unified Computing System Quoting and Configuration with Netformx
• VMworld 2009 Schedule
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

--Colin McNamara

Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)

Are you a single or multiple CCIE who can present with confidence one minute, step to a whiteboard and do a design session and then  hop on a device and configure high end solutions the next?

Are you looking for an opportunity to work with the largest and most challenging enterprise customers in Silicon Valley, working with bleeding edge products and designs?

Do you want to work on a team with 18 CCIE’s nationwide, and 5 in this office alone?

If so, you are in luck. We are adding another senior engineering position to our enterprise sales team. If you have the traits listed above you just might be a great addition to the team.

A little background on ePlus -

ePlus is a national DVAR with 20 offices across the nation. It was founded in 1990 and is publicly traded on the Nasdaq under the symbol PLUS. We have 690 employees nationally, of which 160+ were senior engineers. You would be working in the Sunnyvale California office which has just over 50 employees of which 25 are engineers.

So do you have what it takes?

Sorry recruiters, this is for direct candidates only.Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Challenges integrating VMware into Cisco networks
• Resume – Colin McNamara, CCIE #18233
• Colin has left ePlus Technology
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested

--Colin McNamara

Are you a kick ass engineer looking to grow?

Is the person you are speaking to understanding the subject? Are you going so slow that you are boring them to death? Did you stumble on an organizational landmine an inadvertently offend someone? Who in the room is actually making the decision? It may not be who you think. Is the customer ready to make a decision? All these are good questions to ask when you are presenting a solution, or educating a person or group on a technology. The secret is, you don’t need to ask. The person across the table is telling you. They are telling you through positioning of their body and their movements (commonly known as body language).

When you take into account cultural differences (which there are some distinct body language differences between cultures), a significant portion of communication is communicated non verbally.

One experiment I do when a new systems engineer (SE) joins the organization is to sit in as a coach in a customer meeting. I am there as a safety net while they position a product, or design a solution. After the meeting is concluded we get sit down and do a debriefing. Our focus however is not the technical accuracy of the solution, or how to further help the customer (there is a process of checks and balances for this however). The purpose of the debrief is to discuss what reactions people had to certain content, and specifically to ascertain whether the presenter picked up on these cues. If the cues were picked up, that is great. If not some simple tips and supplemental training can be recommended to help the engineer develop an awareness of these non verbal messages.

What are some common non verbal cues

One thing to get out of the way, is that no single cue can give a clear picture of a persons state (with the exception of flipping the bird). But if you combine multiple cues together you can usually get a good idea of what is going on mentally or emotionally with a person.

Closing off – The crossing of the arms in front of the body. This can indicate a few things. In general this can signal that the person is uncomfortable. You can confirm this by checking out their facial expressions.  This sense of discomfort may be due to fear (afraid of public speaking ), or due to anger (you may have discussed a Cisco UCS solution when they want to go HP).

What to do – I find the best way to deal with this is to be very aware of when this posture occurred. If there person was closed off as they sat down, they may just be uncomfortable in the new surroundings or with new people. If the person closed off right after you made a statement however, it is best to pause an ask peoples thoughts on that statement and address the issue before moving on. If you don’t you run the risk of every thing you talk about afterward not sinking in.

Smiling – This is an easy one to pick up on. It however is commonly forgotten when YOU are the one presenting.  A person who smiles and has a “bright” face is much more likely to be accepted into a positive discussion. I personally have to be acutely aware of this because my default “blank” face can be quite stern. (think Marine Drill Instructor before his coffee).

What to do – Before a meeting or presentation I do facial stretches. These are extreme yawning movements and open up your face. The result is that you don’t unintentionally make anyone uncomfortable due to a stern look.

Leaning back with the hands in back of the head – You have just found the Alpha Male (or Alpha Geek if you are in Silicon Valley). This person is demonstrating his superiority. The most common situation is that this is the boss. If this is not the boss this may be a technical decision maker. Be prepared to field some pointed questions about esoteric items as you establish credibility with this person.

What to do – Be aware that if you challenge this persons authority or knowledge you may just derail the meeting. Getting in a battle of wills trying to see who is the Alpha will go no where. Establish credibility in a non threatening way. Be open and inclusive in your discussions paying special notice to this persons ideas. Ideally take one of their ideas and statements and use that as a keystone for demonstrating your idea or making your point. If you can pull that off not only will you have diffused the threat of derailing the meeting you will have created an advocate in the organization.

These were just four common non verbal cues. To cover all of them would take a book. Luckily there are many books on this subject.

Elbow on the table with the thumb and forefinger split supporting the chin – This is a good one. This person is interested and engaged. If they are maintaining eye contact you are communicating well. If their eyes go off to the side or up they ma be contemplating your message.

What to do  – If their eyes are straight ahead keep doing what you are doing. The audience is interested and engaged and this is exactly where you need to be. Stay aware of this as it is a great sanity check that you are on track. If the eyes move up and behind though you may want to slow things down with some pauses to allow this person to complete their thought. They may have an important question to ask and you don’t want to miss the opportunity to answer it. In any case if they are thinking they are not listening to new content so doing a quick comprehension check is a good thing.

Pulling it all together

As engineers, many of us focus on providing a technical accurate and detailed solutions. This alone is not always sufficient to position a specific solution. By becoming aware of non verbal communications from your audience you will become aware of organizational dynamics, as well as become better at recognizing whether you are on target for the technical level of your audience members.

Want to learn more?

The best book I have read on non verbal communication is called -

The Definitive Book of Body Language by Allan and Barbara Pease.

This covers both the high level body language cues as well as detailing some very minute yet important positioning a posturing details. I would say this book is a must read if you are going to operate in any sales engineering organization.

Similar Posts:

• None Found

--Colin McNamara

Non Verbal Communication for Sales Engineers

So then I ask the question, why do some excel while others struggle in this industry?

The importance of soft skills

Given that most of the engineers in our industry have equal access to training, and roughly equal capacity to absorb that knowledge. The key differentiators in my opinion are the soft skills that the engineer is equipped with.

What is a soft skill? I break soft skills down into four key areas

1. The science of interaction – Understanding the fundamentals of non verbal verbal communication.

2. Organizational and workload management skills – Skills and systems that are the foundation of a “dependable” person.

3. Emotional / Organization intelligence – Reading peoples motivations and emotional influences on their decisions and actions.

4, Presentation skills – How to clearly communicate your ideas including to an audience of two or two hundred.

So much time and  effort is spent on attaining the latest certification, or attending the latest course that the fundamentals of human interaction can be overlooked. An engineer who masters these four areas will without a doubt differentiate themselves from their peers. Engineers who ignore these key fundamentals of human interaction can still be successful (I would reference many amazing engineers with Asperger’s syndrome) however they tend to gravitate to back-end engineering roles where interpersonal skills are not as critical to success.

Pulling it all together

As engineers, many of us focus on providing a technical accurate and detailed solutions. This alone is not always sufficient to position a specific solution or navigate to complicated waters of organizational interactions. By developing soft skills as well as technical skills you will you will become aware of organizational dynamics, as well as become better at recognizing whether you are on target for the technical level of your audience members.

Want to learn more?

Expect to see articles from me in the near future covering-

1. The science of interaction – Posted

2. Organizational and workload management skills

3. Emotional / Organization intelligence

4, Presentation skills

Similar Posts:

• Are you a kick ass engineer looking to grow?

--Colin McNamara

Taking a Sales Engineer from good to great

Reason #1  – Super secret projects

I have been doing detailed design work for a couple REALLY LARGE data centers clients (the type that dominate top 10 lists) . These builds were extremely sensitive, and inadvertently  leaking internal information would not have been a good thing. Since I tend to write about what I am currently working on, I had decided to limit my posting just to avoid the chance of leaking any specific design elements.

Reason #2 – Business is booming

Things got really busy. For me the great recession of 2009 was spent aggressively marketing new product lines and attracting new talent. There is a saying that your marketing dollars go twice as far during a down turn. That saying is completely true. Every day was spent working my tail off to ensure that the region stayed afloat. During that time there were zero layoffs, as well as some key talent acquisitions.

During that same time many of the competitors in my region were forced to downsize their team, and limit the amount of time and money they spent helping their clients. While I can understand the business conditions that can force you to make the decision to lay off, it isn’t the best long term strategy to put your best talent onto the market. It is like burning your winter clothing in a blizzard. In the short term it seems like a good decision, but in the long term you will pay dearly.

Avoiding layoffs, doubling down on marketing, and aggressively supporting Cisco’s entrance into the server market all came together and resulted in my region dominating the stack rankings, taking and holding number one positions in Enterprise, Select and Commercial regions in 2010. In retrospect this could be written up into a case study how to grow a business during an economic downturn. Dominating the market however translates into your free time being dominated. Luckily I work with extremely capable and talented Sales and Engineering teams, which was the only thing that saved me from going insane from the amount of work this last year.

Getting to number one isn’t easy. Staying number one is harder still.

Reason #3 – Certifications

If I haven’t been in a design session I have been nose down in a book this year. I had to re-certify a bunch of my certs as well as add EMC’s Technical Architect and Implementation engineer to balance out my NetApp certifications. I also managed to create a nice amount of work for myself by contributing to design sessions around the joint VMware / Cisco data center certifications. Pretty much every suggestion I threw up on the board got implemented, and I ended up having to pass quite a few tests to fill those roles for my current employer.

Reason #4 – Getting healthy

The day I got back from Networkers in 2009 I had one of those life changing moments that was just the kick in the pants I needed. As of writing this article I am down 92 pounds from that day. I have changed my dietary habits to something resembling what humans are intended to eat, as well as started racing bicycles again.

Being competitive on a bike requires quite few hours a week, and that has cut into time that I had previously scheduled to write. Thankfully I learned a lot about effective training this last year, and I am making much better use of my training hours now. This is resulting in much more free time for writing.

What can you expect to hear about in 2011?

I would look forward to some very cool stuff. Most of the technologies from Cisco I have been working with have become public, and don’t have NDA restrictions around them. The NetApp and EMC (FlexPod and VBlock) solutions are both developing nicely and in the public domain now. There are still quite a few topics that are off limits, but now there are more things that I can talk about vs things I cannot talk about.

In short, I’m back. Expect more from me soon.Similar Posts:

• What does it take to pass the CCIE exam?
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Certguard, Ethan Banks, Network World and Common Sense
• How to succede in 2007 – By Tim O’Reilly
• Me and the Nexus 7000 last week at the Data Center VT
• Cisco Certified Design Expert – CCDE – officially released by Cisco

--Colin McNamara

Where was Colin in 2010?

The Problem

Apparently when the UCS pod’s firmware was updated to 1.3(1c) an interesting bug was encountered. What happens is when you associate your service profile to a server which has had another service profile associated with it previously you a config failure error stating that the local disk config you are applying is destructive to the physical server and violates a requirement.

I headed over to the local disk policies section of UCSM to see what was going on. Once I got there I noticed a new check box labeled “Protect Configuration”.

It’s a lab, which means that change controls should be followed but rarely are. Following that mantra and went ahead and unchecked the “Protect Configuration” box on one of the commonly used local disk policies and saved my changed. A little background on HOW I am shelled into this lab. I am shelled in via a VMware View server that has component installed on blades 1 and 2 of this chassis. And, yes the local disk configuration that I made a change to was used by these profiles.

A little while later, after all the servers went through a reboot and settings application cycle and a coworker kicked a View server in the butt I was back in. The first thing I did was try to apply my service profile. I got the same error message.

I went back to the local disk config profile section to see if maybe the change hadn’t applied. But, when I edited the profile, it showed that the local disk config should not be in a protected configuration.

However when I went into a service profile to change the same local disk policy, you will notice that this same local disk config was still showing up as a protected configuration.

The Solution

When you encounter a bug, the first thing you do if the obvious isn’t working is check the release notes. This bug did show up int he 1.3 release notes, with a tag of “no workaround”. I don’t believe in not having workarounds so proceeded to bang my head up against a wall trying time consuming things like rediscovering servers, recovering bios’s, creating custom firmware packs and more.

After all that failed, I tried the simple things (you like the reverse order?). My excuse was that I assumed that TAC who had created the bug had already tried this. I guess I should assume less often…

The simple thing, that I should have done from the start was create a brand new local disk profile. I named this profile FIX-PERSIST-ANY, choosing to use any local disk config and expressly making it non-persistent. I then applied the same local disk policy that was on previously to my service profile, and then once applied changed it to FIX-PERSIST-ANY.

At that point I whatever flag that had gotten stuck in the UCSM database got unstuck and I was able to get my service profile applied.

Moral of the story

Just because a bug shows no workaround, it doesn’t mean you can’t fix it. It just means that the engineer who submitted the bug wasn’t able to.

Now I can finally get around to what I was originally trying to do today, getting scripted PXE installs of ESXi 4.1 working.Similar Posts:

• Cisco Nexus 4000 Blade Switch
• Cisco introduces the C-Series Rack Servers
• Cisco Unified Computing System Quoting and Configuration with Netformx
• Where was Colin in 2010?
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• VSPEX – EMC’s Flexible Reference Architecture Explained

--Colin McNamara

Fixing UCS Config Failures due to local disk config requirements

Why was I traveling so much?

Two years ago I was asked to team up with a good friend and start a data center practice by my regional vice president. We put together a strong go to market strategy, that tied in strongly with key product initiatives from Cisco and other vendors. To make a long story short, it was immensely successful. It was so successful that we transformed the region from being seen as a Voice and Service Provider partner to being the top Data Center partner in the operation, capturing the #1 places in both Enterprise and Select.

This level of success came with a price. Originally I had negotiated that every third week I would spend three days in Silicon Valley. With each win came additional mind and market share. We were able to use that success to attract some amazing individuals, which created even more buzz and business. In the blink of an eye my travel schedule had been transformed from a manageable three days every third week to Tuesday through Thursday pretty much every week. There was even one stretch where for six weeks I was only home for two days (one day was flying down to San Diego for a lunch and to grab a change of clothes).

Work Life Balance

The funniest thing, is that I am probably one of the most militant work life balance fanatics that I know. I make it clear to everyone that I am a father and a husband first, and an employee second. When I maintain that balanced life I am more valuable to the company (and my family) then if that equation is reversed.

One story I like to tell is of a former boss who ran software sales for DEC in Europe. He lived in Boston at the time and spent over three hundred nights a year abroad. The saddest thing I have ever seen was him trying to create a relationship with his daughter while she was going away to college. Eighteen years that you can never get back were flushed down the toilet in exchange for corp card  dinners and fancy hotels. I witnessed this after spending eighteen hours a day working at my last startup, and pretty much missing the first year of my son’s life. I had vowed to never fall in this trap again, however the success of our data center practice had set the stage for history to repeat itself.

The tipping point

The more time you spend away from your family, the harder it is on your wife and kids. This was becoming readily apparently to me late last year. I sat down and talked with Ashley and discussed some alternatives. I could step down from a leadership position in our regional DC practice, and return to focusing on Systems Engineering for our Health Care and Indian Gaming practice. I could leave my current job and take a Director role at a company local to me. Or we could move the family up to Silicon Valley where 80% of my travel was.

I brought these options up to our leadership. I didn’t pose it as a threat, just a harsh reality. Something had to give, and I wasn’t going to fall into the trap that so many other people do of choosing their job over their family. Luckily I work with some very good people, who understood exactly where I was coming from. Our leadership all the way up to the C level recognized my issue and we settled on option number three, relocating me and my family to Silicon Valley.

Life in Silicon Valley

Choosing from all the varied towns in the bay was a tough one, but we ended up settling down not far from where I first came to the bay during the dot com boom – San Ramon. It has good schools, it is about 45 minutes from the high tech clients in the south bay as well as the same distance from the financial clients in San Francisco. Yes, traffic sucks. But luckily I still work from home, so most of my travel is off commute times heading to client meetings or speaking at events.

The best thing about being up here is that Silicon Valley really starts going at 10:00 am. This means that I can sit down and have a proper breakfast with my kids almost every day. After a year of hotels and Starbucks breakfasts, being able to make some omelets and get an ear full about the latest cartoon superhero drama is just awesome. I am now able to be the dad and husband that I should be. I am present in my family’s life, as well as fully energized to kick ass at work. What more can you ask for?Similar Posts:

• None Found

--Colin McNamara

Colin has moved to the San Francisco Bay Area

Similar Posts:

• None Found

--Colin McNamara

Cisco Live 2010 Schedule

VBlock Infrastructure Packages

VBlock infrastructure packages are pre-configured bundles that are sized to support specific workloads. These packages are available to run both on the customer site, as well as in a hosted (cloud) facility. If you have been listening to anything that has come out of VMware in the past couple years, it has been centered around the unification of private and public clouds. VBlock is a building block of this integrated cloud.

The VBlock infrastructure packages are offered in “bundles”. These bundles are numbered 0-2 at the time of writing.

VBlock 0 is an entry level package supporting 300-800 virtual machines. This is built on Cisco UCS, EMC Celerra Unified Storage, VMware vSphere and the Nexus 1000v.

VBlock 1 is a mid level package supporting 800 – 3000 virtual machines. This is built on Cisco UCS, Cisco MDS, EMC Clarion, VMware vSphere and the Nexus 1000V

Vblock 2 is a high end package supporting 3000 – 6000 virtual machines. This is buit on Cisco UCS, Cisco MDS, EMC Symmetrix V-Max, VMware vSphere and the Nexus 1000V

Integrated Pre-Sales, Service and Support – Fighting the skill silo

The defining factor in the successfully sales and deployment of virtualization infrastructure has been cross platform knowledge and experience. Storage, Network, and Virtualization vendors, as well as partners have struggled to attract and train engineering and sales forces with this cross functional skillset. Partners who have engineering teams with skills that cross these functional areas have seen success even in this down economy. Cisco EMC and VMware are smart enough to recognize this trend and have linked sales teams at the hips in engagements. Nothing makes this more apparent than John Chambers himself addressing Field Sales in the VCE webcast and requiring that these teams coordinate and act as one cohesive unit.

Acadia

Cisco, EMC and VMware have jointly funded a venture called Acadia. This venture, initially staffed at 120 employees is charted with the development and validation of cross platform solutions. They are focused on a “build operate transfer” model for service providers and large enterprise customers. The target date for Acadia’s launch is Q1 2010.

Partner Ecosystem

This was my biggest worry about this release. Does Cisco, VMware and EMC funding Acadia mean that they are going to go direct and bypass their channel? The party line is no, that all three partners will still utilize the channel to sell and distribute the VBlocks. An interesting new twist however is that there is not one master partner certification to sell “validated” VBlock solutions. To participate a partner has to be certified at reasonably high levels with all three partners to have the ability to register and sell deals under the VBlock mantra.

What hasn’t been clearly answered is what happens when a workload is moved to the “cloud”. Does that go through the channel? What if that cloud infrastructure is built onsite but maintained by Acadia? It sounds like we have to wait till January 2010 to get that answer. In the end time will tell whether Cisco will hold true to the success they have found in the channel, or whether Cisco will end up in an MBA case study of what not to do.

Want to learn more ?

Enterprise Strategy Groups write up

Scott Lowe – VCE quick thoughts

Joint Offering Portal – Privatecloud.com

Chad Sakac – an insiders view of VCE

Cisco Press Release on VCESimilar Posts:

• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• VMworld 2009 Schedule
• VSPEX – EMC’s Flexible Reference Architecture Explained
• VSPEX – EMC’s Flexible Reference Architecture Explained
• Cisco’s Cloud Computing Offering
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem

What does this mean?  In Cisco’s view of the world this means supporting the transport of Fibre Channel, Fibre Channel over Ethernet, iSCSI, NFS and CIFS in a scalable and dependable fashion.

What is the Nexus 4000?

The Nexus 4000 is the 5th release of the Nexus line of switches (counting the UCS 6100 as a release).  This switch fits in the blade center form factor. It is intended to be used in the place of the Catalyst 3000 and 3100 series blade switches. It is a full featured Nexus switch, very similar to it’s big brother the Nexus 5000.

What protocols will it support?

In keeping with Cisco’s vision of a Unified IO platform in the data center the Nexus 4000 will support Converged Enhanced Ethernet (CEE) (yes, they finally caved on the naming) as well as providing the same reliable transport of iSCSI, NFS, and CIFS that you get with the Nexus 5000.

What blade centers will it work with?

Cisco is playing close to the chest announcing what blade server vendors will support this product.

My initial gut reaction was that HP would not be supporting this product, however I just saw that HP is OEM’ing the Nexus 5020. It would make sense that they would support the Nexus 4000 in their C Class blade centers, though only time will tell.

IBM however has been very supportive of integrating Cisco technology, as well as OEM’ing the Nexus 5000 switch in their portfolio. I fully expect the Nexus 4000 to be supported in the IBM BladeCenter platform, though again I cannot confirm.

Dell also has resold Cisco blade switches, and although they do not OEM the nexus 5000 they have been large proponents of the Nexus solution and unification of IO workloads throughout their platforms.

Is it the same as a Fabric Extender?

The Nexus 4000 is not a Fabric Extender. What is the difference? A Fabric Extender is a really efficient multiplexer. While using a Fabric Extender the main goal is vast simplification. What you end up with is a dumbed down remote line card that provides simple, fast services to your access layer. This is great for most uses, however there are instances where you need to provide richer services. A full function switch like the Nexus 4000 is appropriate in this case.

What does it run?

The Nexus 4000 runs NX-OS, Cisco’s data center switching operating system. This is the fourth release of what was previously named SAN-OS which ran on Cisco’s MDS line of SAN switches. This operating system is shared between the Nexus 7000, 5000, 4000, 1000v,UCS Fabric Interconnect and MDS line of SAN switches. Now you can have a consistent operating system platform from your data center core, all the way down through your blade switches and into your virtualization layer.

When will it be available?

Just like when the 3000 and 3100 series blade switches got announced, we are going to have to wait on the individual server manufactures to announce support at their own pace. My gut feel says we will be waiting a couple months for units to get out, and for the vendor certification process to complete. Though with business picking back up, this product may get out sooner.Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco introduces the C-Series Rack Servers
• Humor inside the Nexus 5000 switch fabric architecture

--Colin McNamara

Cisco Nexus 4000 Blade Switch

Intellectual capital driving the cloud

It is wise to follow the movements of thought leaders in Silicon Valley. Why is that? Because when enough smart people land at the same company, it is only a matter of time something great happens. This “human network” of intellectual capital has been the seed of many successful tech companies, and will continue to be true in the future.

One of these tech companies with a wealth of intellectual capital is Arista Networks. There are A LOT of ex Cisco folks walking the halls of Arista. Many of them come from the Granite Systems acquisition (Cisco’s 4500 platform). This platform, while designed with line card oversubscription to keep it between the 3560 and 6500 platforms in price and performance has an extremely elegant internal architecture. Case in point, the 4500 platform has had in service software upgrade (ISSU) for over two years, something that the 6500 still struggles with.

Now that this team, and key leaders from Cisco and other tech companies are putting together a network platform, what can they do? And more importantly, what will they do?

Before I dive into that answer, I think it is important to take a quick overview of the two major camps of network platform development, and what the advantages and drawbacks of each method is.

Creating your own ASICS in house

The first way is to create your own ASICS that handle switching and security functions. In this case, you are effectively a chipset manufacturer, who then bundles your own chipsets into routing, switching and security platforms. On one hand, developing your own ASICS can give you a competitive advantage by rolling in features that are not available to your competitors.

On the downside however because of the high cost of developing these chipsets you are forced to design for a very long lifecycle (7+ years). Another downside is that if you have any problems with manufacturing, you cannot just call up another supplier and change your sourcing strategy because you are that supplier. In the case of any Fab issues you are forced to slip your product delivery dates.

Utilizing market silicon

The second way is to utilize routing, switching, and security ASICS that are commercially available through many manufacturers and wrap your own software and chassis integration around them. This is commonly referred to as “market silicon”. In this case, your focus is end to end integration of commodity ASICS and most importanly creating  software differentiation to add value to your product.

The positives aspects of this model is that you are not locked into your own chipset design time lines. If your primary chipset supplier has a Fab issue, then you can easily change your supplier and hit your deployment time lines.

The downsides of this model is that every single networking manufacture in the world has access to the same chipsets. This forces a vendor to differentiate through better software, support, and integration of these “Market Silicon” ASICS into a superior platform.

Who uses what?

With all the talk of Market Silicon being evil, the reality is that the major networking manufacturers use a mix of home grown ASICS and market silicon to drive their products. I can’t say who uses what, but feel free to crack open your switch and take a look at the chipsets on the line cards. Don’t be surprised if you can find some market silicon sprinkled here and there. Now that doesn’t mean that these platforms are bad, it just means that for certain functions it is cheaper to source ASICS externally then to create them in house.

How does Arista approach this problem?

Aristas focus is to create an extensible network operating system that can manage and enable multiple switching ASICS and switching platforms (VMware Virtual Network Distributed Switch – vNDS).

Extensible Operating System (EOS/vEOS)

Arista created a new operating plaform, based on Linux that manages both the physical and virtual implementations of switching devices (ASIC and Virtual Switches). It is called the Extensible Operating System. This operating system has hooks into all the ASICS and vSwitches that it supports. Most importantly it provides one single operating system for all supported platforms both physical and virtual.

sysDB

Core to the functionality of EOS is the sysDB. What is the sysDB? It is a custom real time database written specifically for the interaction of individual system processes. These include routing, switching, security, management processes. By centralizing all of this information in a central location the time to react to events is minimized . This is especially true when compared to classic networking implementations where independent processes keep independent state.

vEOS

Virtual Extensible Operating system is just that – A virtualized instance of the items mentioned above. This can be run inside a vmware virtual machine. It is the same operating system, database, and daemons that run on Arista’s physical hardware. The only difference that it happens to run inside of your virtual infrastructure.

You may ask the question, why would you want to take a network operating system / hardware combination and split it apart?

vEOS and VMware Virtual Distributed Network Switch

EOS and vEOS have implemented a hook into VMware’s vNetwork Distributed Switch (vNDS) API. In effect, you can think of the vNDS as just another ASIC to the operating system. Instead of connected through a device driver, EOS and vEOS connect in through an XML API. This accomplished the function of both retrieving status and performance information that the vNDS provides, and creating policies inside EOS and publishing them into your VMware switching infrastructure.

If you have an Arista switch directly northbound of your ESX servers, you get this monitoring and configuration feature for free. If you don’t have Arista switches, (say you have Cisco, HP, Juniper or Foundary) you can use vEOS (the virtual instance) and pay a fee to get a cli interface into the VDS.

vEOS vs Nexus 1000V

This is a likely to be a highly contested item, complete with competing bumper stickers. In my opinion it isn’t that big of a deal. The reason being is that the 1000v and Arista’s vEOS implementation are completely different. Cisco’s 1000V is a dedicated piece of code running on your ESX servers that handles switching differently then VMware’s vNDS. Arista’s implementation of EOS and vEOS is more of a management interface to VMwares vNDS. vEOS does not replace the switch inside VMware, it configures and monitors it through the vNetwork API.

When comparing the two products head to head, the discussion is really a VMware vNDS vs Nexus 1000v discussion. If you have already decided to move to the 1000V because of the feature differential between the native vNDS then nothing really changes.

This doesn’t mean that vEOS does not add value. In smaller environments where the 1000V is not an option, or in an intercloud situation where state needs to be passed between disparate network instances vEOS’s vNDS implementation can be very valuable. If the vNDS features are all you need, but you would prefer a CLI for your VMware switching and cannot justify the expense for the 1000V licenses, then Arista might be right for you.

Want to learn more?

Arista Networks – Extensible Operating System

Andy Bechtolsheim‘s opinion on Market ASICs

VMware Virtual Network Distributed Switch

Cisco Systems – Nexus 1000V

Similar Posts:

• Jayshree Ullal takes the helm of Arista Networks
• Cisco Nexus 4000 Blade Switch
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco’s Cloud Computing Offering
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

--Colin McNamara

Arista Networks – Their approach to cloud networking

If you happen to be in the same class, or see me passing in the hall, feel free to pull me aside and say hi.

Tuesday
10:00 AM-11:00 AM	EA3605 Room 302	Virtualizing Tier 1 Applications: The Value of the vSphere Internal Cloud as a Better Platform for Apps
11:30 AM-12:30 PM	VM4800 Room 110	The “Next Generation Data Center” for Telecommunication Companies
1:00 PM-2:00 PM	SS5240 Room 134	Engineering Developments Enabling the Virtual Datacenter – VMware, Cisco and EMC
2:00 PM-3:30 PM	EA3234 Room 104	Virtualizing SQL Server in a VMware vSphere environment
4:00 PM-5:00 PM	VM2472 Room 303	Introduction to VMware vCenter Chargeback
6:00 PM-7:00 PM	EA1820 Room 310	Virtualizing Critical Healthcare Applications

Wednesday
10:00 AM-11:00 AM	TA3286 Room 132	Applications in the Cloud: Getting off the ground
11:30 AM-12:30 PM	EA2583 Room 110	HPC/Grid Computing and Virtualization
1:00 PM-2:00 PM	TA1962 Room 121	How and Why we Upgraded Herning Kommune’s Production Environment to vSphere 4.0 at GA
2:30 PM-3:30 PM	TA4100 Room 303	Internal Clouds: Customer perspective and implementations
4:00 PM-5:00 PM	VM3881 Room 309	Business Objects SAP Virtual Infrastructure Lab Manager Deployment and An Overview of the Best Practices and Process of Migrating Between Network Ranges

Thursday
9:30 AM-11:30 AM	LAB11 Nob Hill A	VMware vCenter Chargeback
11:30 AM-12:30 PM	TA4881 Room 132	Designing Dynamic Data Centers with NetApp and VMware
12:30 PM-2:30 PM	LAB09 Salon 4	VMware vCenter AppSpeed
2:30 PM-3:30 PM	EA3241 Room 301	Beyond Infrastructure as a Service: Developer and Runtime Services with VMware and our Partners
4:00 PM-5:00 PM	EA3481 Room 301	Virtualization of Analytic Databases

Similar Posts:

• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Cisco’s Cloud Computing Offering
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Interesting TechWise TV episode on virtualization
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)

--Colin McNamara

VMworld 2009 Schedule

You may notice that I am using a tool called Netformx. You may ask – since this is a Cisco product, why aren’t we using the Dynamic Configuration Tool or the MultiLine Configurator? The answer that was given to me was that UCS requires a bottom up configuration. It requires that you start with the type and number of systems, and then work your way up to the amount of Chassis, FEX’s, links and Fabric Interconnects that are required. All of the workflows in Cisco’s existing tools require a top down approach. Until the new configuration workspace is released from Cisco, Netformx is your only option to quote any UCS product.

.

Thank you for taking the time to watch this walk through. If you found this helpful, please feel free to leave a comment or ping me on twitter.Similar Posts:

• Twitter Updates for 2008-06-05
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)

--Colin McNamara

Cisco Unified Computing System Quoting and Configuration with Netformx

What does this certification entail?

1. CCDE Certified

Yes, now the CCDE will now get MUCH more popular. You will have to pass your CCDE practical before you have a chance to submit an application to the CCA Board.

2. 10 Years industry experience

A common theme that I have sense from the CCDE team (the team who created the CCA) is that the CCIE does not hold the same value as it held 10 years ago. An experience requirement from the CCA not only a certain pedigree of CCA candidates, as well as the wealth of experience that time provides.

3. Application to “the board”

Translation, be careful what you put on twitter. A board, most likely consisting of Bruce Pinsky, Russ White and the other usual players will evaluate your application. If your application is accepted then you get to face the board.

4. Passing The board examination

Interestingly enough, I see this as the most straight forward portion of the entire CCDE / CCA process. The board exam itself is set to model a normal customer interaction for a network architect. For those of us that do this every day this is straight forward.

First, you have a customer that has a requirement. You gather that requirement generally in writing first. Then you have a chance to interview the customer to gather additional requirements, and more importantly the reasoning behind the requirement.

After that, you go and create a proposal that takes into account all of the requirements, applications, and “gotchas” that may happen. Create Diagrams, Bill of Materials and a Solution Overview.

You present this proposal to the customer, and defend all the aspects of your proposal. Again, this is a common customer engagement. Cisco is mirroring this whole process. The two major changes involved are are 1. the customer is “the board” and instead of making a sale, you get your CCA.

Want to learn more – Cisco Certified Architect Press ReleaseSimilar Posts:

• Cisco Certified Design Expert – CCDE – officially released by Cisco
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• It’s on like Donkey Kong – CCDE practical registration is open
• My experience taking the CCDE Practical Beta
• CCDE Practical – Beta candidate deadline August 1 2008

--Colin McNamara

Cisco Certified Architect – Board examination above the CCIE and CCDE

Schedule note – My good friend Rick and I normally alternate picking which classes to attend each year. Last year I picked classes mostly out of the new developers track. This is Rick’s year to choose, so there are a bunch of really fun high end service provider and route switch tracks (would you expect any less from a quintuple CCIE). It should be a blast!

Sunday
5:00 PM-10:00 PM	Poker night / Hog cookout ePlus engineering	Poker night / Hog cookout ePlus engineering

Monday
8:00 AM-5:00 PM	TECCCDE-3005 Moscone S306	CCDE: The Cisco Certified Design Expert
5:30 PM-8:30 PM	WoS Reception 1 World of Solutions	World of Solutions 20th Anniversay Reception

Tuesday
7:30 AM-9:30 AM	BRKVVT-2112 Moscone W2014	Cisco Telepresence Network Infrastructure Design for Service Providers
10:00 AM-11:30 AM (Conference Event)	GENKEY-5501 Hall D	Opening Keynote and Welcome Address with John Chambers
12:00 PM-2:00 PM	BRKAPP-2011 Moscone W2016	Application and Data Delivery Performance in a Low Latency 10GE Environment
2:30 PM-3:30 PM	GENSSN-4462 Hall D	NetQoS Super Session, NBC Universal’s Olympic Gold Network Performance!
4:00 PM-6:00 PM	BRKRST-3365 Moscone W2024	Unified HA Network Design: The Evolution of the Next Generation Network
7:00 PM-10:00 PM	Partner event – Red Devil Lounge CCIE Party – Science Center – Pick the one with the best bar.	Partner event – Red Devil Lounge CCIE Party – Science Center – Pick the one with the best bar.

Wednesday
8:00 AM-10:00 AM	BRKSAN-3707 Moscone W2000	Advanced SAN Services
10:30 AM-11:30 AM (Conference Event)	GENKEY-5564 Hall D	Cisco Technology Keynote with Padmasree Warrior
12:00 PM-2:00 PM	BRKOPT-2115 Moscone N122	IPoDWDM: 40G, 100G, and Beyond
2:30 PM-3:30 PM	GENSSN-4463 Moscone N135	Super Session: Building the Collaboration Extranet
4:00 PM-6:00 PM	BRKRST-3101 Moscone W2002	Advanced Topics and Future Directions in MPLS
7:30 PM-11:30 PM	Customer Event Social Events	Customer Appreciation Event

Thursday
8:00 AM-10:00 AM	BRKRST-3305 Moscone W2022	Advanced IPv6 Deployment and Services
10:30 AM-11:30 AM (Conference Event)	GENKEY-5565 Hall D	Closing Guest Keynote: Guy Kawasaki
12:00 PM-2:00 PM	BRKDCT-2981 Moscone W2005	L2MP overview: going beyond the spanning tree protocol [ Related Technology Demo: Nexus 1000V Data Center Virtual Switching ]
2:30 PM-4:30 PM	BRKNMS-3132 Moscone W2008	Advanced NetFlow

Similar Posts:

• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Heading home – Cisco Live 2008
• No one told me there would be a monsoon – Cisco Live Networkers 2008
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Application Extension API notes – Cisco Live 2008

--Colin McNamara

Cisco Live 2009 – Networkers class schedule

“it looks like one of the key features not on the list of components for the California boxes is going to be a red discount pen”

Timothy references sources who have obtained a price list and shared it with “El Reg” . I wish Timothy would have contacted an actual Cisco Unified Computing System Advanced Technology Partner, because any partner that is involved in the launch could have explained to him the concepts of List price (List), Manufacturers Suggested Retail Price (MSRP), and Purchase or Buy price.

In this article I want to dispel the myths of server and network manufacturer pricing, demonstrate the true cost of building a data center with blade systems, and at the end provide a cost comparison between legacy server vendors options and Cisco’s Unified Compute System.

First, lets go over some the basic concepts of vendor pricing. At the end of this you should understand the difference between list price, manufacturers suggested retail price, and purchase price.

List Price

List price is a high level number that Cisco publishes weekly in its global price list. The purpose of this list price is to provide a uniform price list across all product sets that Cisco offers. The most important thing about list price is NOBODY EVER PAYS LIST PRICE. Let me repeat that again NOBODY EVER PAYS LIST PRICE. Are we clear? This is similar to list price on a car on the car lot. All list price provides is a starting point where a Cisco partner and a customer can negotiate a common discount and end up with something close to (generally at or below depending on technology type and yearly spend) MSRP.

Manufacturers Suggested Retail Price (MSRP)

This concept is something that anyone who has purchased a car before is familiar with. The number that is on the window of the car when you look on the lot is list price. The first number the dealer brings up lower then sticker is MSRP. Depending on the popular of the product, the competition in that particular space, and the negotiating power of the customer you will either pay that price, or some percentage below. For example if you are buying one new car you may have the negotiating power to get the price to drop 5% off of list. If you are buying 200 new cars (say a fleet) you have significantly higher negotiating power, and you may be able to drop the price by 15% of of list price.

In Networking Sales MSRP is significantly less then list price. A good exercise to see what this number is, is to find a device, say a WS-C3560E-12SD-E (3560 with 12 Gig SFP ports and 2 10 Gig ports) in the Global Price List. You have access to this at any partner level at www.cisco.com/dprg . (my point here is that this is no big secret). As of Friday June 12 2009 the LIST price for this product is $19,995.

Now take that same part number - WS-C3560E-12SD-E and pop it into your google search window. Within the top four links I found this product for $12,434.15 . This price is for  pure fulfillment, with no value added consulting or design work from you local Cisco partner.

If you do the quick math, this price difference is equal to 38% off of list price. Come to your own conclusions, but it would be safe to say that this could be considered MSRP for Cisco products.

Purchase / Buy Price

Buy price is just that, the price at which the customer purchases (buys) the product. This is can be at MSRP, or if the customer is buying significant amounts of hardware at a time, or if there is a “special” (programs and incentives) going on the number could be slightly lower then MSRP.

Percent off of list differences between legacy server vendors and networking vendors

This is where the biggest confusion is coming from. Legacy server manufacturers  have set their list prices much closer to MSRP then networking vendors (remember, MSRP is the price where most customers purchase at).

Why is this? In the networking space, vendors have historically created their own processors, ASICS and boards. This means that the sales discussions are feature to feature. It also meant that you had to have a conversation with the networking vendor or networking partner to properly size your network devices and get a quote – which is around MSRP, not List price.

In the legacy server space, especially the majority of the x86 server space, the market has been essentially commoditized. E.G. – You can buy an intel based server with X amount of memory and hard drives that will perform roughly equally from any of the main manufacturers. That made it much easier for a sever admin to just pull a price off of the web and compare. So what the server vendors ended up doing is setting their list price  only slightly above MSRP.

What this translates to is the list price, between legacy compute vendors and Cisco will be drastically unequal. What is equal is MSRP, or the generally accepted purchase price by common customers.

Why did Cisco set the list price of UCS higher then the legacy server manufacturers?

For the vast majority of its sales, Cisco relies on what is called the channel model. This means that Cisco partners with local Value Added Resellers (VAR’s) who sell Cisco’s products and then provide consultative services to design and implement them in customer networks. Most customers who purchase any regular amount of Cisco product either have a general expectation that they will buy Cisco product at a certain percentage discount off of list and sometimes the partner and customer have entered into purchasing contracts which require that all Cisco product is provided at a specific discount off of list price.

If Cisco decided to set the List price at a small percentage lift over MSRP, this would cause a problem for the entire channel. This would be especially hard for any customer who had a contract to buy product at a specific discount. What would happen is contracts would have to be renegotiated, which generally takes months and is about as fun as pulling teeth.

The second reason for setting list price the for compute the same as list for network is quoting. Right now, if you buy hundreds of different Cisco devices through a reseller it is very likely that the discount is going to be the same across all products. This makes the mechanics of sales much simpler, because you don’t have a lot of math in the quote (this can cause errors). On the customer side, having one set discount makes it much easier to compare quotes and to ensure that they are getting the best deal possible. In short, sticking with Cisco’s current list pricing structure benefits both the customer and the partner.

Now that we have set the record straight on list price, MSRP, and Buy price, lets take a deeper dive into what components make up a blade system powered data center. And then we will compare the price structures of both.

Components of all Blade Systems

Blade Server – The compute blade where commodity silicon elements such as the CPU and RAM are housed. As of writing this article, the latest high performance blades from all major server manufactures support two xeon 5500 processors (Nehalem) and DDR3 memory.

Mezzanine cards – These cards take the place of PCI-e cards in a rack form factor server. In a blade system these provide data network and storage network connectivity. They attach to the blade itself via proprietary connectors that implement either PCI-e 8 or 16 lane connectivity at the time of writing. In some cases other functions such as IO accelerators can also be attached in the mezzanine card form factor.

Blade Enclosure – This is functionally a tin can where eight to sixteen blades are placed. It also is used to provide a centralized power distribution fabric, as wells as slots for interconnections of data and storage network devices.

Data Network Modules – These are effectively ethernet switches that have been miniaturized to fit into the tight confines of a blade enclosure. Classically they have provided 1 gig connectivity to the servers, and 10 gig to the distribution layer, however with Nehalem processors and VMware there is a move towards presenting 10 gig connections to the server, and multiple 10 Gig connections into the distribution layer.

Storage Network Modules – The local disk in a blade server is classically anemic. To provide higher IOPS (input outputs per second) to disk, Fibre Channel connectivity is extended by taking SAN fabric switches and miniaturizing them to fit into the blade enclosure.

Data Network Distribution – If you have multiple blade enclosures there is a need to connect them together at a reasonably high bandwidth. To serve that need a variety of 10 Gig distribution switches are provided from all server manufactures at varying cost and performance levels.

Storage Network Distribution – Along the same lines of the data network distribution, SAN fabric switches have to aggregate up to a SAN distribution layer, or if the installation is reasonably large a “director” class SAN switch. This allows all the blade enclosures to see the same storage network, as well as providing for deterministic storage network performance as you scale out.

Management Infrastructure – All manufactures have a need to manage and monitor all of the devices that comprise their blade system. Many manufactures have multiple management modules per blade enclosure.

Comparison of Costs – Cisco vs Legacy Server Manufacturers

The funny thing, is that many people have assumed that Cisco’s Unified Computing System will be priced higher then legacy server manufactures products. In my mind this is because they associate higher quality with higher price (basically the Mercedes vs Kia discussion). Here is something that will shock you - it costs less to buy an entire blade system through Cisco then to buy from the legacy server manufacturers.

When people hear this, they are puzzled. How can two server manufacturers, who buy their CPU’s from the same company (Intel) and their memory from the same fabs end up with different prices? The answer is elegance in engineering. Lets go through each of the elements of a blade system infrastructure and find out where the costs are. More importantly lets look at where Cisco has innovated to provide higher performance at a lower cost.

Dollars and Cents – How much is the cost difference

I worked up two quotes recently. These quotes included all elements required to build an end to end blade system using both legacy server manufactures devices, and using Cisco’s Unified Computing System. I have broken out two scenarios.

8 blade servers - Cisco wins with a savings of 11%

In this scenario the cost of servers and enclosures were fairly equal. The cost savings started racking up as storage and data networking devices were included, as well as base management software was taken into consideration.

320 blade servers - Cisco wins with a savings of 31%

With 32o blade servers the same cost savings seen in the 8 server scenario were amplified. Economies of scale translated into significantly less devices being required to support the individual compute blades. This resulted in 31% savings compared to the legacy server manufacturers.

Summing it up

Cisco has entered into a highly competitive server market by taking an elegant approach to its blade systems. This approach lowers the purchase price of the UCS through reducing the amount of components compared to legacy server manufacturers. I know that there is a lot of misinformation flying around, and I hope this helps to set the record straight on the pricing of Cisco’s Unified Computing System.Similar Posts:

• Cisco Nexus 4000 Blade Switch
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco introduces the C-Series Rack Servers
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco Nexus 5010 released

--Colin McNamara

Confusion about Cisco UCS pricing – Setting the Record Straight

The Server Landscape

If you take a look at most enterprise and commercial customers data centers, you will notice a trend of larger fixed workloads running on two rack unit servers (very commonly HP’s DL380), and newer virtualization workloads consolidated onto blade center form factor servers (commonly c7000 class blade systems, and soon Cisco UCS B-Series blades).

However when you go to a remote site where the compute needs are much smaller, you tend to see a few 1 and 2 rack unit system (DL360 or DL380). Why is this? There are a couple reasons, but the most pressing reason is cost. In a blade system, even if you virtualize there is a tipping point where it costs less to install blades and use centralized storage then it costs to use rack form factor servers with local storage. I find that tipping point is generally between five and 8 blades.

If you are a small remote site, or small to medium size business you may not have the compute needs (especially with virtualization) to push you over that tipping point into the blade center form factor. In that case, a few rack optimized servers provide the optimal return on investment for that smaller site.

Taking a closer look at Cisco’s C-Series Servers

Cisco UCS C 200 M1 -

Effectively this is a clone of the B-200 M1 blade in the B series UCS chassis with the addition of two PCIe slots and two more SFF SAS/SATA drives..

The C 200 M1 is a 1 rack unit form factor server (pizza box). It supports a dual port 10 gigabit converged network adapter. two Xeon 5500 series processors, four small form factor SAS drives, 12 dimms for a total of 96 Gigabytes of memory.

Cisco UCS C 210 M1 -

The C 210 is a 2 rack unit form factor server, with the same CPU and memory architecture as the C 200. What has been added is 3 additional PCIe slots (for a total of 5). There is also support for up to 16 SFF SAS/SATA drives.

Out of all the C-Series servers I think this will be the most popular. The extra local disk and PCIe slots will be extremely tempting. For example if this server was populated with 750 Gig SFF SATA drives and augmented with some Fusion-io cards you could have 6 Terabytes of raw disk inside this server. An end user could install Open Filer or iSCSI Enterprise Target and have a pretty respectable NAS head. The other possibility is someone will notice that the Palo adapter can be used as a FCoE target, and use a couple of these as backends for FC storage. (This FC target functionality is mentioned in Silvano Gai’s book).

Cisco UCS C 250 M1 -

Effectively this is a clone of the B-250 M1 blade in the B series UCS chassis with the addition of five PCIe slots and eight SFF SAS/SATA drives.

The C 250 M1 is a 2 rack unit form factor server. It supports a dual port 10 gigabit converged network adapters. two Xeon 5500 series processors, eight small form factor SAS/SATA drives, and 48 dimms for a total of 384 Gigabytes of memory.

This server utilizes the same catalina chipset for memory expansion that it’s cousing the B-250 M1 utilizes.  The ability to aggregate low cost memory plus the PCIe slots to insert solid state I/O acceleration make this a prime candidate to business intelligence / data warehousing workloads as well as Electronic Design Automation.

When can I buy these?

Putting any new product line into production is a monumental effort that many of us take for granted. My gut feel is that Cisco will focus on satisfying demand for the B Series Unified Compute System first, and once manufacturing has hit their stride with the UCS Cisco will start production of the C-Series. In short, I’m  expecting the first C-Series servers to roll off the line at the end of 2009, and  meaningful availability of the C-Series in the first quarter of calendar year 2010.

How do I integrate these into my network?

This is a question that is bound to come up. Cisco’s C-Series servers can integrate directly into your 10 Gig enabled network. Now, to get the best bang for your buck, you should ideally connect these into a pair of Nexus 5000′s to converge your storage and data networks into simple 10 Gig Data Center Ethernet links.

You may however have site without 10 gig enabled switches. In that case, there are multiple PCIe slots in these servers so we should be free to utilize 10/100/1000 adapters. Then when these sites have the need to move to 10 Gig, the server will be capable of supporting that level of connectivity.

My Perspective

At the end of the day, Cisco is now a server manufacture. Just like the HP and IBM, Cisco has to provide platforms that meet customer needs. While the B-Series Unified Computing System is an outstanding platform, it shares similar entry costs that other blade systems have (the need to purchase chassis and interconnects first) which can server as a barrier for smaller server installations. By introducing a 19″ rack form factor line of servers that share many of the I/O and memory benefits of the B-Series servers, Cisco is directly answering the needs it’s customer base by providing a form factor that can scale across all size of customer installation.

Want to learn more?

Cisco Unified Computing System Overview – colinmcnamara.com

UCS C-Series Rack Servers: A New Path to Unified Computing – Cisco.com

Cisco unveils rackmount servers for UCS - datacenterknowledge.comSimilar Posts:

• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 5010 released
• Usability features in Cisco’s Nexus 7000
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

--Colin McNamara

Cisco introduces the C-Series Rack Servers

Why do I say that? It is simple, every server that moves from a corporate data center into a cloud provider is a switchport and fibre channel port (and now server) that is not purchased from Cisco. More so, each system that is moved into the cloud hurts secondary sales of security and content switching products.

The promise of enterprise cloud computing

The ability to dynamically scale enterprise compute workloads while only running a “right sized” private infrastructure is top of every CIO’s mind. This is the promise of cloud computing in the enterprise space. However, right now most cloud offerings are too new, and lack the critical integrations with VMware or XenSource (the two most common enterprise virtualization platforms) to make a serious dent in Cisco’s revenue stream. But fast forward 12 to 16 months and the kinks will be worked out. Projects that would previously have required new capital infrastructure will be restructured to use cloud providers as an operational expense. This will present a real threat to Cisco’s revenue moving forward.

John Chambers and his team of technologist are not new to this game, this is not the first threat to Cisco’s sales model. And I am sure that it won’t be the last. So if I was in their shoes, what would I do? (and more specifically, what do I think they are doing)

Create a compute platform that can power the cloud at a much lower cost that my competitors

Cisco publicly announced their computing offering, the Unified Computing System in March of this year. The promise of the UCS is to minimize power, cooling, capital costs and management overhead of data center compute. Looking at this new product line from an enterprise sales perspective it makes sence. For Cisco to continue with their growth plans they had to choose to enter the Compute or Storage markets, with the compute (server) market being the logical step.

While the Unified Computing System is well placed as an enterprise computing platform, I think there is a larger goal in mind. The large goal is to make a platform that can be shared by Cisco’s largest enterprise clients in their emerging private clouds, as well as by Cisco itself for it’s own cloud offering. By producing their own servers, with technology that Cisco alone has access too (memory expansion / hypervisor bypass) Cisco sets themselves up to have both lower hardware costs in their own cloud, as well as lower operational costs (power/cooling). This will provide Cisco with higher margin at the same price point as their competitors.

Distribute application aware network devices at customer locations

Cisco already has a significant edge over any competitive cloud offering. A vast majority of enterprise customers already run Cisco routers, switches and firewalls. If Cisco decided to say, port the TCP optimization code from their WAN acceleration platform into IOS, and configure it to work with their own cloud offerings this would give them an immediate leg up on the competition. Combine this with the existing WAAS auto discovery and Cisco could conceivably automatically integrate a cloud based caching offering with a customer’s onsite devices.

Create an application centric cloud security model that can be integrated with virtualization platforms

Last year Cisco announced a new approach to security called Cisco TrustSec. This technology includes a change from layer 4 based acl’s to an application focused role based implementation. This is applicable in the cloud environment because it provides a standard integration for controlling the access to and mobility of applications as they travel between public and private clouds.

An interesting side bar, is the fact that when integrating public and private clouds, there will always be applications that you want to keep on your internal cloud. The easiest way to do this is to put some sort of meta information on the virtual server containing a flag that this server should only run on the private cloud. With VMware there are fields that are used for DRS that can house just such data. I would not be surprised that with all the work that Cisco and VMware have been doing together if this was not implemented with vSphere (Virtual Infrastructure 4).

Learn as an organization how to profit from a SaaS model

I think this last piece of the puzzle has been overlooked by many people. Cisco already has in house experience dealing with a massive Software as a Service (SaaS) offering – Cisco WebEx. In acquiring WebEx Cisco also acquired the talent and technology behind the worlds largest collaboration platform. Cisco should be able to take the lessons learned from running and improving this platform, and apply them to their upcoming cloud offering.

Summary

Cisco has to go to market with a Cloud offering to maintain long term viability as a company. When they do they will have the benefit of lower cost of building and operating the grids that their cloud offering will run on. They will be able to leverage millions of Cisco network devices in their current install base as well as provide application centric security integrated with these same devices. And most importantly they will be able to use the lessons learned from running WebEx to ensure flawless delivery of an upcoming cloud computing offering.Similar Posts:

• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• VMworld 2009 Schedule
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• VSPEX – EMC’s Flexible Reference Architecture Explained
• VSPEX – EMC’s Flexible Reference Architecture Explained
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Cisco’s Cloud Computing Offering

Brian Schwarz (SAVBU) and I were guests, and had the chance to talk about Cisco’s Unified Computing offering. It was my first time doing a podcast, and I have to say it was a blast.

If you can spare the time, I recommend you check out it -

Cisco Interactive Network – Unified Computing PodcastSimilar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco’s Cloud Computing Offering
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• VSPEX – EMC’s Flexible Reference Architecture Explained
• VSPEX – EMC’s Flexible Reference Architecture Explained
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem

--Colin McNamara

Unified Computing Podcast with Cisco Interactive Network

This March, Cisco formally announced its entry into the enterprise computing market with a new product line called the Cisco Unified Computing System (UCS). I say formally announced, becase the existence of the Unified Computing System might just be the worst kept secret in history. In the months prior, to launch Cisco has been openly talking about the system, as well as many news agencies. The only people who haven’t been talking about the system were those of us who got briefed in early and were under strict NDA. (yours truly being one of them). But now, the multiple layers of NDA have been removed and I am free to talk. So, let me tell you about a new concept called Unified Computing.

The Unified Computing System answers a simple question – “what would you do if you could build a system with no preconceptions”. That same question has been asked over the years by Cisco. The results have given us the Catalyst 6500 line of switches, the Cisco MDS storage line, as well as the Nexus 7000/5000/2000/1000V family of switches.

Nuova – a history of innovation

A couple of years ago, Cisco funded a startup called Nuova (meaning “New” in Italian). The founders of this startup were the same innovators who led the Catalyst, MDS and Nexus products. Not only did they have a track record of successful products, but they also had experience in both types of Data Center networking – Ethernet, and Fibre Channel. This startup took the lessons they learned creating a non blocking, low latency, highly available fabric for the MDS line of SAN switches and created a new line of Data Center switches, the Nexus 5000 that is able to transport Fibre Channel and Ethernet traffic at the same time, through a single adapter.

In April of 2008 Cisco formally acquired Nuova (which in effect was just hiring prior innovators back). Nuova was renamed the Server and Virtualization Business Unit (SAVBU), and the Nexus 5000 was released to market, making Cisco the first vendor to deliver a solution based around the upcoming Fibre Channel over Ethernet standard (FCOE). This pattern of innovation continued, as SAVBU released a virtual switch for VMware (the nexus 1000V) and this January released a remote line card technology called Fabric Extension. Those of us on the inside got the hint that the choice of names for this new business unit (SERVER and VIRTUALIZATION Business Unit) was a foreshadow of things to come.

Unified Computing System enclosure w/ redundant 6120 Fabric Interconnects

Here are some spec’s to get you started –

• Single point of management for all devices in the fabric.
• Virtual machine enabled networks adapters. (VNtag capable)
• Up to 320 B-series compute blades in one fabric.
• Up to 384 Gigabytes of memory per blade (full width blade)
• Server Profiles – virtualize server identities (UUID, WWN, MAC)
• Hardware Assisted Virtualization using Intel’s next generation Xeon (code named Nehalem-EP) processors
• Redundant 10 Gigabit connections between servers.
• Fibre Channel SAN access available to every blade.
• Capital costs up to 20% less
• Operational costs up to 30% less

The UCS does all of this while using 1/3 less components then the competition. What does using less components give you? Less components means less things to buy (lower capital expense). It also means less things to power and cool (lower operational expens). And finally it means less items to manage (lower management burden) How does Cisco do all of this while using drastically fewer components? I think it is necessary to talk about the major components that they system is built from to answer that question.

Cisco UCS 6100 Fabric Interconnect (Nexus 5000 on steroids)

.

The primary building block of the system is the Cisco UCS 6100 Fabric Interconnect. Cisco took the non blocking, low latency, lossless fabric from the MDS that was used on the Nexus 5000 and used it as a building block for the 6120 and 6140 Fabric Interconnects. These fabrics support 20 and 40 (6120/6140)10gig Data Center Ethernet (combined Fibre Channel and Ethernet support).

• 6120 – 20 Fixed 10 Gig Data Center Ethernet ports along with an expansion module that supports native Fibre Channel, or additional Data Center Ethernet interfaces
• 6120 – 40 Fixed 10 Gig Data Center Ethernet ports along with two expansion module that supports native Fibre Channel, or additional Data Center Ethernet interfaces

The 6100 series Fabric Interconnect unifies Storage and Ethernet network, as well as providing supervisory functions for its remote line cards, the 2100 series fabric extenders that are inserted the compute chassis. The other thing the 6100 Fabric Interconnect does is house the Unified Computing System Manager (UCSM).

Cisco Unified Computing System Manager (UCSM)

The UCSM runs on the fabric switches, providing a single point of management for all components in the fabric -

• I/O Fabric
• Chassis and Services
• Adapters and Virtual I/O

This interface can be accessed through either a web based Gui or CLI. It also supports a full API for programatic integration and management of the system. The biggest thing that they SAM gives you is the ability to dynamically provision server attributes down to the compute blades. Attributes that can be pushed down dynamically include CPU UUID, SAN PWWN, Ethernet MAC address, and many more. These items are pushed down through as Service Profiles.One key component of the service profile is the Port Profile.

.

These Port Profiles are dynamically created in the SAM, and most importantly enable you to create virtual network interfaces (vNics) that show up to your server administrators as normal network interfaces. This allows your server administrators to follow their application vendors recommended interconnection topologies.

A great example would be VMware’s recommended topology for ESX. In this topology there are four network intefaces defined. Each for a specific function. This logical topology can be implemented, with all the relevant speed, QOS, VLAN, and security attributes all “pre-configured” for the virtulization administrators, simplifying their virtualization cluster deployments.

Cisco UCS 2100 Fabric Extender (Next Generation FEX)

 The next component in this architecture is the UCS 2100 Series Fabric Extender (FEX). There are two of these in each bladechassis. Each FEX has the capability of up-linking to 6100 Fabric Interconnects with four 10 Gig ports. for a total of 80 Gigabit persecond out of each blade chassis (supporting 8 half width blades, or 4 full width blades). Each FEX is managed as a “remote line card” connected off of the Fabric Interconnects.

Logically, think of your 6500 series switch in your Data Center right now. You have three logical functions, supervisory functions (sup module), a bus for the switching fabric (traces in the chassis) and line cards (6748 for example). You will notice that you only manage the sup module itself. You don’t shell into to each line card to set up backplane interconnects, or to update microcode. You update software and configurations on the sup module, and the intelligence that Cisco builds into its software manages this for you.

The 6100 and the 2100 interact in the exact same way. In this case the 6100′s are the sup modules, the 2100′s are the line cards, and we are running 10 Gig connections to build the switching fabric. What this gives you is a simplified network architecture, which takes elements that would in the past be individually managed, maintained, upgraded, etc and consolidates that into one highly available, high bandwidth consolidated SAN and Ethernet for your Data Center compute needs.

Putting Network Intelligence on the Compute Blade

Cisco will be giving customers three mezzanine card network adapters options for the UCS.

The first card (based is based on a the Palo chipset. This chipset was developed internally at Cisco and performs Network, Storage and Virtual Machine networking functions all on one 10 Gig capable chip. This chipset effectively extends network intelligence into the blade itself allowing for some pretty interesting integrations with Virtual Machine Hypevervisors (VMware, Hyper-V, Etc).

The second option is based on the Menlo chipset in conjunction with either a Qlogic or Emulex Fibre Channel adapter chipset that gives you 10 Gig network access, while retaining strict compatability with applications that require either of these classic HBA’s.

The third option is an “economy” option based on an Intel chipset. This will give the compute blade 10 Gig access.

What will drive your choice of network adapter? I think the biggest driver will be a technology called “VNtag”. This technology is currently in use on the FEX to encapsulate traffic that enters the fabric with a little shim header that communicates the identity of the incoming port (VLAN, QOS, Security info, etc). This shim header passes from the FEX up to the 6100 where the shim header is removed and the frame is processed.

This alone is very cool, however Cisco has taken things one step further and put the ability to impose VNtag’s in the Palo chipset (on the blade) itself. What this gives you the ability to logically attach a virtual machine DIRECTLY to the network. We no longer need a vSwitch, or even a 1000V to give full network functionality to a virtual machine. Effectively, Cisco is giving the network adapter inside of the blade many of the functions of a network switchport. Logically what this does is reduce your network tiers from four tiers in a competitive system, to two tiers in a Unified Computing System.

Cisco UCS B-Series Blades

The compute blades themselves are available in either 1/2 width of full width form factors. As stated in the formal announcement the maximum memory for a full width blade will be 384 Gigabytes per blade. Why is this important?

At release, there will be two option for compute blades.

Half width blade

• 2 quad core Intel Xeon 5500 processors
• 96 Gigabytes of memory
• Two small form factor SAS drives (raid 0 and 1)
• Single Converged Network Adapter slot (connected to redundant fabrics)

Full width blade

• 2 quad core Intel Xeon 5500 processors
• 384 Gigabytes of memory
• Two small form factor SAS drives (raid 0 and 1)
• Dual Converged Network Adapter slots

As CPU’s become more powerful, the host compression ratio’s (the amount of virtual machines you run on one physical blade) increases. The one thing is, you can only over commit your memory to a point. Once you are at that point you have to physically add more memory. Your only option with legacy server architectures is to add another physical server, pay for additional licenses and add more memory to it. Then add that server to the cluster and allow your virtual machines to utilize its additional resources in the pool.

The problem with this is a simple one, Cost. The problem was that the virtual machines needed more memory, but since there was a limitation on how much memory the legacy server could handle, it forces costs skyward to meet those memory needs. In this scenario if the customer had been using a full width Unified Computing blade the customer could have avoided purchasing an additional server and avoided the additional licensing and management cost associated with that additional server.

What does this balance out to in real costs? By allowing for higher host compression ratios there is the capability to avoid a significant amount of cost (50%+) in your compute layer. 

Intel Xeon 5500 ( Code Named Nehalem-EP)

Intel’s next generation Xeon CPU (code named Nehalem) will be driving the Compute Blades. The Xeon 5500 signals Intel’s move away from the legacy “Front Side Bus” (FSB) architecture into what is called “Intel Quick Path Interconnect” (QPI). Intel’s Xeon 5500 with Quick Path Interconnect changes a couple key things from previous generation Xeon procesors.

• high bandwidth, full mesh, routed interconnect between CPU’s instead of a low bandwidth bus
• DDR3 vs DDR2 memory and moves the memory bank adjacent to the CPU’s for higher performance
• I/O Hubs are now dedicated for network and storage interconnects

First and Second Gen Xeon vs Xeon 5500 (Nehalem)

.\

If you look at the picture above, where the last generation processors are to the left, and the processor that will be in the UCS is on the right, you will notice a couple key items. I think the most important items to point out is that the bandwidth in pretty much all directions is superior in this architecture. If you think about this as a network on your server itself, you can see how moving from a bus based network, to a full mesh routed network has significant performance advantages. Stay tuned for later posts where I will talk about some of these advantages in detail.

Hardware Assisted Virtualization

One of most important new features that Intel is bringing to the table is the notion of hardware assisted virtualization. Intel has created a couple key technologies to address the following problems faced in virtual environments.

Processor Virtualization

Currently to virtualize an operating system, we rely on the hypervisor (ESX, for example) to accomplish two key tasks – Ring Depriveleging and Context Switching. When we are talking about CPU overhead in virtual environments this is what we are talking about.

Memory Virtualization

Again, in current environments the hypervisor is used to abstract memory. ESX uses a technique called page table shadowing to virtualize the physical memory. This again however adds inefficiency to the process and shows up as virtualization overhead.

I/O Device Virtualization

As our virtual machines go to disk, we are again presented with a situation where the hypervisor has to abstract disks and networks presented tot he physical server, and connect these to the relevant virtual machines. Again, this shows up as virtualization overhead, lowering the efficiency of our virtual servers as well as introducing I/O sprawl.

Solving virtualization overhead problems

With the Xeon 5500 on Cisco’s Unified Compute System blade you will be able to use processor features to solve the problems listed above. VT-X is used to extend CPU virtualization down to the physical CPU, Extended Page Tables, Cisco Memory Expansion and DMA remapping is used to speed remove memory access overhead from virtual network and I/O interfaces, and I/O devices sharing through VT-C is used to integrate the physical network with the virtual network transparently and with much less overhead.

Summary

Cisco’s entry into the computing space is not a “me too” entry into a commodity x86 market. It is a well thought out strategic move unifying storage, network and compute functions in a unique way that will differentiate the Unified Computing System from other compute offerings. I expect some fierce debate of the upcoming months as competitors release products to compete. I feel that Cisco’s value proposition of a unified compute / network layer in the Data Center uniquely solves problems that most customers face. And at the end of the day, the vendor that can solve the customers problems is the vendor that will succede.
Similar Posts:

• None Found

--Colin McNamara

Cisco’s Unified Computing System – It’s not just a blade center

What is a Fabric Extender?

If you think of a large switching chassis such as a Catalyst 6500 or Nexus 7000 you have the notion of a Supervisory module, a switching fabric forming the backplane, and line cards connected on the back into the fabric, and connecting to servers and other networking devices in the front. In the case of these switching chassis all of the items we just talked about are connected on the inside of the same physical box. Now suppose we took each of those components, the Sup, Fabric, and Line Card and installed them in different parts of your data center. The Sup module in this case would be a Nexus 5020 or Nexus 5010. The fabric would be four 10 Gig port bundles from the Nexus to the Fabric Extender, and the line cards themselves would be replaced by the Nexus 2000 Fabric Extender.

Why use a Nexus Fabric Extension in your Data Center designs?

1. Simplify network management – By moving from individualy managed standalone edge switches to an extended fabric you minimize the amount of devices in your datacenter that you have to manage. Say you have 10 racks full of pizza box servers, (That makes 42 servers per rack) you may throw 3750′s or 4948′s top of rack to provide connectivity. In this case your access layer would consist of at minimum 10 unique devices to manage, upgrade, etc. in your server access layer. If instead you put a Fabric Extender at the top of each rack, you still get 48 ports of coppert gigabit ethernet, but logically you would only have 1 device to manage.

2. Simplify your network topology – In the scenarios mentioned above with classic switching, you would have to manage a spanning tree topology accross your entire access layer. Half of your uplinks will be blocked by spanning tree so your network does not loop. This is a perfectly valid topology, but it does leave you open to the pains of spanning tree in your data center Now replace these switches with a Nexus 2000 Fabric Extender. Instead of spanning tree to integrating individual switches, you now how a very simple U topology forming your edge.

3. Lower your costs for Data Center class switching – Before the Nexus 2000 if you wanted to properly deploy a Data Center access layer, you either had to do buy 6748 blade on a 6500, a 48 port gig blade on a Nexus 7k (M148GT) , ora 3750 or 4948 switch. These all are not the cheapest switches and blades, but they provide each gig switch port with the proper buffers and throughput that are needed for true Data Center applications. Now if we chose to use the Nexus 2000 Fabric Extender in conjunction with the Nexus 5000 we can provide Data Center class 1 Gig Ethernet services at roughly half the cost of using the older switches.

4. Integrate 10 gig and 1 Gig services in a clean way – I have seen many many clients try to cleanly integrate 10 Gig services (normally from blade centers w/ ESX clusters) into an existing 1 gig data center edge. Normally what happens is that the “best” integration case is to put some form of oversubscribed 10 Gig card into their existing distribution layer, or in a worst case some customers are only able to provide 10 Gig of a collapsed core. This is obviously not an ideal setup. By integrating the Nexus 5000 40 or 20 port 10 Gig switches with the Nexus 2000 Fabric extender it provides us with a very clean way to integrate both 10 Gig and 1 Gig services in our Data Center access layer.

Why am I excited about this product?

I am lucky enough to work with some forwarding thinking customers with very large Data Center requirements. We have been working with Cisco over the past couple months to incorporate this end to end Nexus infrastructure into multiple customer designs. Before the Nexus  5000 / 2000 combination, designs to provide large layer 2 adjacent mixed 10 and 1 Gig services were well…. not as elegant as we would have liked to see. Now with Fabric Extension, we  are able to answer this mixed 10 / 1 Gig Data Center access layer design scenario in an elegant and scalable way.

Want to learn more?

Nexus 2148T Product Page - Cisco.com
Similar Posts:

• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 5010 released
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Cisco introduces the C-Series Rack Servers

--Colin McNamara

Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)

Most engineers in the channel utilize a tool called the Dynamic Configuration Tool. This allows you to take a product, configure it with all of its software, hardware and licensing options, give it a sanity check and then output a spreadsheet. You then take spreadsheet and combine it with the other hardware in your design to create what is called a Bill of Materials (commonly referred to as a BOM). The challenge here is if you only use the Dynamic Configuration Tool, you will not see the storage specific options for the Nexus family of Data Center switches.

The solution is to use a tool called the Multi-line Configurator. In the video below, I will show you how to use this tool to create a working Nexus 5000 BOM for your customers. (for fullscreen hover your mouse over the video and click on the “X” next to the vimeo link.)

Normally I don’t discuss channel specific topics on this blog, but my fear is that other engineers in the channel may fumble when creating BOM’s around Nexus, and otherwise tarnish a really good product. Since channel specific topics is new to this blog, it would help me out if you could ping me if you found this useful. Depending on the response I receive I will start sprinkling in more of channel partner specific content in the future.
Similar Posts:

• Cisco Unified Computing System Quoting and Configuration with Netformx
• Me and the Nexus 7000 last week at the Data Center VT
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Twitter Updates for 2008-06-05

--Colin McNamara

Cisco Nexus 5020 and 5010 FCOE video ordering guide

The coolest thing about this chassis is its price. You can get 20 ports of line rate lossless frabric 10 Gig cheap (about 850 a port list price). At that price point, putting one of these top of rack starts to look very enticing to many people.

Want to learn more?

Cisco Nexus 5010Similar Posts:

• Cisco introduces the C-Series Rack Servers
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Humor inside the Nexus 5000 switch fabric architecture
• Identity aware networking using Cisco TrustSec
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)

--Colin McNamara

Cisco Nexus 5010 released

It is truly my pleasure and honor to join Arista Networks as the President and CEO of the company. I have known founders, Andy Bechtolsheim and David Cheriton for a decade and worked with them closely during their Granite/Cisco days. To me, Arista is a symbol of an exciting, innovative silicon valley start-up company at the brink of pioneering new models for cloud networking.

After corporate life and managing multibillion dollars of business at Cisco Systems, you might ask why I chose Arista Networks? Three things really drew me here:

1. A top-notch and talented team, with focus on best of breed products and innovative EOS™ (Extensible Operating System) technology.
2. Working with Andy Bechtolsheim, and our long-standing 20+ year professional kinship.
3. A truly unique opportunity in our industry to build and grow into a great company!

Inside of Cisco Jayshree proved herself as a leader that could get results. There was even speculation that she was tagged to be John Chambers eventual replacement. I have a feeling the same qualities that drove her success inside of Cisco will follow her as she explores this new opportunity.Similar Posts:

• Thanks and farewell to Jayshree Ullal
• Arista Networks – Their approach to cloud networking
• About Colin McNamara
• Challenges integrating VMware into Cisco networks
• Heading home – Cisco Live 2008
• What does it take to pass the CCIE exam?

--Colin McNamara

Jayshree Ullal takes the helm of Arista Networks

Similar Posts:

• Twitter Updates for 2008-06-05

--Colin McNamara

My Twitter tweets this week

First and foremost it is important to discuss how many networks are right now (click for larger images)

Figure 1.1

This is a pretty common setup, with 80% of so of systems still physically attached to a mix of 100 and 1000 Megabit access layer switches. The other 20% of virtual systems are attached as through blade center switches with 10 gig to distribution or larger (8-16 core) systems with bundled uplinks to the distribution switches. Service aggregation such as firewall, load balancing, and wan acceleration , image deployment, monitoring / management and other key Data Center services generally provisioned off 1000 Megabit ports in the distribution.

Last but not least, a shadow storage network runs connected to a small percentage of physical servers, and connected to all of the virtual servers via Fiber Channel, iSCSI, or NFS presentation. One thing to keep in mind that all of these elements may not be configured in the “optimal” SRND setup, but it is something that you can expect to see in a real life network today.

What’s so special about Vi4 Application vServices ?

Figure 1.2

The one new feature that is going to throw your network on its heels is vApp. Imagine if any application could be installed on any server in any location of your network at any time. What vApp enables you to do is create a portable application, similar to a Java application that installs in your web browser. But this application can be dynamically deployed to any virtual system in your Data Center as needed in response to a new application request, or the need to dynamically scale an application. What this means to us as network engineers is that any corner of our networks where virtualization is present can become a hot spot for critical application flows. This introduces a new dynamism to our fabrics which wasn’t there before, and frankly many networks are not equiped to handle it successfully.

Currently, to provide virtual machine redundancy we have VMware HA, where we both monitor the availability of a virtual machine. If there is a problem we can restart that virtual machine on another ESX host. With Application vServices there are many new elements and traffic flows. The two most important ones are vLockstop and vCenter Data Recovery. VMware is taking high availability to the next level by keeping a hot standby VM running on a second physical ESX server. If you think about it, you now are adding both additional latency sensitive heartbeat traffic as well as creating a situation where your storage traffic flows can be highly volatile. Additionally vData Center Recovery will be throwing traffic in new and interesting ways across your links.

Adjusting your network designs to deal with the cloud

Figure 1.3

First and foremost application virtualization needs a front end, in network engineering circles we have been handling this successfully for a long time with content switches (load balancers). These provide the logical rallying point for dynamic cloud applications. Since more and more systems will be utilizing these services it is important to ensure that your current content switches have headroom to grow, and if you don’t have any content switching capabilities, it is probably time to take a look at adding them to your data center.

Since applications can exist in any corner of the network, dynamic provisioning of storage and network connections has become critical. Maintaining “shadow” storage networks can provide some dynamic access to storage, however it is now becoming advantageous to virtualize your storage fabric along with your systems and network devices. Fibre Channel Over Ethernet (FCOE) provides just that.

If you look at figure 1.3 above, you will notice a new color introduced into the diagram, as well as the “shadow” storage network removed. This is possible because all the orange links run Data Center Ethernet (DCE) which provides a lossless path for FCOE to follow. The ESX servers now only connect into the Nexus 5000 switches. As you can see, we also have removed the shadow storage network, as it is now consolidated onto our new data center fabric. There may be use cases where we need to extend classic fibre channel connectivity out to certain hosts, and we can do that of the Nexus 5000. However if all possible it is advantageous to utlize FCOE to gain storage mobility and higher bandwidth for your hosts.

You may notice that our uplink counts have doubled. Since we are moving both storage and data traffic over the same links, as well as supporting vMotion and other bandwidth intensive network applications it is time to make the push to port channeled 10 gig adapters. Luckily prices have dropped considerably, where it is not cheaper to use 10 Gig then to bundle 8 1 Gig adapters together.

Last but not least you will notice the core switching is a different color. This is because the Nexus 7000 has found its home in the data center. I wont go to deep into the nexus as that is an article in and of itself. What I will say is that it is the best platform to use to aggregate the amount of 10 Gig links that are populating the data center in a highly available fashion. If you want to learn more about the 7000 I recommend reading these previous articles here here and here, as well as Cisco’s Data Center Switching page.

Your network once Virtual Infrastructure 4 (Vi4) and the Nexus 1000V are released

Figure 1.3

Fast forward to early summer 2008 VMware Virtual Infrastructure 4 (Vi4) and Cisco’s Nexus 1000V are released. Of course a new major version of VMware running your compute cloud, application vServices are in effect, vLockstep is running, and many other features that go with the platform such as the Nexus 1000V.

The Nexus 1000V brings a long missing feature to the Data Center, a defined network edge. Since VMware has taken hold in the Data Center, the boundary layer between the virtual machine and the network has devolved to a dumb bridge running in the memory of a ESX server. Installing the Nexus 1000V in your ESX servers creates a virtual switch with interface counters, pvlans, access controls, QOS and many other features that are critical to operating a Data Center. (check out a previous article about the Nexus 1000V).

Enjoying the fruits of our labors

Cloud computing in general, and specifically Virtual Infrastructure 4 have specific benefits that will drive efficiency and agility in IT as a whole. The mechanisms for these benefits will put increasing load on the storage and data networks in your Data Center. It is our responsibility as network architects to take a proactive stance and provision a network with the immediate future in mind. Luckily planning and preparing for these changes in advance have both benefits for our current infrastructure, as well as allowing us to enjoy the fruits of our labors as Cloud Computing changes from a buzz word to a reality.Similar Posts:

• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Cisco releases Nexus 1000V virtual switch for VMware
• VMworld 2009 Schedule
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco’s Cloud Computing Offering
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

--Colin McNamara

Is your network ready for Cloud Computing with Virtual Infrastructure 4?

If you are from the San Francisco bay area you will recognize the towns of Los Altos and Los Gatos. In  this diagram, the chipsets are Altos and Gatos. But where is the Los ? Missing of course, because it it a Lossless fabric.

Yes, I LOL’ed

Want to learn more?

Nexus 5000 architecture – Building blocks of the unified fabric Similar Posts:

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 5010 released
• Cisco Nexus 4000 Blade Switch
• Challenges integrating VMware into Cisco networks
• Featured on Network World – 20 useful sites for Cisco networking professionals

--Colin McNamara

Humor inside the Nexus 5000 switch fabric architecture

They broke down a couple key challenges of virtualization – Policy Enforcement, Security in a virtual environment, Management, Automation and the change from network plumbing to fabrics. At the core of the message, is the Data Center is changing. The focus of this change is virtualization. You can either get on board, or watch the work pass by you.

One topic that I have talked about in the past, is a pressing subject with Cisco – the challenges of handoff between the ESX server admins and the network admins. Again, this highlights the core value of the Nexus 1000V. About 20 minutes in, there is a bit of banter about being a “networking guy” or a “server guy”. I think this highlights a key point – To be successful deploying Data Center 3.0 technologies, you really have to be both.

Next they have a demo of the Nexus 1000V. For those of you that haven’t seen the beta in action, you will be pleasantly surprised with how it can simplify the management of your virtual network infrastructure.

Last but not least, they go into how you can leverage WAAS and its 4.1 release to accellerate your virtual desktop infrastructure. As well as showing a cool new way you can run a Windows server on a was box with the new WAVE product.

It is good to see the folks at Cisco participating in the conversation surrounding virtual data centers. I suggest you head over to the TechWise TV YouTube channel and check it out for yourself.Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Application Extension API notes – Cisco Live 2008

--Colin McNamara

Interesting TechWise TV episode on virtualization

Because VMware is central to Data Center architectures, I decided to do a deep dive over the past week. This is not my first foray into virtualization, I have used vmware workstation since 1999 and got my first exposure to Storage Networking in 2004 with ESX. Read an article from 2005 about me dealing with network issues in ESX. However VMware has has added so many interesting and relevant features that I found it was good to do a ground up review on. I have to say, that review was helpful. There are many features that as a network designer that should have been in the forefront of my mind, that I hadn’t grasped the full potential of.

As always, after a deep dive into game changing technology I am filled with more questions then answers. But the answers I do have are enough to try my luck at an exam. With an afternoon free, I decided to try my luck at the VMware Certified Professional Exam (VCP-310). Apparently my deep dive worked, because I walked away with a new cert for the binder

Now with a better understanding of the value adds that VMware Infrastructure 3 (Vi3) has in the Data Center, I need to deep dive again on VMware Infrastructure 4 (Vi4) and figure out how Virtual Data Center OS (VDC-OS) and VMware based application virtualization tie into the classic methods of application virtualization (load balancing and content switching) as well as lay down some common network architectures utilizing the Nexus and converged data center fabrics for the move towards cloud computing in the enterprise. I’ll keep you posted on the results of these deep dives, I am sure it will be interesting.

Needless to say, it is a fun time to be a Data Center geek…Similar Posts:

• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Interesting TechWise TV episode on virtualization
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• VMworld 2009 Schedule

--Colin McNamara

Where is Colin ? Passing the VCP exam (VMware Certified Professional)

The one thing in my control is preparation. Preparing for the CCDE was extremely hard for me. Oddly enough, the challenge wasn’t the complexity of the content, but the breadth. For example, stack the nineteen recommended reading books on your desk, and become an expert on them.

Look at the CCDE Practical Blueprint  -

The CCDE Practical Exam is designed to assess a candidate’s ability to perform the following
tasks:
Gather, clarify, and analyze existing and new network requirements
•   Identify requirements and determine how they shape the purpose and expectations of a
given network.
•   Demonstrate the ability to gather and validate information about an existing network.
Develop network designs to meet functional specifications
•   Choose the correct technology to resolve a specific network design problem.
•   Create a network design that minimizes or eliminates negative impact on the existing
network and services.
•   Create a network design that is scalable.
•   Create a network design that is elegant and supportable.
•   Create a network design that is resilient.
Develop a plan to implement network design changes
•   Evaluate the impact of implementation options.
•   Develop contingency plans for network restoration.
Convey design decisions and rationale
•   Justify network design choices based on functional specifications.
•   Justify technology choices based on technical requirements.

I used that outline, as well as the reading list to prepare. I think you will aggree with me that if you look soley at the blueprint, that you have to cast a pretty wide net to get all of it. I interpreted this as being so open, that it was like walking with a lantern. Light from the lantern shines equally on everything, so you pay attention to litterally everything. Now, after taking the exam, I gained a bit of perspective on what exactly the developers were looking for. In this case, it would be like exchanging your lantern for a flashlight. Now, while the beam is wide, it is a lot more focused then walking with the lantern.

This perspective on the exam, or more specifically the intent and target market of the exam is invaluable. Well, I guess it is valued at the seven hundred dollars it took to take the exam . Now that I understand what they are looking for, I think I am in a good position to have a decent chance in Febuary if I don’t walk away with a CCDE number in six weeks.

Pearson

Pearson’s professional testing centers were a new experience for me. The center was clean and professional, and the staff was very helpful (including getting a couple tankards of coffee after me explaining it was the lifeblood of us geeks). However the one thing, I didn’t get the same feeling that you get when walking into the CCIE lab. If you haven’t been to the CCIE lab yet, it is almost like walking onto the football field at Notre Dame. Where in the lab you walk past the wall of pain, at Pearson it feels just like sitting down and taking any other written exam.

I do have to warn anybody who is taking this exam in the future though. If you have big feet like mine, be VERY careful of the power plugs. I managed to kick the power plug from my computer just over an hour into the exam and lost all my work. Rest assured the proctors said that the test would keep state in the production exam.

Chicago

Prior to October, I had been to chicago four times. Sadly each of those times was limited to grabbing some spankitopita at the little Greek place at Miday and then flying on to some other part of the country. This was the first time that I had managed to escape the terminal and make it into the city itself.

The first thing that struck me was how Chicago went up and not out. Coming from the west coast where cities grow out and not up, it was very weird to look up and see 1500 foot tall buildings. This urban canyon was mixed in with buildings from the 1800′s. All in all I have to say that it was pretty cool.

All 1500 feet of the Sears Tower

The other thing about Chicago is that the food is AMAZING. In less then a week in the city I managed to put on two well earned pounds. We hit up Merlot on Maple the first night. It was a quaint little northern Italian resteraunt housed in a little brownstone on the southside of Chicago. The second day we hit up Dua, the second deep dish pizzaria in chicago for lunch. Then we went to Lockwood at the Palmer Hilton for dinner.  All these places were amazing, though I have to say that I prefered the down home delicious of Dua to the others.

Deep dish done right at Dua

The last night, it was time to blow of the stress from the CCDE Practical. The CCDE team was nice enough to host a cocktail party on the ninety fifth floor of the Hancock Building.  I managed to deliver a nice little diatribe on Trill, L3VPN’s and security networks a the user and app level vs. stopping at layer 4 while being about one beer past the point where technical items should be discussed. If I managed to get into any heated discussions aboutthe importance of business relevance versus technical optimization then you have my appologies.

Sadly that party ended at 10:00 pm. Luckily Chicago is Brian McGehan’s home town. He recommended Fado’ , a great little Irish pub in the russian hill section of town. Brian, Scott, Gene, Genes wife, Ryan and I headed down there and made a good time of it till 2:00 am in the morning.

Summing it up

Eighteen months of studying culminated in 8 hours of blurry eyes in front of a computer screen trying to figure out a proctor’s intent. Looking around at the people in the waiting room, I saw many people that just blow my brain away. So if they grade on a curve, I am pretty sure I’ll be back in Febuary. Even if it goes that way, it is a good thing, because it just pushes me to learn more and become a better engineer. At the end of the day, I’m all right with that.

Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Where was Colin in 2010?

--Colin McNamara

My experience taking the CCDE Practical Beta

Tom Ludwig at http://networkvirtualization.wordpress.com pointed out quite accurately that I wasn’t explicit on the public release date for the 1000V. Thank you Tom for pointing that out – Minor confusion about the release date of Cisco’s Nexus 1000V

Scott Lowe at http://blog.scottlowe.org included me in his Day 2 VMworld coverage -  as well as his article on VMworld 2008 resources

Guy Brundson at http://blogs.vmware.com included me in the coverage of VMwares networking releases.

Andrew Kutz at http://blogs.vmware.com/vmtn included me in his coverage of VMworld

Gabriel Maciel at http://it-infrastructure-management.blogspot.com included me in his must read articles list

Duncan Epping at http://www.yellow-bricks.com included me in his article – for those that didn’t go to VMworld

“Red Pinapple” at http://thinkingproblemmanagement.blogspot.com writes about and responds to my article on virtualization in the DMZSimilar Posts:

• None Found

--Colin McNamara

Link Love – Blogs that linked to me this month

• None Found

--Colin McNamara

Quoted on ZDnet – Shameless self promition

Altor networks goal is to provide a single pane view of communications within your ESX clusters, as well as ease access control list creation and deployment. With this single pane virtualization customers should be able to decrease the time needed resolve availability and security issues, allowing virtual enviornments to continue to scale.

This is a sign that we can look forward to many other software vendors adding Nexus 1000v  support to their existing product lines. I wonder who is next ? NetQOS maybe ….

Want to learn more ?

Altor NetworksSimilar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Interesting TechWise TV episode on virtualization
• Arista Networks – Their approach to cloud networking
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

The boundary between server team and network team responsibilities has become “fuzzy”

Cisco address’s this issue by putting a switch that can be managed via the same methods common to other network devices inside the ESX cluster. This switch runs the same code that has become standard on Cisco’s Nexus series of Data Center switches – NX-OS.

Prior to adoption of virtualization, when there was a connectivity problem with a host it was quite common for the network team to verify functionality down to the switch port. The server team would do the same. This allowed for each team to focus on areas that met their core competancy. Once we moved from a real switch port, to a dumb bridge inside ESX, lots of finger pointing resulted.

Now, with a Nexus 1000V sitting virtually inside the ESX clusters, the boundary between network and systems teams has been re-estabilished. Now when there is a problem with a host inside an ESX cluster, the network team can use the same day to day troubleshooting tools available to them in other portions of the network to resolve issues faster, and with less finger pointing.

Security controls have been moved further away from the hosts then we would like

A best practice for applying security policy is to apply controls as close to the source as possible. Think of this analogy – Your kids are blasting Radio Disney from their computer. Which of the following do you do?

A. Turn down the speakers at the source

B. Distribute earplugs to all members or the household

Of course, the obvious action is to go to the source, and apply a control (turn down the volume, and tell the kids to clean their rooms). The same principle is valid on the networking side. The best practice is to apply security policies such as VLAN ACL’s and TrustSec policies directly to the switchports that host your switches. Before the Nexus 1000V this was impossible to do in ESX, and forced many environments to move security controls further up into the distribution layer. The side effect of this was that now the security stance from host to host inside ESX clusters was diminished.

The Nexus 1000V brings something called port policies to the table to address this. What these are is pre-configured application security descriptions that are available to you systems administrators to apply in a point and click fashion. Once these policies are applied to the virtualized host, they follow the host where ever it is moved in your virtual cluster.

Provisioning and integrating the networks of VMware ESX clusters with classic networks for most is challenging at best

I wrote an article in march about this specific issue in my post – Challenges integrating VMware into Cisco networks . The core of this issue is that in general that the network integration portions of VMware ESX clusters is not really designed to address server teams , or network teams. In fact, you need to be pretty savy with both portions to successfully integrate VMware clusters into your network. In the real world, you generally find people that are good at one or the other, not both.

By putting a Nexus 1000V in your VMware clusters, you know give the networking teams something they can understand without having to learn Linux, and how it handles bridges (key to understanding ESX networking). With a Cisco switch running virtually inside your clusters, network teams can follow standard core / distribution / access models with the access layer now residing inside the ESX clusters. The network teams can also leverage their existing LAN switching skills for integrating the virtual switches in the clusters with the existing Data Center switching fabrics.

With these roadblocks addressed, Cisco is moving to further the DC 3.0 vision

To realize the DC 3.0 vision, the network inside of VMware clusters had to be under control, and follow the same architectural guidelines that the rest of our network is subject to. With the Nexus 1000V this is now a reality. The next steps withing the DC 3.0 vision to are to extend virtualization and mobility throughout our storage fabrics, and to continue to extend virtualization to the network as a whole, as well as focusing on application virtualization and acceleration to truly realize the vision of cloud computing in the data center.

On the storage virtualization side, Cisco will be using a technology called FlexAttach to enable virtual and physical hosts to change locations in the datacenter without storage team intervention (more on this in a near future post). And on the application virtulization and acceleration side, expect Cisco to continue to enhance it’s existing Application Control Engine (ACE) and Wide Area Application Services (WAAS), and further integrate these into their virtualization offerings.

Want to learn more ?

Introduction to VN-Link network services – Cisco.com

Nexus 1000V overview – Cisco.com

VMware distributed vNetwork switch demo – VMware.com

Challenges integrating VMware into Cisco networks – colinmcnamara.com

Douglas Gourley speaking about how Cisco and VMware will drive Cloud Computing in the Data CenterSimilar Posts:

• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?

--Colin McNamara

Cisco releases Nexus 1000V virtual switch for VMware

Sadly, I have the unfortunate situation of being tagged as an insider (work in the partner community). So I have to play nice, and cannot reveal any juicy tidbits. Suffice it to say, that Jashree Ullal and Doug Gourlay weren’t pulling anyones leg in the past two years when the DataCenter 3.0 vision was established.

Stay Tuned

–ColinSimilar Posts:

• Me and the Nexus 7000 last week at the Data Center VT
• Thanks and farewell to Jayshree Ullal
• Usability features in Cisco’s Nexus 7000
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Colin has left ePlus Technology
• Sun Project Backbox

--Colin McNamara

BIG Cisco – VMware announcement – 1:30 Pacific time

He writes about “the VLAN leaking myth” and how it encourages clients to utilize physically separate network infrastructure in the DMZ’s. Now first things first, I wouldn’t call VLAN leaking a myth. At one time it was a very real and serious vulnerability that was exploited by overflowing the capacity of the switch you were attacking, and causing it to “downgrade” from switch to a hub. Once this happened you now had access to previously protected devices, as well as having the ability to sniff data as it passed through the shared hub backplane.

As he mentions though, this is 8 years ago. Most switches have evolved to the point where backplanes far exceed the traffic that could ever be injected into their switchports. Even beyond backplane enhancements there are many ways to further firm up your security stance – Virtual Device Contexts, not using Layer 3 SVI’s on a DMZ VLAN, utilizing PVLANs, using port security, virtual routing instances, and many more. Of course, there are still many other attack vectors that still remain, but can be mitigated by utilizing features built into the majority of enterprise switches available today.

I think the real question is not “are VLANs safe in a DMZ”. The important question is have you mitigated the probability of compromise (the actual threat) to levels that are acceptable to your business. This question remains whether you have a standalone switch or not. So many times we hear about risk risk and more risk. But risk alone is meaningless in a business context. What is important is combining risk with likelihood. For that I like to use a simple table to come up with the true threat.

For example, as I drive to Fry’s there is the risk of me dying due to a car crash. The impact of me dying is very high (risk) however the likelihood of an accident is low, and furthermore I reduce (mitigate) the latent risk (threat) by wearing my seat belt. So all in all the threat of me dying on my way to Fry’s is pretty darn low.

In a business context this may be that I have public facing web servers and network devices in my DMZ. The impact of them being compromised is that my public image may be tarnished for a short time, and my end users may lose productivity if they are not able to VPN into work, or access the Internet while on premise. I mitigate this risk by using firewalls and both host and network based Intrusion Prevention Systems as well as implementing best security practices on my network and systems devices. The latent risk (threat) remaining is at a level that is acceptable to the business leaders, so the system is allowed.

One question that I have seen coming up more often as we move towards fully virtualized data centers is centered around commingling of virtual infrastructure. There are some hard questions which challenge some practices that we have held true over the years.

• Should you allow sharing of physical memory on a host virtual machine between an internal and DMZ server?
• Should you allow virtual infrastructure from multiple security zones to share a storage array or cluster of arrays?
• Should you allow multiple virtual switches in different security zones commingling on the same ESX or Hyper-V cluster?
• Should you allow virtual firewall and load balancing instances protecting internal and external zones to reside on the same hardware?
• Should you allow virtual routing instances from multiple zones to share a physical infrastructure?

In the past world of standalone systems, the additional cost of providing a wholly separate infrastructure for DMZ environments was relatively low. Each system generally had internal disk, or at most direct attached storage. Network devices themselves were scaled down to support one chassis one function. This fit quite neatly into the Enterprise Composite Network model that was quite common from 1999-2003.

Now, many data centers have moved to the Service Oriented Network Architecture (SONA). In this model the cost of a virtualized data center is primarily focused on foundation elements such as the virtual storage and virtual fabrics, virtualized network, and virtual systems elements. The cost of providing additional virtualized services off these elements is low, however the cost of duplicating the physical infrastructure is quite high on both the capital and operational levels. This is forcing the technical and executive leadership at many companies to take a long hard look at the true threats they are facing in previously physically separate security zones such as DMZ’s, Financial and other secure zones. In the end, they are having to decide whether the threat remaining after their security controls is worth duplicating hundreds of thousands of dollars worth of infrastructure or not.

These are hard questions, with really no single good answer. My gut feel is that over the next few years we will continue the move towards the fully virtualized data center where components such as memory, PCI-X buses, storage and network devices are even further decentralized. This will make the cost of duplicating the infrastructure more and more significant, causing consolidated data center (or compute) fabrics to be the norm. At this point the discussion will move away from securing zones by creating separate infrastructure, to providing end to end security, starting integrated application level security, maybe with TrustSec or a dirivative, all the way down to securing the data at rest on disk. For the time being however, the best we can do is sit down and do an honest appraisel of our security stances, mitigate what we can, and do our best to design data center architectures that provide the flexibility of implementing whatever choice the technical and business leaders agree on.Similar Posts:

• Moving towards a Green Data Center – Truth behind the hype
• About Colin McNamara
• Cisco’s Cloud Computing Offering
• Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Interesting TechWise TV episode on virtualization

--Colin McNamara

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

Dear Candidate:

On August 27, Cisco will introduce a pilot for the CCIE Routing and
Switching lab exam in Beijing, China. The pilot will add a 10-minute
interview that will assess the candidate's ability to apply expert-level
networking skills and knowledge to networking problems that are encountered
on the job. After the lab orientation, a panel of three experts will conduct
a verbal interview with each candidate, asking a series of expert-level
networking questions (questions and answers will be in English). The ability
to correctly answer these questions will affect the exam score. After
completing the interview, the candidate will have the entire 8 hours to
complete the lab portion of the exam.  These scores will then be
calculated and then combined for a total score which will decide a pass
or a fail.

Our goal with this email is to let you know that your day will extend beyond
the normal testing day by approximately one hour.  The additional hour will
be at the end of the day. We hope you find this interview process
enlightening and helpful as we continue to strive for the standard the world
has come to expect from CCIE.

In my opinion this change is both needed and appropriate. In the past couple years, the two main barriers to entry with the CCIE (access to gear, and knowledge) have been lowered with the abundance of training programs as well as dynamips and it’s derivatives for gear emulation. Where in the past you were looking at a minimum of $8,000 dollars for a full lab, now you can run it on your PC at home.

From what I see, this is encouraging engineers to get their CCIE’s earlier in their career. This in itself is not a bad thing. If an engineer has dedicated themselfs to learning all the in’s and out’s of networking technology, then they really have earned the title. The problem comes when people want to take short cuts. They buy a lab of someone in China, or use other methods to get copies of the lab. To them, passing the lab and getting their number is all that is important, not truly becoming an expert in the technology.

While in the short term this may seem like the quick path to a good salary, in the long term everybody loses. Those who have cheated their way to their CCIE (while few and far between) end up devaluing the cert for the rest of us. And at the end of the day, they are just cheating themselves, and will lose their jobs when their true skills are tested.

It looks like Cisco is seeing the same thing that I have just talked about. This pilot program should go a long way into protecting the integrity of the CCIE for years to come.Similar Posts:

• What does it take to pass the CCIE exam?
• My experience taking the CCDE Practical Beta
• It’s on like Donkey Kong – CCDE practical registration is open
• Are you a kick ass engineer looking to grow?
• And it begins again – On the road to my CCIE in Storage
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Protecting the integrity of the CCIE lab – Verbal Interviews being tested

Similar Posts:

• Me and the Nexus 7000 last week at the Data Center VT
• Witch fire in San Diego – Notes from an evacuee
• RSS feeds – an intranet aggregation solution?
• Weddings, Measles and Podcasting -
• Redhat AS3.3 and VMware ESX network issues
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Who Moved My Brain ? – A must see presentation

As a CCDE beta participant on the qualification exam, you have given us your time and feedback and have made a significant commitment to making this a valuable program in the market. As a token of our appreciation for your commitment to the success of the program, if you qualify, we are offering the beta of the practical exam to you at a reduced price of $700, a savings of $280 off the retail price of the beta exam along with a priority seat. Cisco will be offering this beta delivery of the exam on October 1, 2008, in Chicago, IL at a Pearson professional testing center. This is an exceptional offer and opportunity to be one of the first individuals in the world to obtain their CCDE certification.

There is a catch here, and hopefully everyone who is participating is able to pull their heads out of current projects soon enough to catch it.

We can’t keep priority seats forever so we’ll need your commitment by August 1, 2008. After August 1, 2008 you will be registering under open enrollment rules and we cannot guarantee your seat.

That’s right, you have 11 days to reply to the email, or forever hold your peace. In my case, them email is already sent. Hopefully I can talk my VP into letting me take that $280 I “saved” him and apply it to a really posh hotel.

–ColinSimilar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested
• Cisco’s Cloud Computing Offering
• My experience taking the CCDE Practical Beta

--Colin McNamara

CCDE Practical – Beta candidate deadline August 1 2008

I think Rick (5x CCIE) put it best in a company wide email earlier this afternoon  -

Please join me in congratulating Darrel in obtaining his Storage CCIE. There are only 24 double CCIES (RS/Storage) in the world, so he is probably about 1 of 15 or less in the world to hold all three.

What is everyone’s vote what is next in his career?  And, NO, you don’t have a say, Darrel

A) Service Provider

B) VOICE

C) CCDE

Thanks,

Rick Davis

ePlus, Senior Network Engineer

CCIE – Storage, Voice, Security, Service Provider, Routing and Switching (#5672)

Great job Darrel, everyone is really proud of you. and our apologies in advance to the wife for stealing you for choices A, B or C. (My vote is for C)

–Colin

Similar Posts:

• Updated CCIE numbers
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• About Colin McNamara
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Are you a kick ass engineer looking to grow?

--Colin McNamara

Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

The CCDE just got VERY real in a big way.The following announcement was posted in the CCDE zone at the Cisco Learning Network. (If you haven’t checked the Cisco Learning Network out yet, I recommend it. Its like NetPro on steriods, but focused around certifications.)

REGISTER NOW for the BETA Practical Exam
Cisco is now registering beta candidates for the CCDE Practical Exam. Cisco has finished development of the second exam needed to attain the CCDE certification, the practical exam, and is now soliciting candidates for the beta delivery.

Cisco will be offering this beta delivery of the exam on October, 1 in Chicago, Illinois at a VUE professional testing center. Only candidates that have a passing score on the CCDE qualification exam may register and participate in this exam. Exam beta pricing is $980US. Register Now by email at:ccdebeta@cisco.com

For my CCIE, it always seemed like a switched turned the moment I put my credit card information in and secured a seat. Before that button was pushed, it was a “future” item to deal with. Once that button was pushed it was a “now” item. Things like going out, having a beer with the guys, video games, etc all got shut down so my focus could burn a hole in the subject matter.

I just sent in my registration email for the CCDE practical. I’ll be in Chicago Oct 1, ready to give it my all. But, the more important lesson I learned from my CCIE was that if you focus your efforts on your lab day, you will fail. However if you focus your efforts consistently over the months before, you have a chance of passing. Now that my registration email has been sent, it is time to turn that focus dial up, lock to the door to my office and earn the CCDE through months of hard work.

See you in Chicago

–Colin

Similar Posts:

• CCDE Practical – Beta candidate deadline August 1 2008
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• My experience taking the CCDE Practical Beta
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested

--Colin McNamara

It’s on like Donkey Kong – CCDE practical registration is open

Of course, it was all worth it. Some people see networkers as primarily an opportunity to prepare for a certification. Others got to learn something completely new. Some even go just for the world of solutions and the various booth babes. What I value the most is the opportunity to see old friends, and make new ones, to sit down with someone you have just met and have a half hour conversation on distribution / access layer technologies, or just throw some darts. No matter what, the goal is to connect, learn and collaborate with my peers. This year, I can say that these goals have been achieved. See you next year at the Moscone Center in San Francisco at Cisco Live Networkers 2008.Similar Posts:

• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• What does it take to pass the CCIE exam?
• Colin has left ePlus Technology
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Heading home – Cisco Live 2008

Similar Posts:

• Cisco Live 2009 – Networkers class schedule
• CCDE Practical – Beta candidate deadline August 1 2008
• Colin has left ePlus Technology
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

--Colin McNamara

No one told me there would be a monsoon – Cisco Live Networkers 2008

Luckily we made it to the party without dying, ePlus is safe for the time being. It was nice to have Cisco show appriciation to their biggest chearleaders, and even better to run into your peers and share a drink.

The venue was nice, though I am sure in retrospect that the organizers now now that if you pack hundreds of nerds in a room with video games and beer, there is bound to be a line. The party itself did seem to die out pretty quickly, but I do have to thank the folks at Cisco for taking the time to put the vent together for us.

Next year, Cisco is on its home turf. I think I’ll be the first to put my vote into the suggestion box. My vote is for Conference Room “G” . Where ever it does end up, lets look forward to seeing each other again next year.Similar Posts:

• VMworld 2009 Schedule
• Weddings, Measles and Podcasting -
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Live 2009 – Networkers class schedule
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Witch fire in San Diego – Notes from an evacuee

--Colin McNamara

CCIE Party 2008 Recap – Cisco Live Networkers 2008

Where would you use these ?

You want  your custom application to be able to react, and act on network specific information. Integrating both at a very close level. Fundamentally your application can dynamically reconfigure your router in reaction to network events.

You want to remove common services such as AAA, Syslog, DHCP, etc, IVR apps, Unified communication apps all at the branch office in the ISR. If there is a failure, your router can dynamically reconfigure around that.

AXP architecture

Base Cisco Linux os, IOS CLI, Virtual Instances, C++, Perl, Java, OSGI, Bash. Fundementally this is very similar to a fedora core 4 systems doing paravirtualization.

API Fun – What can it do

1. You can query and change both the router and the network module
2. Leverage Embedded Event Manager (EEM) to trigger events on changes, and react to network events.
3. Network Packet monitoring .. Sniff, Sniff, Sniff

My Questions –

1. How do I automate network updates, similar to YUM?
2. Is Cisco using KVM for paravirtualization?

Similar Posts:

• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Cool new features in 12.4(15)T
• Will Cisco succede where Sun has failed?
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• User experience testing – enhanced
• Routers can email you when they go down

--Colin McNamara

Application Extension API notes – Cisco Live 2008

NX-OS / DCNM XML API Fundamental Technology

Netconf – platform for secure communication of XML data between DCNM / NX-OS and mgmt station.

XML, using clear text tags, creates a self describing API. This is necessary because of the confusion and unneccessary complexity inherent in the current SNMP MIB based structure commonly in place today.

Webservices API = SOAP/XML over HTTPS.

Netconf/XML on NX-OS capabilities.

• Must be run over SSH
• Maximum of eight concurrent NetConf Sessions per nexus virtual device context.
• Every single CLI capabilities is assigned a XML tag

JMS is supported in DCNM as wel as NETCONF

• Native integration with IBM Message Queue

Similar Posts:

• Arista Networks – Their approach to cloud networking
• Challenges integrating VMware into Cisco networks
• Interesting TechWise TV episode on virtualization
• Identity aware networking using Cisco TrustSec
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Cool new features in 12.4(15)T

--Colin McNamara

Cisco Nexus NX-OS and DCNM XML API’s – Cisco Live 2008

• And it begins again – On the road to my CCIE in Storage
• Featured on Network World – 20 useful sites for Cisco networking professionals
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Certguards inflamitory post about Ethan Banks removed from Network World Magazine

--Colin McNamara

Schwag at world of solutions, then off to margaritaville

In that spirit, my schedule is listed below. If you are in the area, it would be great if you would stop by and say hello.
“6/23/08″ “11:00 AM”"Certification Exam  –  Certification Exam”
“6/23/08″ “1:30 PM”"BRKCCT-1001  –  Contact Center Welcome Session: Focusing on the Experience”
“6/23/08″ “5:00 PM”"WoS Reception 1  –  Welcome Reception in World of Solutions”
“6/24/08″ “8:00 AM”"certification focus group  –  certification focus group”
“6/24/08″ “9:00 AM”"BRKITI-1031  –  Cisco Data Center 3.0 Strategy and Business Impact”
“6/24/08″ “10:00 AM”"GENKEY-1001  –  Keynote and Welcome Address with John Chambers”
“6/24/08″ “12:00 PM”"ITIPCS-1015  –  NetQoS: Getting the Most from Cisco WAN / Application Acceleration Technologies”
“6/24/08″ “1:00 PM”"BRKDEV-1221  –  Applying Cisco’s Nexus Operating System (NX-OS) and DCNM APIs to Emerging Data Center Infrastructure”
“6/24/08″ “2:00 PM”"BRKDEV-1001  –  Cisco Application eXtension Platform”
“6/24/08″ “3:00 PM”"GENSSN-1001  –  Super Session: The Power of Collaboration Panel”
“6/24/08″ “4:00 PM”"BRKSEC-3007  –  Solving Security Challenges with Embedded Event Manager”
“6/24/08″ “7:00 PM”"BRKAGG-2001  –  Multiservice Edge Architectures and Solutions for Service Providers”
“6/25/08″ “6:00 PM”"CCIE Appriciation  –  CCIE Appreciation part – Nascar Grill”
“6/25/08″ “9:00 AM”"BRKDEV-1111  –  Location Based Services using Cisco Location API”
“6/25/08″ “10:00 AM”"GENKEY-1002  –  Cisco Technology Keynote with Padmasree Warrior”
“6/25/08″ “12:00 PM”"ITIPCS-1019  –  Fluke Networks: General Parts Uses Embedded IOS Technologies to Successfully Manage Inventory at Retail Locations:
“6/25/08″ “1:00 PM”"BRKDEV-1051  –  ANA Technical Session and Demo”
“6/25/08″ “3:00 PM”"GENSSN-1002  –  Super Session: The Data Center–Evolution and Transformation:”
“6/25/08″ “4:00 PM”"BRKDEV-1131  –  Customer Voice Portal Application Development”
“6/25/08″ “8:00 PM”"Customer Event  –  Customer Appreciation Event”
“6/26/08″ “9:00 AM”"BRKITI-1034  –  Realize Business Goals through Network Architecture Solutions”
“6/26/08″ “10:00 AM”"GENKEY-1003  –  Closing Keynote Address and Guest Speaker, Ben Stein, Actor/Writer/Columnist”
“6/26/08″ “1:00 PM”"BRKCCIE-3003  –  CCDE: The Cisco Certified Design Expert”
“6/26/08″ “3:00 PM”"BRKDEV-1171  –  Managing  Network Performance using the New IOS Data Collection Services”
“6/26/08″ “4:00 PM”"BRKDEV-1181  –  Configuration and Provisioning using IOS  XML API”Similar Posts:

• Cisco Live 2009 – Networkers class schedule
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• It’s on like Donkey Kong – CCDE practical registration is open
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• About Colin McNamara
• Cisco Certified Design Expert – CCDE – officially released by Cisco

--Colin McNamara

I’ll be at Cisco Live 2008 (networkers) in Orlando all week

From the network world editors -

Network World and the authors have decided to remove this blog post and the discussion that followed. While the original post was intended to highlight how the issue of braindumps is a pervasive one, we regret having singled out anyone in particular and apologize for any accusations of cheating.

I hope that Ethan is watching the outflow of support for him, and puts his site back up soon.Similar Posts:

• Certguard, Ethan Banks, Network World and Common Sense
• Featured on Network World – 20 useful sites for Cisco networking professionals
• Cisco Nexus 4000 Blade Switch
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It
• Cisco releases Nexus 1000V virtual switch for VMware
• Usability features in Cisco’s Nexus 7000

--Colin McNamara

Certguards inflamitory post about Ethan Banks removed from Network World Magazine

This is the first step towards sitting for a practical examination that will hopefully be released this October. And, in response to Micheal Morris’s blog post – Yes Mike, I can pass the CCDE written.

The second big item on my todo list was to recertify my CCIE. Thankfully, Cisco counts the CCDE written towards my recertification requirements. I am waiting for the system to update, but I think this will set me up to be certified till June of 2011.

There is one interesting side effect of passing my CCDE written the week before networkers. I had originally planned on using the free exam at networkers as a “safety” exam in case I struck out on this attempt. Now of course, that is not necessary. Since I am already a CCIE, there isn’t much incentive to take a professional level exam.

So, after weighing my options, I have decided to take the CCIE Service Provider written. It covers much of the MPLS / IP Next Generation Networks material that I have been studying. I only have 7 days to prepare, so the odds are against me. However, with the heavy service provider focus in the CCDE blueprint, I have a feeling after I battle the CCDE practical I will be set to roll right into the CCIE Service Provider lab.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• My experience taking the CCDE Practical Beta
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• What does it take to pass the CCIE exam?

--Colin McNamara

Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

From Roberts article on networkworld

Ok, so Ethan doesn’t believe in violating the NDA that he had to sign umpteen times to get where he is now, but he’s promoting the use of Testking (a well known cheating tool) to “study” for his CCIE.

As a CCIE, I am obviously supportive of Cisco’s efforts to maintain the integrity of their (and my) certifications. And yes, Ethan was not exercising the best judgment by posting about Testking in a comment on his blog. Is that a reason to start a fire, and try to get his CCIE revoked? As a CCIE, my vote is a resounding no. While Ethan definately made a bonehead move, it does not change a couple things.

1. The CCIE written is just a gating exam, meant to limit the CCIE lab to individuals that have a chance (a notably slim chance) of passing the actual lab.
2. The CCIE exam, and its proctors are amazingly effective at weeding out cheaters. Yes, every once and a while a cheater manages to get through. But trust me, these guys get eaten alive when they look for employment.
3. Cisco has its own enforcement team and methods for finding cheaters, they have managed to keep Cisco certifications from devolving into the land of the MCSE. I think we should trust them to do their jobs, and more importantly trust their discretion.
4. Ethans site documented a very thorough preparation process as he walked the long road towards his CCIE. Sadly his site has been taken down, but in my opinion this shows that he put significant preparation in, and earned his number.

My take on things is that Ethan the target of a marketing scheme. From what I can see, Roberts efforts here are not focused on supporting Cisco’s certifications. It looks to me that he is trying to drum up traffic to his business. If you look at his products, there are $995 – $4,999 fee’s to become a “VIP site”. For your payment, you receive a seal of approval and a listing in the “VIP” area of his site.

Sadly, I have seen this scheme before in the photography world. Certain photographers have been known to set up review sites of other photographers. They build Google Page Rank (PR) on their site so they show up in searches relevant to their competition. Once they start showing up in those targeted searches they sell “VIP” listing or reviews. The photographers that pay up to become “VIP” members ensure that no bad reviews of their buisiness are put up on these sites.

Robert is running the same quasi extortion scheme, but for training vendors. I think this demonstrates a lack of integrity on Roberts part. There is no excuse for attempting to destroy Ethans name in order to make a few bucks. I refuse to condone his behavior and would hope that the editors at Network World feel the same and remove his blog from their site.

Ethan – If you read this, I hope you realize that me and others like me are on your side. You have obviously put stellar effort into both studying, and documenting your efforts. It is obvious to any reasonable person that you have earned the title of CCIE.Similar Posts:

• Certguards inflamitory post about Ethan Banks removed from Network World Magazine
• Featured on Network World – 20 useful sites for Cisco networking professionals
• It’s on like Donkey Kong – CCDE practical registration is open
• What does it take to pass the CCIE exam?
• Updated CCIE numbers
• Cisco Certified Design Expert – CCDE – officially released by Cisco

--Colin McNamara

Certguard, Ethan Banks, Network World and Common Sense

When I work with data center infrastructure I expect the following – clean, remotely manageable, secure devices that runs on the same power and similar cabling, and everything can have a 24x7x4 support contract for hardware replacement. For the most part, you get this when dealing with Cisco, HP, Sun and similar manufacturers.

More often then not (with a few very cool exceptions), when I run into video surveillance infrastructure the video management infrastructure runs on some random third tier manufactured server. It never fails that the video management software is on Windows (normally XP or win2k). I have even seen some systems where the vendor requires you to have a session open to run the software.

And then when you get to the encoders themselves, it never fails. You have two choices.

1. The Uber package that can run a Casino, Identify and track dust mites , and if you point it at space, determine if there is life on mars.
2. Individual dinky encoders that run one or two camera’s each. They have limited encoding choices, limited camera control, no remote management, and normally run on 110 volt system that require different power distribution then the 220 that is common in systems today.

Cisco’s answer to this mess

Cisco has released both a video management solution, as well as a video encoding solution in a network module form factor for the Integrated Services Router (ISR).

The first part of this system, the Video Management and Storage System (VMSS) module fills the following roles -

• Management of multiple video streams from one interface, including IP cameras, 3rd party encoders, and streams from Cisco’s video encoding module
• Streaming of live and archived footage through a web browser interface
• This one is pretty cool – The module can mount external storage via iSCSI. So, in addition to its 160 gig internal drive, you can mount a filer and utilize external storage to scale the system.
• “fast forward” to events, as well as notify security and other personnel through SMS and email

The second part of the system (the module on the left in the picture above) is the Analog Video Gateway Network Module (EV-IPVS-16A). It has a couple functions -

• It can take up to 16 analogue video inputs and encode them with MJPEG or MPEG4 codecs
• You can use the first two ports to output video to a external monitors
• If you are using MPEG4, it can be used as a motion detector (handy for fast forwarding to important events, or triggering alerts)
• It can control pan and tilt cameras. This is good for pointing the camera at the janitor unplugging your servers each night to vacuum
• You can configure analogue contacts as an alarm. This can be bound to a door switch, or even temperature and water level monitors in a remote data center. This one will be very handy.

The third part of this solution is Cisco’s Video Surveillance Operations Manager. It manages, archives, displays and distributes the content that was created and collected on the two previous modules. You would use this if you had many branches to aggregate, or needed to staff a video wall (e.g. casino gaming commission operations). Now, you can run each of these components individually. Buy run together as a whole, Cisco has an enterprise class security solution.

Want to learn more ?

Branch office security page on cisco.com http://www.cisco.com/en/US/products/ps9671/prod_module_series_home.html

Cisco’s product page for the Video Managment Module – http://www.cisco.com/en/US/prod/collateral/modules/ps9671/data_sheet_c78_462225.htmlSimilar Posts:

• Interesting TechWise TV episode on virtualization
• About Colin McNamara
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

UPDATE  – Sorry for the RSS spam, I have been playing with twitter (and frankly am failing to see its draw) and setup twitter tools to integrate my blog with my twitter microblog. I apparently left the create daily twitter summaries on. My appologies for the RSS spam.

–ColinSimilar Posts:

• Fibre Channel over Ethernet is taking off
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Unified Computing System Quoting and Configuration with Netformx
• Colin has left ePlus Technology
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Twitter Updates for 2008-06-05

1. Layer 2 Tunneling Protcol (V3) static and hairpin configuration example - my buddy Rick was nerding it out in the lab and sent a great configuration doc for L2TPv3 my way. L2TP(V3) is used to create a layer 2 psuedowire across layer 3 routed links. This is a great service provider tool that you can use in your own network, no MPLS needed .

2. SNIA Education – Fiber Channel Over Ethernet – There is a lot of buzz going around right now about Fiber Channel Over Ethernet (FCOE). There is also a lot of misunderstanding about the fundamentals of this architecture. This Storage Networking Industry Association (SNIA) does an outstanding job of covering FCOE at both at an architectural level, as well as going over low level messaging structures.

3. Trill (Rbridge) architecture – IETF internet draft – I think the last time I was this interested in an internet draft was when iSCSI was first being proposed in the IP Storage working group. Trill, in my opinion is basically a light weight version of MPLS / VPLS. It has as far as I can tell most of the advantages of this architecture, without some of the configuration and hardware requirement drawbacks. Fair warning, reading this document started a doc hunt that killed my Saturday.

4. Cisco’s Security Response to Sebastian Muniz’s IOS rootkit – Security is a very important aspect of network design. Sebastian’s IOS rootkit demonstration is going to force some customers who in the past have been “OK” with having older, possibly vulnerable IOS versions floating around to update their operational practices and start keeping their routers and switches operating systems as often as they do their servers. Thankfully, Cisco has been embracing technologies such as kernel virtual machines, in service software upgrades and more to lesson or remove the impacts of software upgrades.

5. Turning Wounded Warriors into Network Ninja’s – As a former Marine (well, always a Marine, formerly employed by the USMC) this program goes straight to the heart. Cisco is partnering with Naval Medical Center San Diego (NMCSD, or Balboa Naval Hospital for us locals) to provide technical training to Marines and Sailors who have recieved service ending wounds in Afghanastan and Iraq.Similar Posts:

• Fibre Channel over Ethernet is taking off
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Zone based IOS firewalls
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Link Round Up – L2TPv3 FCOE Trill Wounded Warriors

Please join me in welcoming John McCool to his new position as the leader of (in my opinion) Cisco’s most strategic business units. Similar Posts:

• Thanks and farewell to Jayshree Ullal
• Jayshree Ullal takes the helm of Arista Networks
• How to succede in 2007 – By Tim O’Reilly
• Cisco Nexus 4000 Blade Switch
• Certguard, Ethan Banks, Network World and Common Sense
• BIG Cisco – VMware announcement – 1:30 Pacific time

--Colin McNamara

John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)

Please join me in thanking Jayshree for all the positive contributions she has given to Cisco and the industry, and wishing her the best in her future endeavors.

Similar Posts:

• John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)
• Jayshree Ullal takes the helm of Arista Networks
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Cisco Nexus 4000 Blade Switch
• BIG Cisco – VMware announcement – 1:30 Pacific time
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Thanks and farewell to Jayshree Ullal

Legal implications of a breach

Losing control of personal data means means more then just replacing a tape in your backup rotation. Laws vary from state to state, however generally you are required to contact the identity holders who were breached, as well as fund some sort of remediation. This has huge implications on consumer confidence, and at the end of the day stock price of your company. In some cases, such as ChoicePoint a company can be completely decimated by a breach.

Data protection regulations

There are an ever increasing number of regulations that concern the control of sensitive data. These can vary from laws focused on patient data, to financial data, to personal identification data. The most most well known laws are HIPPA, GLBA, and Sarbanes Oxley (SOX). Past that there are laws that pop up every day at the state and municipality level that further increase the requirements and expense of dealing with a breach. In short, it is becoming an expensive and in some cases criminal offense to lose control of your sensitive.

What you can do to protect your backup tapes

First things first, putting a lock on that Iron Mountain box is just not good enough. You must assume that no matter what, a determined attacker will get physical access to your tapes. So many times companies thing that just because their data format is unique or proprietary that an attacker won’t be able to access it. The cold reality is that any format can be read, and yours is not that special.

The only way to be assured that your data is safe is to encrypt it with a complex cipher. In short, you need to treat your data the same way on tape as you would if it was sitting on a public ftp site (with anonymous access enabled). Luckily Cisco has a technology that allows you to encrypt and decrypt your data coming on and off tape. This technology is storage media encryption.

Cisco Storage Media Encryption (SME)

Cisco’s Storage Media Encryption (SME) technology allows for the seamless encryption of your data flows on and off your backup tapes using AES256 standard encryption. Whether you have VSANS segregating your data, a core / edge architecture, or Virtual Tape Libraries (VTL), you can use SME to protect your data at rest, removing the possibility of an attacker getting access to your critical data.

Storage Media Encryption works by leveraging a multifunction chipset available in the 18/4 module that comes default with the 9222i and is an option for the 9500 series director class SAN switches. Chipset has a couple functions, including line rate encryption of iSCSI and FCIP data streams at gigabit speeds, as well as line rate encryption of data as it streams your tape or virtual tape library’s (VTL).

Want to learn more ?

SAN and NAS, Oreilly Press – In the classic Oreilly style by W. Curtis Preston, this book is a great starting place to understanding the fundamentals of San and Nas architectures that many people are likely to face.

Storage Media Encryption for Cisco MDS SAN Switches – http://www.cisco.com/en/US/products/ps8502/index.html . Cisco has lumped together a couple good data sheets here, though I may have to write a future article taking a deap dive on what really drives SME.Similar Posts:

• Identity aware networking using Cisco TrustSec
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• My CCIE Storage Shopping List
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• How to succede in 2007 – By Tim O’Reilly

--Colin McNamara

Encrypting your backup tapes with Cisco Storage Media Encryption (SME)

This switch answers a fundamental problem that has been presented by blade centers and VMware. The problem is increasing density of 10 Gig Ethernet, as well as the creation of SAN islands to provide storage access to VMware ESX clusters.  The nexus 5020 provides a solution that address both of these challenges, as well as supporting Fibre Channel Over Ethernet (FCOE) for the eventual move to a consolidated data center fabric in the years to come.

Want to learn more ?

Mastering VMware Infrastructure

Nexus 5020 Video Data Sheet

Unified Data Center Fabric whitepaperSimilar Posts:

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 4000 Blade Switch
• Fibre Channel over Ethernet is taking off
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel

In the past couple years, VMware has changed from a product hidden in development and testing environments to a full fledged enterprise computing platform. It brings many benefits to the companies that implement it, however with those benefits come changes to the access layer of your data center. Your access layer is no longer a top of rack Cisco switch, or end of row aggregation chassis. It is now a virtual bridge that exists logically within your VMware ESX server.

This causes an interesting question to come up in many customers – Who is responsible for the configuration and maintenance of this Vswitch? At first glance most groups reference the port on the last Cisco switch as the division of responsibility between network operations and systems operations. This has worked well in the past for a three main reasons.

First, it divided responsibilities based on technical skillset. For example a network engineer understands spanning tree, trunking, routing protocols, firewalling. While a systems engineer understands file systems, databases and Linux and Windows operating systems.

Second, it provided for a interconnection point where standardized configurations could be applied by an operational group, versus complicated configurations that could impact overall network designs and require an architectural board review.

Third it provided for a clean hand off for troubleshooting. Both network and systems operations could agree on layer 2-4 functionality in an area that provided for detailed debugging on both sides.

Lack of a defined access layer

VMware ESX throws a wrench in this model. We no longer have this well defined edge at the access layer. The access layer now exists virtually inside a server. More specifically, it is a logical devices running in a Linux server. This presents a challenge because it requires cross over knowledge. Whoever is responsible for this integration has to be fluent in Linux systems administration , and also fluent in network design and operations. Frankly this is a rare skill set to come across, as it requires and engineer who has attained high proficiency in both systems and network engineering.

I see this fuzzy line of demarcation often as a failing point for many VMware integrations. Many times I see network operations teams not involved in ESX cluster design because its a “server” , and systems operations teams generally don’t have the networking skills necessary to design and implement an fully functional system.. The solution to this problem is education and collaboration.

The need for collaborative design sessions

The single most powerful element in a successful VMware integration is the creation of strong design documents. These are created by holding planning sessions where both your systems and networking leads hash out a strong design that takes both short and long term virtualization and network goals into account. Also, many times when people hear the word design, they think it is a high level Visio and a bill of materials. That is a just a fraction of the effort required. A proper design should cover everything from a 10,000 foot overview Visio down to protocol flow diagrams and configuration examples. By created a detailed design like this it is likely to bring up common issues such as 10 gig aggregation, trunking, VMotion security, layer two adjacency and layer 7 network service delivery on a white board instead of a production environment.

To create this detailed design, both your Network and Systems leads have to understand this product. VMware recognizes this is critical to successful implementation (and to further sales of their product) an offers the VMware Certified Professional certification. If you have the resources, I would recommend sending both your network and systems leads to this training at the same time. Having them attend training together allows them to leverage each others strengths and bring up questions specific to their network and their goals.

A real world example of this is the company I work for, Eplus. Last April forty of us, all senior engineers attended VMware Certified Professional training at the same time. The class was mixed up so there was an even distribution of CCIE’s, Systems Experts, and Storage Experts. Needless to say this presented our instructors with some extremely challenging questions, but more importantly it set the stage and created a venue for collaboration between these different practices within our own company.

Real world benefits

A great example of this model’s success this occurred last month. Rick and I were sitting in the engineering side of our Sunnyvale office, catching up on email after giving presentations at Cisco that morning and afternoon. In the bullpen behind us, one of the Microsoft architects was engrossed in a troubleshooting call with a large customer on the other line. It turns out a large systems vendor (who shall remain nameless) had been trying for a week to integrate the first ESX cluster into this network and just could not get the networking portion to work correctly. Our account manager received the call from a the customer, and asked the technical teams to step in to see if we could help out in any way.

The systems engineers were able to isolate the problem down to the network interconnections, but needed to bring in networking resources to resolve the problem. Rick and I were waved over and were given an overview of the problem and introduced us to the customer the far side of the call. We asked a few questions about the physical and logical architecture of their network and created a diagram of their network on the whiteboard. With this we were able to ask them to execute commands continuously isolating the problem domain until we found and resolved the issue.

Seven minutes had passed from the point Rick and I were waved over to the point the customer had a working installation. This allowed the customer to focus on moving their business forward instead of fixing a failed implementation. Three of us on the call had attended VMware Certified Professional training together. We had spent at a minimum 50 hours each creating a baseline of understanding in class, as well as many discussions in engineering meetings. The solution came in seven minutes not because of any one teams individual strengths, but because of collaboration. The systems engineers were able to isolate the problem domain very specifically. And as network engineers trained on VMware were able to quickly understand and digest the issues, and tie it together with our larger understanding of networks as a whole. Only at that point, when the team was able to leverage each others strengths were we able to address the problem so quickly.

There will come a point in the next few years where this fuzzy boundary between the “network” and the “server” is established again. My call is that this will coincide with Cisco finishing development of their Vswitch that will reside inside the ESX server. This switch will require both Cisco and VMware improve their design and integration guides for ESX which are both frankly lacking substance. Until those detailed architecture, integration and troubleshooting guides exist the key to successful ESX cluster implementation will be a strong cross trained systems and network teams that are collaborating on the next level of virtual network design in your enterprise.

Want to learn more?

Cisco – Integrating Virtual Machines Into Cisco Data Center Architecture

This is Cisco’s main design guide regarding the integration of virtual machines. You can use it as a decent high level overview if you are a network engineer who is curious how VMware ESX, or Xen servers for that matter will fit into your network.

VMware – Virtual networking Concepts

This VMware document goes between high level overviews and detailed descriptions. It is a decent resource for a network engineer, and provides an overview of ESX network features, however it misses the target for providing configuration examples.

Blog of Scott Lowe – Technical Lead for Virtualization at Eplus Technology

Scott is an engineer that works with me at Eplus Technology. He is based out of the east coast and covers servers, storage and virtualization. His blog is chock full of good of information. A recent post of interest was how to enable Cisco Discovery Protocol (CDP) on VMware ESX server network interface cards.Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Arista Networks – Their approach to cloud networking
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Resume – Colin McNamara, CCIE #18233
• New features in VMware 3.1

--Colin McNamara

Challenges integrating VMware into Cisco networks

IOS-XE is takes the best elements out of Internet Operating System (IOS) which has its roots in a closet at Stanford, and combines them with the most successful open source technology ever – Linux. Cisco is leveraging Linux virtualization technologies such as Kernel Based Virtual Machines to protect against operating system failures as well as to allow for In Service Software Upgrades (ISSU).

To really appreciate this, we first have to dive down into the overall architectural changes of the ASR1000. The largest change that Cisco has made was to implement separate forwarding and control planes. In the past, Cisco routers would have the processes responsible for forwarding traffic, and the processes responsible for configuring the router running on the same root operating system. The side effect of this is that if you want to upgrade the root operating system of your router, you are going to have interrupt the traffic flowing through it to do so, or have a physically separate route processor to take over while you rebooted. This is a big headache operationally, and effectively forced engineers to design in separate physical chassis to meet high uptime requirements.

What Cisco has done to address this, was to mirror changes made in their storage and carrier routing portfolios. Both of those product lines utilize the operating system to push commands into advanced processors that exist on the line cards themselves. The ASICS on the line cards are designed to work in a distributed fashion, so that production traffic never goes into up into the router processor (or sup engine). This in effect ensures that the control and forwarding planes can exist as independent elements.

If you look at the graphic above, you will notice 3 main zones. The upper zone is what we would normally describe as the control plane. This is where the higher level functions such as your routing processes, ssh daemons, snmp daemons, and shells live. In short, if you you configure or read something, you are going to do it here. The only time traffic flows through this plane is when you are doing a thing called process switching. keep in mind this is a rare occurrence and usually occurs because of an oversight in your network designs.

By separating the control and forwarding planes, this allows Cisco to basically run a management station on the router, that programs chip sets in the line cards on the fly. This in my opinion is where the true power of this architecture comes through. By separating the two functions the software engineers are free to utilize powerful open source technologies such as Kernel-based Virtual Machines, and the Linux kernel, while letting the integrated circuit engineers design blazing fast chips which allow full functionality at line rate.

What benefits should we receive from a virtualized control plane? First, in larger routing and switching chassis (including the top end of the ASR1000 line) you normally have physically redundant route processors (RP)/ supervisory engines(SUP). The operating systems on these RP’s synchronize many things, including configuration, process state, routing tables, security associations and much more. The primary reason for this, is if you have a failure in the active RP, you can failover to the standby RP without interrupting traffic flows.They also can be used to streamline the software upgrade process by only upgrading one RP at a time, and then gracefully transferring traffic to it. Once proper operation is verified, the backup RP can be brought up to the same code revision.In any production environment this is highly desirable, and helps immensely in the battle for five nines.

The ASR1000 takes the redundant RP concept seen in high end chassis, and allows you to implement redundant upgrades, as well as protection against software failure, with only one physical route processor. This is done by utilizing Linux kernel virtualization. Instead of running the control plane directly on the production hardware, a small kernel is inserted. Booting from that are two copies of IOS-XE. These run independently, and synchronize state and configurations just as if you had two physically separate route processors. What this means in operational English, is that where in the past, you would have to either have two devices, or a larger device with redundant RP’s to upgrade without disruption, you can now have that same ease of maintenance, in a much smaller (and at the end of the day, less total cost) package.

Below this is the forwarding plane.It plugs into to a high speed interconnected fabric which all line cards and RP’s are redundantly connected to. In the diagram above, this is the bottom level. Items in this plane include buffer memory, Cisco Express Forwarding (CEF) ASICS, and now the new QuantumFlow processor. This is normally where you would find your DCEF enabled line cards, fibre channel and Nexus7000 line cards, as well as the modules for the ASR1000 routers. When properly utilized, traffic should be relatively isolated to this tier, and function independently from the control plane.

The shining star of the ASR1000′s forwarding plane is a group of chips that is referred to as QuantumFlow. The QuantumFlow architecture itself merges Cisco’s strength in integrated circuit design, with its strengths in IOS software design. In the past, Cisco would design ASICS’s for specific functions, and then write commands down into them. This has worked very well, until they point that a new feature came out that couldn’t leverage the fixed configuration of an older ASIC. Your choice at that point was generally to process switch for that feature (which is slower, and honestly bad form), or upgrade your cards to the newer ASIC design. The QuantumFlow chipset approaches this problem from a new angle. The first chip in the set (Popeye) is designed to be field programmable in C, as well as no fixed internal pipelines. This combined with utilizing 40 cores running between 900 and 1200 megahertz allows the programmers to utilize parallel processing techniques to utilize an immense amount of processing power in real time.

To put things into perspective, remember when you got your first multi core laptop or desktop. You were able to say watch a DVD, as well as compile code at this same time, while continuing to have a responsive workstation. Now imagine what you could do with a 40 core processor. This is the kind of power that we are talking about. Now imagine, that not only is your workstation immensely powerful, but you could also offload common jobs such as running daily builds, or encoding videos to another machine (or in this case processor.

In the ASR1000 this processor is called Spinach (yellow are in the graphic above). And of course just like the cartoon, Popeye’s potential really comes to light when combined with Spinach. Spinach is a separate chip, that is used a a traffic manager. This chip handles queueing and quality of service, ensuring that the proper packets arrive at the proper time, as well as interconnecting with cryptographic offload engines so it can equally apply services to encrypted flows.

At the end of the day, the most important question is not how fast something is, or how cool it is. The question is what can it do for me? By leveraging this new architecture the ASR1000 is now able to do line rate inspection of traffic using Network Based Application Recognition (NBAR), Support 128,000 queues for deep quality of service, secure and encrypt data using zone based firewalls and embedded crypto engines, segregate traffic using MPLS, integrate advanced voice and video functionality, as well as providing fulling Netflow v9 support for all of the above. It provides all of these services in an always on solution utilizing Linux virtualization, as well as leveraging an flexible chip set architecture that allows for field programmable improvements in the future.

My hope is that after reading this article that you are in a better to understand how Cisco is leveraging open source technology and integrated circuit designs to improve the foundation of the internet. In upcoming articles I will be discussing design scenarios utilizing this features in this product, as well as highlighting other areas where Cisco is embracing both open source technology, as well as open architectures that can properly leverage projects such as Linux, Ntop, Wireshark and more. If this article has you interested in learning more about some of the technologies mentioned today, then I encourage you to check out some of the links below, or shoot me and email to be highlighted in a future readers questions article.

Learn more about Linux Kernel-based Virtual Machines

Learn more about Cisco’s ASR1000

Learn more about Cisco QuantumFlowSimilar Posts:

• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Application Extension API notes – Cisco Live 2008
• Zone based IOS firewalls
• Arista Networks – Their approach to cloud networking
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

--Colin McNamara

Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

Mike Writes -

“Hi Colin,
I’m an avid reader of your blog and had a question that I figured you could answer. I don’t have CCIE knowledge like I’m sure a lot of your readers do. I have worked for the same company for 6 years and during that time had been promoted into the Network Group where I was sent through class and earned my CCNA. The company I worked for decided to relocate across the country and so I have been looking for a new job. Finding a new job doesn’t seem to be that big of a deal but I noticed a lot of job descriptions are asking for BGP experience. We didn’t use BGP at my last job and I thought BGP is used primarily by ISPs for routing between Autonomous systems? If that is the case why do so many non-ISP companys list BGP experience in Networking job descriptions? What are they doing with it? Shouldn’t the ISP be doing the BGP routing for them?
Thanks!
-Mike”

Well Mike there are 3 primary reasons why a company would require (or want) BGP knowledge from its candidates.

Scenario 1. The company has an redundant Internet edge.

In this case lets call our company sample_company. Sample_company has its website hosted in a publicly facing DMZ and wants to make sure that its web servers are available in the case of an ISP failure. Normally in this case the company would request and Autonomous Systems Number (ASN) from ARIN and would get assigned a block of publicly routeable IP address’s (normally /24) that they can advertise. Sample_company would then peer with multiple ISP’s for example one connection to AT&T and the other to Sprint. Sample_company would advertise their ASN through both these ISP’s, and in the case of a failure of one of their ISP’s, the rest of the Internet would be able to calculate a path to sample_company’s web servers via the backup ISP.

Scenario 2. The company is utilizing MPLS for its WAN connectivity.

From a customer perspective MPLS is a private BGP based WAN where all edge devices connected to the MPLS provider utilize BGP to inject and learn routes. One note, some providers do support advertisement of routes via OSPF and even EIGRP now, but the most common scenario is to use BGP as your internal WAN protocol while running MPLS. One trend I am starting to notice, is that since companies are already using BGP on the MPLS WAN, they have started utilizing BGP as their primary routing protocol for their sites to avoid running multiple routing protocols and having to redistribute into BGP to cross the WAN.

Scenario 3. The company is using MPLS inside their data centers for segregation of business units.

In essence they are using the same tools and technologies that MPLS service providers are, however applying it inside of their data center and campus networks. In this case, BGP is the routing protocol necessary to carry the routes between the seperate MPLS VPN’s that are running inside the corporate data center. While this sounds pretty complicated, it actually simplifies many of the designs that you would normally implement to attain the same goals.

Learn more about BGP - Of course, there are many other reasons why you may see BGP on a job listing, but I think the previous covers the most common. If you are curious, and want to learn more about BGP I recommend buying Routing TCP/IP volume 2 by Jeff Doyle. This covers many great scenarios and configuration examples in EGP protocols. It is also written in plain English which can be a challenge with many technical books.

Learn more about MPLS in the enterprise - If you are feeling like learning about how you can implement MPLS inside of your own enterprise network then I would recommend buying Network Virtualization by Kumar Reddy and Victor Moreno. I was lucky enough to have Rick Davis translate the whole idea of utilizing MPLS in a campus environment into plain English for me a couple years back. From that point I was able to really expand my knowledge base and start asking the right questions from a firm foundational understanding of the technology. Kumar and Victors book took my understanding to the next level, showing how to incorporate many very cool features to make a MPLS network stand on its head if you want to. I can say (and actually have said to Kumar Reddy) that this book redefined my data center designs for large corporate and enterprise customers. I really recommend that you add this to your collection.Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Identity aware networking using Cisco TrustSec
• Challenges integrating VMware into Cisco networks
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Jayshree Ullal takes the helm of Arista Networks
• Arista Networks – Their approach to cloud networking

--Colin McNamara

Reader question – Why are corporations looking for BGP experience?

Cisco TrustSec starts at the edge by negotiating a secure link if both hosts support it (802.1ae). This is similar to wireless encryption schemes, where a secure handshake is established and the L2 path become impervious to sniffing. This is user configurable, and to my knowledge the asics available to support line rate encryption are currently only on the Nexus 7000 blades.

The next step is to start 802.1x negotiations. For the people not familiar with 802.1x, it is a way of passing username / password information from your computer up into the network infrastructure. Once this is completed, the switch can not only utilise tools like NAC to place you into the appropriate quarantine, or access vlans, but it also know knows your identity.

Now the “network” is aware of your identity, a new level of granular security control can be deployed across your infrastructure. These security policies can map into “user x can connect to webserver y” instead of being restricted by ip and port. This allows you to utilize true roles based administration similar to what you use in your Windows and Unix file systems, but now you can do this across the network.

How is this done ? I like to think of this as a mix between dscp and mpls tags. Which in a nutshell means that when traffic enters the network it is tagged with a small amount of additional “identity: information which is retained as it traverses the network. This information can be used to augment or completely replace your current ACL based security controls in a way that enables you to more effectively comply with complex regulatory environments such as PCI, SOX, GLBA and HPPA.

Over the past few years we have learned how to leverage intelligence in the the network by utilizing tools like QOS, MPLS VPN’s, and many others. Expect to add Cisco TrustSec to your quiver of tricks to address the ever growing compliance needs faced by today’s network designers.

Learn more about Cisco TrustSecSimilar Posts:

• Encrypting your backup tapes with Cisco Storage Media Encryption (SME)
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco releases Nexus 1000V virtual switch for VMware
• Zone based IOS firewalls
• Cisco Nexus 4000 Blade Switch

--Colin McNamara

Identity aware networking using Cisco TrustSec

I was wrong, the Green Data Center is not about saving baby seals, it is about saving cold hard cash. Saving the world is just a nice side benefit.

That being said, saving cold hard cash is a very important discussion item in any IT Operations group as they are normally seen as a cost center. For them, a penny saved is literally a penny earned. Not only can you save money by not paying for power, but PG&E will actually has a budget to pay you NOT to use their power. Most people here this and get a puzzled look on their face. “why would the power company, who makes money on power, not want me to buy it from them?” The answer is that Californians use more power then PG&E can produce at peak times. When they have to buy it from another state it can cost them 10 times or more then they charge us. This is the reason why PG&E will pay you to use less. Each penny they give to the consumer for saving a watt, saves them 4 pennies (80% return on investment).

Great, PG&E saves money by giving it to me. How do I get this cash? Well there are a couple ways to get this.

1. Incentives for new buying new energy efficient servers
2. Rebates for moving to virtualized servers
3. Rebates and incentives for moving to thin client desktop systems
4. Audit teams for cooling and power if your Data Center is 10,000 square feet or more
5. Incentives for airflow control systems
6. Incentives for high efficiency UPS and power distribution systems
7. Technical services for cooling system evaluation (PG&E funded)

That is a pretty comprehensive list of how to get money from the power company, but you can save even more money buy not using the power in the first place. Not unsurprisingly this starts with the server.

First thing you can do, is virtualize, virtualize, and virtualize some more. For most people this means VMware. For others this may mean Xen, or Microsofts virtualization product. Whatever flavor you chose, the key message is to consolidate from many servers to few. A server sitting “idle” still pulls 50% of its max current. Now, howe many servers do you have that are just sitting there? My guess is a large amount. By virtualizing these servers, you allow them to be stacked onto high performance server that can be run at a higher utilization. This lowers the over all power utilization for your DataCenter. Another side benefit is that ever watt that you remove from a server, you get another watt removed from your cooling.

These same virtualization techniques can also be applied to your network devices, which account for 6 to 12 percent of your datacenters power draw.

Ask yourself a few questions

• ” Do I need 4 different firewall clusters?”. It is likely that these are leftovers from organic growth, and that you could consolidate them into virtual firewalls on a more efficient chassis (ASA comes to mind).
• ” Do I need to maintain physically separate infrastructure?”. There are technologies like MPLS, VFR-Lite, Virtual Switching and more that allow you to consolidate onto a shared network infrastructure, taking a service provider approach to providing transport in your network.
• ” Am I running old inefficient gear?”. Power supplies have increased in efficiency over the last few years. There may be a good return on investment for you to upgrade.
• ” Can I consolidate into larger chassis?”. Ask the question, which is more efficient – a closet full of 3560′s or a 4507? There is efficiency in scaling out.

I hope that reading this has caused you to ask some questions, and maybe look at the larger impact of your network operations on both the ecosystem and your operational expenses. With these questions in hand, you might want to talk to PG&E and your Cisco / HP parter about going “Green” in the data center.Similar Posts:

• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Usability features in Cisco’s Nexus 7000
• Cisco’s Cloud Computing Offering
• Cisco introduces the C-Series Rack Servers
• New features in VMware 3.1
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

--Colin McNamara

Moving towards a Green Data Center – Truth behind the hype

For new readers to this site, please you might enjoy the following articles -

Who is Colin McNamara ?

Usability features on the Nexus 7000

Overview of NX-OS 4.0 (the operating system for the Nexus 7000)

Why did I choose to get a CCIE in storage networking?

What does it take to pass the CCIE exam?Similar Posts:

• And it begins again – On the road to my CCIE in Storage
• What does it take to pass the CCIE exam?
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Certguards inflamitory post about Ethan Banks removed from Network World Magazine
• created a new map of ashley’s site
• Certguard, Ethan Banks, Network World and Common Sense

--Colin McNamara

Featured on Network World – 20 useful sites for Cisco networking professionals

• Cisco Certified Design Expert – CCDE – officially released by Cisco
• PHP / MySQL / FLASH website integration
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It
• User experience testing – enhanced
• Weddings, Measles and Podcasting -
• Dragged to the hospital

--Colin McNamara

What do you do for fun?

What useability enhancements do you feel are the most beneficial?

1. A separate, IP enabled, Management Interface. This has been a long time coming. The out of band management interface is very similar to a Ilo card in the HP world. it is effectively a supercharged console server that happens to site on the backplane of the sup engine. I am sure whoever pushed this feature through is going to get flowers one day from a Tech who DIDN’T lock himself out because the management interface was effectively a separate system.
2. Finally, a functionally USB Interface that I can transfer IOS (well, now NX-OS) images through. Everyone has a USB key nowadays, even my Grandmother has one, it will make life so much easier when I can have a 4 gig key with me that has most IOS / NX-OS  versions and my common configs and just pop them right in.
3. The integrated Cabling system is CLEAN. I love that it forces you to reserve the appropriate space for cabling, and that there finally is the possibility to avoid the flying spaghetti train wreck we see so often in Data Centers.
4. Front to back Cooling. The cooling design is well thought out. I liked the fact that it draws from directly above the front floor and exits rear top.. This should help out in raised floor data centers that have a large temperature gradient as you move to the top of the rack. It also negates problem of having multiple 6500 chassis side to side and having warm air blowing from the exhaust of one 6500 to the intake of another 6500.
5. Fan Slots are now placed where it is IMPOSSIBLE to cover with cables. I would say 7 out of 10 times when I walk into a new customers Data Center I find that there are cables run directly over the fan tray with no slack. That is not a failure in design per say, but it could have been avoided. With the Nexus 7000 fan trays in the back the problem is solved before it is created.
6. Power supplies are in the back . FAR away from the data cabling. It never fails that 20 amp circuits get uncomfortably close to copper cabling. By moving the power supplies to the back side of the chassis, this becomes a mute point and we remove any shadow of a doubt about EM interference causing craziness in our cabling.
7. This one sounds really mundane, but a quick heads up grouping of status lights. In the past these were normally in a position where you had to squat down to see them, or they are obscured by cables. Buy putting them on the front of the cable tray assembly it ensures these will always be visible.

What can we focus on now to make it a better platform?

1. One thing that worried me a little was the placement of the compact flash cards in the supervisory module. For those how haven’t it up close look at this picture of the chassis  and look for the Grey cover midway up the sup modules in the center slots. Behind them are two flash cards, one for system partition extension, and one to dump log files into. Having these cards available are great features however I could see an operational process of security rotating out the log partitions, or more likely and engineer pulling the flash card after dumping some data for analysis to it, and then pulling the wrong card by accident. Having a simple strap (like the screw downs for power supply plugs) or something similar would go along way towards mitigating that risk.
2. Continue with the spirit of innovation that has defined Cisco over the years. Cisco has consistently came out with or acquired and integrated many great products that directly address the needs of the market place into the product line (MARS, ASA, AireSpace, TelePresence, MDS, ACE, Etc) but frankly the last GAME CHANGING product that set the industry on its heals and forced everyone to rethink how we utilize technology to accelerate business as a whole was the acquisition of Selsius and the introduction of VOIP as an enterprise class product to the world. I remember having the hair stand up on my arms from the excitement of going up against Avaya and Nortel back then and fighting that uphill battle, educating customers and peers about this “new thing called VOIP and how CallManager (now Unified Communications Manager) is your ticket towards productivity.

   When we talk about the Virtual DataCenter, I/O Virtualization (FCOE) and VFrame Automation it is not just another incremental improvement of existing technology. It is a paradigm shift, a leap ahead, a GAME CHANGER. I get the same chills that I did when VOIP was new because I know that those are technologies that will force us to rethink how we approach computing and data systems. These technologies are to the Data Center what IP telephony was to the PBX, and Cisco is the only company with technologies and engineering know how in all the verticals necessary to pull this off.

Similar Posts:

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Moving towards a Green Data Center – Truth behind the hype
• Interesting TechWise TV episode on virtualization

--Colin McNamara

Usability features in Cisco’s Nexus 7000

As with any vendor specific event, there is a mix of for public knowledge and for private consumption content, so I generally choose not to talk or write about subjects that may have been covered in the VT unless I can find some public documentation on that subject. So don’t expect to find any juicy pre-release information or gossip here. I don’t want to have the NDA police knocking at my door, and its just not cool to let stuff slip. So, I will generally avoid the subject.

What I can tell you is this – There is a lot of buzz about the Nexus 7000. It is a rocking platform, and we spent the majority of a day going over it. I can’t share much more then I did the night before the VT just yet (will wait till I get lab access to one) but I can share this.

Yes, most people are proud of their shots with Tom Cruise, or Oprah, Richard Stephens or BSD Girl. But I can Top that.. I have a picture of me and the Nexus 7000.

The DC Channels team was nice enough to take us down to the DataCenter and Network Applications (DNA) lab. Where the Nexus 7000 has taken its new throne. They allowed to ooh and ahh and poke and prod it. Weirdly enough, the one thing that struck most was the attention to detail that went into the physical design of this chassis. It is not only good looking, but has some super usability enhancements that really impressed me.Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Where was Colin in 2010?
• Cisco releases Nexus 1000V virtual switch for VMware
• Humor inside the Nexus 5000 switch fabric architecture
• BIG Cisco – VMware announcement – 1:30 Pacific time
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

--Colin McNamara

Me and the Nexus 7000 last week at the Data Center VT

GoDaddy, one of the nations largest registrars and hosting providers is distributing bloated and possibly insecure code that will cause the average user to more then double their hosting costs. In the pages below you will learn exactly what GoDaddy is doing to your server, how their support staff will try to upsell you, and the steps you need to take to ensure proper operation of your Virtual Dedicated Server.

Background

One of my new years resolutions this year was to consolidate hosting accounts into one virtual server (hosted). I had my domains, and my old hosting with Godaddy already so it was a no brainer to try out one of GoDaddys VDS (Virtual Dedicated Servers).

I went with their 29.99 a month package, with Centos5, unlimited domains, 10Gb disk, and 256 MB of memory. This should be perfectly fine for hosting a couple MySql driven sites, and a couple gallery instances. Let me emphasise this is only handling 4 active domains, two of which only have static HTML.

Provisioning was a breeze, from order to shell account only took 4 hours. I was provided with shell access, pre-configured yum repositories, and this web control panel – simple control panel, or TurboPanel (seems to have two different names). I was able to pop into GoDaddy’s control panel interface with a direct link from their server manager console, and was setting up domains in no time. (Let me throw this caveat out though, don’t buy this product for your mom’s hosting…. the documentation is horrible, and by horrible I mean non-existant).

So I get my server all set up a couple weeks ago, transfer all my files from 2 Cups Solutions and set up my new www.colinmcnamara.com site. Things go just fine, I changed over to wordpress as a CMS and am totally thrilled. My applications and email are working perfectly. Plus, I have a shell account at GoDaddy which is a very handy thing to have as a network engineer. Things are going so well, that I give my buddy Rick a Christmas present and get ricksdavis.com and el-cinco.net for him, and host it on my GoDaddy VDS.I go ahead and purchase the domain through godaddy’s domain manager. This is obviously GoDaddy’s core competency, and goes flawlessly as usual. Next step, I go into the Turbo Panel web interface. Let me give you a little background on TurboPanel. This is the “free” equivalent “to plesk or cpanel. It is actually ok for automating your domain provisioning, though if you are a normal skill level user, I would recommend paying the extra 9.99 a month for Cpanel.

Server Error

I open up my TurboPanel interface and go to provision ricksdavis.com into the domain manager. It comes back with the least descriptive error I have ever received.

Server Error
We are sorry, the system has encountered an error while processing your request.

Home

If you continue to receive this error, please contact your system administrator.

Your URL: /domain/edit.do

Error details:

CommandFailedException: Unable to get min/max uids
at c.g.t.f.systems.user.LinuxUserSubsystem.loadUids:825
at c.g.t.f.systems.user.LinuxUserSubsystem.getMinUid:780
at c.g.t.f.systems.user.LinuxUserSubsystem.loadUserInfo:670
at c.g.t.f.systems.user.LinuxUserSubsystem.getUserInfo:646
at c.g.t.w.actions.domain.ActionDomainEdit.process:84
at c.g.t.w.actions.AbstractSpringAction.execute:118
…
at c.g.t.w.filters.AuthorizedResourceFilter.doFilter:38
…
at c.g.t.w.filters.RequestPopulationFilter.doFilter:117
…

This is the most descriptive error ever right? it tells you what is wrong, has a link to the support system, and gives you actionable information…. I would say a resounding NO. This is a classic example of why friends don’t let friends program in Java. When I got this error last night, I was scratching my head. As an engineer, the first thing I will look at is the last change to the system. Coincidentally I had installed awstats two nights before, and looking at my change logs, I saw that I had upgraded my perl version. So, with no fast response to the support email from GoDaddy I chose to put in a server re provision request (fully automated) and restore from my backups. That process took about an hour, but afterwards I was back online with no errors. Eureka! I found it (I thought). I provisioned Rick’s domain, wordpress, gallery2 etc and then went to bed.

GoDaddy Support Response

Fast forward to this morning, and I finally recieve an email reply from godaddy support. The email is pasted below-

(I have replaced the agents name with John Doe. Tech support is a hard job and I see no reason to highlight him specifically)

Before re-provisioning the server, I went ahead and tried the old three finger salute (reboot) the error still existed. So even if this email would have came to me on time, it would not have helped.

But that is besides the point. lets dig into the solution

The agent suggested the following fix -

Restart tomcat – which I was NOT using for any of my web applications (not an ejb guy)

/etc/init.d/tomcat55 restart

Restart TurboPanel (or simple control panel now – they haven’t updated their init scripts)

/etc/init.d/turbopanel restart

GoDaddy tried to upsell me, instead of fixing their code

He gives the standard, run less stuff on your server speech (remember, I only have 4 domains on this server)

Now here is the kicker – To remedy this issue long-term, you could either setup a server with 512mb RAM, or upgrade to a Dedicated server.

What the heck is with that? I should not need an upgrade with only 4 domains on a server. Especially when in the setup the default Cpanel implies support of 30 domains. Is this Tech Support or a Sales Call?

But, since my server was working fine I don’t pay much attention to the email and move on with my life.

Fast forward an hour, and I am show Rick how to access all the features of his new site, and I figure that I need to change an email account on his domain to forward to his old account. Fine, this should take two minutes. I log onto the TurboPanel interface to put the email forward in.. and there it, a big useless error screen. What the heck is with that?

So this time I actually read the email, and try the fix. Results = nothing. GoDaddy offers shell access so I log in, run top and filter for %memory used. Low and behold, there is only 8142 bytes of memory free, and a Java process owned by root is using 300Mb of virtual memory, and 132Mb of real memory, and Tomcat is using 115Mb of virtual memory and 86Mb of real memory.

Let me translate this into English – Godaddy’s control panel application was using 218 Megabytes of the 256 Megabytes of memory I had purchased. That left me with 34 Megabytes of memory . Let me clarify this, I had paid for a virtual server with 256Mb of ram, up to 1000Mb bursted (which I think is their code for swap). I am only running 4 domains on this server, and two pop3 email servers. This should not be a problem.So what is the cause of the problem? I can sum it up, crappy Java programming. Someone decided to write this program in Java (probably easier to outsource) instead of optimising it to run on lean systems. Their code effectively takes up all the available memory. And on top of that, they are are running a webserver process as root… yes as root. It is like asking for your server to get hacked.

Now, that I am done ranting, let me highlight how to fix this problem.

If you are on Windows use the following procedure to get shell access to your GoDaddy VDS -

• you will want to download a ssh client called putty – Download Here
• Copy this file to your desktop, double click putty.exe , and you should see something like this -

• In the host name field I have www.yourdomain.com . replace yourdomain with your domain name.
• Click on the open button on the bottom right, and a shell should pop up, along with a warning that looks like this (you can click OK to the warning)

• Now skip past the linux section

If you are running Linux or Unix start here -

• Open up a command line terminal
• ssh using your godaddy simple control panel username example -

ssh your-godaddy-control-panel-username@www.yourdomain.com

• If this is your first time connecting to this server, you will be prompted to accept an unkown ssh key into known_hosts, choose yes to accept

Both Windows, Linux and Unix Continue Here –

• Enter your the password you use to access your GoDaddy Simple Control Panel Interface
• You will be presented with what looks like a DOS window, this is called a secure shell terminal. Type in the username you use to access your Godaddy Simple Control Panel and then hit enter

• Now type in the password that you use to access your Simple Control Panel Interface and hit enter

• Congratulations, if you see the window below you are now shelled into your virtual dedicated server.

Change to the Root user

• Now that you are shelled into a Linux device you need to escalate your privileges to get administrator level access. In the Unix world this user is known as Root. You can change to this user, and get full system privileges by using the following command.

su – root

• You will be presented with a password prompt, enter in the same password that you have used to log into your Simple Control Panel Interface
• You are now root, be careful with what command you enter under this user, as you can do some damage if you are careless

Clean out your servers memory

• Most recent Redhat direvatives (including Centos) utilize a tool called yum to add and remove packages. This is also true with your linux servers at GoDaddy.
• you need to install a tool called memhog, it is part of a package called numactl that is normally used to assign specific process’s to specific cpu’s in a multi-core system. We will be using it today to fix GoDaddy’s memory hogging application

yum install numactl

• choose yes to all the prompts, and numactl will automatically be downloaded and installed on your server

Stop GoDaddy Simple Control Panel, and Tomcat, and tell them not to start automatically when your server restarts.

• Tomcat is a special type of webserver for Java based applications. Godaddy uses it to run their control panel interface. 99.99999 percent of users will not need to use Tomcat. If you do need to use Tomcat then you are a technical user and will know what to do.
• In Linux, server applications are called daemons. The are executed by init scripts. We will use these scripts to turn off these server applications
• Turn off the TurboPanel daemon ( this is the process that runs your simple control panel web interface

/etc/init.d/turbopanel stop

• Next we need to turn off Tomcat

/etc/init.d/tomcat55 stop

• Now that we have these services turned off, we need to make sure that they don’t come back when we reboot the server. We can do this by using the chkconfig command.
• Stop the Simple Control Panel Interface from starting automatically by executing the following command

chkconfig turbopanel off

• Stop the Tomcat server from starting automatically by executing the following command

chkconfig tomcat55 off

Clean the mess GoDaddy made of your servers memory

• A couple steps back we installed numactl. The executable we wanted out of this package is memhog. Issue the following command to take your memory back. This command will overwrite 200 megabytes of your memory, allowing the rest of your applications to get access to that memory.

memhog 200m

• This will Clear out the memory that GoDaddy’s application took over, and allow the rest of your daemons to run fine.

Great, my server is running better now. But I want to use my Simple Control Panel Interface. How do I do that?

• Easy, all you need to do is temporarily start the turbopanel daemon. When you are done making changes, you can turn it off again

/etc/init.d/tomcat55 start

/etc/init.d/turbopanel start

• When you are done, don’t forget to turn it off

/etc/init.d/turbopanel stop

/etc/init.d/tomcat55 stop

*** UPDATE *** *** UPDATE ***

I managed to stay with Godaddy and use their Virtual Dedicated Servers for 12 months. However I have moved to a new hosting provider (rimuhosting) in the spring of 2009. My last straw with GoDaddy occurred when I noticed that even with my memory utilization under control my applications were performing poorly. I shelled into verify and found that the virtual disk I/O was severly limited.

Performance issues –

Simple command to determine directory size on GoDaddy VPS

[root@ip-72-167-15-128 home]# time du -hs
1.3G    .
real    0m49.013s
user    0m0.011s
sys    0m0.062s

Simple command to determine directory size on Rimuhosting VPS
[root@colinmcnamara home]# time du -hs
1.3G    .
real    0m0.343s
user    0m0.050s
sys    0m0.290s

Translated into english, it took 49 seconds to execute a simple command on my GoDaddy server, and it too 0.34 seconds (under 1 second) to execute the same command on my virtual server at Rimuhosting.

On top of that, I was paying $32 dollars a month to GoDaddy for a server with 256 megs of ram as well as a FTP backup account. When I created my short list of hosts, I noticed that I was not getting the best deal by staying with GoDaddy.

Pricing at Rimuhosting

• Virtual Dedicated Server 190 Megabytes RAM – $19.95
• Virtual Dedicated Server 400 Megabytes RAM – $29.95
• Virtual Dedicated Server 900 Megabytes RAM – $39.95
• Virtual Dedicated Server 1150+ Megabytes RAM – $49.95

One thing you may notice, is that for the same price as the base GoDaddy VDS ($29.95) you get 400 Megabytes of RAM instead of 256. (and they won’t put on a memory sucking turbopanel app) On top of that, things that I had to pay extra for at GoDaddy such as backup space, backup mail relays, and DNS service came bundled for free.

I made the choice to move to Rimuhosting, and the service has been superior to GoDaddy in every single way. If you get sick of GoDaddy like I did, you might want to check Rimuhosting out, I think you’ll like them.Similar Posts:

• What should I do this thanksgiving break?
• Zone based IOS firewalls
• Routers can email you when they go down
• New features in VMware 3.1
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Identity aware networking using Cisco TrustSec

--Colin McNamara

Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Thanks and farewell to Jayshree Ullal
• Jayshree Ullal takes the helm of Arista Networks
• John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)
• The emergence of MDS features in Cisco’s datacenter networking equipment
• Cisco Nexus 5010 released

--Colin McNamara

DataCenter SVP Jayshree Ullal interviewed about the Nexus 7000

One feature that is new, and frankly extremely exciting is Virtual Device Contexts. Each virtual device runs with its own process, vs the use of tagged differentiators in technologies such as VRF-Lite. This provides for paravirtualized management instances, and clear lines of delineation for both software and hardware for a resource that can be shared between different groups within an enterprise.

Chassis that run NX-OS will support In Service Software Upgrades (NSSU) to allow operations groups to upgrade operating systems with zero downtime. This is accomplished through a combination of modular software architecture, and the decoupling for the control and forwarding planes.

One of my favorite features in SAN-OS is the embedded is fabric analyser. This is a tool that can sniff management traffic without having to plug in a sniffer, or provision a span port. You can dump in real time to a tcpdump like interface in the command line, output to a local file, or map to the ip of a wireshark instance that layer 3 access to the management port. Cisco again has taken the best of SAN-OS and bundled it with NX-OS. You will be able to remotely span management traffic without having to set up rspan, or trudge down to the datacenter to set up a sniffer.

Now, your router can call home right now so that is not a totally new feature. Smart Call Home was released recently into IOS. But that still doesn’t stop it from being a great feature. This allows you to configure NX-OS powered devices to mail an xml formatted troubleshooting email to TAC, and / or your support staff. This has been proven to drop the average time to resolution from 16-30 hours to 6 hours.

Now the drum roll…… All IP routing features are VRF aware. This has been a point of contention with me for a while. As Cisco and the market in general has embraced virtualization as an answer to pressing business concerns of leveraging shared infrastructure, while retaining security controls segregating disparate environments technologies such as MPLS and VRF within the datacenter have become more and more prevalent. That is great, however it never fails that the feature you need at that moment always seems to be coming out in the NEXT IOS release. With Cisco NX-OS 4.0 this is no longer a question.

Now, if I was a CIO and I was reading about all these new technologies that Cisco was pushing with NX-OS, I would frankly be cautious, and rightfully so. The thing is, most of these features are not new, they have been in use, and in production under the most stringent uptime conditions in the world – storage networking. They have been tried and tested on Cisco’s MDS line of storage networking switches. So get comfortable, get educated, but most importantly get on board for DataCenter 3.0.Similar Posts:

• The emergence of MDS features in Cisco’s datacenter networking equipment
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• New features in VMware 3.1
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• Arista Networks – Their approach to cloud networking
• About Colin McNamara

--Colin McNamara

Cisco NX-OS 4.0 | Next Generation Internet Operating System

Highlights of the the Nexus 7000′s features are -

• 15 Terrabit per second backplane
• Support for 40 and 100 gig ports in the future
• Seperate control and data planes
• link layer encryption
• front to back airflow (FINALLY available in a non NEBS chassis)
• Lossless non blocking fabric (VOQ enabled)
• Fibre Channel, Infinaband, and Ethernet blades in one unified platform
• Cisco Data Center Network Manager (MDS Fabric Manager on steroids)
• Virtual Device Contexts (Network Systems virtualization, the next level past VRF route tags)

You can learn more about this switch in upcoming articles, and at http://www.cisco.com/en/US/products/ps9402/index.htmlSimilar Posts:

• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Interesting TechWise TV episode on virtualization
• Humor inside the Nexus 5000 switch fabric architecture
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

• Russ White – CCDE interview
• CCDE Practical – Beta candidate deadline August 1 2008
• My experience taking the CCDE Practical Beta
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

--Colin McNamara

Russ White – CCDE interview – Part 2

you suck at photoshop 1

you suck at photoshop 2

you suck at photoshop 3

you suck at photoshop 4
Similar Posts:

• Interesting thoughts from Mark Cuban
• The difference between a consultant and a partner
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco introduces the C-Series Rack Servers
• Cisco Nexus 4000 Blade Switch
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

--Colin McNamara

Quite possibly the funniest and most educational PhotoShop tutorials ever.

For the engineering perspective on this, the CCDE is equivalent  to the CCIE. However, the CCDE is focused on design and architecture rather then implementation. Where the CCIE (R&S, Voice, Security, Service Provider, Storage) is focused on implementation, the CCDE is focused more on the pre-sales design and architecture efforts. I am personally looking forward to the lab being released, as it provides a certification to validate the skill set needed to be an sales engineer on Enterprise accounts, or to be a network architect at an Enterprise corporation.

It is funny how small a world it is. Eplus (the company I work for) CEO – Phil Norton was quoted on Cisco’s press release -

“Certifications provide a stamp of approval that validates the quality of our organization’s employees,” said Phil Norton, chairman, CEO and president of ePlus. “The CCDE isn’t about operations; it’s about recognizing the value of network designers and honoring their core skills that provide a real value to our business and our customers.”

My gut feel when I first got invited to the CCDE beta program was that this will become a requirement for the Channel. I think Phil’s statement cements that gut feel into a reality. Obtaining a CCDE will become similar to the CCIE – a check box that you must attain to work with the top VAR’s out there. This makes me extremely grateful that I was lucky enough to be invited into the beta group to be allowed first crack at this gem of a certification.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Are you a kick ass engineer looking to grow?
• Challenges integrating VMware into Cisco networks
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week

--Colin McNamara

Cisco Certified Design Expert – CCDE – officially released by Cisco

• Russ White – CCDE interview – Part 2
• CCDE Practical – Beta candidate deadline August 1 2008
• My experience taking the CCDE Practical Beta
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

--Colin McNamara

Russ White – CCDE interview

According to surveys, 57 percent of Americans shower every day.

Hugh Hefner has a species of rabbit, the Sylvilagus palustris hefneri, named after him.

The bull’s-eye on a dartboard should be exactly 5 feet, 8 inches off the ground.

Teenagers are 50 percent more susceptible to colds than people over 50.

Sir Isaac Newton died a virgin.

Studies have shown that the larger a man’s testicles, the more likely it is he’ll cheat on his mate.

The consumption of beer in a lavatory is forbidden in Manitoba, Canada.

Elevators and escalators kill about 30 people, and injure about 17,000, each year in the United States.

Mother Teresa’s real name was Agnes Gonxha Bojaxhiu.

In ancient Rome it was considered a sin to eat the flesh of a woodpecker.

Typically, sex between snakes lasts between six and 12 hours.

“Symphorophilia” is sexual arousal derived from arranging a disaster, crash or explosion.

The average American worker uses 11 Post-It notes a day.

There are five cities named Las Vegas in the United States. There are two in Puerto Rico.

The oldest existing governing body is in Althing, Iceland. It was established in 930 A.D.

The band Creedence Clearwater Revival was originally named The Blue Velvets.

Men are twice as likely to contract leprosy as women. Similar Posts:

• Christmas Trivia
• Updated CCIE numbers
• What does it take to pass the CCIE exam?
• Dragged to the hospital
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• How to succede in 2007 – By Tim O’Reilly

--Colin McNamara

A little trivia to start the week

More making of…, originally uploaded by Ashley McNamara Photography.

I got bought a 15mm fisheye lense, and of course, Ashley can put it to much better use then me. This photo is of her friend Ingrid getting henna art done on her belly.

Similar Posts:

• Kylie Launching in Yosemite while sledding
• PHP / MySQL / FLASH website integration
• Tour of Ashley’s new site !
• Google Translate API and speech recognition
• What should I do this thanksgiving break?
• What being married to a geek who does search engine optimization gets you

--Colin McNamara

Ashley stole my new Lense…

Kylie Launching in Yosemite while sledding, originally uploaded by Colin_McNamara.

This is the best vacation ever, 4 days in Yosemite over Christmas. This may turn into a yearly thing.

Similar Posts:

• Ashley stole my new Lense…
• Christmas Trivia
• Google Translate API and speech recognition
• Witch fire in San Diego – Notes from an evacuee
• New features in VMware 3.1
• Gall stones update – Kaiser sucks

--Colin McNamara

Kylie Launching in Yosemite while sledding

1. The first and foremost goal is to only use “white hat” or legal ways of increasing her visibility
2. Get Ashley on page 1 for four target keywords
3. Get An indented listing

Well, it looks like I met my initial goals. Now to move to some more generic keywords and see what goes from there.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks
• Great TCL and EEM preso found on IOS hints and tricks -
• Sun Project Backbox

--Colin McNamara

What being married to a geek who does search engine optimization gets you

http://www.ashleymcnamara.com/index2.php

http://www.ashleymcnamara.com/htmlver/
http://www.ashleymcnamara.com/articles/
http://www.ashleymcnamara.com/htmlver/info.php?num=1
http://www.ashleymcnamara.com/htmlver/galleries.php?sec=1&galnum=1
http://www.ashleymcnamara.com/htmlver/multipage.php
http://www.ashleymcnamara.com/htmlver/proofing.php
http://www.ashleymcnamara.com/htmlver/calendar.php
http://www.ashleymcnamara.com/htmlver/contact.php
http://www.ashleymcnamara.com/articles/2007/12/31/happy-new-year/
http://www.ashleymcnamara.com/articles/2007/12/19/thank-you/
http://www.ashleymcnamara.com/articles/2007/12/02/30/
http://www.ashleymcnamara.com/articles/2007/11/20/baby-t/
http://www.ashleymcnamara.com/articles/2007/11/17/the-wilson-strauss-family/
http://www.ashleymcnamara.com/articles/2007/11/11/the-naritomi-family/
http://www.ashleymcnamara.com/articles/2007/10/31/tot-trends-weekly/
http://www.ashleymcnamara.com/articles/2007/10/31/cotton-candy-sky/
http://www.ashleymcnamara.com/articles/2007/10/30/southern-california-wildfires/
http://www.ashleymcnamara.com/articles/2007/09/21/baby-g/
http://www.ashleymcnamara.com/articles/page/2/
http://www.ashleymcnamara.com/articles/about/
http://www.ashleymcnamara.com/articles/wp-login.php
http://www.ashleymcnamara.com/htmlver/index.php
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=1&sec=1&tstart=2
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1
http://www.ashleymcnamara.com/htmlver/multipage.php?num=3
http://www.ashleymcnamara.com/htmlver/multipage.php?num=2
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=01&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=02&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=03&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=04&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=05&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=06&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=07&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=08&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=09&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=10&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=11&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=12&yearC=2008
http://www.ashleymcnamara.com/articles/2007/09/16/ive-been-tagged/
http://www.ashleymcnamara.com/articles/2007/08/15/the-pirraglia-family/
http://www.ashleymcnamara.com/articles/2007/06/21/baby-sophia/
http://www.ashleymcnamara.com/articles/2007/06/03/my-kidlets/
http://www.ashleymcnamara.com/articles/2007/05/23/11/
http://www.ashleymcnamara.com/articles/2007/05/20/baby-emily/
http://www.ashleymcnamara.com/articles/2007/08/09/good-to-be-back/
http://www.ashleymcnamara.com/articles/2007/07/12/oh-baby/
http://www.ashleymcnamara.com/articles/2007/08/15/baby-viv/
http://www.ashleymcnamara.com/articles/2007/08/27/miss-livia/
http://www.ashleymcnamara.com/articles/2007/08/14/the-jones-family/
http://www.ashleymcnamara.com/articles/2007/06/08/baby-v/
http://www.ashleymcnamara.com/articles/page/3/

http://www.ashleymcnamara.com/articles/2007/05/19/mama-rocks/

http://www.ashleymcnamara.com/articles/2007/05/22/cuteness-overload/
http://www.ashleymcnamara.com/articles/2007/05/15/motherly-love/
http://www.ashleymcnamara.com/articles/2007/05/16/birthday-girl/
http://www.ashleymcnamara.com/articles/wp-login.php?action=lostpassword
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=1&sec=1&tstart=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1&tstart=2
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=1&sec=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1&tstart=2
http://www.ashleymcnamara.com/htmlver/multipage.php?num=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1&tstart=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1&tstart=3
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1&tstart=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1&tstart=3

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Tour of Ashley’s new site !
• Featured on Network World – 20 useful sites for Cisco networking professionals
• Cool new features in 12.4(15)T
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• PHP / MySQL / FLASH website integration
• Certguard, Ethan Banks, Network World and Common Sense

--Colin McNamara

created a new map of ashley’s site

Here is the flash version of her site

Here is the HTML beginning of her site

Direct to the HTML version

Her about page titled your San Diego Photographer

Her maternity portfolio, featuring some great shots of San Diego moms

Her baby portfolio feature babies in San Diego

Her children portfolio

Her frequently asked questions

Her price sheet

Ashley’s Charity Work

Her client proofing, where her clients can preview all their images

One that I really like is a place where you can check her schedule

And last but not least, a place where you can contact her

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• PHP / MySQL / FLASH website integration
• created a new map of ashley’s site
• San Diego Maternity Photographer
• Ashley stole my new Lense…
• Weddings, Measles and Podcasting -
• What being married to a geek who does search engine optimization gets you

--Colin McNamara

Tour of Ashley’s new site !

This tactic address one key failing of ISCSI. Specifically an ISCSI interface running at 400 megabit will take 16% of a 3 ghz 64 bit cpu while using a software initiator or target. This can create some interesting issues where you don’t want to have them. By removing the layer3 information, and transposing fibre channel commands over the Ethernet transport a major cpu hit is avoided.

My gut feel is that this technology will follow a similar track as ISCSI did. ISCSI had a very low adoption in the first 3 years. Storage guys are naturally timid, as there are stiff consequences for failure, but eventually engineers warmed up to ISCSI and started deploying it where it was most appropriate, in lower bandwidth utilization hosts. FCOE will follow this same path, however this time we won’t have to fight the FUD of storage of a network transport. What is in FCOE’s favor is that as a protocol it is optimized for the general ISCSI setup of flat layer two transport between target and initiator.

That all being said, we are going to have to see some product releases from Cisco and Intel for FCOE to really take off. If we don’t, then FCOE will fall down the same hole that ATA over Ethernet disappeared down.

Colin McNamara
CCIE #18233 (Storage Networking)
2 Cups Solutions
“The difficult we do immediately, the impossible just takes a little longer”

References -

Intel Project Page

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 4000 Blade Switch
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• My CCIE Storage Shopping List
• What being married to a geek who does search engine optimization gets you
• Will Cisco succede where Sun has failed?

--Colin McNamara

Fibre Channel over Ethernet is taking off