for Tier 1 Virtualized Environments

Today’s virtualized Data Centers are not stand-alone environments. The availability and performance of these environments depends on complex inter-dependencies of networking, server, virtualization and storage vendor components. Behaviors of which can vary by vendor or even firmware version.

Not only are end to end configuration guides that encompass every element in these infrastructures rare, but there are so many elements that one minor mis-configuration may result in your virtualized datacenter not performing deterministically under all conditions. The same rigorous testing that is required for Tier 1 systems and networks in the physical work must now be mapped into the virtual infrastructure.

In this session we will explore testing tools and methodologies to validate a virtualized environments ability to meet SLA’s, and also track performance changes over time as new hardware, firmware, and software is introduced.

**Special needs of Tier 1 applications**

Availability –

Applications have a small window that you can lose packets before the application breaks. Is your convergence time under that? Voice apps require even stricter controls then this. Requirements include minimums among overall latency as well as the variation of latency as well as a maximum percentage of packet loss that can be sustained.

Quality Of Service –

Voice and video servers are starting to make their way into your virtualized infrastructures. There are specific prioritizations that need to occur at many physical and logical points in your infrastructure. Luckily these can be tested before you get a call about call quality issues.

Throughput –

Will that new app bring your cluster to its knees? Good thing to test first.

**Areas of increasing complexity in virtualized DC infrastructures**

What new components are showing up in our virtual infrastructure that can affect our SLA’s

-        Networking Components

-        Storage

-        Security

A single mis-configuration of bug in firmware of any one of these items can stop you from meeting your SLA’s. We will highlight common components that we need to test in Tier 1 virtualized infrastructures.

**QA and Acceptance testing methodology**

There is no need to reinvent the wheel when it comes to QA and Acceptance testing. We will discuss common tests such as SRLG (Single Resource Link Group) failure tests along with common testing and report frameworks.

**Test tools and procedures **

It doesn’t take a million dollar test set to validate your infrastructure. We will review some great open source tools out there that use can use to validate Availability, Quality of Service, and Throughput as well as show a couple of my favorites in action.

Call to Action - If you want to hear all this and more, vote for my VMworld presentation here

http://www.vmworld.com/cfp.jspaSimilar Posts:

• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Cisco Unified Computing System Quoting and Configuration with Netformx
• VMworld 2009 Schedule
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)

Similar Posts:

• None Found

--Colin McNamara

Cisco Live 2010 Schedule

Schedule note – My good friend Rick and I normally alternate picking which classes to attend each year. Last year I picked classes mostly out of the new developers track. This is Rick’s year to choose, so there are a bunch of really fun high end service provider and route switch tracks (would you expect any less from a quintuple CCIE). It should be a blast!

Sunday
5:00 PM-10:00 PM	Poker night / Hog cookout ePlus engineering	Poker night / Hog cookout ePlus engineering

Monday
8:00 AM-5:00 PM	TECCCDE-3005 Moscone S306	CCDE: The Cisco Certified Design Expert
5:30 PM-8:30 PM	WoS Reception 1 World of Solutions	World of Solutions 20th Anniversay Reception

Tuesday
7:30 AM-9:30 AM	BRKVVT-2112 Moscone W2014	Cisco Telepresence Network Infrastructure Design for Service Providers
10:00 AM-11:30 AM (Conference Event)	GENKEY-5501 Hall D	Opening Keynote and Welcome Address with John Chambers
12:00 PM-2:00 PM	BRKAPP-2011 Moscone W2016	Application and Data Delivery Performance in a Low Latency 10GE Environment
2:30 PM-3:30 PM	GENSSN-4462 Hall D	NetQoS Super Session, NBC Universal’s Olympic Gold Network Performance!
4:00 PM-6:00 PM	BRKRST-3365 Moscone W2024	Unified HA Network Design: The Evolution of the Next Generation Network
7:00 PM-10:00 PM	Partner event – Red Devil Lounge CCIE Party – Science Center – Pick the one with the best bar.	Partner event – Red Devil Lounge CCIE Party – Science Center – Pick the one with the best bar.

Wednesday
8:00 AM-10:00 AM	BRKSAN-3707 Moscone W2000	Advanced SAN Services
10:30 AM-11:30 AM (Conference Event)	GENKEY-5564 Hall D	Cisco Technology Keynote with Padmasree Warrior
12:00 PM-2:00 PM	BRKOPT-2115 Moscone N122	IPoDWDM: 40G, 100G, and Beyond
2:30 PM-3:30 PM	GENSSN-4463 Moscone N135	Super Session: Building the Collaboration Extranet
4:00 PM-6:00 PM	BRKRST-3101 Moscone W2002	Advanced Topics and Future Directions in MPLS
7:30 PM-11:30 PM	Customer Event Social Events	Customer Appreciation Event

Thursday
8:00 AM-10:00 AM	BRKRST-3305 Moscone W2022	Advanced IPv6 Deployment and Services
10:30 AM-11:30 AM (Conference Event)	GENKEY-5565 Hall D	Closing Guest Keynote: Guy Kawasaki
12:00 PM-2:00 PM	BRKDCT-2981 Moscone W2005	L2MP overview: going beyond the spanning tree protocol [ Related Technology Demo: Nexus 1000V Data Center Virtual Switching ]
2:30 PM-4:30 PM	BRKNMS-3132 Moscone W2008	Advanced NetFlow

Similar Posts:

• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Heading home – Cisco Live 2008
• No one told me there would be a monsoon – Cisco Live Networkers 2008
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Application Extension API notes – Cisco Live 2008

--Colin McNamara

Cisco Live 2009 – Networkers class schedule

Dear Candidate:

On August 27, Cisco will introduce a pilot for the CCIE Routing and
Switching lab exam in Beijing, China. The pilot will add a 10-minute
interview that will assess the candidate's ability to apply expert-level
networking skills and knowledge to networking problems that are encountered
on the job. After the lab orientation, a panel of three experts will conduct
a verbal interview with each candidate, asking a series of expert-level
networking questions (questions and answers will be in English). The ability
to correctly answer these questions will affect the exam score. After
completing the interview, the candidate will have the entire 8 hours to
complete the lab portion of the exam.  These scores will then be
calculated and then combined for a total score which will decide a pass
or a fail.

Our goal with this email is to let you know that your day will extend beyond
the normal testing day by approximately one hour.  The additional hour will
be at the end of the day. We hope you find this interview process
enlightening and helpful as we continue to strive for the standard the world
has come to expect from CCIE.

In my opinion this change is both needed and appropriate. In the past couple years, the two main barriers to entry with the CCIE (access to gear, and knowledge) have been lowered with the abundance of training programs as well as dynamips and it’s derivatives for gear emulation. Where in the past you were looking at a minimum of $8,000 dollars for a full lab, now you can run it on your PC at home.

From what I see, this is encouraging engineers to get their CCIE’s earlier in their career. This in itself is not a bad thing. If an engineer has dedicated themselfs to learning all the in’s and out’s of networking technology, then they really have earned the title. The problem comes when people want to take short cuts. They buy a lab of someone in China, or use other methods to get copies of the lab. To them, passing the lab and getting their number is all that is important, not truly becoming an expert in the technology.

While in the short term this may seem like the quick path to a good salary, in the long term everybody loses. Those who have cheated their way to their CCIE (while few and far between) end up devaluing the cert for the rest of us. And at the end of the day, they are just cheating themselves, and will lose their jobs when their true skills are tested.

It looks like Cisco is seeing the same thing that I have just talked about. This pilot program should go a long way into protecting the integrity of the CCIE for years to come.Similar Posts:

• What does it take to pass the CCIE exam?
• My experience taking the CCDE Practical Beta
• It’s on like Donkey Kong – CCDE practical registration is open
• Are you a kick ass engineer looking to grow?
• And it begins again – On the road to my CCIE in Storage
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Protecting the integrity of the CCIE lab – Verbal Interviews being tested

I think Rick (5x CCIE) put it best in a company wide email earlier this afternoon  -

Please join me in congratulating Darrel in obtaining his Storage CCIE. There are only 24 double CCIES (RS/Storage) in the world, so he is probably about 1 of 15 or less in the world to hold all three.

What is everyone’s vote what is next in his career?  And, NO, you don’t have a say, Darrel

A) Service Provider

B) VOICE

C) CCDE

Thanks,

Rick Davis

ePlus, Senior Network Engineer

CCIE – Storage, Voice, Security, Service Provider, Routing and Switching (#5672)

Great job Darrel, everyone is really proud of you. and our apologies in advance to the wife for stealing you for choices A, B or C. (My vote is for C)

–Colin

Similar Posts:

• Updated CCIE numbers
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• About Colin McNamara
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Are you a kick ass engineer looking to grow?

--Colin McNamara

Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

Luckily we made it to the party without dying, ePlus is safe for the time being. It was nice to have Cisco show appriciation to their biggest chearleaders, and even better to run into your peers and share a drink.

The venue was nice, though I am sure in retrospect that the organizers now now that if you pack hundreds of nerds in a room with video games and beer, there is bound to be a line. The party itself did seem to die out pretty quickly, but I do have to thank the folks at Cisco for taking the time to put the vent together for us.

Next year, Cisco is on its home turf. I think I’ll be the first to put my vote into the suggestion box. My vote is for Conference Room “G” . Where ever it does end up, lets look forward to seeing each other again next year.Similar Posts:

• VMworld 2009 Schedule
• Weddings, Measles and Podcasting -
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Live 2009 – Networkers class schedule
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Witch fire in San Diego – Notes from an evacuee

--Colin McNamara

CCIE Party 2008 Recap – Cisco Live Networkers 2008

Where would you use these ?

You want  your custom application to be able to react, and act on network specific information. Integrating both at a very close level. Fundamentally your application can dynamically reconfigure your router in reaction to network events.

You want to remove common services such as AAA, Syslog, DHCP, etc, IVR apps, Unified communication apps all at the branch office in the ISR. If there is a failure, your router can dynamically reconfigure around that.

AXP architecture

Base Cisco Linux os, IOS CLI, Virtual Instances, C++, Perl, Java, OSGI, Bash. Fundementally this is very similar to a fedora core 4 systems doing paravirtualization.

API Fun – What can it do

1. You can query and change both the router and the network module
2. Leverage Embedded Event Manager (EEM) to trigger events on changes, and react to network events.
3. Network Packet monitoring .. Sniff, Sniff, Sniff

My Questions –

1. How do I automate network updates, similar to YUM?
2. Is Cisco using KVM for paravirtualization?

Similar Posts:

• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Cool new features in 12.4(15)T
• Will Cisco succede where Sun has failed?
• User experience testing – enhanced
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Routers can email you when they go down

--Colin McNamara

Application Extension API notes – Cisco Live 2008

• And it begins again – On the road to my CCIE in Storage
• Featured on Network World – 20 useful sites for Cisco networking professionals
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Certguards inflamitory post about Ethan Banks removed from Network World Magazine

--Colin McNamara

Schwag at world of solutions, then off to margaritaville

In that spirit, my schedule is listed below. If you are in the area, it would be great if you would stop by and say hello.
“6/23/08″ “11:00 AM”"Certification Exam  –  Certification Exam”
“6/23/08″ “1:30 PM”"BRKCCT-1001  –  Contact Center Welcome Session: Focusing on the Experience”
“6/23/08″ “5:00 PM”"WoS Reception 1  –  Welcome Reception in World of Solutions”
“6/24/08″ “8:00 AM”"certification focus group  –  certification focus group”
“6/24/08″ “9:00 AM”"BRKITI-1031  –  Cisco Data Center 3.0 Strategy and Business Impact”
“6/24/08″ “10:00 AM”"GENKEY-1001  –  Keynote and Welcome Address with John Chambers”
“6/24/08″ “12:00 PM”"ITIPCS-1015  –  NetQoS: Getting the Most from Cisco WAN / Application Acceleration Technologies”
“6/24/08″ “1:00 PM”"BRKDEV-1221  –  Applying Cisco’s Nexus Operating System (NX-OS) and DCNM APIs to Emerging Data Center Infrastructure”
“6/24/08″ “2:00 PM”"BRKDEV-1001  –  Cisco Application eXtension Platform”
“6/24/08″ “3:00 PM”"GENSSN-1001  –  Super Session: The Power of Collaboration Panel”
“6/24/08″ “4:00 PM”"BRKSEC-3007  –  Solving Security Challenges with Embedded Event Manager”
“6/24/08″ “7:00 PM”"BRKAGG-2001  –  Multiservice Edge Architectures and Solutions for Service Providers”
“6/25/08″ “6:00 PM”"CCIE Appriciation  –  CCIE Appreciation part – Nascar Grill”
“6/25/08″ “9:00 AM”"BRKDEV-1111  –  Location Based Services using Cisco Location API”
“6/25/08″ “10:00 AM”"GENKEY-1002  –  Cisco Technology Keynote with Padmasree Warrior”
“6/25/08″ “12:00 PM”"ITIPCS-1019  –  Fluke Networks: General Parts Uses Embedded IOS Technologies to Successfully Manage Inventory at Retail Locations:
“6/25/08″ “1:00 PM”"BRKDEV-1051  –  ANA Technical Session and Demo”
“6/25/08″ “3:00 PM”"GENSSN-1002  –  Super Session: The Data Center–Evolution and Transformation:”
“6/25/08″ “4:00 PM”"BRKDEV-1131  –  Customer Voice Portal Application Development”
“6/25/08″ “8:00 PM”"Customer Event  –  Customer Appreciation Event”
“6/26/08″ “9:00 AM”"BRKITI-1034  –  Realize Business Goals through Network Architecture Solutions”
“6/26/08″ “10:00 AM”"GENKEY-1003  –  Closing Keynote Address and Guest Speaker, Ben Stein, Actor/Writer/Columnist”
“6/26/08″ “1:00 PM”"BRKCCIE-3003  –  CCDE: The Cisco Certified Design Expert”
“6/26/08″ “3:00 PM”"BRKDEV-1171  –  Managing  Network Performance using the New IOS Data Collection Services”
“6/26/08″ “4:00 PM”"BRKDEV-1181  –  Configuration and Provisioning using IOS  XML API”Similar Posts:

• Cisco Live 2009 – Networkers class schedule
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• It’s on like Donkey Kong – CCDE practical registration is open
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• About Colin McNamara
• Cisco Certified Design Expert – CCDE – officially released by Cisco

--Colin McNamara

I’ll be at Cisco Live 2008 (networkers) in Orlando all week

From the network world editors -

Network World and the authors have decided to remove this blog post and the discussion that followed. While the original post was intended to highlight how the issue of braindumps is a pervasive one, we regret having singled out anyone in particular and apologize for any accusations of cheating.

I hope that Ethan is watching the outflow of support for him, and puts his site back up soon.Similar Posts:

• Certguard, Ethan Banks, Network World and Common Sense
• Featured on Network World – 20 useful sites for Cisco networking professionals
• Cisco Nexus 4000 Blade Switch
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It
• Cisco releases Nexus 1000V virtual switch for VMware
• Usability features in Cisco’s Nexus 7000

--Colin McNamara

Certguards inflamitory post about Ethan Banks removed from Network World Magazine

This is the first step towards sitting for a practical examination that will hopefully be released this October. And, in response to Micheal Morris’s blog post – Yes Mike, I can pass the CCDE written.

The second big item on my todo list was to recertify my CCIE. Thankfully, Cisco counts the CCDE written towards my recertification requirements. I am waiting for the system to update, but I think this will set me up to be certified till June of 2011.

There is one interesting side effect of passing my CCDE written the week before networkers. I had originally planned on using the free exam at networkers as a “safety” exam in case I struck out on this attempt. Now of course, that is not necessary. Since I am already a CCIE, there isn’t much incentive to take a professional level exam.

So, after weighing my options, I have decided to take the CCIE Service Provider written. It covers much of the MPLS / IP Next Generation Networks material that I have been studying. I only have 7 days to prepare, so the odds are against me. However, with the heavy service provider focus in the CCDE blueprint, I have a feeling after I battle the CCDE practical I will be set to roll right into the CCIE Service Provider lab.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• My experience taking the CCDE Practical Beta
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• What does it take to pass the CCIE exam?

--Colin McNamara

Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

From Roberts article on networkworld

Ok, so Ethan doesn’t believe in violating the NDA that he had to sign umpteen times to get where he is now, but he’s promoting the use of Testking (a well known cheating tool) to “study” for his CCIE.

As a CCIE, I am obviously supportive of Cisco’s efforts to maintain the integrity of their (and my) certifications. And yes, Ethan was not exercising the best judgment by posting about Testking in a comment on his blog. Is that a reason to start a fire, and try to get his CCIE revoked? As a CCIE, my vote is a resounding no. While Ethan definately made a bonehead move, it does not change a couple things.

1. The CCIE written is just a gating exam, meant to limit the CCIE lab to individuals that have a chance (a notably slim chance) of passing the actual lab.
2. The CCIE exam, and its proctors are amazingly effective at weeding out cheaters. Yes, every once and a while a cheater manages to get through. But trust me, these guys get eaten alive when they look for employment.
3. Cisco has its own enforcement team and methods for finding cheaters, they have managed to keep Cisco certifications from devolving into the land of the MCSE. I think we should trust them to do their jobs, and more importantly trust their discretion.
4. Ethans site documented a very thorough preparation process as he walked the long road towards his CCIE. Sadly his site has been taken down, but in my opinion this shows that he put significant preparation in, and earned his number.

My take on things is that Ethan the target of a marketing scheme. From what I can see, Roberts efforts here are not focused on supporting Cisco’s certifications. It looks to me that he is trying to drum up traffic to his business. If you look at his products, there are $995 – $4,999 fee’s to become a “VIP site”. For your payment, you receive a seal of approval and a listing in the “VIP” area of his site.

Sadly, I have seen this scheme before in the photography world. Certain photographers have been known to set up review sites of other photographers. They build Google Page Rank (PR) on their site so they show up in searches relevant to their competition. Once they start showing up in those targeted searches they sell “VIP” listing or reviews. The photographers that pay up to become “VIP” members ensure that no bad reviews of their buisiness are put up on these sites.

Robert is running the same quasi extortion scheme, but for training vendors. I think this demonstrates a lack of integrity on Roberts part. There is no excuse for attempting to destroy Ethans name in order to make a few bucks. I refuse to condone his behavior and would hope that the editors at Network World feel the same and remove his blog from their site.

Ethan – If you read this, I hope you realize that me and others like me are on your side. You have obviously put stellar effort into both studying, and documenting your efforts. It is obvious to any reasonable person that you have earned the title of CCIE.Similar Posts:

• Certguards inflamitory post about Ethan Banks removed from Network World Magazine
• Featured on Network World – 20 useful sites for Cisco networking professionals
• It’s on like Donkey Kong – CCDE practical registration is open
• What does it take to pass the CCIE exam?
• Updated CCIE numbers
• Cisco Certified Design Expert – CCDE – officially released by Cisco

--Colin McNamara

Certguard, Ethan Banks, Network World and Common Sense

When I work with data center infrastructure I expect the following – clean, remotely manageable, secure devices that runs on the same power and similar cabling, and everything can have a 24x7x4 support contract for hardware replacement. For the most part, you get this when dealing with Cisco, HP, Sun and similar manufacturers.

More often then not (with a few very cool exceptions), when I run into video surveillance infrastructure the video management infrastructure runs on some random third tier manufactured server. It never fails that the video management software is on Windows (normally XP or win2k). I have even seen some systems where the vendor requires you to have a session open to run the software.

And then when you get to the encoders themselves, it never fails. You have two choices.

1. The Uber package that can run a Casino, Identify and track dust mites , and if you point it at space, determine if there is life on mars.
2. Individual dinky encoders that run one or two camera’s each. They have limited encoding choices, limited camera control, no remote management, and normally run on 110 volt system that require different power distribution then the 220 that is common in systems today.

Cisco’s answer to this mess

Cisco has released both a video management solution, as well as a video encoding solution in a network module form factor for the Integrated Services Router (ISR).

The first part of this system, the Video Management and Storage System (VMSS) module fills the following roles -

• Management of multiple video streams from one interface, including IP cameras, 3rd party encoders, and streams from Cisco’s video encoding module
• Streaming of live and archived footage through a web browser interface
• This one is pretty cool – The module can mount external storage via iSCSI. So, in addition to its 160 gig internal drive, you can mount a filer and utilize external storage to scale the system.
• “fast forward” to events, as well as notify security and other personnel through SMS and email

The second part of the system (the module on the left in the picture above) is the Analog Video Gateway Network Module (EV-IPVS-16A). It has a couple functions -

• It can take up to 16 analogue video inputs and encode them with MJPEG or MPEG4 codecs
• You can use the first two ports to output video to a external monitors
• If you are using MPEG4, it can be used as a motion detector (handy for fast forwarding to important events, or triggering alerts)
• It can control pan and tilt cameras. This is good for pointing the camera at the janitor unplugging your servers each night to vacuum
• You can configure analogue contacts as an alarm. This can be bound to a door switch, or even temperature and water level monitors in a remote data center. This one will be very handy.

The third part of this solution is Cisco’s Video Surveillance Operations Manager. It manages, archives, displays and distributes the content that was created and collected on the two previous modules. You would use this if you had many branches to aggregate, or needed to staff a video wall (e.g. casino gaming commission operations). Now, you can run each of these components individually. Buy run together as a whole, Cisco has an enterprise class security solution.

Want to learn more ?

Branch office security page on cisco.com http://www.cisco.com/en/US/products/ps9671/prod_module_series_home.html

Cisco’s product page for the Video Managment Module – http://www.cisco.com/en/US/prod/collateral/modules/ps9671/data_sheet_c78_462225.htmlSimilar Posts:

• Interesting TechWise TV episode on virtualization
• About Colin McNamara
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

1. Layer 2 Tunneling Protcol (V3) static and hairpin configuration example - my buddy Rick was nerding it out in the lab and sent a great configuration doc for L2TPv3 my way. L2TP(V3) is used to create a layer 2 psuedowire across layer 3 routed links. This is a great service provider tool that you can use in your own network, no MPLS needed .

2. SNIA Education – Fiber Channel Over Ethernet – There is a lot of buzz going around right now about Fiber Channel Over Ethernet (FCOE). There is also a lot of misunderstanding about the fundamentals of this architecture. This Storage Networking Industry Association (SNIA) does an outstanding job of covering FCOE at both at an architectural level, as well as going over low level messaging structures.

3. Trill (Rbridge) architecture – IETF internet draft – I think the last time I was this interested in an internet draft was when iSCSI was first being proposed in the IP Storage working group. Trill, in my opinion is basically a light weight version of MPLS / VPLS. It has as far as I can tell most of the advantages of this architecture, without some of the configuration and hardware requirement drawbacks. Fair warning, reading this document started a doc hunt that killed my Saturday.

4. Cisco’s Security Response to Sebastian Muniz’s IOS rootkit – Security is a very important aspect of network design. Sebastian’s IOS rootkit demonstration is going to force some customers who in the past have been “OK” with having older, possibly vulnerable IOS versions floating around to update their operational practices and start keeping their routers and switches operating systems as often as they do their servers. Thankfully, Cisco has been embracing technologies such as kernel virtual machines, in service software upgrades and more to lesson or remove the impacts of software upgrades.

5. Turning Wounded Warriors into Network Ninja’s – As a former Marine (well, always a Marine, formerly employed by the USMC) this program goes straight to the heart. Cisco is partnering with Naval Medical Center San Diego (NMCSD, or Balboa Naval Hospital for us locals) to provide technical training to Marines and Sailors who have recieved service ending wounds in Afghanastan and Iraq.Similar Posts:

• Fibre Channel over Ethernet is taking off
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Zone based IOS firewalls
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Link Round Up – L2TPv3 FCOE Trill Wounded Warriors

Please join me in welcoming John McCool to his new position as the leader of (in my opinion) Cisco’s most strategic business units. Similar Posts:

• Thanks and farewell to Jayshree Ullal
• Jayshree Ullal takes the helm of Arista Networks
• Cisco Nexus 4000 Blade Switch
• How to succede in 2007 – By Tim O’Reilly
• Certguard, Ethan Banks, Network World and Common Sense
• BIG Cisco – VMware announcement – 1:30 Pacific time

--Colin McNamara

John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)

This switch answers a fundamental problem that has been presented by blade centers and VMware. The problem is increasing density of 10 Gig Ethernet, as well as the creation of SAN islands to provide storage access to VMware ESX clusters.  The nexus 5020 provides a solution that address both of these challenges, as well as supporting Fibre Channel Over Ethernet (FCOE) for the eventual move to a consolidated data center fabric in the years to come.

Want to learn more ?

Mastering VMware Infrastructure

Nexus 5020 Video Data Sheet

Unified Data Center Fabric whitepaperSimilar Posts:

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 4000 Blade Switch
• Fibre Channel over Ethernet is taking off
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel

IOS-XE is takes the best elements out of Internet Operating System (IOS) which has its roots in a closet at Stanford, and combines them with the most successful open source technology ever – Linux. Cisco is leveraging Linux virtualization technologies such as Kernel Based Virtual Machines to protect against operating system failures as well as to allow for In Service Software Upgrades (ISSU).

To really appreciate this, we first have to dive down into the overall architectural changes of the ASR1000. The largest change that Cisco has made was to implement separate forwarding and control planes. In the past, Cisco routers would have the processes responsible for forwarding traffic, and the processes responsible for configuring the router running on the same root operating system. The side effect of this is that if you want to upgrade the root operating system of your router, you are going to have interrupt the traffic flowing through it to do so, or have a physically separate route processor to take over while you rebooted. This is a big headache operationally, and effectively forced engineers to design in separate physical chassis to meet high uptime requirements.

What Cisco has done to address this, was to mirror changes made in their storage and carrier routing portfolios. Both of those product lines utilize the operating system to push commands into advanced processors that exist on the line cards themselves. The ASICS on the line cards are designed to work in a distributed fashion, so that production traffic never goes into up into the router processor (or sup engine). This in effect ensures that the control and forwarding planes can exist as independent elements.

If you look at the graphic above, you will notice 3 main zones. The upper zone is what we would normally describe as the control plane. This is where the higher level functions such as your routing processes, ssh daemons, snmp daemons, and shells live. In short, if you you configure or read something, you are going to do it here. The only time traffic flows through this plane is when you are doing a thing called process switching. keep in mind this is a rare occurrence and usually occurs because of an oversight in your network designs.

By separating the control and forwarding planes, this allows Cisco to basically run a management station on the router, that programs chip sets in the line cards on the fly. This in my opinion is where the true power of this architecture comes through. By separating the two functions the software engineers are free to utilize powerful open source technologies such as Kernel-based Virtual Machines, and the Linux kernel, while letting the integrated circuit engineers design blazing fast chips which allow full functionality at line rate.

What benefits should we receive from a virtualized control plane? First, in larger routing and switching chassis (including the top end of the ASR1000 line) you normally have physically redundant route processors (RP)/ supervisory engines(SUP). The operating systems on these RP’s synchronize many things, including configuration, process state, routing tables, security associations and much more. The primary reason for this, is if you have a failure in the active RP, you can failover to the standby RP without interrupting traffic flows.They also can be used to streamline the software upgrade process by only upgrading one RP at a time, and then gracefully transferring traffic to it. Once proper operation is verified, the backup RP can be brought up to the same code revision.In any production environment this is highly desirable, and helps immensely in the battle for five nines.

The ASR1000 takes the redundant RP concept seen in high end chassis, and allows you to implement redundant upgrades, as well as protection against software failure, with only one physical route processor. This is done by utilizing Linux kernel virtualization. Instead of running the control plane directly on the production hardware, a small kernel is inserted. Booting from that are two copies of IOS-XE. These run independently, and synchronize state and configurations just as if you had two physically separate route processors. What this means in operational English, is that where in the past, you would have to either have two devices, or a larger device with redundant RP’s to upgrade without disruption, you can now have that same ease of maintenance, in a much smaller (and at the end of the day, less total cost) package.

Below this is the forwarding plane.It plugs into to a high speed interconnected fabric which all line cards and RP’s are redundantly connected to. In the diagram above, this is the bottom level. Items in this plane include buffer memory, Cisco Express Forwarding (CEF) ASICS, and now the new QuantumFlow processor. This is normally where you would find your DCEF enabled line cards, fibre channel and Nexus7000 line cards, as well as the modules for the ASR1000 routers. When properly utilized, traffic should be relatively isolated to this tier, and function independently from the control plane.

The shining star of the ASR1000′s forwarding plane is a group of chips that is referred to as QuantumFlow. The QuantumFlow architecture itself merges Cisco’s strength in integrated circuit design, with its strengths in IOS software design. In the past, Cisco would design ASICS’s for specific functions, and then write commands down into them. This has worked very well, until they point that a new feature came out that couldn’t leverage the fixed configuration of an older ASIC. Your choice at that point was generally to process switch for that feature (which is slower, and honestly bad form), or upgrade your cards to the newer ASIC design. The QuantumFlow chipset approaches this problem from a new angle. The first chip in the set (Popeye) is designed to be field programmable in C, as well as no fixed internal pipelines. This combined with utilizing 40 cores running between 900 and 1200 megahertz allows the programmers to utilize parallel processing techniques to utilize an immense amount of processing power in real time.

To put things into perspective, remember when you got your first multi core laptop or desktop. You were able to say watch a DVD, as well as compile code at this same time, while continuing to have a responsive workstation. Now imagine what you could do with a 40 core processor. This is the kind of power that we are talking about. Now imagine, that not only is your workstation immensely powerful, but you could also offload common jobs such as running daily builds, or encoding videos to another machine (or in this case processor.

In the ASR1000 this processor is called Spinach (yellow are in the graphic above). And of course just like the cartoon, Popeye’s potential really comes to light when combined with Spinach. Spinach is a separate chip, that is used a a traffic manager. This chip handles queueing and quality of service, ensuring that the proper packets arrive at the proper time, as well as interconnecting with cryptographic offload engines so it can equally apply services to encrypted flows.

At the end of the day, the most important question is not how fast something is, or how cool it is. The question is what can it do for me? By leveraging this new architecture the ASR1000 is now able to do line rate inspection of traffic using Network Based Application Recognition (NBAR), Support 128,000 queues for deep quality of service, secure and encrypt data using zone based firewalls and embedded crypto engines, segregate traffic using MPLS, integrate advanced voice and video functionality, as well as providing fulling Netflow v9 support for all of the above. It provides all of these services in an always on solution utilizing Linux virtualization, as well as leveraging an flexible chip set architecture that allows for field programmable improvements in the future.

My hope is that after reading this article that you are in a better to understand how Cisco is leveraging open source technology and integrated circuit designs to improve the foundation of the internet. In upcoming articles I will be discussing design scenarios utilizing this features in this product, as well as highlighting other areas where Cisco is embracing both open source technology, as well as open architectures that can properly leverage projects such as Linux, Ntop, Wireshark and more. If this article has you interested in learning more about some of the technologies mentioned today, then I encourage you to check out some of the links below, or shoot me and email to be highlighted in a future readers questions article.

Learn more about Linux Kernel-based Virtual Machines

Learn more about Cisco’s ASR1000

Learn more about Cisco QuantumFlowSimilar Posts:

• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Application Extension API notes – Cisco Live 2008
• Zone based IOS firewalls
• Arista Networks – Their approach to cloud networking
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

--Colin McNamara

Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

Mike Writes -

“Hi Colin,
I’m an avid reader of your blog and had a question that I figured you could answer. I don’t have CCIE knowledge like I’m sure a lot of your readers do. I have worked for the same company for 6 years and during that time had been promoted into the Network Group where I was sent through class and earned my CCNA. The company I worked for decided to relocate across the country and so I have been looking for a new job. Finding a new job doesn’t seem to be that big of a deal but I noticed a lot of job descriptions are asking for BGP experience. We didn’t use BGP at my last job and I thought BGP is used primarily by ISPs for routing between Autonomous systems? If that is the case why do so many non-ISP companys list BGP experience in Networking job descriptions? What are they doing with it? Shouldn’t the ISP be doing the BGP routing for them?
Thanks!
-Mike”

Well Mike there are 3 primary reasons why a company would require (or want) BGP knowledge from its candidates.

Scenario 1. The company has an redundant Internet edge.

In this case lets call our company sample_company. Sample_company has its website hosted in a publicly facing DMZ and wants to make sure that its web servers are available in the case of an ISP failure. Normally in this case the company would request and Autonomous Systems Number (ASN) from ARIN and would get assigned a block of publicly routeable IP address’s (normally /24) that they can advertise. Sample_company would then peer with multiple ISP’s for example one connection to AT&T and the other to Sprint. Sample_company would advertise their ASN through both these ISP’s, and in the case of a failure of one of their ISP’s, the rest of the Internet would be able to calculate a path to sample_company’s web servers via the backup ISP.

Scenario 2. The company is utilizing MPLS for its WAN connectivity.

From a customer perspective MPLS is a private BGP based WAN where all edge devices connected to the MPLS provider utilize BGP to inject and learn routes. One note, some providers do support advertisement of routes via OSPF and even EIGRP now, but the most common scenario is to use BGP as your internal WAN protocol while running MPLS. One trend I am starting to notice, is that since companies are already using BGP on the MPLS WAN, they have started utilizing BGP as their primary routing protocol for their sites to avoid running multiple routing protocols and having to redistribute into BGP to cross the WAN.

Scenario 3. The company is using MPLS inside their data centers for segregation of business units.

In essence they are using the same tools and technologies that MPLS service providers are, however applying it inside of their data center and campus networks. In this case, BGP is the routing protocol necessary to carry the routes between the seperate MPLS VPN’s that are running inside the corporate data center. While this sounds pretty complicated, it actually simplifies many of the designs that you would normally implement to attain the same goals.

Learn more about BGP - Of course, there are many other reasons why you may see BGP on a job listing, but I think the previous covers the most common. If you are curious, and want to learn more about BGP I recommend buying Routing TCP/IP volume 2 by Jeff Doyle. This covers many great scenarios and configuration examples in EGP protocols. It is also written in plain English which can be a challenge with many technical books.

Learn more about MPLS in the enterprise - If you are feeling like learning about how you can implement MPLS inside of your own enterprise network then I would recommend buying Network Virtualization by Kumar Reddy and Victor Moreno. I was lucky enough to have Rick Davis translate the whole idea of utilizing MPLS in a campus environment into plain English for me a couple years back. From that point I was able to really expand my knowledge base and start asking the right questions from a firm foundational understanding of the technology. Kumar and Victors book took my understanding to the next level, showing how to incorporate many very cool features to make a MPLS network stand on its head if you want to. I can say (and actually have said to Kumar Reddy) that this book redefined my data center designs for large corporate and enterprise customers. I really recommend that you add this to your collection.Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Identity aware networking using Cisco TrustSec
• Challenges integrating VMware into Cisco networks
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Jayshree Ullal takes the helm of Arista Networks
• Arista Networks – Their approach to cloud networking

--Colin McNamara

Reader question – Why are corporations looking for BGP experience?

For new readers to this site, please you might enjoy the following articles -

Who is Colin McNamara ?

Usability features on the Nexus 7000

Overview of NX-OS 4.0 (the operating system for the Nexus 7000)

Why did I choose to get a CCIE in storage networking?

What does it take to pass the CCIE exam?Similar Posts:

• And it begins again – On the road to my CCIE in Storage
• What does it take to pass the CCIE exam?
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco Nexus 4000 Blade Switch
• created a new map of ashley’s site
• Certguards inflamitory post about Ethan Banks removed from Network World Magazine

--Colin McNamara

Featured on Network World – 20 useful sites for Cisco networking professionals

As with any vendor specific event, there is a mix of for public knowledge and for private consumption content, so I generally choose not to talk or write about subjects that may have been covered in the VT unless I can find some public documentation on that subject. So don’t expect to find any juicy pre-release information or gossip here. I don’t want to have the NDA police knocking at my door, and its just not cool to let stuff slip. So, I will generally avoid the subject.

What I can tell you is this – There is a lot of buzz about the Nexus 7000. It is a rocking platform, and we spent the majority of a day going over it. I can’t share much more then I did the night before the VT just yet (will wait till I get lab access to one) but I can share this.

Yes, most people are proud of their shots with Tom Cruise, or Oprah, Richard Stephens or BSD Girl. But I can Top that.. I have a picture of me and the Nexus 7000.

The DC Channels team was nice enough to take us down to the DataCenter and Network Applications (DNA) lab. Where the Nexus 7000 has taken its new throne. They allowed to ooh and ahh and poke and prod it. Weirdly enough, the one thing that struck most was the attention to detail that went into the physical design of this chassis. It is not only good looking, but has some super usability enhancements that really impressed me.Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Where was Colin in 2010?
• Cisco releases Nexus 1000V virtual switch for VMware
• Humor inside the Nexus 5000 switch fabric architecture
• BIG Cisco – VMware announcement – 1:30 Pacific time
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

--Colin McNamara

Me and the Nexus 7000 last week at the Data Center VT

GoDaddy, one of the nations largest registrars and hosting providers is distributing bloated and possibly insecure code that will cause the average user to more then double their hosting costs. In the pages below you will learn exactly what GoDaddy is doing to your server, how their support staff will try to upsell you, and the steps you need to take to ensure proper operation of your Virtual Dedicated Server.

Background

One of my new years resolutions this year was to consolidate hosting accounts into one virtual server (hosted). I had my domains, and my old hosting with Godaddy already so it was a no brainer to try out one of GoDaddys VDS (Virtual Dedicated Servers).

I went with their 29.99 a month package, with Centos5, unlimited domains, 10Gb disk, and 256 MB of memory. This should be perfectly fine for hosting a couple MySql driven sites, and a couple gallery instances. Let me emphasise this is only handling 4 active domains, two of which only have static HTML.

Provisioning was a breeze, from order to shell account only took 4 hours. I was provided with shell access, pre-configured yum repositories, and this web control panel – simple control panel, or TurboPanel (seems to have two different names). I was able to pop into GoDaddy’s control panel interface with a direct link from their server manager console, and was setting up domains in no time. (Let me throw this caveat out though, don’t buy this product for your mom’s hosting…. the documentation is horrible, and by horrible I mean non-existant).

So I get my server all set up a couple weeks ago, transfer all my files from 2 Cups Solutions and set up my new www.colinmcnamara.com site. Things go just fine, I changed over to wordpress as a CMS and am totally thrilled. My applications and email are working perfectly. Plus, I have a shell account at GoDaddy which is a very handy thing to have as a network engineer. Things are going so well, that I give my buddy Rick a Christmas present and get ricksdavis.com and el-cinco.net for him, and host it on my GoDaddy VDS.I go ahead and purchase the domain through godaddy’s domain manager. This is obviously GoDaddy’s core competency, and goes flawlessly as usual. Next step, I go into the Turbo Panel web interface. Let me give you a little background on TurboPanel. This is the “free” equivalent “to plesk or cpanel. It is actually ok for automating your domain provisioning, though if you are a normal skill level user, I would recommend paying the extra 9.99 a month for Cpanel.

Server Error

I open up my TurboPanel interface and go to provision ricksdavis.com into the domain manager. It comes back with the least descriptive error I have ever received.

Server Error
We are sorry, the system has encountered an error while processing your request.

Home

If you continue to receive this error, please contact your system administrator.

Your URL: /domain/edit.do

Error details:

CommandFailedException: Unable to get min/max uids
at c.g.t.f.systems.user.LinuxUserSubsystem.loadUids:825
at c.g.t.f.systems.user.LinuxUserSubsystem.getMinUid:780
at c.g.t.f.systems.user.LinuxUserSubsystem.loadUserInfo:670
at c.g.t.f.systems.user.LinuxUserSubsystem.getUserInfo:646
at c.g.t.w.actions.domain.ActionDomainEdit.process:84
at c.g.t.w.actions.AbstractSpringAction.execute:118
…
at c.g.t.w.filters.AuthorizedResourceFilter.doFilter:38
…
at c.g.t.w.filters.RequestPopulationFilter.doFilter:117
…

This is the most descriptive error ever right? it tells you what is wrong, has a link to the support system, and gives you actionable information…. I would say a resounding NO. This is a classic example of why friends don’t let friends program in Java. When I got this error last night, I was scratching my head. As an engineer, the first thing I will look at is the last change to the system. Coincidentally I had installed awstats two nights before, and looking at my change logs, I saw that I had upgraded my perl version. So, with no fast response to the support email from GoDaddy I chose to put in a server re provision request (fully automated) and restore from my backups. That process took about an hour, but afterwards I was back online with no errors. Eureka! I found it (I thought). I provisioned Rick’s domain, wordpress, gallery2 etc and then went to bed.

GoDaddy Support Response

Fast forward to this morning, and I finally recieve an email reply from godaddy support. The email is pasted below-

(I have replaced the agents name with John Doe. Tech support is a hard job and I see no reason to highlight him specifically)

Before re-provisioning the server, I went ahead and tried the old three finger salute (reboot) the error still existed. So even if this email would have came to me on time, it would not have helped.

But that is besides the point. lets dig into the solution

The agent suggested the following fix -

Restart tomcat – which I was NOT using for any of my web applications (not an ejb guy)

/etc/init.d/tomcat55 restart

Restart TurboPanel (or simple control panel now – they haven’t updated their init scripts)

/etc/init.d/turbopanel restart

GoDaddy tried to upsell me, instead of fixing their code

He gives the standard, run less stuff on your server speech (remember, I only have 4 domains on this server)

Now here is the kicker – To remedy this issue long-term, you could either setup a server with 512mb RAM, or upgrade to a Dedicated server.

What the heck is with that? I should not need an upgrade with only 4 domains on a server. Especially when in the setup the default Cpanel implies support of 30 domains. Is this Tech Support or a Sales Call?

But, since my server was working fine I don’t pay much attention to the email and move on with my life.

Fast forward an hour, and I am show Rick how to access all the features of his new site, and I figure that I need to change an email account on his domain to forward to his old account. Fine, this should take two minutes. I log onto the TurboPanel interface to put the email forward in.. and there it, a big useless error screen. What the heck is with that?

So this time I actually read the email, and try the fix. Results = nothing. GoDaddy offers shell access so I log in, run top and filter for %memory used. Low and behold, there is only 8142 bytes of memory free, and a Java process owned by root is using 300Mb of virtual memory, and 132Mb of real memory, and Tomcat is using 115Mb of virtual memory and 86Mb of real memory.

Let me translate this into English – Godaddy’s control panel application was using 218 Megabytes of the 256 Megabytes of memory I had purchased. That left me with 34 Megabytes of memory . Let me clarify this, I had paid for a virtual server with 256Mb of ram, up to 1000Mb bursted (which I think is their code for swap). I am only running 4 domains on this server, and two pop3 email servers. This should not be a problem.So what is the cause of the problem? I can sum it up, crappy Java programming. Someone decided to write this program in Java (probably easier to outsource) instead of optimising it to run on lean systems. Their code effectively takes up all the available memory. And on top of that, they are are running a webserver process as root… yes as root. It is like asking for your server to get hacked.

Now, that I am done ranting, let me highlight how to fix this problem.

If you are on Windows use the following procedure to get shell access to your GoDaddy VDS -

• you will want to download a ssh client called putty – Download Here
• Copy this file to your desktop, double click putty.exe , and you should see something like this -

• In the host name field I have www.yourdomain.com . replace yourdomain with your domain name.
• Click on the open button on the bottom right, and a shell should pop up, along with a warning that looks like this (you can click OK to the warning)

• Now skip past the linux section

If you are running Linux or Unix start here -

• Open up a command line terminal
• ssh using your godaddy simple control panel username example -

ssh your-godaddy-control-panel-username@www.yourdomain.com

• If this is your first time connecting to this server, you will be prompted to accept an unkown ssh key into known_hosts, choose yes to accept

Both Windows, Linux and Unix Continue Here –

• Enter your the password you use to access your GoDaddy Simple Control Panel Interface
• You will be presented with what looks like a DOS window, this is called a secure shell terminal. Type in the username you use to access your Godaddy Simple Control Panel and then hit enter

• Now type in the password that you use to access your Simple Control Panel Interface and hit enter

• Congratulations, if you see the window below you are now shelled into your virtual dedicated server.

Change to the Root user

• Now that you are shelled into a Linux device you need to escalate your privileges to get administrator level access. In the Unix world this user is known as Root. You can change to this user, and get full system privileges by using the following command.

su – root

• You will be presented with a password prompt, enter in the same password that you have used to log into your Simple Control Panel Interface
• You are now root, be careful with what command you enter under this user, as you can do some damage if you are careless

Clean out your servers memory

• Most recent Redhat direvatives (including Centos) utilize a tool called yum to add and remove packages. This is also true with your linux servers at GoDaddy.
• you need to install a tool called memhog, it is part of a package called numactl that is normally used to assign specific process’s to specific cpu’s in a multi-core system. We will be using it today to fix GoDaddy’s memory hogging application

yum install numactl

• choose yes to all the prompts, and numactl will automatically be downloaded and installed on your server

Stop GoDaddy Simple Control Panel, and Tomcat, and tell them not to start automatically when your server restarts.

• Tomcat is a special type of webserver for Java based applications. Godaddy uses it to run their control panel interface. 99.99999 percent of users will not need to use Tomcat. If you do need to use Tomcat then you are a technical user and will know what to do.
• In Linux, server applications are called daemons. The are executed by init scripts. We will use these scripts to turn off these server applications
• Turn off the TurboPanel daemon ( this is the process that runs your simple control panel web interface

/etc/init.d/turbopanel stop

• Next we need to turn off Tomcat

/etc/init.d/tomcat55 stop

• Now that we have these services turned off, we need to make sure that they don’t come back when we reboot the server. We can do this by using the chkconfig command.
• Stop the Simple Control Panel Interface from starting automatically by executing the following command

chkconfig turbopanel off

• Stop the Tomcat server from starting automatically by executing the following command

chkconfig tomcat55 off

Clean the mess GoDaddy made of your servers memory

• A couple steps back we installed numactl. The executable we wanted out of this package is memhog. Issue the following command to take your memory back. This command will overwrite 200 megabytes of your memory, allowing the rest of your applications to get access to that memory.

memhog 200m

• This will Clear out the memory that GoDaddy’s application took over, and allow the rest of your daemons to run fine.

Great, my server is running better now. But I want to use my Simple Control Panel Interface. How do I do that?

• Easy, all you need to do is temporarily start the turbopanel daemon. When you are done making changes, you can turn it off again

/etc/init.d/tomcat55 start

/etc/init.d/turbopanel start

• When you are done, don’t forget to turn it off

/etc/init.d/turbopanel stop

/etc/init.d/tomcat55 stop

*** UPDATE *** *** UPDATE ***

I managed to stay with Godaddy and use their Virtual Dedicated Servers for 12 months. However I have moved to a new hosting provider (rimuhosting) in the spring of 2009. My last straw with GoDaddy occurred when I noticed that even with my memory utilization under control my applications were performing poorly. I shelled into verify and found that the virtual disk I/O was severly limited.

Performance issues –

Simple command to determine directory size on GoDaddy VPS

[root@ip-72-167-15-128 home]# time du -hs
1.3G    .
real    0m49.013s
user    0m0.011s
sys    0m0.062s

Simple command to determine directory size on Rimuhosting VPS
[root@colinmcnamara home]# time du -hs
1.3G    .
real    0m0.343s
user    0m0.050s
sys    0m0.290s

Translated into english, it took 49 seconds to execute a simple command on my GoDaddy server, and it too 0.34 seconds (under 1 second) to execute the same command on my virtual server at Rimuhosting.

On top of that, I was paying $32 dollars a month to GoDaddy for a server with 256 megs of ram as well as a FTP backup account. When I created my short list of hosts, I noticed that I was not getting the best deal by staying with GoDaddy.

Pricing at Rimuhosting

• Virtual Dedicated Server 190 Megabytes RAM – $19.95
• Virtual Dedicated Server 400 Megabytes RAM – $29.95
• Virtual Dedicated Server 900 Megabytes RAM – $39.95
• Virtual Dedicated Server 1150+ Megabytes RAM – $49.95

One thing you may notice, is that for the same price as the base GoDaddy VDS ($29.95) you get 400 Megabytes of RAM instead of 256. (and they won’t put on a memory sucking turbopanel app) On top of that, things that I had to pay extra for at GoDaddy such as backup space, backup mail relays, and DNS service came bundled for free.

I made the choice to move to Rimuhosting, and the service has been superior to GoDaddy in every single way. If you get sick of GoDaddy like I did, you might want to check Rimuhosting out, I think you’ll like them.Similar Posts:

• What should I do this thanksgiving break?
• Zone based IOS firewalls
• Routers can email you when they go down
• New features in VMware 3.1
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Identity aware networking using Cisco TrustSec

--Colin McNamara

Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It

For the engineering perspective on this, the CCDE is equivalent  to the CCIE. However, the CCDE is focused on design and architecture rather then implementation. Where the CCIE (R&S, Voice, Security, Service Provider, Storage) is focused on implementation, the CCDE is focused more on the pre-sales design and architecture efforts. I am personally looking forward to the lab being released, as it provides a certification to validate the skill set needed to be an sales engineer on Enterprise accounts, or to be a network architect at an Enterprise corporation.

It is funny how small a world it is. Eplus (the company I work for) CEO – Phil Norton was quoted on Cisco’s press release -

“Certifications provide a stamp of approval that validates the quality of our organization’s employees,” said Phil Norton, chairman, CEO and president of ePlus. “The CCDE isn’t about operations; it’s about recognizing the value of network designers and honoring their core skills that provide a real value to our business and our customers.”

My gut feel when I first got invited to the CCDE beta program was that this will become a requirement for the Channel. I think Phil’s statement cements that gut feel into a reality. Obtaining a CCDE will become similar to the CCIE – a check box that you must attain to work with the top VAR’s out there. This makes me extremely grateful that I was lucky enough to be invited into the beta group to be allowed first crack at this gem of a certification.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Are you a kick ass engineer looking to grow?
• Challenges integrating VMware into Cisco networks
• About Colin McNamara

--Colin McNamara

Cisco Certified Design Expert – CCDE – officially released by Cisco

• Russ White – CCDE interview – Part 2
• CCDE Practical – Beta candidate deadline August 1 2008
• My experience taking the CCDE Practical Beta
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

--Colin McNamara

Russ White – CCDE interview

Though CCIEs are members of an exclusive group, they can be found in countries on every continent. Use the map and tables below to discover your peers around the world.

Americas EMEA Pacific Rim Africa Asia Cana Europe Middle East Pacific Islands South America United States

Total of Worldwide CCIEs:		15658 (last updated 11.14.2007)
Total of Routing and Switching CCIEs:		14329
Total of Security CCIEs:		1207
Total of Service Provider CCIEs:		650
Total of Storage Networking CCIEs:		99
Total of Voice CCIEs:		601

Multiple Certifications:

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• What does it take to pass the CCIE exam?
• About Colin McNamara
• Cool new features in 12.4(15)T
• And it begins again – On the road to my CCIE in Storage
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

--Colin McNamara

Updated CCIE numbers

Cisco has finally included zone based firewalling in the IOS firewall feature set. The configuration guide can be found here -

Zone Based Firewall Design and Configuration Guide

The things that really got me interested are -

1. It is VRF aware (works well with network virtualization strategies)
2. No more CBAC’s
3. Policing built into firewalling classes
4. Content inspection including HTTP,P2P, and Instant Messenger

I think the biggest plus for this release is that IOS firewalls are finally following the general trend of zone based firewalling. By moving this way, configuration errors resulting in lax controls are likely to be minimized.

Excerpts from the documentation -

Cisco IOS Software Release 12.4(6)T introduced a new configuration model for the Cisco IOS Firewall feature set. This new configuration model offers intuitive policies for multiple-interface routers, increased granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall zones until an explicit policy is applied to allow desirable traffic.

Nearly all firewall features implemented prior to Cisco IOS Software Release 12.4(6)T are supported in the new zone-based policy inspection interface; supported features are as follows:

•Stateful packet inspection

•Application inspection

–HTTP

–Post Office Protocol (POP3), Internet Mail Access Protocol (IMAP), Simple Mail Transfer Protocol/Enhanced Simple Mail Transfer Protocol (SMTP/ESMTP)

–Sun RPC

•VRF-aware Cisco IOS Firewall

•URL filtering

•Denial-of-service (DoS) mitigation

Zone-based policy firewall generally improves Cisco IOS performance for most firewall inspection activities.

The only Cisco IOS Firewall features that are not supported in zone-based policy firewall in Cisco IOS Software Release 12.4(6)T are as follows:

•Authentication proxy

•Stateful firewall failover

•Unified firewall MIB

Zone-based policy firewall completely changes the way you configure a Cisco IOS Firewall.

The first major change to the firewall configuration is the introduction of zone-based configuration. Cisco IOS Firewall is the first Cisco IOS Software threat defense feature to implement a zone configuration model. Other features might adopt the zone model over time. The classical Cisco IOS Firewall stateful inspection/context-based access control (CBAC) interface-based configuration model employing the ip inspect command set will be maintained for a period of time, but few, if any, new features will be configurable with the classical command-line interface (CLI). Zone-policy firewall does not use the stateful inspection/CBAC commands. The two configuration models can be used concurrently on routers but not combined on interfaces; an interface cannot be configured as a security zone member as well as being configured for ip inspect simultaneously.

Zones establish the security borders of your network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of your network. Zone-Policy Firewall’s default policy between zones is to deny all. If no policy is explicitly configured, all traffic moving between zones is blocked. This is a significant departure from stateful inspection’s model, in which traffic was implicitly allowed unless it was explicitly blocked with an access control list (ACL).

The second major change is the introduction of a new configuration policy language known as CPL. Users familiar with the Cisco IOS Software Modular quality-of-service (QoS) CLI (MQC) might recognize the format being similar to QoS’s use of class maps to specify which traffic will be affected by the action applied in a policy map.

Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Cool new features in 12.4(15)T
• Identity aware networking using Cisco TrustSec
• Routers can email you when they go down
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Zone based IOS firewalls

Hell has frozen over, you now no longer need to explicitly configure peers in a BGP configuration. You now can set up peer group templates that allow connections from a range of ip address’s. This has a multitude of implications. The main scenarios that I can think of are -

1. dynamic configuration of peers in a fully bgp enabled datacenter (replacement for eigrp / ospf)
2. dynamic advertisement of host routes from servers

Other cool things include tracking of SSO status in hsrp / glbp groups and an embeded syslog manager which allows you to have full filtering capability on device without needing an external server. I see this will be great for troubleshooting.

Colin McNamara
CCIE #18233
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Routers can email you when they go down
• I found a great tutorial on PHP + MySQL+Flash integration
• New features in VMware 3.1
• PHP / MySQL / FLASH website integration
• The emergence of MDS features in Cisco’s datacenter networking equipment
• Cool new features in 12.4(15)T

--Colin McNamara

Cool new features in 12.2(33)SXH

http://www.cisco.com/application/pdf/en/us/guest/products/ps6555/c1161/cdccont_0900aecd805456f7.pdf

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• I found a great tutorial on PHP + MySQL+Flash integration
• San Diego Maternity Photographer
• San Diego WildFIre Update
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?

--Colin McNamara

Great TCL and EEM preso found on IOS hints and tricks -

Link – http://www.cisco.com/application/pdf/en/us/guest/products/ps8258/c1161/cdccont_0900aecd80679ce3.pdf

From Cisco’s site -

Cisco IOS Software Release 12.4T integrates a portfolio of new capabilities, including security, voice, and wireless, with powerful hardware support to deliver advanced services for enterprise and access customers. It will be issued as a series of regularly scheduled individual releases, which Cisco will ultimately consolidate to form the next major release.

Release 12.4(15)T, the sixth release of the 12.4T family, streamlines the Cisco IOS Software upgrade process, provides sub-second link failure detection and faster convergence, delivers next-generation Layer 2-7 flexible packet classification, enhances intrusion protection and SSL VPN capabilities, and provides support for the new Cisco 7201 Router, amongst other features.

Like all releases in the 12.4T family, Release 12.4(15)T integrates innovations that span multiple technology areas, including Cisco IOS Security, Voice, Cisco IOS Infrastructure, Access, High Availability, Management Instrumentation, Quality of Service, IP Multicast, Broadband, IP Routing, and IP Services. Release 12.4(15)T delivers these integrated technologies on the broadest range of hardware in the industry, including the Cisco Integrated Services Routers, Cisco 7200 Series, and Cisco 7301 Router.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• The emergence of MDS features in Cisco’s datacenter networking equipment
• About Colin McNamara
• Application Extension API notes – Cisco Live 2008
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• New features in VMware 3.1

--Colin McNamara

Cool new features in 12.4(15)T

For those that have been watching, there has been a trend of helpful MDS (Cisco’s director class storage switch) features into core networking products. The first feature I have noticed is the “do” command now available in configuraiton mode in ios 12.4. It allows you to execute exec commands from the configuration section in IOS. Needless to say this is very handy, primarily due to not having to exit to your shell to do a show command.

Things like that make me very happy. They decrease the time needed complete tasks, and improve your accuracy.

One of the features that I have always loved with the MDS is call home. It is a deamon that monitors the hardware and software for faults, and when one is found it posts an email to TAC and your support staff.

This feature now has made it into the 6500 series switches as of 12.2(22)SXH which should be out mid August. It will integrate directly with Cisco TAC, and your own internal Monitoring and management systems. The really cool thing is that this ties right into the GOLD (Generic On Line Diagnostics) tests. If your GOLD tests find a hardware problem TAC will automatically be contacted, a RMA issued, engineer contacted, and parts shipped to the devices location. The target for this is SmartNet time + 1.5 hours. So if you had 4 hour smartnet, you could expect hardware onsite, with no additional troubleshooting in 5.5 hours.

Cisco portal for smartcall is located at http://www.cisco.com/go/smartcall

Colin McNamara, CCIE #18233
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Routers can email you when they go down
• Zone based IOS firewalls
• Cool new features in 12.4(15)T
• What being married to a geek who does search engine optimization gets you
• What does it take to pass the CCIE exam?

--Colin McNamara

The emergence of MDS features in Cisco’s datacenter networking equipment

My background is all over the place. It goes from running a small ISP when I was 18 to managing international CallManager clusters, to enterprise data center design and migrations. I swear that I have tech ADD. I see something new and I am like.. oooooh shiny, lets do a sniff and see how it works.

I actually attempted the Route Switch lab twice in 2002 (still had token ring and dlsw still) but got activated for the war before I could get my number. I can tell you.. that sucked horribly.

So, why did I choose to get my Storage CCIE first instead of finishing up my Route Switch first? Well, over the past couple years I have done a significant amount of IP storage (NFS, ISCSI, ATA over Ethernet, etc) including building my own IP storage heads based on linux. I had also done a little bit of fiber channel work. I felt that I had a significant advantage compared to most network engineers in the storage networking space. And, I think more importantly, the topics that I had to study were new and fresh. Whereas when I cracked open my Route Switch books.. I honestly wasn’t to excited about it at the time ( I think I was holding a grudge from my first attempts in 2002).

The partner e-learning central portion of Cisco has an Excellent lab access to labgear.net. It gives you 2 hour segments of time with 2 mds’s (both with IPS blades), 1 2 port jbod, and 2 2 port servers. They also have introductory tutorials for most major technology segments.

I did all of those, along with the every E-learning class that was on PEC. I think the major ones were the Design, Support, and CASSI classes.I took that, sat for the design and support specialist exams, and took my written last December.

After doing all that work, I was honestly 70% there. I took a little break for january and febuary (There was no open lab dates) and then started hitting the labs I think at the end of febuary.

For the majority of my practice I used the labs available through PEC. I also was able to weasel my way into 8 hour sessions every sunday from our channel SE. (I owe him plenty of drinks at networkers this year) For those 8 hour sessions I had labs created to summarize the major technology areas and to be as evil as possible to myself.

I had one attempt which didn’t work out as well as I would have liked. In RTP the lab starts at 7:15. This means if you are from the west coast like I am you will be getting up at 3:00 am in the morning for your lab. That royally kicked my but. I diverted from my attack plan and ended up
running out of time. It was a classic example of letting the lab run you, instead of you running the lab.

Luckily a data opened up just over a month later. I spent that time just working on my speed (speed is the secret sauce). I migrated to using Fabric Manager (gui interface) instead of command line. After 2 practice runs my time had dropped 25%. I also flew out to RTP 3 days before, and made sure to relax and get on east coast time.

For my final prep I got access to iementor’s lab. Their lab is excellent. I cannot reinforce enough how much it contributed to my confidence in that final week. Roman was really cool about working with an existing candidate to get me squeezed in. They are really cool guys, and they have the only workbook on the market right now.

So, I used their lab 2 days before mine, and then just chilled the day before. The day of the lab I had 70 points by lunch, and had completed configuration of the lab by 12:30. I spent the rest of the day reviewing my configurations (found 2 errors), fixing one bug, and generally harassing the proctor to make sure I didn’t misinterpret anything.

So.. if I had it all to do over again what would I do. I would still do the PEC stuff, and continue to primarily live in the Doc CD. Though I would probably pony up the cash and buy the iementor book and more lab time with them.

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233
“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• What does it take to pass the CCIE exam?
• Fibre Channel over Ethernet is taking off
• And it begins again – On the road to my CCIE in Storage
• Are you a kick ass engineer looking to grow?
• My CCIE Storage Shopping List
• Where was Colin in 2010?

--Colin McNamara

Why was Storage Networking my first CCIE? And What did I do to prepare?

For those who haven’t heard yet, I passed my CCIE Lab on June 14th. Now I can officially put CCIE #18233 after my name.

Anyone who has been down the same path understands how long of a road this is.
I started down this path in the spring of 1999 as the 432nd student ever in Cisco’s Networking Academy (which I promptly dropped out of to move to the bay area). I grew my networking skills all the way to passing my CCIE Written in 2001. I attempted my Route Switch lab in 2002, however I got called away to war for a year. Being away from it all for a year really cramped my style technically. In that time many of my certs expired, and I lost much of the momentum I had built of the past half decade.

Since I got back to the real world I had focused on work to the detriment of my certifications. I really did some great things, however I really neglected my resume.
In July of 2006 I had worked 2038 hours that year (for those not mathematically inclined, that is a full work year, in 1/2 a year) . At that point I decided it was time to stop neglecting my certifications. At that point I dedicated 8 hours each saturday, along with two nights a week to studies. By December of that year I had Certified on a few of the technologies that I had tons of experience in.

I managed to get my RHCE, Cisco Storage Support and Design Specialist, update my old IP Telephony specialist certifications to CCVP, get my Netapp Certified Administrator, and pass my CCIE Written for storage networking all by the end of the year. This spring I finished my Netapp Certified Expert and scheduled my Storage lab for early summer.

Anyone who knows me well knows how closely I track my time. That time tracking extends to my training. I tracked my training (reading, lab practice, testing, etc) just like any other part of my professional life. I spent around 150 hours studying for my Design, Support specialist certs, along with reading the recommended books of the CCIE reading list, and around 300 hours preparing for my lab exam. That is 300 hours configuring every possible combination and permutation of technology that could be setup, and then refining my speed in configuring those technologies until i got to the point where speed as well as brains would be an advantage in the lab.

So now that I have my CCIE, whats next? Well, oddly enough.. I am thinking of getting my second CCIE cert. In my office I will be the Jr guy by only having a single CCIE (on of our guys has all five). I also need to take my VMware certified professional cert, and probably get my HP Master Accredited Storage Engineer. I guess I am just a glutton for punishment.

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Where was Colin in 2010?
• About Colin McNamara
• Updated CCIE numbers
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• And it begins again – On the road to my CCIE in Storage
• Update on the Cisco / Nuova connection

--Colin McNamara

What does it take to pass the CCIE exam?

	Search Criteria Search Criteria
	Note : Only 150 random matches will be displayed
	Partner List Sort By Select Sort Type Company Name Country Company Name Country Authorizations Sites

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco Storage Partners – California… a very small list
• How close did the fire come?
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks

--Colin McNamara

Storage partners nationwide – 14