Colin McNamara - CCIE 18233 , VCP, RHCE, GCIH, GEEK

Jayshree Ullal takes the helm of Arista Networks

colinmcnamara — Mon, 17 Nov 2008 18:35:13 +0000

The speculation is over, Jayshree Ullal former Senior Vice President in charge of Data Center, Switching, and Security groups for Cisco Systems is now the CEO of Arista Networks. Why she made that change is best by her on her blog -

It is truly my pleasure and honor to join Arista Networks as the President and CEO of the company. I have known founders, Andy Bechtolsheim and David Cheriton for a decade and worked with them closely during their Granite/Cisco days. To me, Arista is a symbol of an exciting, innovative silicon valley start-up company at the brink of pioneering new models for cloud networking.

After corporate life and managing multibillion dollars of business at Cisco Systems, you might ask why I chose Arista Networks? Three things really drew me here:

A top-notch and talented team, with focus on best of breed products and innovative EOS™ (Extensible Operating System) technology.

Working with Andy Bechtolsheim, and our long-standing 20+ year professional kinship.

A truly unique opportunity in our industry to build and grow into a great company!

Inside of Cisco Jayshree proved herself as a leader that could get results. There was even speculation that she was tagged to be John Chambers eventual replacement. I have a feeling the same qualities that drove her success inside of Cisco will follow her as she explores this new opportunity.Similar Posts:

--Colin McNamara

Jayshree Ullal takes the helm of Arista Networks

Share and Enjoy:

My Twitter tweets this week

colinmcnamara — Mon, 17 Nov 2008 07:59:59 +0000

Flying to San Jose, staying flying back home Wednesday night. #
It looks like going home Wednesday is out the door. Hopefully I’ll be home by Saturday morning. #
http://twitpic.com/lg12 - Partying in the city. #
Heading to see the Warriors and Pistons battle it out. #
Hanging out with the child process’s. The simple things in life are the best. #
LA is burning, countdown till the arsonists get San Diego going again #

Similar Posts:

--Colin McNamara

My Twitter tweets this week

Share and Enjoy:

Is your network ready for Cloud Computing with Virtual Infrastructure 4?

colinmcnamara — Tue, 04 Nov 2008 06:02:38 +0000

Cloud computing is coming whether you like it or not. VMware’s next release , Virtual Infrastructure 4 (Vi4) is going to change how applications are fundamentally delivered in your Data Center. But what does that really mean to you as a network and systems architects?

First and foremost it is important to discuss how many networks are right now (click for larger images)

Figure 1.1

This is a pretty common setup, with 80% of so of systems still physically attached to a mix of 100 and 1000 Megabit access layer switches. The other 20% of virtual systems are attached as through blade center switches with 10 gig to distribution or larger (8-16 core) systems with bundled uplinks to the distribution switches. Service aggregation such as firewall, load balancing, and wan acceleration , image deployment, monitoring / management and other key Data Center services generally provisioned off 1000 Megabit ports in the distribution.

Last but not least, a shadow storage network runs connected to a small percentage of physical servers, and connected to all of the virtual servers via Fiber Channel, iSCSI, or NFS presentation. One thing to keep in mind that all of these elements may not be configured in the “optimal” SRND setup, but it is something that you can expect to see in a real life network today.

What’s so special about Vi4 Application vServices ?

Figure 1.2

The one new feature that is going to throw your network on its heels is vApp. Imagine if any application could be installed on any server in any location of your network at any time. What vApp enables you to do is create a portable application, similar to a Java application that installs in your web browser. But this application can be dynamically deployed to any virtual system in your Data Center as needed in response to a new application request, or the need to dynamically scale an application. What this means to us as network engineers is that any corner of our networks where virtualization is present can become a hot spot for critical application flows. This introduces a new dynamism to our fabrics which wasn’t there before, and frankly many networks are not equiped to handle it successfully.

Currently, to provide virtual machine redundancy we have VMware HA, where we both monitor the availability of a virtual machine. If there is a problem we can restart that virtual machine on another ESX host. With Application vServices there are many new elements and traffic flows. The two most important ones are vLockstop and vCenter Data Recovery. VMware is taking high availability to the next level by keeping a hot standby VM running on a second physical ESX server. If you think about it, you now are adding both additional latency sensitive heartbeat traffic as well as creating a situation where your storage traffic flows can be highly volatile. Additionally vData Center Recovery will be throwing traffic in new and interesting ways across your links.

Adjusting your network designs to deal with the cloud

Figure 1.3

First and foremost application virtualization needs a front end, in network engineering circles we have been handling this successfully for a long time with content switches (load balancers). These provide the logical rallying point for dynamic cloud applications. Since more and more systems will be utilizing these services it is important to ensure that your current content switches have headroom to grow, and if you don’t have any content switching capabilities, it is probably time to take a look at adding them to your data center.

Since applications can exist in any corner of the network, dynamic provisioning of storage and network connections has become critical. Maintaining “shadow” storage networks can provide some dynamic access to storage, however it is now becoming advantageous to virtualize your storage fabric along with your systems and network devices. Fibre Channel Over Ethernet (FCOE) provides just that.

If you look at figure 1.3 above, you will notice a new color introduced into the diagram, as well as the “shadow” storage network removed. This is possible because all the orange links run Data Center Ethernet (DCE) which provides a lossless path for FCOE to follow. The ESX servers now only connect into the Nexus 5000 switches. As you can see, we also have removed the shadow storage network, as it is now consolidated onto our new data center fabric. There may be use cases where we need to extend classic fibre channel connectivity out to certain hosts, and we can do that of the Nexus 5000. However if all possible it is advantageous to utlize FCOE to gain storage mobility and higher bandwidth for your hosts.

You may notice that our uplink counts have doubled. Since we are moving both storage and data traffic over the same links, as well as supporting vMotion and other bandwidth intensive network applications it is time to make the push to port channeled 10 gig adapters. Luckily prices have dropped considerably, where it is not cheaper to use 10 Gig then to bundle 8 1 Gig adapters together.

Last but not least you will notice the core switching is a different color. This is because the Nexus 7000 has found its home in the data center. I wont go to deep into the nexus as that is an article in and of itself. What I will say is that it is the best platform to use to aggregate the amount of 10 Gig links that are populating the data center in a highly available fashion. If you want to learn more about the 7000 I recommend reading these previous articles here here and here, as well as Cisco’s Data Center Switching page.

Your network once Virtual Infrastructure 4 (Vi4) and the Nexus 1000V are released

Figure 1.3

Fast forward to early summer 2008 VMware Virtual Infrastructure 4 (Vi4) and Cisco’s Nexus 1000V are released. Of course a new major version of VMware running your compute cloud, application vServices are in effect, vLockstep is running, and many other features that go with the platform such as the Nexus 1000V.

The Nexus 1000V brings a long missing feature to the Data Center, a defined network edge. Since VMware has taken hold in the Data Center, the boundary layer between the virtual machine and the network has devolved to a dumb bridge running in the memory of a ESX server. Installing the Nexus 1000V in your ESX servers creates a virtual switch with interface counters, pvlans, access controls, QOS and many other features that are critical to operating a Data Center. (check out a previous article about the Nexus 1000V).

Enjoying the fruits of our labors

Cloud computing in general, and specifically Virtual Infrastructure 4 have specific benefits that will drive efficiency and agility in IT as a whole. The mechanisms for these benefits will put increasing load on the storage and data networks in your Data Center. It is our responsibility as network architects to take a proactive stance and provision a network with the immediate future in mind. Luckily planning and preparing for these changes in advance have both benefits for our current infrastructure, as well as allowing us to enjoy the fruits of our labors as Cloud Computing changes from a buzz word to a reality.Similar Posts:

--Colin McNamara

Is your network ready for Cloud Computing with Virtual Infrastructure 4?

Share and Enjoy:

Humor inside the Nexus 5000 switch fabric architecture

colinmcnamara — Mon, 27 Oct 2008 16:10:18 +0000

I was putting together some presentations this morning and found a joke hidden inside the Nexus 5000 switch fabric architecture. Can you find it?

If you are from the San Francisco bay area you will recognize the towns of Los Altos and Los Gatos. In this diagram, the chipsets are Altos and Gatos. But where is the Los ? Missing of course, because it it a Lossless fabric.

Yes, I LOL’ed

Want to learn more?

Nexus 5000 architecture - Building blocks of the unified fabric Similar Posts:

--Colin McNamara

Humor inside the Nexus 5000 switch fabric architecture

Share and Enjoy:

Interesting TechWise TV episode on virtualization

colinmcnamara — Thu, 23 Oct 2008 18:00:20 +0000

The folks over at TechWise TV just posted an interesting video on virtualization, and its effect on the Data Center.

They broke down a couple key challenges of virtualization - Policy Enforcement, Security in a virtual environment, Management, Automation and the change from network plumbing to fabrics. At the core of the message, is the Data Center is changing. The focus of this change is virtualization. You can either get on board, or watch the work pass by you.

One topic that I have talked about in the past, is a pressing subject with Cisco - the challenges of handoff between the ESX server admins and the network admins. Again, this highlights the core value of the Nexus 1000V. About 20 minutes in, there is a bit of banter about being a “networking guy” or a “server guy”. I think this highlights a key point - To be successful deploying Data Center 3.0 technologies, you really have to be both.

Next they have a demo of the Nexus 1000V. For those of you that haven’t seen the beta in action, you will be pleasantly surprised with how it can simplify the management of your virtual network infrastructure.

Last but not least, they go into how you can leverage WAAS and its 4.1 release to accellerate your virtual desktop infrastructure. As well as showing a cool new way you can run a Windows server on a was box with the new WAVE product.

It is good to see the folks at Cisco participating in the conversation surrounding virtual data centers. I suggest you head over to the TechWise TV YouTube channel and check it out for yourself.Similar Posts:

--Colin McNamara

Interesting TechWise TV episode on virtualization

Share and Enjoy:

Where is Colin ? Passing the VCP exam (VMware Certified Professional)

colinmcnamara — Wed, 22 Oct 2008 00:17:09 +0000

Life has been busy lately, with the promotion, CCDE practical, and new team members I have been working 60 to 70 hour weeks for the past month or so. Part of my new role is developing new reference architectures surrounding Data Center technologies. Of course, VMware and virtualization technologies in general are key pieces of any Data Center architecture now.

Because VMware is central to Data Center architectures, I decided to do a deep dive over the past week. This is not my first foray into virtualization, I have used vmware workstation since 1999 and got my first exposure to Storage Networking in 2004 with ESX. Read an article from 2005 about me dealing with network issues in ESX. However VMware has has added so many interesting and relevant features that I found it was good to do a ground up review on. I have to say, that review was helpful. There are many features that as a network designer that should have been in the forefront of my mind, that I hadn’t grasped the full potential of.

As always, after a deep dive into game changing technology I am filled with more questions then answers. But the answers I do have are enough to try my luck at an exam. With an afternoon free, I decided to try my luck at the VMware Certified Professional Exam (VCP-310). Apparently my deep dive worked, because I walked away with a new cert for the binder

Now with a better understanding of the value adds that VMware Infrastructure 3 (Vi3) has in the Data Center, I need to deep dive again on VMware Infrastructure 4 (Vi4) and figure out how Virtual Data Center OS (VDC-OS) and VMware based application virtualization tie into the classic methods of application virtualization (load balancing and content switching) as well as lay down some common network architectures utilizing the Nexus and converged data center fabrics for the move towards cloud computing in the enterprise. I’ll keep you posted on the results of these deep dives, I am sure it will be interesting.

Needless to say, it is a fun time to be a Data Center geek…Similar Posts:

--Colin McNamara

Where is Colin ? Passing the VCP exam (VMware Certified Professional)

Share and Enjoy:

My experience taking the CCDE Practical Beta

colinmcnamara — Mon, 06 Oct 2008 04:37:54 +0000

To answer the question that everyone is bound to ask - “did you pass?”. The answer is, I’ll tell you in 6-8 weeks. The CCDE Practical Beta is just that, a beta. From what Dr Sarah and Russ White have said, there will be many iterations of psychometric analysis, as well as throwing out certain questions with the intent of finding the “true” right answer. While I hope that answer is the one I supplied, it really is out of my control.

The one thing in my control is preparation. Preparing for the CCDE was extremely hard for me. Oddly enough, the challenge wasn’t the complexity of the content, but the breadth. For example, stack the nineteen recommended reading books on your desk, and become an expert on them.

Look at the CCDE Practical Blueprint -

The CCDE Practical Exam is designed to assess a candidate’s ability to perform the following
tasks:
Gather, clarify, and analyze existing and new network requirements
•   Identify requirements and determine how they shape the purpose and expectations of a
given network.
•   Demonstrate the ability to gather and validate information about an existing network.
Develop network designs to meet functional specifications
•   Choose the correct technology to resolve a specific network design problem.
•   Create a network design that minimizes or eliminates negative impact on the existing
network and services.
•   Create a network design that is scalable.
•   Create a network design that is elegant and supportable.
•   Create a network design that is resilient.
Develop a plan to implement network design changes
•   Evaluate the impact of implementation options.
•   Develop contingency plans for network restoration.
Convey design decisions and rationale
•   Justify network design choices based on functional specifications.
•   Justify technology choices based on technical requirements.

I used that outline, as well as the reading list to prepare. I think you will aggree with me that if you look soley at the blueprint, that you have to cast a pretty wide net to get all of it. I interpreted this as being so open, that it was like walking with a lantern. Light from the lantern shines equally on everything, so you pay attention to litterally everything. Now, after taking the exam, I gained a bit of perspective on what exactly the developers were looking for. In this case, it would be like exchanging your lantern for a flashlight. Now, while the beam is wide, it is a lot more focused then walking with the lantern.

This perspective on the exam, or more specifically the intent and target market of the exam is invaluable. Well, I guess it is valued at the seven hundred dollars it took to take the exam ;). Now that I understand what they are looking for, I think I am in a good position to have a decent chance in Febuary if I don’t walk away with a CCDE number in six weeks.

Pearson

Pearson’s professional testing centers were a new experience for me. The center was clean and professional, and the staff was very helpful (including getting a couple tankards of coffee after me explaining it was the lifeblood of us geeks). However the one thing, I didn’t get the same feeling that you get when walking into the CCIE lab. If you haven’t been to the CCIE lab yet, it is almost like walking onto the football field at Notre Dame. Where in the lab you walk past the wall of pain, at Pearson it feels just like sitting down and taking any other written exam.

I do have to warn anybody who is taking this exam in the future though. If you have big feet like mine, be VERY careful of the power plugs. I managed to kick the power plug from my computer just over an hour into the exam and lost all my work. Rest assured the proctors said that the test would keep state in the production exam.

Chicago

Prior to October, I had been to chicago four times. Sadly each of those times was limited to grabbing some spankitopita at the little Greek place at Miday and then flying on to some other part of the country. This was the first time that I had managed to escape the terminal and make it into the city itself.

The first thing that struck me was how Chicago went up and not out. Coming from the west coast where cities grow out and not up, it was very weird to look up and see 1500 foot tall buildings. This urban canyon was mixed in with buildings from the 1800’s. All in all I have to say that it was pretty cool.

All 1500 feet of the Sears Tower

The other thing about Chicago is that the food is AMAZING. In less then a week in the city I managed to put on two well earned pounds. We hit up Merlot on Maple the first night. It was a quaint little northern Italian resteraunt housed in a little brownstone on the southside of Chicago. The second day we hit up Dua, the second deep dish pizzaria in chicago for lunch. Then we went to Lockwood at the Palmer Hilton for dinner. All these places were amazing, though I have to say that I prefered the down home delicious of Dua to the others.

Deep dish done right at Dua

The last night, it was time to blow of the stress from the CCDE Practical. The CCDE team was nice enough to host a cocktail party on the ninety fifth floor of the Hancock Building. I managed to deliver a nice little diatribe on Trill, L3VPN’s and security networks a the user and app level vs. stopping at layer 4 while being about one beer past the point where technical items should be discussed. If I managed to get into any heated discussions aboutthe importance of business relevance versus technical optimization then you have my appologies.

Sadly that party ended at 10:00 pm. Luckily Chicago is Brian McGehan’s home town. He recommended Fado’ , a great little Irish pub in the russian hill section of town. Brian, Scott, Gene, Genes wife, Ryan and I headed down there and made a good time of it till 2:00 am in the morning.

Summing it up

Eighteen months of studying culminated in 8 hours of blurry eyes in front of a computer screen trying to figure out a proctor’s intent. Looking around at the people in the waiting room, I saw many people that just blow my brain away. So if they grade on a curve, I am pretty sure I’ll be back in Febuary. Even if it goes that way, it is a good thing, because it just pushes me to learn more and become a better engineer. At the end of the day, I’m all right with that.

Similar Posts:

--Colin McNamara

My experience taking the CCDE Practical Beta

Share and Enjoy:

Link Love - Blogs that linked to me this month

colinmcnamara — Tue, 30 Sep 2008 16:56:13 +0000

To the following blogs linked to me in their articles this month, Thank you.

Tom Ludwig at http://networkvirtualization.wordpress.com pointed out quite accurately that I wasn’t explicit on the public release date for the 1000V. Thank you Tom for pointing that out - Minor confusion about the release date of Cisco’s Nexus 1000V

Scott Lowe at http://blog.scottlowe.org included me in his Day 2 VMworld coverage - as well as his article on VMworld 2008 resources

Guy Brundson at http://blogs.vmware.com included me in the coverage of VMwares networking releases.

Andrew Kutz at http://blogs.vmware.com/vmtn included me in his coverage of VMworld

Gabriel Maciel at http://it-infrastructure-management.blogspot.com included me in his must read articles list

Duncan Epping at http://www.yellow-bricks.com included me in his article - for those that didn’t go to VMworld

“Red Pinapple” at http://thinkingproblemmanagement.blogspot.com writes about and responds to my article on virtualization in the DMZSimilar Posts:

--Colin McNamara

Link Love - Blogs that linked to me this month

Share and Enjoy:

Quoted on ZDnet - Shameless self promition

colinmcnamara — Thu, 18 Sep 2008 16:18:48 +0000

As the buzz surrounding Cisco’s foray into the virtual networking space spreads, the folks over at ZDnet quoted the recent article I wrote about the Nexus 1000V - Cisco , VMware collaborate on desktop virtualizationSimilar Posts:

--Colin McNamara

Quoted on ZDnet - Shameless self promition

Share and Enjoy:

Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

colinmcnamara — Wed, 17 Sep 2008 19:06:20 +0000

Altor networks is the first vendor to announce that it will be leveraging the additional visibility and security features of Cisco’s Nexus 1000v virtual switch for VMware. Their Virtual Network Security Analyzer and Virtual Network Firewall products are targeted at the emerging virtual machine security markets.

Altor networks goal is to provide a single pane view of communications within your ESX clusters, as well as ease access control list creation and deployment. With this single pane virtualization customers should be able to decrease the time needed resolve availability and security issues, allowing virtual enviornments to continue to scale.

This is a sign that we can look forward to many other software vendors adding Nexus 1000v support to their existing product lines. I wonder who is next ? NetQOS maybe ….

Want to learn more ?

Altor NetworksSimilar Posts:

--Colin McNamara

Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

Share and Enjoy:

Cisco releases Nexus 1000V virtual switch for VMware

colinmcnamara — Tue, 16 Sep 2008 20:30:21 +0000

This afternoon Cisco released a new member of the Nexus family of switches, the Nexus 1000V. This is the first switch to take advantage of VMware opening up their ESX and ESXi platforms to for third party network device manufacturers. This switch directly address some pretty big pain points surrounding current virtualization implementations.

The boundary between server team and network team responsibilities has become “fuzzy”

Cisco address’s this issue by putting a switch that can be managed via the same methods common to other network devices inside the ESX cluster. This switch runs the same code that has become standard on Cisco’s Nexus series of Data Center switches - NX-OS.

Prior to adoption of virtualization, when there was a connectivity problem with a host it was quite common for the network team to verify functionality down to the switch port. The server team would do the same. This allowed for each team to focus on areas that met their core competancy. Once we moved from a real switch port, to a dumb bridge inside ESX, lots of finger pointing resulted.

Now, with a Nexus 1000V sitting virtually inside the ESX clusters, the boundary between network and systems teams has been re-estabilished. Now when there is a problem with a host inside an ESX cluster, the network team can use the same day to day troubleshooting tools available to them in other portions of the network to resolve issues faster, and with less finger pointing.

Security controls have been moved further away from the hosts then we would like

A best practice for applying security policy is to apply controls as close to the source as possible. Think of this analogy - Your kids are blasting Radio Disney from their computer. Which of the following do you do?

A. Turn down the speakers at the source

B. Distribute earplugs to all members or the household

Of course, the obvious action is to go to the source, and apply a control (turn down the volume, and tell the kids to clean their rooms). The same principle is valid on the networking side. The best practice is to apply security policies such as VLAN ACL’s and TrustSec policies directly to the switchports that host your switches. Before the Nexus 1000V this was impossible to do in ESX, and forced many environments to move security controls further up into the distribution layer. The side effect of this was that now the security stance from host to host inside ESX clusters was diminished.

The Nexus 1000V brings something called port policies to the table to address this. What these are is pre-configured application security descriptions that are available to you systems administrators to apply in a point and click fashion. Once these policies are applied to the virtualized host, they follow the host where ever it is moved in your virtual cluster.

Provisioning and integrating the networks of VMware ESX clusters with classic networks for most is challenging at best

I wrote an article in march about this specific issue in my post - Challenges integrating VMware into Cisco networks . The core of this issue is that in general that the network integration portions of VMware ESX clusters is not really designed to address server teams , or network teams. In fact, you need to be pretty savy with both portions to successfully integrate VMware clusters into your network. In the real world, you generally find people that are good at one or the other, not both.

By putting a Nexus 1000V in your VMware clusters, you know give the networking teams something they can understand without having to learn Linux, and how it handles bridges (key to understanding ESX networking). With a Cisco switch running virtually inside your clusters, network teams can follow standard core / distribution / access models with the access layer now residing inside the ESX clusters. The network teams can also leverage their existing LAN switching skills for integrating the virtual switches in the clusters with the existing Data Center switching fabrics.

With these roadblocks addressed, Cisco is moving to further the DC 3.0 vision

To realize the DC 3.0 vision, the network inside of VMware clusters had to be under control, and follow the same architectural guidelines that the rest of our network is subject to. With the Nexus 1000V this is now a reality. The next steps withing the DC 3.0 vision to are to extend virtualization and mobility throughout our storage fabrics, and to continue to extend virtualization to the network as a whole, as well as focusing on application virtualization and acceleration to truly realize the vision of cloud computing in the data center.

On the storage virtualization side, Cisco will be using a technology called FlexAttach to enable virtual and physical hosts to change locations in the datacenter without storage team intervention (more on this in a near future post). And on the application virtulization and acceleration side, expect Cisco to continue to enhance it’s existing Application Control Engine (ACE) and Wide Area Application Services (WAAS), and further integrate these into their virtualization offerings.

Want to learn more ?

Introduction to VN-Link network services - Cisco.com

Nexus 1000V overview - Cisco.com

VMware distributed vNetwork switch demo - VMware.com

Challenges integrating VMware into Cisco networks - colinmcnamara.com

Douglas Gourley speaking about how Cisco and VMware will drive Cloud Computing in the Data CenterSimilar Posts:

--Colin McNamara

Cisco releases Nexus 1000V virtual switch for VMware

Share and Enjoy:

BIG Cisco - VMware announcement - 1:30 Pacific time

colinmcnamara — Tue, 16 Sep 2008 15:19:27 +0000

Expect something really big in the cloud computing / datacenter 3.0 space to be announced by Cisco this afternoon.

Sadly, I have the unfortunate situation of being tagged as an insider (work in the partner community). So I have to play nice, and cannot reveal any juicy tidbits. Suffice it to say, that Jashree Ullal and Doug Gourlay weren’t pulling anyones leg in the past two years when the DataCenter 3.0 vision was established.

Stay Tuned

–ColinSimilar Posts:

--Colin McNamara

BIG Cisco - VMware announcement - 1:30 Pacific time

Share and Enjoy:

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

colinmcnamara — Tue, 09 Sep 2008 20:36:57 +0000

Ivan Pepelnjak over at IOS Hints and Tricks wrote a post about DMZ VLAN leaking that got me thinking.

He writes about “the VLAN leaking myth” and how it encourages clients to utilize physically separate network infrastructure in the DMZ’s. Now first things first, I wouldn’t call VLAN leaking a myth. At one time it was a very real and serious vulnerability that was exploited by overflowing the capacity of the switch you were attacking, and causing it to “downgrade” from switch to a hub. Once this happened you now had access to previously protected devices, as well as having the ability to sniff data as it passed through the shared hub backplane.

As he mentions though, this is 8 years ago. Most switches have evolved to the point where backplanes far exceed the traffic that could ever be injected into their switchports. Even beyond backplane enhancements there are many ways to further firm up your security stance - Virtual Device Contexts, not using Layer 3 SVI’s on a DMZ VLAN, utilizing PVLANs, using port security, virtual routing instances, and many more. Of course, there are still many other attack vectors that still remain, but can be mitigated by utilizing features built into the majority of enterprise switches available today.

I think the real question is not “are VLANs safe in a DMZ”. The important question is have you mitigated the probability of compromise (the actual threat) to levels that are acceptable to your business. This question remains whether you have a standalone switch or not. So many times we hear about risk risk and more risk. But risk alone is meaningless in a business context. What is important is combining risk with likelihood. For that I like to use a simple table to come up with the true threat.

For example, as I drive to Fry’s there is the risk of me dying due to a car crash. The impact of me dying is very high (risk) however the likelihood of an accident is low, and furthermore I reduce (mitigate) the latent risk (threat) by wearing my seat belt. So all in all the threat of me dying on my way to Fry’s is pretty darn low.

In a business context this may be that I have public facing web servers and network devices in my DMZ. The impact of them being compromised is that my public image may be tarnished for a short time, and my end users may lose productivity if they are not able to VPN into work, or access the Internet while on premise. I mitigate this risk by using firewalls and both host and network based Intrusion Prevention Systems as well as implementing best security practices on my network and systems devices. The latent risk (threat) remaining is at a level that is acceptable to the business leaders, so the system is allowed.

One question that I have seen coming up more often as we move towards fully virtualized data centers is centered around commingling of virtual infrastructure. There are some hard questions which challenge some practices that we have held true over the years.

Should you allow sharing of physical memory on a host virtual machine between an internal and DMZ server?
Should you allow virtual infrastructure from multiple security zones to share a storage array or cluster of arrays?
Should you allow multiple virtual switches in different security zones commingling on the same ESX or Hyper-V cluster?
Should you allow virtual firewall and load balancing instances protecting internal and external zones to reside on the same hardware?
Should you allow virtual routing instances from multiple zones to share a physical infrastructure?

In the past world of standalone systems, the additional cost of providing a wholly separate infrastructure for DMZ environments was relatively low. Each system generally had internal disk, or at most direct attached storage. Network devices themselves were scaled down to support one chassis one function. This fit quite neatly into the Enterprise Composite Network model that was quite common from 1999-2003.

Now, many data centers have moved to the Service Oriented Network Architecture (SONA). In this model the cost of a virtualized data center is primarily focused on foundation elements such as the virtual storage and virtual fabrics, virtualized network, and virtual systems elements. The cost of providing additional virtualized services off these elements is low, however the cost of duplicating the physical infrastructure is quite high on both the capital and operational levels. This is forcing the technical and executive leadership at many companies to take a long hard look at the true threats they are facing in previously physically separate security zones such as DMZ’s, Financial and other secure zones. In the end, they are having to decide whether the threat remaining after their security controls is worth duplicating hundreds of thousands of dollars worth of infrastructure or not.

These are hard questions, with really no single good answer. My gut feel is that over the next few years we will continue the move towards the fully virtualized data center where components such as memory, PCI-X buses, storage and network devices are even further decentralized. This will make the cost of duplicating the infrastructure more and more significant, causing consolidated data center (or compute) fabrics to be the norm. At this point the discussion will move away from securing zones by creating separate infrastructure, to providing end to end security, starting integrated application level security, maybe with TrustSec or a dirivative, all the way down to securing the data at rest on disk. For the time being however, the best we can do is sit down and do an honest appraisel of our security stances, mitigate what we can, and do our best to design data center architectures that provide the flexibility of implementing whatever choice the technical and business leaders agree on.Similar Posts:

--Colin McNamara

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

Share and Enjoy:

Protecting the integrity of the CCIE lab - Verbal Interviews being tested

colinmcnamara — Fri, 29 Aug 2008 23:22:36 +0000

Brian Dennis over at Internetwork Experts blog caught wind of an interesting email from Cisco -

Dear Candidate:

On August 27, Cisco will introduce a pilot for the CCIE Routing and
Switching lab exam in Beijing, China. The pilot will add a 10-minute
interview that will assess the candidate's ability to apply expert-level
networking skills and knowledge to networking problems that are encountered
on the job. After the lab orientation, a panel of three experts will conduct
a verbal interview with each candidate, asking a series of expert-level
networking questions (questions and answers will be in English). The ability
to correctly answer these questions will affect the exam score. After
completing the interview, the candidate will have the entire 8 hours to
complete the lab portion of the exam.  These scores will then be
calculated and then combined for a total score which will decide a pass
or a fail.

Our goal with this email is to let you know that your day will extend beyond
the normal testing day by approximately one hour.  The additional hour will
be at the end of the day. We hope you find this interview process
enlightening and helpful as we continue to strive for the standard the world
has come to expect from CCIE.

In my opinion this change is both needed and appropriate. In the past couple years, the two main barriers to entry with the CCIE (access to gear, and knowledge) have been lowered with the abundance of training programs as well as dynamips and it’s derivatives for gear emulation. Where in the past you were looking at a minimum of $8,000 dollars for a full lab, now you can run it on your PC at home.

From what I see, this is encouraging engineers to get their CCIE’s earlier in their career. This in itself is not a bad thing. If an engineer has dedicated themselfs to learning all the in’s and out’s of networking technology, then they really have earned the title. The problem comes when people want to take short cuts. They buy a lab of someone in China, or use other methods to get copies of the lab. To them, passing the lab and getting their number is all that is important, not truly becoming an expert in the technology.

While in the short term this may seem like the quick path to a good salary, in the long term everybody loses. Those who have cheated their way to their CCIE (while few and far between) end up devaluing the cert for the rest of us. And at the end of the day, they are just cheating themselves, and will lose their jobs when their true skills are tested.

It looks like Cisco is seeing the same thing that I have just talked about. This pilot program should go a long way into protecting the integrity of the CCIE for years to come.Similar Posts:

--Colin McNamara

Protecting the integrity of the CCIE lab - Verbal Interviews being tested

Share and Enjoy: