VBlock Infrastructure Packages

VBlock infrastructure packages are pre-configured bundles that are sized to support specific workloads. These packages are available to run both on the customer site, as well as in a hosted (cloud) facility. If you have been listening to anything that has come out of VMware in the past couple years, it has been centered around the unification of private and public clouds. VBlock is a building block of this integrated cloud.

The VBlock infrastructure packages are offered in “bundles”. These bundles are numbered 0-2 at the time of writing.

VBlock 0 is an entry level package supporting 300-800 virtual machines. This is built on Cisco UCS, EMC Celerra Unified Storage, VMware vSphere and the Nexus 1000v.

VBlock 1 is a mid level package supporting 800 – 3000 virtual machines. This is built on Cisco UCS, Cisco MDS, EMC Clarion, VMware vSphere and the Nexus 1000V

Vblock 2 is a high end package supporting 3000 – 6000 virtual machines. This is buit on Cisco UCS, Cisco MDS, EMC Symmetrix V-Max, VMware vSphere and the Nexus 1000V

Integrated Pre-Sales, Service and Support – Fighting the skill silo

The defining factor in the successfully sales and deployment of virtualization infrastructure has been cross platform knowledge and experience. Storage, Network, and Virtualization vendors, as well as partners have struggled to attract and train engineering and sales forces with this cross functional skillset. Partners who have engineering teams with skills that cross these functional areas have seen success even in this down economy. Cisco EMC and VMware are smart enough to recognize this trend and have linked sales teams at the hips in engagements. Nothing makes this more apparent than John Chambers himself addressing Field Sales in the VCE webcast and requiring that these teams coordinate and act as one cohesive unit.

Acadia

Cisco, EMC and VMware have jointly funded a venture called Acadia. This venture, initially staffed at 120 employees is charted with the development and validation of cross platform solutions. They are focused on a “build operate transfer” model for service providers and large enterprise customers. The target date for Acadia’s launch is Q1 2010.

Partner Ecosystem

This was my biggest worry about this release. Does Cisco, VMware and EMC funding Acadia mean that they are going to go direct and bypass their channel? The party line is no, that all three partners will still utilize the channel to sell and distribute the VBlocks. An interesting new twist however is that there is not one master partner certification to sell “validated” VBlock solutions. To participate a partner has to be certified at reasonably high levels with all three partners to have the ability to register and sell deals under the VBlock mantra.

What hasn’t been clearly answered is what happens when a workload is moved to the “cloud”. Does that go through the channel? What if that cloud infrastructure is built onsite but maintained by Acadia? It sounds like we have to wait till January 2010 to get that answer. In the end time will tell whether Cisco will hold true to the success they have found in the channel, or whether Cisco will end up in an MBA case study of what not to do.

Want to learn more ?

Enterprise Strategy Groups write up

Scott Lowe – VCE quick thoughts

Joint Offering Portal – Privatecloud.com

Chad Sakac – an insiders view of VCE

Cisco Press Release on VCESimilar Posts:

• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• VMworld 2009 Schedule
• Cisco’s Cloud Computing Offering
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem

What does this mean?  In Cisco’s view of the world this means supporting the transport of Fibre Channel, Fibre Channel over Ethernet, iSCSI, NFS and CIFS in a scalable and dependable fashion.

What is the Nexus 4000?

The Nexus 4000 is the 5th release of the Nexus line of switches (counting the UCS 6100 as a release).  This switch fits in the blade center form factor. It is intended to be used in the place of the Catalyst 3000 and 3100 series blade switches. It is a full featured Nexus switch, very similar to it’s big brother the Nexus 5000.

What protocols will it support?

In keeping with Cisco’s vision of a Unified IO platform in the data center the Nexus 4000 will support Converged Enhanced Ethernet (CEE) (yes, they finally caved on the naming) as well as providing the same reliable transport of iSCSI, NFS, and CIFS that you get with the Nexus 5000.

What blade centers will it work with?

Cisco is playing close to the chest announcing what blade server vendors will support this product.

My initial gut reaction was that HP would not be supporting this product, however I just saw that HP is OEM’ing the Nexus 5020. It would make sense that they would support the Nexus 4000 in their C Class blade centers, though only time will tell.

IBM however has been very supportive of integrating Cisco technology, as well as OEM’ing the Nexus 5000 switch in their portfolio. I fully expect the Nexus 4000 to be supported in the IBM BladeCenter platform, though again I cannot confirm.

Dell also has resold Cisco blade switches, and although they do not OEM the nexus 5000 they have been large proponents of the Nexus solution and unification of IO workloads throughout their platforms.

Is it the same as a Fabric Extender?

The Nexus 4000 is not a Fabric Extender. What is the difference? A Fabric Extender is a really efficient multiplexer. While using a Fabric Extender the main goal is vast simplification. What you end up with is a dumbed down remote line card that provides simple, fast services to your access layer. This is great for most uses, however there are instances where you need to provide richer services. A full function switch like the Nexus 4000 is appropriate in this case.

What does it run?

The Nexus 4000 runs NX-OS, Cisco’s data center switching operating system. This is the fourth release of what was previously named SAN-OS which ran on Cisco’s MDS line of SAN switches. This operating system is shared between the Nexus 7000, 5000, 4000, 1000v,UCS Fabric Interconnect and MDS line of SAN switches. Now you can have a consistent operating system platform from your data center core, all the way down through your blade switches and into your virtualization layer.

When will it be available?

Just like when the 3000 and 3100 series blade switches got announced, we are going to have to wait on the individual server manufactures to announce support at their own pace. My gut feel says we will be waiting a couple months for units to get out, and for the vendor certification process to complete. Though with business picking back up, this product may get out sooner.Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco introduces the C-Series Rack Servers
• Cisco’s Unified Computing System – It’s not just a blade center

--Colin McNamara

Cisco Nexus 4000 Blade Switch

Intellectual capital driving the cloud

It is wise to follow the movements of thought leaders in Silicon Valley. Why is that? Because when enough smart people land at the same company, it is only a matter of time something great happens. This “human network” of intellectual capital has been the seed of many successful tech companies, and will continue to be true in the future.

One of these tech companies with a wealth of intellectual capital is Arista Networks. There are A LOT of ex Cisco folks walking the halls of Arista. Many of them come from the Granite Systems acquisition (Cisco’s 4500 platform). This platform, while designed with line card oversubscription to keep it between the 3560 and 6500 platforms in price and performance has an extremely elegant internal architecture. Case in point, the 4500 platform has had in service software upgrade (ISSU) for over two years, something that the 6500 still struggles with.

Now that this team, and key leaders from Cisco and other tech companies are putting together a network platform, what can they do? And more importantly, what will they do?

Before I dive into that answer, I think it is important to take a quick overview of the two major camps of network platform development, and what the advantages and drawbacks of each method is.

Creating your own ASICS in house

The first way is to create your own ASICS that handle switching and security functions. In this case, you are effectively a chipset manufacturer, who then bundles your own chipsets into routing, switching and security platforms. On one hand, developing your own ASICS can give you a competitive advantage by rolling in features that are not available to your competitors.

On the downside however because of the high cost of developing these chipsets you are forced to design for a very long lifecycle (7+ years). Another downside is that if you have any problems with manufacturing, you cannot just call up another supplier and change your sourcing strategy because you are that supplier. In the case of any Fab issues you are forced to slip your product delivery dates.

Utilizing market silicon

The second way is to utilize routing, switching, and security ASICS that are commercially available through many manufacturers and wrap your own software and chassis integration around them. This is commonly referred to as “market silicon”. In this case, your focus is end to end integration of commodity ASICS and most importanly creating  software differentiation to add value to your product.

The positives aspects of this model is that you are not locked into your own chipset design time lines. If your primary chipset supplier has a Fab issue, then you can easily change your supplier and hit your deployment time lines.

The downsides of this model is that every single networking manufacture in the world has access to the same chipsets. This forces a vendor to differentiate through better software, support, and integration of these “Market Silicon” ASICS into a superior platform.

Who uses what?

With all the talk of Market Silicon being evil, the reality is that the major networking manufacturers use a mix of home grown ASICS and market silicon to drive their products. I can’t say who uses what, but feel free to crack open your switch and take a look at the chipsets on the line cards. Don’t be surprised if you can find some market silicon sprinkled here and there. Now that doesn’t mean that these platforms are bad, it just means that for certain functions it is cheaper to source ASICS externally then to create them in house.

How does Arista approach this problem?

Aristas focus is to create an extensible network operating system that can manage and enable multiple switching ASICS and switching platforms (VMware Virtual Network Distributed Switch – vNDS).

Extensible Operating System (EOS/vEOS)

Arista created a new operating plaform, based on Linux that manages both the physical and virtual implementations of switching devices (ASIC and Virtual Switches). It is called the Extensible Operating System. This operating system has hooks into all the ASICS and vSwitches that it supports. Most importantly it provides one single operating system for all supported platforms both physical and virtual.

sysDB

Core to the functionality of EOS is the sysDB. What is the sysDB? It is a custom real time database written specifically for the interaction of individual system processes. These include routing, switching, security, management processes. By centralizing all of this information in a central location the time to react to events is minimized . This is especially true when compared to classic networking implementations where independent processes keep independent state.

vEOS

Virtual Extensible Operating system is just that – A virtualized instance of the items mentioned above. This can be run inside a vmware virtual machine. It is the same operating system, database, and daemons that run on Arista’s physical hardware. The only difference that it happens to run inside of your virtual infrastructure.

You may ask the question, why would you want to take a network operating system / hardware combination and split it apart?

vEOS and VMware Virtual Distributed Network Switch

EOS and vEOS have implemented a hook into VMware’s vNetwork Distributed Switch (vNDS) API. In effect, you can think of the vNDS as just another ASIC to the operating system. Instead of connected through a device driver, EOS and vEOS connect in through an XML API. This accomplished the function of both retrieving status and performance information that the vNDS provides, and creating policies inside EOS and publishing them into your VMware switching infrastructure.

If you have an Arista switch directly northbound of your ESX servers, you get this monitoring and configuration feature for free. If you don’t have Arista switches, (say you have Cisco, HP, Juniper or Foundary) you can use vEOS (the virtual instance) and pay a fee to get a cli interface into the VDS.

vEOS vs Nexus 1000V

This is a likely to be a highly contested item, complete with competing bumper stickers. In my opinion it isn’t that big of a deal. The reason being is that the 1000v and Arista’s vEOS implementation are completely different. Cisco’s 1000V is a dedicated piece of code running on your ESX servers that handles switching differently then VMware’s vNDS. Arista’s implementation of EOS and vEOS is more of a management interface to VMwares vNDS. vEOS does not replace the switch inside VMware, it configures and monitors it through the vNetwork API.

When comparing the two products head to head, the discussion is really a VMware vNDS vs Nexus 1000v discussion. If you have already decided to move to the 1000V because of the feature differential between the native vNDS then nothing really changes.

This doesn’t mean that vEOS does not add value. In smaller environments where the 1000V is not an option, or in an intercloud situation where state needs to be passed between disparate network instances vEOS’s vNDS implementation can be very valuable. If the vNDS features are all you need, but you would prefer a CLI for your VMware switching and cannot justify the expense for the 1000V licenses, then Arista might be right for you.

Want to learn more?

Arista Networks – Extensible Operating System

Andy Bechtolsheim’s opinion on Market ASICs

VMware Virtual Network Distributed Switch

Cisco Systems – Nexus 1000V

Similar Posts:

• Jayshree Ullal takes the helm of Arista Networks
• Cisco Nexus 4000 Blade Switch
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco’s Cloud Computing Offering
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

--Colin McNamara

Arista Networks – Their approach to cloud networking

If you happen to be in the same class, or see me passing in the hall, feel free to pull me aside and say hi.

Tuesday
10:00 AM-11:00 AM	EA3605 Room 302	Virtualizing Tier 1 Applications: The Value of the vSphere Internal Cloud as a Better Platform for Apps
11:30 AM-12:30 PM	VM4800 Room 110	The “Next Generation Data Center” for Telecommunication Companies
1:00 PM-2:00 PM	SS5240 Room 134	Engineering Developments Enabling the Virtual Datacenter – VMware, Cisco and EMC
2:00 PM-3:30 PM	EA3234 Room 104	Virtualizing SQL Server in a VMware vSphere environment
4:00 PM-5:00 PM	VM2472 Room 303	Introduction to VMware vCenter Chargeback
6:00 PM-7:00 PM	EA1820 Room 310	Virtualizing Critical Healthcare Applications

Wednesday
10:00 AM-11:00 AM	TA3286 Room 132	Applications in the Cloud: Getting off the ground
11:30 AM-12:30 PM	EA2583 Room 110	HPC/Grid Computing and Virtualization
1:00 PM-2:00 PM	TA1962 Room 121	How and Why we Upgraded Herning Kommune’s Production Environment to vSphere 4.0 at GA
2:30 PM-3:30 PM	TA4100 Room 303	Internal Clouds: Customer perspective and implementations
4:00 PM-5:00 PM	VM3881 Room 309	Business Objects SAP Virtual Infrastructure Lab Manager Deployment and An Overview of the Best Practices and Process of Migrating Between Network Ranges

Thursday
9:30 AM-11:30 AM	LAB11 Nob Hill A	VMware vCenter Chargeback
11:30 AM-12:30 PM	TA4881 Room 132	Designing Dynamic Data Centers with NetApp and VMware
12:30 PM-2:30 PM	LAB09 Salon 4	VMware vCenter AppSpeed
2:30 PM-3:30 PM	EA3241 Room 301	Beyond Infrastructure as a Service: Developer and Runtime Services with VMware and our Partners
4:00 PM-5:00 PM	EA3481 Room 301	Virtualization of Analytic Databases

Similar Posts:

• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Cisco’s Cloud Computing Offering
• Link Love – Blogs that linked to me this month
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Interesting TechWise TV episode on virtualization
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?

--Colin McNamara

VMworld 2009 Schedule

You may notice that I am using a tool called Netformx. You may ask – since this is a Cisco product, why aren’t we using the Dynamic Configuration Tool or the MultiLine Configurator? The answer that was given to me was that UCS requires a bottom up configuration. It requires that you start with the type and number of systems, and then work your way up to the amount of Chassis, FEX’s, links and Fabric Interconnects that are required. All of the workflows in Cisco’s existing tools require a top down approach. Until the new configuration workspace is released from Cisco, Netformx is your only option to quote any UCS product.

.

Thank you for taking the time to watch this walk through. If you found this helpful, please feel free to leave a comment or ping me on twitter.Similar Posts:

• Twitter Updates for 2008-06-05
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Cisco Nexus 4000 Blade Switch
• Cisco’s Unified Computing System – It’s not just a blade center

--Colin McNamara

Cisco Unified Computing System Quoting and Configuration with Netformx

“it looks like one of the key features not on the list of components for the California boxes is going to be a red discount pen”

Timothy references sources who have obtained a price list and shared it with “El Reg” . I wish Timothy would have contacted an actual Cisco Unified Computing System Advanced Technology Partner, because any partner that is involved in the launch could have explained to him the concepts of List price (List), Manufacturers Suggested Retail Price (MSRP), and Purchase or Buy price.

In this article I want to dispel the myths of server and network manufacturer pricing, demonstrate the true cost of building a data center with blade systems, and at the end provide a cost comparison between legacy server vendors options and Cisco’s Unified Compute System.

First, lets go over some the basic concepts of vendor pricing. At the end of this you should understand the difference between list price, manufacturers suggested retail price, and purchase price.

List Price

List price is a high level number that Cisco publishes weekly in its global price list. The purpose of this list price is to provide a uniform price list across all product sets that Cisco offers. The most important thing about list price is NOBODY EVER PAYS LIST PRICE. Let me repeat that again NOBODY EVER PAYS LIST PRICE. Are we clear? This is similar to list price on a car on the car lot. All list price provides is a starting point where a Cisco partner and a customer can negotiate a common discount and end up with something close to (generally at or below depending on technology type and yearly spend) MSRP.

Manufacturers Suggested Retail Price (MSRP)

This concept is something that anyone who has purchased a car before is familiar with. The number that is on the window of the car when you look on the lot is list price. The first number the dealer brings up lower then sticker is MSRP. Depending on the popular of the product, the competition in that particular space, and the negotiating power of the customer you will either pay that price, or some percentage below. For example if you are buying one new car you may have the negotiating power to get the price to drop 5% off of list. If you are buying 200 new cars (say a fleet) you have significantly higher negotiating power, and you may be able to drop the price by 15% of of list price.

In Networking Sales MSRP is significantly less then list price. A good exercise to see what this number is, is to find a device, say a WS-C3560E-12SD-E (3560 with 12 Gig SFP ports and 2 10 Gig ports) in the Global Price List. You have access to this at any partner level at www.cisco.com/dprg . (my point here is that this is no big secret). As of Friday June 12 2009 the LIST price for this product is $19,995.

Now take that same part number - WS-C3560E-12SD-E and pop it into your google search window. Within the top four links I found this product for $12,434.15 . This price is for  pure fulfillment, with no value added consulting or design work from you local Cisco partner.

If you do the quick math, this price difference is equal to 38% off of list price. Come to your own conclusions, but it would be safe to say that this could be considered MSRP for Cisco products.

Purchase / Buy Price

Buy price is just that, the price at which the customer purchases (buys) the product. This is can be at MSRP, or if the customer is buying significant amounts of hardware at a time, or if there is a “special” (programs and incentives) going on the number could be slightly lower then MSRP.

Percent off of list differences between legacy server vendors and networking vendors

This is where the biggest confusion is coming from. Legacy server manufacturers  have set their list prices much closer to MSRP then networking vendors (remember, MSRP is the price where most customers purchase at).

Why is this? In the networking space, vendors have historically created their own processors, ASICS and boards. This means that the sales discussions are feature to feature. It also meant that you had to have a conversation with the networking vendor or networking partner to properly size your network devices and get a quote – which is around MSRP, not List price.

In the legacy server space, especially the majority of the x86 server space, the market has been essentially commoditized. E.G. – You can buy an intel based server with X amount of memory and hard drives that will perform roughly equally from any of the main manufacturers. That made it much easier for a sever admin to just pull a price off of the web and compare. So what the server vendors ended up doing is setting their list price  only slightly above MSRP.

What this translates to is the list price, between legacy compute vendors and Cisco will be drastically unequal. What is equal is MSRP, or the generally accepted purchase price by common customers.

Why did Cisco set the list price of UCS higher then the legacy server manufacturers?

For the vast majority of its sales, Cisco relies on what is called the channel model. This means that Cisco partners with local Value Added Resellers (VAR’s) who sell Cisco’s products and then provide consultative services to design and implement them in customer networks. Most customers who purchase any regular amount of Cisco product either have a general expectation that they will buy Cisco product at a certain percentage discount off of list and sometimes the partner and customer have entered into purchasing contracts which require that all Cisco product is provided at a specific discount off of list price.

If Cisco decided to set the List price at a small percentage lift over MSRP, this would cause a problem for the entire channel. This would be especially hard for any customer who had a contract to buy product at a specific discount. What would happen is contracts would have to be renegotiated, which generally takes months and is about as fun as pulling teeth.

The second reason for setting list price the for compute the same as list for network is quoting. Right now, if you buy hundreds of different Cisco devices through a reseller it is very likely that the discount is going to be the same across all products. This makes the mechanics of sales much simpler, because you don’t have a lot of math in the quote (this can cause errors). On the customer side, having one set discount makes it much easier to compare quotes and to ensure that they are getting the best deal possible. In short, sticking with Cisco’s current list pricing structure benefits both the customer and the partner.

Now that we have set the record straight on list price, MSRP, and Buy price, lets take a deeper dive into what components make up a blade system powered data center. And then we will compare the price structures of both.

Components of all Blade Systems

Blade Server – The compute blade where commodity silicon elements such as the CPU and RAM are housed. As of writing this article, the latest high performance blades from all major server manufactures support two xeon 5500 processors (Nehalem) and DDR3 memory.

Mezzanine cards – These cards take the place of PCI-e cards in a rack form factor server. In a blade system these provide data network and storage network connectivity. They attach to the blade itself via proprietary connectors that implement either PCI-e 8 or 16 lane connectivity at the time of writing. In some cases other functions such as IO accelerators can also be attached in the mezzanine card form factor.

Blade Enclosure – This is functionally a tin can where eight to sixteen blades are placed. It also is used to provide a centralized power distribution fabric, as wells as slots for interconnections of data and storage network devices.

Data Network Modules – These are effectively ethernet switches that have been miniaturized to fit into the tight confines of a blade enclosure. Classically they have provided 1 gig connectivity to the servers, and 10 gig to the distribution layer, however with Nehalem processors and VMware there is a move towards presenting 10 gig connections to the server, and multiple 10 Gig connections into the distribution layer.

Storage Network Modules – The local disk in a blade server is classically anemic. To provide higher IOPS (input outputs per second) to disk, Fibre Channel connectivity is extended by taking SAN fabric switches and miniaturizing them to fit into the blade enclosure.

Data Network Distribution – If you have multiple blade enclosures there is a need to connect them together at a reasonably high bandwidth. To serve that need a variety of 10 Gig distribution switches are provided from all server manufactures at varying cost and performance levels.

Storage Network Distribution – Along the same lines of the data network distribution, SAN fabric switches have to aggregate up to a SAN distribution layer, or if the installation is reasonably large a “director” class SAN switch. This allows all the blade enclosures to see the same storage network, as well as providing for deterministic storage network performance as you scale out.

Management Infrastructure – All manufactures have a need to manage and monitor all of the devices that comprise their blade system. Many manufactures have multiple management modules per blade enclosure.

Comparison of Costs – Cisco vs Legacy Server Manufacturers

The funny thing, is that many people have assumed that Cisco’s Unified Computing System will be priced higher then legacy server manufactures products. In my mind this is because they associate higher quality with higher price (basically the Mercedes vs Kia discussion). Here is something that will shock you - it costs less to buy an entire blade system through Cisco then to buy from the legacy server manufacturers.

When people hear this, they are puzzled. How can two server manufacturers, who buy their CPU’s from the same company (Intel) and their memory from the same fabs end up with different prices? The answer is elegance in engineering. Lets go through each of the elements of a blade system infrastructure and find out where the costs are. More importantly lets look at where Cisco has innovated to provide higher performance at a lower cost.

Dollars and Cents – How much is the cost difference

I worked up two quotes recently. These quotes included all elements required to build an end to end blade system using both legacy server manufactures devices, and using Cisco’s Unified Computing System. I have broken out two scenarios.

8 blade servers - Cisco wins with a savings of 11%

In this scenario the cost of servers and enclosures were fairly equal. The cost savings started racking up as storage and data networking devices were included, as well as base management software was taken into consideration.

320 blade servers - Cisco wins with a savings of 31%

With 32o blade servers the same cost savings seen in the 8 server scenario were amplified. Economies of scale translated into significantly less devices being required to support the individual compute blades. This resulted in 31% savings compared to the legacy server manufacturers.

Summing it up

Cisco has entered into a highly competitive server market by taking an elegant approach to its blade systems. This approach lowers the purchase price of the UCS through reducing the amount of components compared to legacy server manufacturers. I know that there is a lot of misinformation flying around, and I hope this helps to set the record straight on the pricing of Cisco’s Unified Computing System.Similar Posts:

• Cisco Nexus 4000 Blade Switch
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco introduces the C-Series Rack Servers
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco’s Unified Computing System – It’s not just a blade center
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?

--Colin McNamara

Confusion about Cisco UCS pricing – Setting the Record Straight

The Server Landscape

If you take a look at most enterprise and commercial customers data centers, you will notice a trend of larger fixed workloads running on two rack unit servers (very commonly HP’s DL380), and newer virtualization workloads consolidated onto blade center form factor servers (commonly c7000 class blade systems, and soon Cisco UCS B-Series blades).

However when you go to a remote site where the compute needs are much smaller, you tend to see a few 1 and 2 rack unit system (DL360 or DL380). Why is this? There are a couple reasons, but the most pressing reason is cost. In a blade system, even if you virtualize there is a tipping point where it costs less to install blades and use centralized storage then it costs to use rack form factor servers with local storage. I find that tipping point is generally between five and 8 blades.

If you are a small remote site, or small to medium size business you may not have the compute needs (especially with virtualization) to push you over that tipping point into the blade center form factor. In that case, a few rack optimized servers provide the optimal return on investment for that smaller site.

Taking a closer look at Cisco’s C-Series Servers

Cisco UCS C 200 M1 -

Effectively this is a clone of the B-200 M1 blade in the B series UCS chassis with the addition of two PCIe slots and two more SFF SAS/SATA drives..

The C 200 M1 is a 1 rack unit form factor server (pizza box). It supports a dual port 10 gigabit converged network adapter. two Xeon 5500 series processors, four small form factor SAS drives, 12 dimms for a total of 96 Gigabytes of memory.

Cisco UCS C 210 M1 -

The C 210 is a 2 rack unit form factor server, with the same CPU and memory architecture as the C 200. What has been added is 3 additional PCIe slots (for a total of 5). There is also support for up to 16 SFF SAS/SATA drives.

Out of all the C-Series servers I think this will be the most popular. The extra local disk and PCIe slots will be extremely tempting. For example if this server was populated with 750 Gig SFF SATA drives and augmented with some Fusion-io cards you could have 6 Terabytes of raw disk inside this server. An end user could install Open Filer or iSCSI Enterprise Target and have a pretty respectable NAS head. The other possibility is someone will notice that the Palo adapter can be used as a FCoE target, and use a couple of these as backends for FC storage. (This FC target functionality is mentioned in Silvano Gai’s book).

Cisco UCS C 250 M1 -

Effectively this is a clone of the B-250 M1 blade in the B series UCS chassis with the addition of five PCIe slots and eight SFF SAS/SATA drives.

The C 250 M1 is a 2 rack unit form factor server. It supports a dual port 10 gigabit converged network adapters. two Xeon 5500 series processors, eight small form factor SAS/SATA drives, and 48 dimms for a total of 384 Gigabytes of memory.

This server utilizes the same catalina chipset for memory expansion that it’s cousing the B-250 M1 utilizes.  The ability to aggregate low cost memory plus the PCIe slots to insert solid state I/O acceleration make this a prime candidate to business intelligence / data warehousing workloads as well as Electronic Design Automation.

When can I buy these?

Putting any new product line into production is a monumental effort that many of us take for granted. My gut feel is that Cisco will focus on satisfying demand for the B Series Unified Compute System first, and once manufacturing has hit their stride with the UCS Cisco will start production of the C-Series. In short, I’m  expecting the first C-Series servers to roll off the line at the end of 2009, and  meaningful availability of the C-Series in the first quarter of calendar year 2010.

How do I integrate these into my network?

This is a question that is bound to come up. Cisco’s C-Series servers can integrate directly into your 10 Gig enabled network. Now, to get the best bang for your buck, you should ideally connect these into a pair of Nexus 5000’s to converge your storage and data networks into simple 10 Gig Data Center Ethernet links.

You may however have site without 10 gig enabled switches. In that case, there are multiple PCIe slots in these servers so we should be free to utilize 10/100/1000 adapters. Then when these sites have the need to move to 10 Gig, the server will be capable of supporting that level of connectivity.

My Perspective

At the end of the day, Cisco is now a server manufacture. Just like the HP and IBM, Cisco has to provide platforms that meet customer needs. While the B-Series Unified Computing System is an outstanding platform, it shares similar entry costs that other blade systems have (the need to purchase chassis and interconnects first) which can server as a barrier for smaller server installations. By introducing a 19″ rack form factor line of servers that share many of the I/O and memory benefits of the B-Series servers, Cisco is directly answering the needs it’s customer base by providing a form factor that can scale across all size of customer installation.

Want to learn more?

Cisco Unified Computing System Overview – colinmcnamara.com

UCS C-Series Rack Servers: A New Path to Unified Computing – Cisco.com

Cisco unveils rackmount servers for UCS - datacenterknowledge.comSimilar Posts:

• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco’s Unified Computing System – It’s not just a blade center
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 5010 released
• Usability features in Cisco’s Nexus 7000

--Colin McNamara

Cisco introduces the C-Series Rack Servers

Why do I say that? It is simple, every server that moves from a corporate data center into a cloud provider is a switchport and fibre channel port (and now server) that is not purchased from Cisco. More so, each system that is moved into the cloud hurts secondary sales of security and content switching products.

The promise of enterprise cloud computing

The ability to dynamically scale enterprise compute workloads while only running a “right sized” private infrastructure is top of every CIO’s mind. This is the promise of cloud computing in the enterprise space. However, right now most cloud offerings are too new, and lack the critical integrations with VMware or XenSource (the two most common enterprise virtualization platforms) to make a serious dent in Cisco’s revenue stream. But fast forward 12 to 16 months and the kinks will be worked out. Projects that would previously have required new capital infrastructure will be restructured to use cloud providers as an operational expense. This will present a real threat to Cisco’s revenue moving forward.

John Chambers and his team of technologist are not new to this game, this is not the first threat to Cisco’s sales model. And I am sure that it won’t be the last. So if I was in their shoes, what would I do? (and more specifically, what do I think they are doing)

Create a compute platform that can power the cloud at a much lower cost that my competitors

Cisco publicly announced their computing offering, the Unified Computing System in March of this year. The promise of the UCS is to minimize power, cooling, capital costs and management overhead of data center compute. Looking at this new product line from an enterprise sales perspective it makes sence. For Cisco to continue with their growth plans they had to choose to enter the Compute or Storage markets, with the compute (server) market being the logical step.

While the Unified Computing System is well placed as an enterprise computing platform, I think there is a larger goal in mind. The large goal is to make a platform that can be shared by Cisco’s largest enterprise clients in their emerging private clouds, as well as by Cisco itself for it’s own cloud offering. By producing their own servers, with technology that Cisco alone has access too (memory expansion / hypervisor bypass) Cisco sets themselves up to have both lower hardware costs in their own cloud, as well as lower operational costs (power/cooling). This will provide Cisco with higher margin at the same price point as their competitors.

Distribute application aware network devices at customer locations

Cisco already has a significant edge over any competitive cloud offering. A vast majority of enterprise customers already run Cisco routers, switches and firewalls. If Cisco decided to say, port the TCP optimization code from their WAN acceleration platform into IOS, and configure it to work with their own cloud offerings this would give them an immediate leg up on the competition. Combine this with the existing WAAS auto discovery and Cisco could conceivably automatically integrate a cloud based caching offering with a customer’s onsite devices.

Create an application centric cloud security model that can be integrated with virtualization platforms

Last year Cisco announced a new approach to security called Cisco TrustSec. This technology includes a change from layer 4 based acl’s to an application focused role based implementation. This is applicable in the cloud environment because it provides a standard integration for controlling the access to and mobility of applications as they travel between public and private clouds.

An interesting side bar, is the fact that when integrating public and private clouds, there will always be applications that you want to keep on your internal cloud. The easiest way to do this is to put some sort of meta information on the virtual server containing a flag that this server should only run on the private cloud. With VMware there are fields that are used for DRS that can house just such data. I would not be surprised that with all the work that Cisco and VMware have been doing together if this was not implemented with vSphere (Virtual Infrastructure 4).

Learn as an organization how to profit from a SaaS model

I think this last piece of the puzzle has been overlooked by many people. Cisco already has in house experience dealing with a massive Software as a Service (SaaS) offering – Cisco WebEx. In acquiring WebEx Cisco also acquired the talent and technology behind the worlds largest collaboration platform. Cisco should be able to take the lessons learned from running and improving this platform, and apply them to their upcoming cloud offering.

Summary

Cisco has to go to market with a Cloud offering to maintain long term viability as a company. When they do they will have the benefit of lower cost of building and operating the grids that their cloud offering will run on. They will be able to leverage millions of Cisco network devices in their current install base as well as provide application centric security integrated with these same devices. And most importantly they will be able to use the lessons learned from running WebEx to ensure flawless delivery of an upcoming cloud computing offering.Similar Posts:

• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• VMworld 2009 Schedule
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Unified Computing Podcast with Cisco Interactive Network
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Cisco’s Cloud Computing Offering

Brian Schwarz (SAVBU) and I were guests, and had the chance to talk about Cisco’s Unified Computing offering. It was my first time doing a podcast, and I have to say it was a blast.

If you can spare the time, I recommend you check out it -

Cisco Interactive Network – Unified Computing PodcastSimilar Posts:

• Cisco’s Cloud Computing Offering
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• CCDE Practical – Beta candidate deadline August 1 2008
• VMworld 2009 Schedule
• Cisco Unified Computing System Quoting and Configuration with Netformx

--Colin McNamara

Unified Computing Podcast with Cisco Interactive Network

What is a Fabric Extender?

If you think of a large switching chassis such as a Catalyst 6500 or Nexus 7000 you have the notion of a Supervisory module, a switching fabric forming the backplane, and line cards connected on the back into the fabric, and connecting to servers and other networking devices in the front. In the case of these switching chassis all of the items we just talked about are connected on the inside of the same physical box. Now suppose we took each of those components, the Sup, Fabric, and Line Card and installed them in different parts of your data center. The Sup module in this case would be a Nexus 5020 or Nexus 5010. The fabric would be four 10 Gig port bundles from the Nexus to the Fabric Extender, and the line cards themselves would be replaced by the Nexus 2000 Fabric Extender.

Why use a Nexus Fabric Extension in your Data Center designs?

1. Simplify network management – By moving from individualy managed standalone edge switches to an extended fabric you minimize the amount of devices in your datacenter that you have to manage. Say you have 10 racks full of pizza box servers, (That makes 42 servers per rack) you may throw 3750’s or 4948’s top of rack to provide connectivity. In this case your access layer would consist of at minimum 10 unique devices to manage, upgrade, etc. in your server access layer. If instead you put a Fabric Extender at the top of each rack, you still get 48 ports of coppert gigabit ethernet, but logically you would only have 1 device to manage.

2. Simplify your network topology – In the scenarios mentioned above with classic switching, you would have to manage a spanning tree topology accross your entire access layer. Half of your uplinks will be blocked by spanning tree so your network does not loop. This is a perfectly valid topology, but it does leave you open to the pains of spanning tree in your data center Now replace these switches with a Nexus 2000 Fabric Extender. Instead of spanning tree to integrating individual switches, you now how a very simple U topology forming your edge.

3. Lower your costs for Data Center class switching – Before the Nexus 2000 if you wanted to properly deploy a Data Center access layer, you either had to do buy 6748 blade on a 6500, a 48 port gig blade on a Nexus 7k (M148GT) , ora 3750 or 4948 switch. These all are not the cheapest switches and blades, but they provide each gig switch port with the proper buffers and throughput that are needed for true Data Center applications. Now if we chose to use the Nexus 2000 Fabric Extender in conjunction with the Nexus 5000 we can provide Data Center class 1 Gig Ethernet services at roughly half the cost of using the older switches.

4. Integrate 10 gig and 1 Gig services in a clean way – I have seen many many clients try to cleanly integrate 10 Gig services (normally from blade centers w/ ESX clusters) into an existing 1 gig data center edge. Normally what happens is that the “best” integration case is to put some form of oversubscribed 10 Gig card into their existing distribution layer, or in a worst case some customers are only able to provide 10 Gig of a collapsed core. This is obviously not an ideal setup. By integrating the Nexus 5000 40 or 20 port 10 Gig switches with the Nexus 2000 Fabric extender it provides us with a very clean way to integrate both 10 Gig and 1 Gig services in our Data Center access layer.

Why am I excited about this product?

I am lucky enough to work with some forwarding thinking customers with very large Data Center requirements. We have been working with Cisco over the past couple months to incorporate this end to end Nexus infrastructure into multiple customer designs. Before the Nexus  5000 / 2000 combination, designs to provide large layer 2 adjacent mixed 10 and 1 Gig services were well…. not as elegant as we would have liked to see. Now with Fabric Extension, we  are able to answer this mixed 10 / 1 Gig Data Center access layer design scenario in an elegant and scalable way.

Want to learn more?

Nexus 2148T Product Page - Cisco.com
Similar Posts:

• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco Nexus 5010 released
• Cisco’s Unified Computing System – It’s not just a blade center
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)

Most engineers in the channel utilize a tool called the Dynamic Configuration Tool. This allows you to take a product, configure it with all of its software, hardware and licensing options, give it a sanity check and then output a spreadsheet. You then take spreadsheet and combine it with the other hardware in your design to create what is called a Bill of Materials (commonly referred to as a BOM). The challenge here is if you only use the Dynamic Configuration Tool, you will not see the storage specific options for the Nexus family of Data Center switches.

The solution is to use a tool called the Multi-line Configurator. In the video below, I will show you how to use this tool to create a working Nexus 5000 BOM for your customers. (for fullscreen hover your mouse over the video and click on the “X” next to the vimeo link.)

Normally I don’t discuss channel specific topics on this blog, but my fear is that other engineers in the channel may fumble when creating BOM’s around Nexus, and otherwise tarnish a really good product. Since channel specific topics is new to this blog, it would help me out if you could ping me if you found this useful. Depending on the response I receive I will start sprinkling in more of channel partner specific content in the future.
Similar Posts:

• Cisco Unified Computing System Quoting and Configuration with Netformx
• Me and the Nexus 7000 last week at the Data Center VT
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Twitter Updates for 2008-06-05

--Colin McNamara

Cisco Nexus 5020 and 5010 FCOE video ordering guide

The coolest thing about this chassis is its price. You can get 20 ports of line rate lossless frabric 10 Gig cheap (about 850 a port list price). At that price point, putting one of these top of rack starts to look very enticing to many people.

Want to learn more?

Cisco Nexus 5010Similar Posts:

• Cisco introduces the C-Series Rack Servers
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Identity aware networking using Cisco TrustSec
• Humor inside the Nexus 5000 switch fabric architecture
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)

--Colin McNamara

Cisco Nexus 5010 released

It is truly my pleasure and honor to join Arista Networks as the President and CEO of the company. I have known founders, Andy Bechtolsheim and David Cheriton for a decade and worked with them closely during their Granite/Cisco days. To me, Arista is a symbol of an exciting, innovative silicon valley start-up company at the brink of pioneering new models for cloud networking.

After corporate life and managing multibillion dollars of business at Cisco Systems, you might ask why I chose Arista Networks? Three things really drew me here:

1. A top-notch and talented team, with focus on best of breed products and innovative EOS™ (Extensible Operating System) technology.
2. Working with Andy Bechtolsheim, and our long-standing 20+ year professional kinship.
3. A truly unique opportunity in our industry to build and grow into a great company!

Inside of Cisco Jayshree proved herself as a leader that could get results. There was even speculation that she was tagged to be John Chambers eventual replacement. I have a feeling the same qualities that drove her success inside of Cisco will follow her as she explores this new opportunity.Similar Posts:

• Thanks and farewell to Jayshree Ullal
• Arista Networks – Their approach to cloud networking
• Heading home – Cisco Live 2008
• About Colin McNamara
• What does it take to pass the CCIE exam?
• Challenges integrating VMware into Cisco networks

--Colin McNamara

Jayshree Ullal takes the helm of Arista Networks

They broke down a couple key challenges of virtualization – Policy Enforcement, Security in a virtual environment, Management, Automation and the change from network plumbing to fabrics. At the core of the message, is the Data Center is changing. The focus of this change is virtualization. You can either get on board, or watch the work pass by you.

One topic that I have talked about in the past, is a pressing subject with Cisco – the challenges of handoff between the ESX server admins and the network admins. Again, this highlights the core value of the Nexus 1000V. About 20 minutes in, there is a bit of banter about being a “networking guy” or a “server guy”. I think this highlights a key point – To be successful deploying Data Center 3.0 technologies, you really have to be both.

Next they have a demo of the Nexus 1000V. For those of you that haven’t seen the beta in action, you will be pleasantly surprised with how it can simplify the management of your virtual network infrastructure.

Last but not least, they go into how you can leverage WAAS and its 4.1 release to accellerate your virtual desktop infrastructure. As well as showing a cool new way you can run a Windows server on a was box with the new WAVE product.

It is good to see the folks at Cisco participating in the conversation surrounding virtual data centers. I suggest you head over to the TechWise TV YouTube channel and check it out for yourself.Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Quoted on ZDnet – Shameless self promition
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Interesting TechWise TV episode on virtualization

Because VMware is central to Data Center architectures, I decided to do a deep dive over the past week. This is not my first foray into virtualization, I have used vmware workstation since 1999 and got my first exposure to Storage Networking in 2004 with ESX. Read an article from 2005 about me dealing with network issues in ESX. However VMware has has added so many interesting and relevant features that I found it was good to do a ground up review on. I have to say, that review was helpful. There are many features that as a network designer that should have been in the forefront of my mind, that I hadn’t grasped the full potential of.

As always, after a deep dive into game changing technology I am filled with more questions then answers. But the answers I do have are enough to try my luck at an exam. With an afternoon free, I decided to try my luck at the VMware Certified Professional Exam (VCP-310). Apparently my deep dive worked, because I walked away with a new cert for the binder

Now with a better understanding of the value adds that VMware Infrastructure 3 (Vi3) has in the Data Center, I need to deep dive again on VMware Infrastructure 4 (Vi4) and figure out how Virtual Data Center OS (VDC-OS) and VMware based application virtualization tie into the classic methods of application virtualization (load balancing and content switching) as well as lay down some common network architectures utilizing the Nexus and converged data center fabrics for the move towards cloud computing in the enterprise. I’ll keep you posted on the results of these deep dives, I am sure it will be interesting.

Needless to say, it is a fun time to be a Data Center geek…Similar Posts:

• Interesting TechWise TV episode on virtualization
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• About Colin McNamara
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Where is Colin ? Passing the VCP exam (VMware Certified Professional)

The one thing in my control is preparation. Preparing for the CCDE was extremely hard for me. Oddly enough, the challenge wasn’t the complexity of the content, but the breadth. For example, stack the nineteen recommended reading books on your desk, and become an expert on them.

Look at the CCDE Practical Blueprint  -

The CCDE Practical Exam is designed to assess a candidate’s ability to perform the following
tasks:
Gather, clarify, and analyze existing and new network requirements
•   Identify requirements and determine how they shape the purpose and expectations of a
given network.
•   Demonstrate the ability to gather and validate information about an existing network.
Develop network designs to meet functional specifications
•   Choose the correct technology to resolve a specific network design problem.
•   Create a network design that minimizes or eliminates negative impact on the existing
network and services.
•   Create a network design that is scalable.
•   Create a network design that is elegant and supportable.
•   Create a network design that is resilient.
Develop a plan to implement network design changes
•   Evaluate the impact of implementation options.
•   Develop contingency plans for network restoration.
Convey design decisions and rationale
•   Justify network design choices based on functional specifications.
•   Justify technology choices based on technical requirements.

I used that outline, as well as the reading list to prepare. I think you will aggree with me that if you look soley at the blueprint, that you have to cast a pretty wide net to get all of it. I interpreted this as being so open, that it was like walking with a lantern. Light from the lantern shines equally on everything, so you pay attention to litterally everything. Now, after taking the exam, I gained a bit of perspective on what exactly the developers were looking for. In this case, it would be like exchanging your lantern for a flashlight. Now, while the beam is wide, it is a lot more focused then walking with the lantern.

This perspective on the exam, or more specifically the intent and target market of the exam is invaluable. Well, I guess it is valued at the seven hundred dollars it took to take the exam . Now that I understand what they are looking for, I think I am in a good position to have a decent chance in Febuary if I don’t walk away with a CCDE number in six weeks.

Pearson

Pearson’s professional testing centers were a new experience for me. The center was clean and professional, and the staff was very helpful (including getting a couple tankards of coffee after me explaining it was the lifeblood of us geeks). However the one thing, I didn’t get the same feeling that you get when walking into the CCIE lab. If you haven’t been to the CCIE lab yet, it is almost like walking onto the football field at Notre Dame. Where in the lab you walk past the wall of pain, at Pearson it feels just like sitting down and taking any other written exam.

I do have to warn anybody who is taking this exam in the future though. If you have big feet like mine, be VERY careful of the power plugs. I managed to kick the power plug from my computer just over an hour into the exam and lost all my work. Rest assured the proctors said that the test would keep state in the production exam.

Chicago

Prior to October, I had been to chicago four times. Sadly each of those times was limited to grabbing some spankitopita at the little Greek place at Miday and then flying on to some other part of the country. This was the first time that I had managed to escape the terminal and make it into the city itself.

The first thing that struck me was how Chicago went up and not out. Coming from the west coast where cities grow out and not up, it was very weird to look up and see 1500 foot tall buildings. This urban canyon was mixed in with buildings from the 1800’s. All in all I have to say that it was pretty cool.

All 1500 feet of the Sears Tower

The other thing about Chicago is that the food is AMAZING. In less then a week in the city I managed to put on two well earned pounds. We hit up Merlot on Maple the first night. It was a quaint little northern Italian resteraunt housed in a little brownstone on the southside of Chicago. The second day we hit up Dua, the second deep dish pizzaria in chicago for lunch. Then we went to Lockwood at the Palmer Hilton for dinner.  All these places were amazing, though I have to say that I prefered the down home delicious of Dua to the others.

Deep dish done right at Dua

The last night, it was time to blow of the stress from the CCDE Practical. The CCDE team was nice enough to host a cocktail party on the ninety fifth floor of the Hancock Building.  I managed to deliver a nice little diatribe on Trill, L3VPN’s and security networks a the user and app level vs. stopping at layer 4 while being about one beer past the point where technical items should be discussed. If I managed to get into any heated discussions aboutthe importance of business relevance versus technical optimization then you have my appologies.

Sadly that party ended at 10:00 pm. Luckily Chicago is Brian McGehan’s home town. He recommended Fado’ , a great little Irish pub in the russian hill section of town. Brian, Scott, Gene, Genes wife, Ryan and I headed down there and made a good time of it till 2:00 am in the morning.

Summing it up

Eighteen months of studying culminated in 8 hours of blurry eyes in front of a computer screen trying to figure out a proctor’s intent. Looking around at the people in the waiting room, I saw many people that just blow my brain away. So if they grade on a curve, I am pretty sure I’ll be back in Febuary. Even if it goes that way, it is a good thing, because it just pushes me to learn more and become a better engineer. At the end of the day, I’m all right with that.

Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Cisco Unified Computing System Quoting and Configuration with Netformx

--Colin McNamara

My experience taking the CCDE Practical Beta

Altor networks goal is to provide a single pane view of communications within your ESX clusters, as well as ease access control list creation and deployment. With this single pane virtualization customers should be able to decrease the time needed resolve availability and security issues, allowing virtual enviornments to continue to scale.

This is a sign that we can look forward to many other software vendors adding Nexus 1000v  support to their existing product lines. I wonder who is next ? NetQOS maybe ….

Want to learn more ?

Altor NetworksSimilar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Interesting TechWise TV episode on virtualization
• Arista Networks – Their approach to cloud networking
• Challenges integrating VMware into Cisco networks
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)

--Colin McNamara

Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

The boundary between server team and network team responsibilities has become “fuzzy”

Cisco address’s this issue by putting a switch that can be managed via the same methods common to other network devices inside the ESX cluster. This switch runs the same code that has become standard on Cisco’s Nexus series of Data Center switches – NX-OS.

Prior to adoption of virtualization, when there was a connectivity problem with a host it was quite common for the network team to verify functionality down to the switch port. The server team would do the same. This allowed for each team to focus on areas that met their core competancy. Once we moved from a real switch port, to a dumb bridge inside ESX, lots of finger pointing resulted.

Now, with a Nexus 1000V sitting virtually inside the ESX clusters, the boundary between network and systems teams has been re-estabilished. Now when there is a problem with a host inside an ESX cluster, the network team can use the same day to day troubleshooting tools available to them in other portions of the network to resolve issues faster, and with less finger pointing.

Security controls have been moved further away from the hosts then we would like

A best practice for applying security policy is to apply controls as close to the source as possible. Think of this analogy – Your kids are blasting Radio Disney from their computer. Which of the following do you do?

A. Turn down the speakers at the source

B. Distribute earplugs to all members or the household

Of course, the obvious action is to go to the source, and apply a control (turn down the volume, and tell the kids to clean their rooms). The same principle is valid on the networking side. The best practice is to apply security policies such as VLAN ACL’s and TrustSec policies directly to the switchports that host your switches. Before the Nexus 1000V this was impossible to do in ESX, and forced many environments to move security controls further up into the distribution layer. The side effect of this was that now the security stance from host to host inside ESX clusters was diminished.

The Nexus 1000V brings something called port policies to the table to address this. What these are is pre-configured application security descriptions that are available to you systems administrators to apply in a point and click fashion. Once these policies are applied to the virtualized host, they follow the host where ever it is moved in your virtual cluster.

Provisioning and integrating the networks of VMware ESX clusters with classic networks for most is challenging at best

I wrote an article in march about this specific issue in my post – Challenges integrating VMware into Cisco networks . The core of this issue is that in general that the network integration portions of VMware ESX clusters is not really designed to address server teams , or network teams. In fact, you need to be pretty savy with both portions to successfully integrate VMware clusters into your network. In the real world, you generally find people that are good at one or the other, not both.

By putting a Nexus 1000V in your VMware clusters, you know give the networking teams something they can understand without having to learn Linux, and how it handles bridges (key to understanding ESX networking). With a Cisco switch running virtually inside your clusters, network teams can follow standard core / distribution / access models with the access layer now residing inside the ESX clusters. The network teams can also leverage their existing LAN switching skills for integrating the virtual switches in the clusters with the existing Data Center switching fabrics.

With these roadblocks addressed, Cisco is moving to further the DC 3.0 vision

To realize the DC 3.0 vision, the network inside of VMware clusters had to be under control, and follow the same architectural guidelines that the rest of our network is subject to. With the Nexus 1000V this is now a reality. The next steps withing the DC 3.0 vision to are to extend virtualization and mobility throughout our storage fabrics, and to continue to extend virtualization to the network as a whole, as well as focusing on application virtualization and acceleration to truly realize the vision of cloud computing in the data center.

On the storage virtualization side, Cisco will be using a technology called FlexAttach to enable virtual and physical hosts to change locations in the datacenter without storage team intervention (more on this in a near future post). And on the application virtulization and acceleration side, expect Cisco to continue to enhance it’s existing Application Control Engine (ACE) and Wide Area Application Services (WAAS), and further integrate these into their virtualization offerings.

Want to learn more ?

Introduction to VN-Link network services – Cisco.com

Nexus 1000V overview – Cisco.com

VMware distributed vNetwork switch demo – VMware.com

Challenges integrating VMware into Cisco networks – colinmcnamara.com

Douglas Gourley speaking about how Cisco and VMware will drive Cloud Computing in the Data CenterSimilar Posts:

• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?

--Colin McNamara

Cisco releases Nexus 1000V virtual switch for VMware

Sadly, I have the unfortunate situation of being tagged as an insider (work in the partner community). So I have to play nice, and cannot reveal any juicy tidbits. Suffice it to say, that Jashree Ullal and Doug Gourlay weren’t pulling anyones leg in the past two years when the DataCenter 3.0 vision was established.

Stay Tuned

–ColinSimilar Posts:

• Me and the Nexus 7000 last week at the Data Center VT
• Thanks and farewell to Jayshree Ullal
• Usability features in Cisco’s Nexus 7000
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Sun Project Backbox
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

BIG Cisco – VMware announcement – 1:30 Pacific time

He writes about “the VLAN leaking myth” and how it encourages clients to utilize physically separate network infrastructure in the DMZ’s. Now first things first, I wouldn’t call VLAN leaking a myth. At one time it was a very real and serious vulnerability that was exploited by overflowing the capacity of the switch you were attacking, and causing it to “downgrade” from switch to a hub. Once this happened you now had access to previously protected devices, as well as having the ability to sniff data as it passed through the shared hub backplane.

As he mentions though, this is 8 years ago. Most switches have evolved to the point where backplanes far exceed the traffic that could ever be injected into their switchports. Even beyond backplane enhancements there are many ways to further firm up your security stance – Virtual Device Contexts, not using Layer 3 SVI’s on a DMZ VLAN, utilizing PVLANs, using port security, virtual routing instances, and many more. Of course, there are still many other attack vectors that still remain, but can be mitigated by utilizing features built into the majority of enterprise switches available today.

I think the real question is not “are VLANs safe in a DMZ”. The important question is have you mitigated the probability of compromise (the actual threat) to levels that are acceptable to your business. This question remains whether you have a standalone switch or not. So many times we hear about risk risk and more risk. But risk alone is meaningless in a business context. What is important is combining risk with likelihood. For that I like to use a simple table to come up with the true threat.

For example, as I drive to Fry’s there is the risk of me dying due to a car crash. The impact of me dying is very high (risk) however the likelihood of an accident is low, and furthermore I reduce (mitigate) the latent risk (threat) by wearing my seat belt. So all in all the threat of me dying on my way to Fry’s is pretty darn low.

In a business context this may be that I have public facing web servers and network devices in my DMZ. The impact of them being compromised is that my public image may be tarnished for a short time, and my end users may lose productivity if they are not able to VPN into work, or access the Internet while on premise. I mitigate this risk by using firewalls and both host and network based Intrusion Prevention Systems as well as implementing best security practices on my network and systems devices. The latent risk (threat) remaining is at a level that is acceptable to the business leaders, so the system is allowed.

One question that I have seen coming up more often as we move towards fully virtualized data centers is centered around commingling of virtual infrastructure. There are some hard questions which challenge some practices that we have held true over the years.

• Should you allow sharing of physical memory on a host virtual machine between an internal and DMZ server?
• Should you allow virtual infrastructure from multiple security zones to share a storage array or cluster of arrays?
• Should you allow multiple virtual switches in different security zones commingling on the same ESX or Hyper-V cluster?
• Should you allow virtual firewall and load balancing instances protecting internal and external zones to reside on the same hardware?
• Should you allow virtual routing instances from multiple zones to share a physical infrastructure?

In the past world of standalone systems, the additional cost of providing a wholly separate infrastructure for DMZ environments was relatively low. Each system generally had internal disk, or at most direct attached storage. Network devices themselves were scaled down to support one chassis one function. This fit quite neatly into the Enterprise Composite Network model that was quite common from 1999-2003.

Now, many data centers have moved to the Service Oriented Network Architecture (SONA). In this model the cost of a virtualized data center is primarily focused on foundation elements such as the virtual storage and virtual fabrics, virtualized network, and virtual systems elements. The cost of providing additional virtualized services off these elements is low, however the cost of duplicating the physical infrastructure is quite high on both the capital and operational levels. This is forcing the technical and executive leadership at many companies to take a long hard look at the true threats they are facing in previously physically separate security zones such as DMZ’s, Financial and other secure zones. In the end, they are having to decide whether the threat remaining after their security controls is worth duplicating hundreds of thousands of dollars worth of infrastructure or not.

These are hard questions, with really no single good answer. My gut feel is that over the next few years we will continue the move towards the fully virtualized data center where components such as memory, PCI-X buses, storage and network devices are even further decentralized. This will make the cost of duplicating the infrastructure more and more significant, causing consolidated data center (or compute) fabrics to be the norm. At this point the discussion will move away from securing zones by creating separate infrastructure, to providing end to end security, starting integrated application level security, maybe with TrustSec or a dirivative, all the way down to securing the data at rest on disk. For the time being however, the best we can do is sit down and do an honest appraisel of our security stances, mitigate what we can, and do our best to design data center architectures that provide the flexibility of implementing whatever choice the technical and business leaders agree on.Similar Posts:

• Moving towards a Green Data Center – Truth behind the hype
• Cisco’s Cloud Computing Offering
• About Colin McNamara
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Interesting TechWise TV episode on virtualization
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

Dear Candidate:

On August 27, Cisco will introduce a pilot for the CCIE Routing and
Switching lab exam in Beijing, China. The pilot will add a 10-minute
interview that will assess the candidate's ability to apply expert-level
networking skills and knowledge to networking problems that are encountered
on the job. After the lab orientation, a panel of three experts will conduct
a verbal interview with each candidate, asking a series of expert-level
networking questions (questions and answers will be in English). The ability
to correctly answer these questions will affect the exam score. After
completing the interview, the candidate will have the entire 8 hours to
complete the lab portion of the exam.  These scores will then be
calculated and then combined for a total score which will decide a pass
or a fail.

Our goal with this email is to let you know that your day will extend beyond
the normal testing day by approximately one hour.  The additional hour will
be at the end of the day. We hope you find this interview process
enlightening and helpful as we continue to strive for the standard the world
has come to expect from CCIE.

In my opinion this change is both needed and appropriate. In the past couple years, the two main barriers to entry with the CCIE (access to gear, and knowledge) have been lowered with the abundance of training programs as well as dynamips and it’s derivatives for gear emulation. Where in the past you were looking at a minimum of $8,000 dollars for a full lab, now you can run it on your PC at home.

From what I see, this is encouraging engineers to get their CCIE’s earlier in their career. This in itself is not a bad thing. If an engineer has dedicated themselfs to learning all the in’s and out’s of networking technology, then they really have earned the title. The problem comes when people want to take short cuts. They buy a lab of someone in China, or use other methods to get copies of the lab. To them, passing the lab and getting their number is all that is important, not truly becoming an expert in the technology.

While in the short term this may seem like the quick path to a good salary, in the long term everybody loses. Those who have cheated their way to their CCIE (while few and far between) end up devaluing the cert for the rest of us. And at the end of the day, they are just cheating themselves, and will lose their jobs when their true skills are tested.

It looks like Cisco is seeing the same thing that I have just talked about. This pilot program should go a long way into protecting the integrity of the CCIE for years to come.Similar Posts:

• What does it take to pass the CCIE exam?
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• My experience taking the CCDE Practical Beta
• It’s on like Donkey Kong – CCDE practical registration is open
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• And it begins again – On the road to my CCIE in Storage

--Colin McNamara

Protecting the integrity of the CCIE lab – Verbal Interviews being tested

As a CCDE beta participant on the qualification exam, you have given us your time and feedback and have made a significant commitment to making this a valuable program in the market. As a token of our appreciation for your commitment to the success of the program, if you qualify, we are offering the beta of the practical exam to you at a reduced price of $700, a savings of $280 off the retail price of the beta exam along with a priority seat. Cisco will be offering this beta delivery of the exam on October 1, 2008, in Chicago, IL at a Pearson professional testing center. This is an exceptional offer and opportunity to be one of the first individuals in the world to obtain their CCDE certification.

There is a catch here, and hopefully everyone who is participating is able to pull their heads out of current projects soon enough to catch it.

We can’t keep priority seats forever so we’ll need your commitment by August 1, 2008. After August 1, 2008 you will be registering under open enrollment rules and we cannot guarantee your seat.

That’s right, you have 11 days to reply to the email, or forever hold your peace. In my case, them email is already sent. Hopefully I can talk my VP into letting me take that $280 I “saved” him and apply it to a really posh hotel.

–ColinSimilar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested
• Cisco’s Cloud Computing Offering
• My experience taking the CCDE Practical Beta

--Colin McNamara

CCDE Practical – Beta candidate deadline August 1 2008

The CCDE just got VERY real in a big way.The following announcement was posted in the CCDE zone at the Cisco Learning Network. (If you haven’t checked the Cisco Learning Network out yet, I recommend it. Its like NetPro on steriods, but focused around certifications.)

REGISTER NOW for the BETA Practical Exam
Cisco is now registering beta candidates for the CCDE Practical Exam. Cisco has finished development of the second exam needed to attain the CCDE certification, the practical exam, and is now soliciting candidates for the beta delivery.

Cisco will be offering this beta delivery of the exam on October, 1 in Chicago, Illinois at a VUE professional testing center. Only candidates that have a passing score on the CCDE qualification exam may register and participate in this exam. Exam beta pricing is $980US. Register Now by email at:ccdebeta@cisco.com

For my CCIE, it always seemed like a switched turned the moment I put my credit card information in and secured a seat. Before that button was pushed, it was a “future” item to deal with. Once that button was pushed it was a “now” item. Things like going out, having a beer with the guys, video games, etc all got shut down so my focus could burn a hole in the subject matter.

I just sent in my registration email for the CCDE practical. I’ll be in Chicago Oct 1, ready to give it my all. But, the more important lesson I learned from my CCIE was that if you focus your efforts on your lab day, you will fail. However if you focus your efforts consistently over the months before, you have a chance of passing. Now that my registration email has been sent, it is time to turn that focus dial up, lock to the door to my office and earn the CCDE through months of hard work.

See you in Chicago

–Colin

Similar Posts:

• CCDE Practical – Beta candidate deadline August 1 2008
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• My experience taking the CCDE Practical Beta
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested

--Colin McNamara

It’s on like Donkey Kong – CCDE practical registration is open

Of course, it was all worth it. Some people see networkers as primarily an opportunity to prepare for a certification. Others got to learn something completely new. Some even go just for the world of solutions and the various booth babes. What I value the most is the opportunity to see old friends, and make new ones, to sit down with someone you have just met and have a half hour conversation on distribution / access layer technologies, or just throw some darts. No matter what, the goal is to connect, learn and collaborate with my peers. This year, I can say that these goals have been achieved. See you next year at the Moscone Center in San Francisco at Cisco Live Networkers 2008.Similar Posts:

• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• What does it take to pass the CCIE exam?
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• VMworld 2009 Schedule

--Colin McNamara

Heading home – Cisco Live 2008

Similar Posts:

• Cisco Live 2009 – Networkers class schedule
• CCDE Practical – Beta candidate deadline August 1 2008
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• BIG Cisco – VMware announcement – 1:30 Pacific time

--Colin McNamara

No one told me there would be a monsoon – Cisco Live Networkers 2008

Luckily we made it to the party without dying, ePlus is safe for the time being. It was nice to have Cisco show appriciation to their biggest chearleaders, and even better to run into your peers and share a drink.

The venue was nice, though I am sure in retrospect that the organizers now now that if you pack hundreds of nerds in a room with video games and beer, there is bound to be a line. The party itself did seem to die out pretty quickly, but I do have to thank the folks at Cisco for taking the time to put the vent together for us.

Next year, Cisco is on its home turf. I think I’ll be the first to put my vote into the suggestion box. My vote is for Conference Room “G” . Where ever it does end up, lets look forward to seeing each other again next year.Similar Posts:

• VMworld 2009 Schedule
• Weddings, Measles and Podcasting -
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Live 2009 – Networkers class schedule
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Witch fire in San Diego – Notes from an evacuee

--Colin McNamara

CCIE Party 2008 Recap – Cisco Live Networkers 2008

Where would you use these ?

You want  your custom application to be able to react, and act on network specific information. Integrating both at a very close level. Fundamentally your application can dynamically reconfigure your router in reaction to network events.

You want to remove common services such as AAA, Syslog, DHCP, etc, IVR apps, Unified communication apps all at the branch office in the ISR. If there is a failure, your router can dynamically reconfigure around that.

AXP architecture

Base Cisco Linux os, IOS CLI, Virtual Instances, C++, Perl, Java, OSGI, Bash. Fundementally this is very similar to a fedora core 4 systems doing paravirtualization.

API Fun – What can it do

1. You can query and change both the router and the network module
2. Leverage Embedded Event Manager (EEM) to trigger events on changes, and react to network events.
3. Network Packet monitoring .. Sniff, Sniff, Sniff

My Questions –

1. How do I automate network updates, similar to YUM?
2. Is Cisco using KVM for paravirtualization?

Similar Posts:

• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Cool new features in 12.4(15)T
• Will Cisco succede where Sun has failed?
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• User experience testing – enhanced
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Application Extension API notes – Cisco Live 2008

NX-OS / DCNM XML API Fundamental Technology

Netconf – platform for secure communication of XML data between DCNM / NX-OS and mgmt station.

XML, using clear text tags, creates a self describing API. This is necessary because of the confusion and unneccessary complexity inherent in the current SNMP MIB based structure commonly in place today.

Webservices API = SOAP/XML over HTTPS.

Netconf/XML on NX-OS capabilities.

• Must be run over SSH
• Maximum of eight concurrent NetConf Sessions per nexus virtual device context.
• Every single CLI capabilities is assigned a XML tag

JMS is supported in DCNM as wel as NETCONF

• Native integration with IBM Message Queue

Similar Posts:

• Arista Networks – Their approach to cloud networking
• Challenges integrating VMware into Cisco networks
• Interesting TechWise TV episode on virtualization
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Cool new features in 12.4(15)T
• Cisco Nexus 5020 and 5010 FCOE video ordering guide

--Colin McNamara

Cisco Nexus NX-OS and DCNM XML API’s – Cisco Live 2008

In that spirit, my schedule is listed below. If you are in the area, it would be great if you would stop by and say hello.
“6/23/08″ “11:00 AM”"Certification Exam  –  Certification Exam”
“6/23/08″ “1:30 PM”"BRKCCT-1001  –  Contact Center Welcome Session: Focusing on the Experience”
“6/23/08″ “5:00 PM”"WoS Reception 1  –  Welcome Reception in World of Solutions”
“6/24/08″ “8:00 AM”"certification focus group  –  certification focus group”
“6/24/08″ “9:00 AM”"BRKITI-1031  –  Cisco Data Center 3.0 Strategy and Business Impact”
“6/24/08″ “10:00 AM”"GENKEY-1001  –  Keynote and Welcome Address with John Chambers”
“6/24/08″ “12:00 PM”"ITIPCS-1015  –  NetQoS: Getting the Most from Cisco WAN / Application Acceleration Technologies”
“6/24/08″ “1:00 PM”"BRKDEV-1221  –  Applying Cisco’s Nexus Operating System (NX-OS) and DCNM APIs to Emerging Data Center Infrastructure”
“6/24/08″ “2:00 PM”"BRKDEV-1001  –  Cisco Application eXtension Platform”
“6/24/08″ “3:00 PM”"GENSSN-1001  –  Super Session: The Power of Collaboration Panel”
“6/24/08″ “4:00 PM”"BRKSEC-3007  –  Solving Security Challenges with Embedded Event Manager”
“6/24/08″ “7:00 PM”"BRKAGG-2001  –  Multiservice Edge Architectures and Solutions for Service Providers”
“6/25/08″ “6:00 PM”"CCIE Appriciation  –  CCIE Appreciation part – Nascar Grill”
“6/25/08″ “9:00 AM”"BRKDEV-1111  –  Location Based Services using Cisco Location API”
“6/25/08″ “10:00 AM”"GENKEY-1002  –  Cisco Technology Keynote with Padmasree Warrior”
“6/25/08″ “12:00 PM”"ITIPCS-1019  –  Fluke Networks: General Parts Uses Embedded IOS Technologies to Successfully Manage Inventory at Retail Locations:
“6/25/08″ “1:00 PM”"BRKDEV-1051  –  ANA Technical Session and Demo”
“6/25/08″ “3:00 PM”"GENSSN-1002  –  Super Session: The Data Center–Evolution and Transformation:”
“6/25/08″ “4:00 PM”"BRKDEV-1131  –  Customer Voice Portal Application Development”
“6/25/08″ “8:00 PM”"Customer Event  –  Customer Appreciation Event”
“6/26/08″ “9:00 AM”"BRKITI-1034  –  Realize Business Goals through Network Architecture Solutions”
“6/26/08″ “10:00 AM”"GENKEY-1003  –  Closing Keynote Address and Guest Speaker, Ben Stein, Actor/Writer/Columnist”
“6/26/08″ “1:00 PM”"BRKCCIE-3003  –  CCDE: The Cisco Certified Design Expert”
“6/26/08″ “3:00 PM”"BRKDEV-1171  –  Managing  Network Performance using the New IOS Data Collection Services”
“6/26/08″ “4:00 PM”"BRKDEV-1181  –  Configuration and Provisioning using IOS  XML API”Similar Posts:

• Cisco Live 2009 – Networkers class schedule
• Cisco Live 2010 Schedule
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• It’s on like Donkey Kong – CCDE practical registration is open
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• About Colin McNamara

--Colin McNamara

I’ll be at Cisco Live 2008 (networkers) in Orlando all week

This is the first step towards sitting for a practical examination that will hopefully be released this October. And, in response to Micheal Morris’s blog post – Yes Mike, I can pass the CCDE written.

The second big item on my todo list was to recertify my CCIE. Thankfully, Cisco counts the CCDE written towards my recertification requirements. I am waiting for the system to update, but I think this will set me up to be certified till June of 2011.

There is one interesting side effect of passing my CCDE written the week before networkers. I had originally planned on using the free exam at networkers as a “safety” exam in case I struck out on this attempt. Now of course, that is not necessary. Since I am already a CCIE, there isn’t much incentive to take a professional level exam.

So, after weighing my options, I have decided to take the CCIE Service Provider written. It covers much of the MPLS / IP Next Generation Networks material that I have been studying. I only have 7 days to prepare, so the odds are against me. However, with the heavy service provider focus in the CCDE blueprint, I have a feeling after I battle the CCDE practical I will be set to roll right into the CCIE Service Provider lab.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• My experience taking the CCDE Practical Beta
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• What does it take to pass the CCIE exam?

--Colin McNamara

Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

From Roberts article on networkworld

Ok, so Ethan doesn’t believe in violating the NDA that he had to sign umpteen times to get where he is now, but he’s promoting the use of Testking (a well known cheating tool) to “study” for his CCIE.

As a CCIE, I am obviously supportive of Cisco’s efforts to maintain the integrity of their (and my) certifications. And yes, Ethan was not exercising the best judgment by posting about Testking in a comment on his blog. Is that a reason to start a fire, and try to get his CCIE revoked? As a CCIE, my vote is a resounding no. While Ethan definately made a bonehead move, it does not change a couple things.

1. The CCIE written is just a gating exam, meant to limit the CCIE lab to individuals that have a chance (a notably slim chance) of passing the actual lab.
2. The CCIE exam, and its proctors are amazingly effective at weeding out cheaters. Yes, every once and a while a cheater manages to get through. But trust me, these guys get eaten alive when they look for employment.
3. Cisco has its own enforcement team and methods for finding cheaters, they have managed to keep Cisco certifications from devolving into the land of the MCSE. I think we should trust them to do their jobs, and more importantly trust their discretion.
4. Ethans site documented a very thorough preparation process as he walked the long road towards his CCIE. Sadly his site has been taken down, but in my opinion this shows that he put significant preparation in, and earned his number.

My take on things is that Ethan the target of a marketing scheme. From what I can see, Roberts efforts here are not focused on supporting Cisco’s certifications. It looks to me that he is trying to drum up traffic to his business. If you look at his products, there are $995 – $4,999 fee’s to become a “VIP site”. For your payment, you receive a seal of approval and a listing in the “VIP” area of his site.

Sadly, I have seen this scheme before in the photography world. Certain photographers have been known to set up review sites of other photographers. They build Google Page Rank (PR) on their site so they show up in searches relevant to their competition. Once they start showing up in those targeted searches they sell “VIP” listing or reviews. The photographers that pay up to become “VIP” members ensure that no bad reviews of their buisiness are put up on these sites.

Robert is running the same quasi extortion scheme, but for training vendors. I think this demonstrates a lack of integrity on Roberts part. There is no excuse for attempting to destroy Ethans name in order to make a few bucks. I refuse to condone his behavior and would hope that the editors at Network World feel the same and remove his blog from their site.

Ethan – If you read this, I hope you realize that me and others like me are on your side. You have obviously put stellar effort into both studying, and documenting your efforts. It is obvious to any reasonable person that you have earned the title of CCIE.Similar Posts:

• Certguards inflamitory post about Ethan Banks removed from Network World Magazine
• Featured on Network World – 20 useful sites for Cisco networking professionals
• What does it take to pass the CCIE exam?
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Updated CCIE numbers

--Colin McNamara

Certguard, Ethan Banks, Network World and Common Sense

When I work with data center infrastructure I expect the following – clean, remotely manageable, secure devices that runs on the same power and similar cabling, and everything can have a 24×7x4 support contract for hardware replacement. For the most part, you get this when dealing with Cisco, HP, Sun and similar manufacturers.

More often then not (with a few very cool exceptions), when I run into video surveillance infrastructure the video management infrastructure runs on some random third tier manufactured server. It never fails that the video management software is on Windows (normally XP or win2k). I have even seen some systems where the vendor requires you to have a session open to run the software.

And then when you get to the encoders themselves, it never fails. You have two choices.

1. The Uber package that can run a Casino, Identify and track dust mites , and if you point it at space, determine if there is life on mars.
2. Individual dinky encoders that run one or two camera’s each. They have limited encoding choices, limited camera control, no remote management, and normally run on 110 volt system that require different power distribution then the 220 that is common in systems today.

Cisco’s answer to this mess

Cisco has released both a video management solution, as well as a video encoding solution in a network module form factor for the Integrated Services Router (ISR).

The first part of this system, the Video Management and Storage System (VMSS) module fills the following roles -

• Management of multiple video streams from one interface, including IP cameras, 3rd party encoders, and streams from Cisco’s video encoding module
• Streaming of live and archived footage through a web browser interface
• This one is pretty cool – The module can mount external storage via iSCSI. So, in addition to its 160 gig internal drive, you can mount a filer and utilize external storage to scale the system.
• “fast forward” to events, as well as notify security and other personnel through SMS and email

The second part of the system (the module on the left in the picture above) is the Analog Video Gateway Network Module (EV-IPVS-16A). It has a couple functions -

• It can take up to 16 analogue video inputs and encode them with MJPEG or MPEG4 codecs
• You can use the first two ports to output video to a external monitors
• If you are using MPEG4, it can be used as a motion detector (handy for fast forwarding to important events, or triggering alerts)
• It can control pan and tilt cameras. This is good for pointing the camera at the janitor unplugging your servers each night to vacuum
• You can configure analogue contacts as an alarm. This can be bound to a door switch, or even temperature and water level monitors in a remote data center. This one will be very handy.

The third part of this solution is Cisco’s Video Surveillance Operations Manager. It manages, archives, displays and distributes the content that was created and collected on the two previous modules. You would use this if you had many branches to aggregate, or needed to staff a video wall (e.g. casino gaming commission operations). Now, you can run each of these components individually. Buy run together as a whole, Cisco has an enterprise class security solution.

Want to learn more ?

Branch office security page on cisco.com http://www.cisco.com/en/US/products/ps9671/prod_module_series_home.html

Cisco’s product page for the Video Managment Module – http://www.cisco.com/en/US/prod/collateral/modules/ps9671/data_sheet_c78_462225.htmlSimilar Posts:

• Interesting TechWise TV episode on virtualization
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• About Colin McNamara

--Colin McNamara

Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

UPDATE  – Sorry for the RSS spam, I have been playing with twitter (and frankly am failing to see its draw) and setup twitter tools to integrate my blog with my twitter microblog. I apparently left the create daily twitter summaries on. My appologies for the RSS spam.

–ColinSimilar Posts:

• Fibre Channel over Ethernet is taking off
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Unified Computing System Quoting and Configuration with Netformx
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Twitter Updates for 2008-06-05

1. Layer 2 Tunneling Protcol (V3) static and hairpin configuration example - my buddy Rick was nerding it out in the lab and sent a great configuration doc for L2TPv3 my way. L2TP(V3) is used to create a layer 2 psuedowire across layer 3 routed links. This is a great service provider tool that you can use in your own network, no MPLS needed .

2. SNIA Education – Fiber Channel Over Ethernet – There is a lot of buzz going around right now about Fiber Channel Over Ethernet (FCOE). There is also a lot of misunderstanding about the fundamentals of this architecture. This Storage Networking Industry Association (SNIA) does an outstanding job of covering FCOE at both at an architectural level, as well as going over low level messaging structures.

3. Trill (Rbridge) architecture – IETF internet draft – I think the last time I was this interested in an internet draft was when iSCSI was first being proposed in the IP Storage working group. Trill, in my opinion is basically a light weight version of MPLS / VPLS. It has as far as I can tell most of the advantages of this architecture, without some of the configuration and hardware requirement drawbacks. Fair warning, reading this document started a doc hunt that killed my Saturday.

4. Cisco’s Security Response to Sebastian Muniz’s IOS rootkit – Security is a very important aspect of network design. Sebastian’s IOS rootkit demonstration is going to force some customers who in the past have been “OK” with having older, possibly vulnerable IOS versions floating around to update their operational practices and start keeping their routers and switches operating systems as often as they do their servers. Thankfully, Cisco has been embracing technologies such as kernel virtual machines, in service software upgrades and more to lesson or remove the impacts of software upgrades.

5. Turning Wounded Warriors into Network Ninja’s – As a former Marine (well, always a Marine, formerly employed by the USMC) this program goes straight to the heart. Cisco is partnering with Naval Medical Center San Diego (NMCSD, or Balboa Naval Hospital for us locals) to provide technical training to Marines and Sailors who have recieved service ending wounds in Afghanastan and Iraq.Similar Posts:

• Fibre Channel over Ethernet is taking off
• Cisco Live 2010 Schedule
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Zone based IOS firewalls
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

--Colin McNamara

Link Round Up – L2TPv3 FCOE Trill Wounded Warriors

Please join me in welcoming John McCool to his new position as the leader of (in my opinion) Cisco’s most strategic business units. Similar Posts:

• Thanks and farewell to Jayshree Ullal
• Jayshree Ullal takes the helm of Arista Networks
• Cisco Nexus 4000 Blade Switch
• Certguard, Ethan Banks, Network World and Common Sense
• How to succede in 2007 – By Tim O’Reilly
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors

--Colin McNamara

John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)

Please join me in thanking Jayshree for all the positive contributions she has given to Cisco and the industry, and wishing her the best in her future endeavors.

Similar Posts:

• John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)
• Jayshree Ullal takes the helm of Arista Networks
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Cisco Nexus 4000 Blade Switch
• Cisco releases Nexus 1000V virtual switch for VMware
• BIG Cisco – VMware announcement – 1:30 Pacific time

--Colin McNamara

Thanks and farewell to Jayshree Ullal

Legal implications of a breach

Losing control of personal data means means more then just replacing a tape in your backup rotation. Laws vary from state to state, however generally you are required to contact the identity holders who were breached, as well as fund some sort of remediation. This has huge implications on consumer confidence, and at the end of the day stock price of your company. In some cases, such as ChoicePoint a company can be completely decimated by a breach.

Data protection regulations

There are an ever increasing number of regulations that concern the control of sensitive data. These can vary from laws focused on patient data, to financial data, to personal identification data. The most most well known laws are HIPPA, GLBA, and Sarbanes Oxley (SOX). Past that there are laws that pop up every day at the state and municipality level that further increase the requirements and expense of dealing with a breach. In short, it is becoming an expensive and in some cases criminal offense to lose control of your sensitive.

What you can do to protect your backup tapes

First things first, putting a lock on that Iron Mountain box is just not good enough. You must assume that no matter what, a determined attacker will get physical access to your tapes. So many times companies thing that just because their data format is unique or proprietary that an attacker won’t be able to access it. The cold reality is that any format can be read, and yours is not that special.

The only way to be assured that your data is safe is to encrypt it with a complex cipher. In short, you need to treat your data the same way on tape as you would if it was sitting on a public ftp site (with anonymous access enabled). Luckily Cisco has a technology that allows you to encrypt and decrypt your data coming on and off tape. This technology is storage media encryption.

Cisco Storage Media Encryption (SME)

Cisco’s Storage Media Encryption (SME) technology allows for the seamless encryption of your data flows on and off your backup tapes using AES256 standard encryption. Whether you have VSANS segregating your data, a core / edge architecture, or Virtual Tape Libraries (VTL), you can use SME to protect your data at rest, removing the possibility of an attacker getting access to your critical data.

Storage Media Encryption works by leveraging a multifunction chipset available in the 18/4 module that comes default with the 9222i and is an option for the 9500 series director class SAN switches. Chipset has a couple functions, including line rate encryption of iSCSI and FCIP data streams at gigabit speeds, as well as line rate encryption of data as it streams your tape or virtual tape library’s (VTL).

Want to learn more ?

SAN and NAS, Oreilly Press – In the classic Oreilly style by W. Curtis Preston, this book is a great starting place to understanding the fundamentals of San and Nas architectures that many people are likely to face.

Storage Media Encryption for Cisco MDS SAN Switches – http://www.cisco.com/en/US/products/ps8502/index.html . Cisco has lumped together a couple good data sheets here, though I may have to write a future article taking a deap dive on what really drives SME.Similar Posts:

• Identity aware networking using Cisco TrustSec
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• My CCIE Storage Shopping List
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• How to succede in 2007 – By Tim O’Reilly

--Colin McNamara

Encrypting your backup tapes with Cisco Storage Media Encryption (SME)

This switch answers a fundamental problem that has been presented by blade centers and VMware. The problem is increasing density of 10 Gig Ethernet, as well as the creation of SAN islands to provide storage access to VMware ESX clusters.  The nexus 5020 provides a solution that address both of these challenges, as well as supporting Fibre Channel Over Ethernet (FCOE) for the eventual move to a consolidated data center fabric in the years to come.

Want to learn more ?

Mastering VMware Infrastructure

Nexus 5020 Video Data Sheet

Unified Data Center Fabric whitepaperSimilar Posts:

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Cisco Nexus 4000 Blade Switch
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Fibre Channel over Ethernet is taking off
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel

In the past couple years, VMware has changed from a product hidden in development and testing environments to a full fledged enterprise computing platform. It brings many benefits to the companies that implement it, however with those benefits come changes to the access layer of your data center. Your access layer is no longer a top of rack Cisco switch, or end of row aggregation chassis. It is now a virtual bridge that exists logically within your VMware ESX server.

This causes an interesting question to come up in many customers – Who is responsible for the configuration and maintenance of this Vswitch? At first glance most groups reference the port on the last Cisco switch as the division of responsibility between network operations and systems operations. This has worked well in the past for a three main reasons.

First, it divided responsibilities based on technical skillset. For example a network engineer understands spanning tree, trunking, routing protocols, firewalling. While a systems engineer understands file systems, databases and Linux and Windows operating systems.

Second, it provided for a interconnection point where standardized configurations could be applied by an operational group, versus complicated configurations that could impact overall network designs and require an architectural board review.

Third it provided for a clean hand off for troubleshooting. Both network and systems operations could agree on layer 2-4 functionality in an area that provided for detailed debugging on both sides.

Lack of a defined access layer

VMware ESX throws a wrench in this model. We no longer have this well defined edge at the access layer. The access layer now exists virtually inside a server. More specifically, it is a logical devices running in a Linux server. This presents a challenge because it requires cross over knowledge. Whoever is responsible for this integration has to be fluent in Linux systems administration , and also fluent in network design and operations. Frankly this is a rare skill set to come across, as it requires and engineer who has attained high proficiency in both systems and network engineering.

I see this fuzzy line of demarcation often as a failing point for many VMware integrations. Many times I see network operations teams not involved in ESX cluster design because its a “server” , and systems operations teams generally don’t have the networking skills necessary to design and implement an fully functional system.. The solution to this problem is education and collaboration.

The need for collaborative design sessions

The single most powerful element in a successful VMware integration is the creation of strong design documents. These are created by holding planning sessions where both your systems and networking leads hash out a strong design that takes both short and long term virtualization and network goals into account. Also, many times when people hear the word design, they think it is a high level Visio and a bill of materials. That is a just a fraction of the effort required. A proper design should cover everything from a 10,000 foot overview Visio down to protocol flow diagrams and configuration examples. By created a detailed design like this it is likely to bring up common issues such as 10 gig aggregation, trunking, VMotion security, layer two adjacency and layer 7 network service delivery on a white board instead of a production environment.

To create this detailed design, both your Network and Systems leads have to understand this product. VMware recognizes this is critical to successful implementation (and to further sales of their product) an offers the VMware Certified Professional certification. If you have the resources, I would recommend sending both your network and systems leads to this training at the same time. Having them attend training together allows them to leverage each others strengths and bring up questions specific to their network and their goals.

A real world example of this is the company I work for, Eplus. Last April forty of us, all senior engineers attended VMware Certified Professional training at the same time. The class was mixed up so there was an even distribution of CCIE’s, Systems Experts, and Storage Experts. Needless to say this presented our instructors with some extremely challenging questions, but more importantly it set the stage and created a venue for collaboration between these different practices within our own company.

Real world benefits

A great example of this model’s success this occurred last month. Rick and I were sitting in the engineering side of our Sunnyvale office, catching up on email after giving presentations at Cisco that morning and afternoon. In the bullpen behind us, one of the Microsoft architects was engrossed in a troubleshooting call with a large customer on the other line. It turns out a large systems vendor (who shall remain nameless) had been trying for a week to integrate the first ESX cluster into this network and just could not get the networking portion to work correctly. Our account manager received the call from a the customer, and asked the technical teams to step in to see if we could help out in any way.

The systems engineers were able to isolate the problem down to the network interconnections, but needed to bring in networking resources to resolve the problem. Rick and I were waved over and were given an overview of the problem and introduced us to the customer the far side of the call. We asked a few questions about the physical and logical architecture of their network and created a diagram of their network on the whiteboard. With this we were able to ask them to execute commands continuously isolating the problem domain until we found and resolved the issue.

Seven minutes had passed from the point Rick and I were waved over to the point the customer had a working installation. This allowed the customer to focus on moving their business forward instead of fixing a failed implementation. Three of us on the call had attended VMware Certified Professional training together. We had spent at a minimum 50 hours each creating a baseline of understanding in class, as well as many discussions in engineering meetings. The solution came in seven minutes not because of any one teams individual strengths, but because of collaboration. The systems engineers were able to isolate the problem domain very specifically. And as network engineers trained on VMware were able to quickly understand and digest the issues, and tie it together with our larger understanding of networks as a whole. Only at that point, when the team was able to leverage each others strengths were we able to address the problem so quickly.

There will come a point in the next few years where this fuzzy boundary between the “network” and the “server” is established again. My call is that this will coincide with Cisco finishing development of their Vswitch that will reside inside the ESX server. This switch will require both Cisco and VMware improve their design and integration guides for ESX which are both frankly lacking substance. Until those detailed architecture, integration and troubleshooting guides exist the key to successful ESX cluster implementation will be a strong cross trained systems and network teams that are collaborating on the next level of virtual network design in your enterprise.

Want to learn more?

Cisco – Integrating Virtual Machines Into Cisco Data Center Architecture

This is Cisco’s main design guide regarding the integration of virtual machines. You can use it as a decent high level overview if you are a network engineer who is curious how VMware ESX, or Xen servers for that matter will fit into your network.

VMware – Virtual networking Concepts

This VMware document goes between high level overviews and detailed descriptions. It is a decent resource for a network engineer, and provides an overview of ESX network features, however it misses the target for providing configuration examples.

Blog of Scott Lowe – Technical Lead for Virtualization at Eplus Technology

Scott is an engineer that works with me at Eplus Technology. He is based out of the east coast and covers servers, storage and virtualization. His blog is chock full of good of information. A recent post of interest was how to enable Cisco Discovery Protocol (CDP) on VMware ESX server network interface cards.Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Arista Networks – Their approach to cloud networking
• Resume – Colin McNamara, CCIE #18233
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem

--Colin McNamara

Challenges integrating VMware into Cisco networks

IOS-XE is takes the best elements out of Internet Operating System (IOS) which has its roots in a closet at Stanford, and combines them with the most successful open source technology ever – Linux. Cisco is leveraging Linux virtualization technologies such as Kernel Based Virtual Machines to protect against operating system failures as well as to allow for In Service Software Upgrades (ISSU).

To really appreciate this, we first have to dive down into the overall architectural changes of the ASR1000. The largest change that Cisco has made was to implement separate forwarding and control planes. In the past, Cisco routers would have the processes responsible for forwarding traffic, and the processes responsible for configuring the router running on the same root operating system. The side effect of this is that if you want to upgrade the root operating system of your router, you are going to have interrupt the traffic flowing through it to do so, or have a physically separate route processor to take over while you rebooted. This is a big headache operationally, and effectively forced engineers to design in separate physical chassis to meet high uptime requirements.

What Cisco has done to address this, was to mirror changes made in their storage and carrier routing portfolios. Both of those product lines utilize the operating system to push commands into advanced processors that exist on the line cards themselves. The ASICS on the line cards are designed to work in a distributed fashion, so that production traffic never goes into up into the router processor (or sup engine). This in effect ensures that the control and forwarding planes can exist as independent elements.

If you look at the graphic above, you will notice 3 main zones. The upper zone is what we would normally describe as the control plane. This is where the higher level functions such as your routing processes, ssh daemons, snmp daemons, and shells live. In short, if you you configure or read something, you are going to do it here. The only time traffic flows through this plane is when you are doing a thing called process switching. keep in mind this is a rare occurrence and usually occurs because of an oversight in your network designs.

By separating the control and forwarding planes, this allows Cisco to basically run a management station on the router, that programs chip sets in the line cards on the fly. This in my opinion is where the true power of this architecture comes through. By separating the two functions the software engineers are free to utilize powerful open source technologies such as Kernel-based Virtual Machines, and the Linux kernel, while letting the integrated circuit engineers design blazing fast chips which allow full functionality at line rate.

What benefits should we receive from a virtualized control plane? First, in larger routing and switching chassis (including the top end of the ASR1000 line) you normally have physically redundant route processors (RP)/ supervisory engines(SUP). The operating systems on these RP’s synchronize many things, including configuration, process state, routing tables, security associations and much more. The primary reason for this, is if you have a failure in the active RP, you can failover to the standby RP without interrupting traffic flows.They also can be used to streamline the software upgrade process by only upgrading one RP at a time, and then gracefully transferring traffic to it. Once proper operation is verified, the backup RP can be brought up to the same code revision.In any production environment this is highly desirable, and helps immensely in the battle for five nines.

The ASR1000 takes the redundant RP concept seen in high end chassis, and allows you to implement redundant upgrades, as well as protection against software failure, with only one physical route processor. This is done by utilizing Linux kernel virtualization. Instead of running the control plane directly on the production hardware, a small kernel is inserted. Booting from that are two copies of IOS-XE. These run independently, and synchronize state and configurations just as if you had two physically separate route processors. What this means in operational English, is that where in the past, you would have to either have two devices, or a larger device with redundant RP’s to upgrade without disruption, you can now have that same ease of maintenance, in a much smaller (and at the end of the day, less total cost) package.

Below this is the forwarding plane.It plugs into to a high speed interconnected fabric which all line cards and RP’s are redundantly connected to. In the diagram above, this is the bottom level. Items in this plane include buffer memory, Cisco Express Forwarding (CEF) ASICS, and now the new QuantumFlow processor. This is normally where you would find your DCEF enabled line cards, fibre channel and Nexus7000 line cards, as well as the modules for the ASR1000 routers. When properly utilized, traffic should be relatively isolated to this tier, and function independently from the control plane.

The shining star of the ASR1000’s forwarding plane is a group of chips that is referred to as QuantumFlow. The QuantumFlow architecture itself merges Cisco’s strength in integrated circuit design, with its strengths in IOS software design. In the past, Cisco would design ASICS’s for specific functions, and then write commands down into them. This has worked very well, until they point that a new feature came out that couldn’t leverage the fixed configuration of an older ASIC. Your choice at that point was generally to process switch for that feature (which is slower, and honestly bad form), or upgrade your cards to the newer ASIC design. The QuantumFlow chipset approaches this problem from a new angle. The first chip in the set (Popeye) is designed to be field programmable in C, as well as no fixed internal pipelines. This combined with utilizing 40 cores running between 900 and 1200 megahertz allows the programmers to utilize parallel processing techniques to utilize an immense amount of processing power in real time.

To put things into perspective, remember when you got your first multi core laptop or desktop. You were able to say watch a DVD, as well as compile code at this same time, while continuing to have a responsive workstation. Now imagine what you could do with a 40 core processor. This is the kind of power that we are talking about. Now imagine, that not only is your workstation immensely powerful, but you could also offload common jobs such as running daily builds, or encoding videos to another machine (or in this case processor.

In the ASR1000 this processor is called Spinach (yellow are in the graphic above). And of course just like the cartoon, Popeye’s potential really comes to light when combined with Spinach. Spinach is a separate chip, that is used a a traffic manager. This chip handles queueing and quality of service, ensuring that the proper packets arrive at the proper time, as well as interconnecting with cryptographic offload engines so it can equally apply services to encrypted flows.

At the end of the day, the most important question is not how fast something is, or how cool it is. The question is what can it do for me? By leveraging this new architecture the ASR1000 is now able to do line rate inspection of traffic using Network Based Application Recognition (NBAR), Support 128,000 queues for deep quality of service, secure and encrypt data using zone based firewalls and embedded crypto engines, segregate traffic using MPLS, integrate advanced voice and video functionality, as well as providing fulling Netflow v9 support for all of the above. It provides all of these services in an always on solution utilizing Linux virtualization, as well as leveraging an flexible chip set architecture that allows for field programmable improvements in the future.

My hope is that after reading this article that you are in a better to understand how Cisco is leveraging open source technology and integrated circuit designs to improve the foundation of the internet. In upcoming articles I will be discussing design scenarios utilizing this features in this product, as well as highlighting other areas where Cisco is embracing both open source technology, as well as open architectures that can properly leverage projects such as Linux, Ntop, Wireshark and more. If this article has you interested in learning more about some of the technologies mentioned today, then I encourage you to check out some of the links below, or shoot me and email to be highlighted in a future readers questions article.

Learn more about Linux Kernel-based Virtual Machines

Learn more about Cisco’s ASR1000

Learn more about Cisco QuantumFlowSimilar Posts:

• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Application Extension API notes – Cisco Live 2008
• Arista Networks – Their approach to cloud networking
• Zone based IOS firewalls
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

--Colin McNamara

Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers

Mike Writes -

“Hi Colin,
I’m an avid reader of your blog and had a question that I figured you could answer. I don’t have CCIE knowledge like I’m sure a lot of your readers do. I have worked for the same company for 6 years and during that time had been promoted into the Network Group where I was sent through class and earned my CCNA. The company I worked for decided to relocate across the country and so I have been looking for a new job. Finding a new job doesn’t seem to be that big of a deal but I noticed a lot of job descriptions are asking for BGP experience. We didn’t use BGP at my last job and I thought BGP is used primarily by ISPs for routing between Autonomous systems? If that is the case why do so many non-ISP companys list BGP experience in Networking job descriptions? What are they doing with it? Shouldn’t the ISP be doing the BGP routing for them?
Thanks!
-Mike”

Well Mike there are 3 primary reasons why a company would require (or want) BGP knowledge from its candidates.

Scenario 1. The company has an redundant Internet edge.

In this case lets call our company sample_company. Sample_company has its website hosted in a publicly facing DMZ and wants to make sure that its web servers are available in the case of an ISP failure. Normally in this case the company would request and Autonomous Systems Number (ASN) from ARIN and would get assigned a block of publicly routeable IP address’s (normally /24) that they can advertise. Sample_company would then peer with multiple ISP’s for example one connection to AT&T and the other to Sprint. Sample_company would advertise their ASN through both these ISP’s, and in the case of a failure of one of their ISP’s, the rest of the Internet would be able to calculate a path to sample_company’s web servers via the backup ISP.

Scenario 2. The company is utilizing MPLS for its WAN connectivity.

From a customer perspective MPLS is a private BGP based WAN where all edge devices connected to the MPLS provider utilize BGP to inject and learn routes. One note, some providers do support advertisement of routes via OSPF and even EIGRP now, but the most common scenario is to use BGP as your internal WAN protocol while running MPLS. One trend I am starting to notice, is that since companies are already using BGP on the MPLS WAN, they have started utilizing BGP as their primary routing protocol for their sites to avoid running multiple routing protocols and having to redistribute into BGP to cross the WAN.

Scenario 3. The company is using MPLS inside their data centers for segregation of business units.

In essence they are using the same tools and technologies that MPLS service providers are, however applying it inside of their data center and campus networks. In this case, BGP is the routing protocol necessary to carry the routes between the seperate MPLS VPN’s that are running inside the corporate data center. While this sounds pretty complicated, it actually simplifies many of the designs that you would normally implement to attain the same goals.

Learn more about BGP - Of course, there are many other reasons why you may see BGP on a job listing, but I think the previous covers the most common. If you are curious, and want to learn more about BGP I recommend buying Routing TCP/IP volume 2 by Jeff Doyle. This covers many great scenarios and configuration examples in EGP protocols. It is also written in plain English which can be a challenge with many technical books.

Learn more about MPLS in the enterprise - If you are feeling like learning about how you can implement MPLS inside of your own enterprise network then I would recommend buying Network Virtualization by Kumar Reddy and Victor Moreno. I was lucky enough to have Rick Davis translate the whole idea of utilizing MPLS in a campus environment into plain English for me a couple years back. From that point I was able to really expand my knowledge base and start asking the right questions from a firm foundational understanding of the technology. Kumar and Victors book took my understanding to the next level, showing how to incorporate many very cool features to make a MPLS network stand on its head if you want to. I can say (and actually have said to Kumar Reddy) that this book redefined my data center designs for large corporate and enterprise customers. I really recommend that you add this to your collection.Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Identity aware networking using Cisco TrustSec
• Challenges integrating VMware into Cisco networks
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Jayshree Ullal takes the helm of Arista Networks
• Arista Networks – Their approach to cloud networking

--Colin McNamara

Reader question – Why are corporations looking for BGP experience?

Cisco TrustSec starts at the edge by negotiating a secure link if both hosts support it (802.1ae). This is similar to wireless encryption schemes, where a secure handshake is established and the L2 path become impervious to sniffing. This is user configurable, and to my knowledge the asics available to support line rate encryption are currently only on the Nexus 7000 blades.

The next step is to start 802.1x negotiations. For the people not familiar with 802.1x, it is a way of passing username / password information from your computer up into the network infrastructure. Once this is completed, the switch can not only utilise tools like NAC to place you into the appropriate quarantine, or access vlans, but it also know knows your identity.

Now the “network” is aware of your identity, a new level of granular security control can be deployed across your infrastructure. These security policies can map into “user x can connect to webserver y” instead of being restricted by ip and port. This allows you to utilize true roles based administration similar to what you use in your Windows and Unix file systems, but now you can do this across the network.

How is this done ? I like to think of this as a mix between dscp and mpls tags. Which in a nutshell means that when traffic enters the network it is tagged with a small amount of additional “identity: information which is retained as it traverses the network. This information can be used to augment or completely replace your current ACL based security controls in a way that enables you to more effectively comply with complex regulatory environments such as PCI, SOX, GLBA and HPPA.

Over the past few years we have learned how to leverage intelligence in the the network by utilizing tools like QOS, MPLS VPN’s, and many others. Expect to add Cisco TrustSec to your quiver of tricks to address the ever growing compliance needs faced by today’s network designers.

Learn more about Cisco TrustSecSimilar Posts:

• Encrypting your backup tapes with Cisco Storage Media Encryption (SME)
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco releases Nexus 1000V virtual switch for VMware
• Zone based IOS firewalls
• Cisco Nexus 4000 Blade Switch

--Colin McNamara

Identity aware networking using Cisco TrustSec

I was wrong, the Green Data Center is not about saving baby seals, it is about saving cold hard cash. Saving the world is just a nice side benefit.

That being said, saving cold hard cash is a very important discussion item in any IT Operations group as they are normally seen as a cost center. For them, a penny saved is literally a penny earned. Not only can you save money by not paying for power, but PG&E will actually has a budget to pay you NOT to use their power. Most people here this and get a puzzled look on their face. “why would the power company, who makes money on power, not want me to buy it from them?” The answer is that Californians use more power then PG&E can produce at peak times. When they have to buy it from another state it can cost them 10 times or more then they charge us. This is the reason why PG&E will pay you to use less. Each penny they give to the consumer for saving a watt, saves them 4 pennies (80% return on investment).

Great, PG&E saves money by giving it to me. How do I get this cash? Well there are a couple ways to get this.

1. Incentives for new buying new energy efficient servers
2. Rebates for moving to virtualized servers
3. Rebates and incentives for moving to thin client desktop systems
4. Audit teams for cooling and power if your Data Center is 10,000 square feet or more
5. Incentives for airflow control systems
6. Incentives for high efficiency UPS and power distribution systems
7. Technical services for cooling system evaluation (PG&E funded)

That is a pretty comprehensive list of how to get money from the power company, but you can save even more money buy not using the power in the first place. Not unsurprisingly this starts with the server.

First thing you can do, is virtualize, virtualize, and virtualize some more. For most people this means VMware. For others this may mean Xen, or Microsofts virtualization product. Whatever flavor you chose, the key message is to consolidate from many servers to few. A server sitting “idle” still pulls 50% of its max current. Now, howe many servers do you have that are just sitting there? My guess is a large amount. By virtualizing these servers, you allow them to be stacked onto high performance server that can be run at a higher utilization. This lowers the over all power utilization for your DataCenter. Another side benefit is that ever watt that you remove from a server, you get another watt removed from your cooling.

These same virtualization techniques can also be applied to your network devices, which account for 6 to 12 percent of your datacenters power draw.

Ask yourself a few questions

• ” Do I need 4 different firewall clusters?”. It is likely that these are leftovers from organic growth, and that you could consolidate them into virtual firewalls on a more efficient chassis (ASA comes to mind).
• ” Do I need to maintain physically separate infrastructure?”. There are technologies like MPLS, VFR-Lite, Virtual Switching and more that allow you to consolidate onto a shared network infrastructure, taking a service provider approach to providing transport in your network.
• ” Am I running old inefficient gear?”. Power supplies have increased in efficiency over the last few years. There may be a good return on investment for you to upgrade.
• ” Can I consolidate into larger chassis?”. Ask the question, which is more efficient – a closet full of 3560’s or a 4507? There is efficiency in scaling out.

I hope that reading this has caused you to ask some questions, and maybe look at the larger impact of your network operations on both the ecosystem and your operational expenses. With these questions in hand, you might want to talk to PG&E and your Cisco / HP parter about going “Green” in the data center.Similar Posts:

• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Usability features in Cisco’s Nexus 7000
• Cisco’s Cloud Computing Offering
• Cisco introduces the C-Series Rack Servers
• New features in VMware 3.1
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

--Colin McNamara

Moving towards a Green Data Center – Truth behind the hype

For new readers to this site, please you might enjoy the following articles -

Who is Colin McNamara ?

Usability features on the Nexus 7000

Overview of NX-OS 4.0 (the operating system for the Nexus 7000)

Why did I choose to get a CCIE in storage networking?

What does it take to pass the CCIE exam?Similar Posts:

• And it begins again – On the road to my CCIE in Storage
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• created a new map of ashley’s site
• What does it take to pass the CCIE exam?
• Cisco Nexus 4000 Blade Switch
• Certguards inflamitory post about Ethan Banks removed from Network World Magazine

--Colin McNamara

Featured on Network World – 20 useful sites for Cisco networking professionals

What useability enhancements do you feel are the most beneficial?

1. A separate, IP enabled, Management Interface. This has been a long time coming. The out of band management interface is very similar to a Ilo card in the HP world. it is effectively a supercharged console server that happens to site on the backplane of the sup engine. I am sure whoever pushed this feature through is going to get flowers one day from a Tech who DIDN’T lock himself out because the management interface was effectively a separate system.
2. Finally, a functionally USB Interface that I can transfer IOS (well, now NX-OS) images through. Everyone has a USB key nowadays, even my Grandmother has one, it will make life so much easier when I can have a 4 gig key with me that has most IOS / NX-OS  versions and my common configs and just pop them right in.
3. The integrated Cabling system is CLEAN. I love that it forces you to reserve the appropriate space for cabling, and that there finally is the possibility to avoid the flying spaghetti train wreck we see so often in Data Centers.
4. Front to back Cooling. The cooling design is well thought out. I liked the fact that it draws from directly above the front floor and exits rear top.. This should help out in raised floor data centers that have a large temperature gradient as you move to the top of the rack. It also negates problem of having multiple 6500 chassis side to side and having warm air blowing from the exhaust of one 6500 to the intake of another 6500.
5. Fan Slots are now placed where it is IMPOSSIBLE to cover with cables. I would say 7 out of 10 times when I walk into a new customers Data Center I find that there are cables run directly over the fan tray with no slack. That is not a failure in design per say, but it could have been avoided. With the Nexus 7000 fan trays in the back the problem is solved before it is created.
6. Power supplies are in the back . FAR away from the data cabling. It never fails that 20 amp circuits get uncomfortably close to copper cabling. By moving the power supplies to the back side of the chassis, this becomes a mute point and we remove any shadow of a doubt about EM interference causing craziness in our cabling.
7. This one sounds really mundane, but a quick heads up grouping of status lights. In the past these were normally in a position where you had to squat down to see them, or they are obscured by cables. Buy putting them on the front of the cable tray assembly it ensures these will always be visible.

What can we focus on now to make it a better platform?

1. One thing that worried me a little was the placement of the compact flash cards in the supervisory module. For those how haven’t it up close look at this picture of the chassis  and look for the Grey cover midway up the sup modules in the center slots. Behind them are two flash cards, one for system partition extension, and one to dump log files into. Having these cards available are great features however I could see an operational process of security rotating out the log partitions, or more likely and engineer pulling the flash card after dumping some data for analysis to it, and then pulling the wrong card by accident. Having a simple strap (like the screw downs for power supply plugs) or something similar would go along way towards mitigating that risk.
2. Continue with the spirit of innovation that has defined Cisco over the years. Cisco has consistently came out with or acquired and integrated many great products that directly address the needs of the market place into the product line (MARS, ASA, AireSpace, TelePresence, MDS, ACE, Etc) but frankly the last GAME CHANGING product that set the industry on its heals and forced everyone to rethink how we utilize technology to accelerate business as a whole was the acquisition of Selsius and the introduction of VOIP as an enterprise class product to the world. I remember having the hair stand up on my arms from the excitement of going up against Avaya and Nortel back then and fighting that uphill battle, educating customers and peers about this “new thing called VOIP and how CallManager (now Unified Communications Manager) is your ticket towards productivity.

   When we talk about the Virtual DataCenter, I/O Virtualization (FCOE) and VFrame Automation it is not just another incremental improvement of existing technology. It is a paradigm shift, a leap ahead, a GAME CHANGER. I get the same chills that I did when VOIP was new because I know that those are technologies that will force us to rethink how we approach computing and data systems. These technologies are to the Data Center what IP telephony was to the PBX, and Cisco is the only company with technologies and engineering know how in all the verticals necessary to pull this off.

Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Moving towards a Green Data Center – Truth behind the hype
• New features in VMware 3.1

--Colin McNamara

Usability features in Cisco’s Nexus 7000

As with any vendor specific event, there is a mix of for public knowledge and for private consumption content, so I generally choose not to talk or write about subjects that may have been covered in the VT unless I can find some public documentation on that subject. So don’t expect to find any juicy pre-release information or gossip here. I don’t want to have the NDA police knocking at my door, and its just not cool to let stuff slip. So, I will generally avoid the subject.

What I can tell you is this – There is a lot of buzz about the Nexus 7000. It is a rocking platform, and we spent the majority of a day going over it. I can’t share much more then I did the night before the VT just yet (will wait till I get lab access to one) but I can share this.

Yes, most people are proud of their shots with Tom Cruise, or Oprah, Richard Stephens or BSD Girl. But I can Top that.. I have a picture of me and the Nexus 7000.

The DC Channels team was nice enough to take us down to the DataCenter and Network Applications (DNA) lab. Where the Nexus 7000 has taken its new throne. They allowed to ooh and ahh and poke and prod it. Weirdly enough, the one thing that struck most was the attention to detail that went into the physical design of this chassis. It is not only good looking, but has some super usability enhancements that really impressed me.Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Quoted on ZDnet – Shameless self promition
• Humor inside the Nexus 5000 switch fabric architecture
• Cisco releases Nexus 1000V virtual switch for VMware
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• BIG Cisco – VMware announcement – 1:30 Pacific time

--Colin McNamara

Me and the Nexus 7000 last week at the Data Center VT

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Thanks and farewell to Jayshree Ullal
• Jayshree Ullal takes the helm of Arista Networks
• The emergence of MDS features in Cisco’s datacenter networking equipment
• Me and the Nexus 7000 last week at the Data Center VT
• John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)

--Colin McNamara

DataCenter SVP Jayshree Ullal interviewed about the Nexus 7000

One feature that is new, and frankly extremely exciting is Virtual Device Contexts. Each virtual device runs with its own process, vs the use of tagged differentiators in technologies such as VRF-Lite. This provides for paravirtualized management instances, and clear lines of delineation for both software and hardware for a resource that can be shared between different groups within an enterprise.

Chassis that run NX-OS will support In Service Software Upgrades (NSSU) to allow operations groups to upgrade operating systems with zero downtime. This is accomplished through a combination of modular software architecture, and the decoupling for the control and forwarding planes.

One of my favorite features in SAN-OS is the embedded is fabric analyser. This is a tool that can sniff management traffic without having to plug in a sniffer, or provision a span port. You can dump in real time to a tcpdump like interface in the command line, output to a local file, or map to the ip of a wireshark instance that layer 3 access to the management port. Cisco again has taken the best of SAN-OS and bundled it with NX-OS. You will be able to remotely span management traffic without having to set up rspan, or trudge down to the datacenter to set up a sniffer.

Now, your router can call home right now so that is not a totally new feature. Smart Call Home was released recently into IOS. But that still doesn’t stop it from being a great feature. This allows you to configure NX-OS powered devices to mail an xml formatted troubleshooting email to TAC, and / or your support staff. This has been proven to drop the average time to resolution from 16-30 hours to 6 hours.

Now the drum roll…… All IP routing features are VRF aware. This has been a point of contention with me for a while. As Cisco and the market in general has embraced virtualization as an answer to pressing business concerns of leveraging shared infrastructure, while retaining security controls segregating disparate environments technologies such as MPLS and VRF within the datacenter have become more and more prevalent. That is great, however it never fails that the feature you need at that moment always seems to be coming out in the NEXT IOS release. With Cisco NX-OS 4.0 this is no longer a question.

Now, if I was a CIO and I was reading about all these new technologies that Cisco was pushing with NX-OS, I would frankly be cautious, and rightfully so. The thing is, most of these features are not new, they have been in use, and in production under the most stringent uptime conditions in the world – storage networking. They have been tried and tested on Cisco’s MDS line of storage networking switches. So get comfortable, get educated, but most importantly get on board for DataCenter 3.0.Similar Posts:

• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• The emergence of MDS features in Cisco’s datacenter networking equipment
• New features in VMware 3.1
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• About Colin McNamara
• Arista Networks – Their approach to cloud networking

--Colin McNamara

Cisco NX-OS 4.0 | Next Generation Internet Operating System

Highlights of the the Nexus 7000’s features are -

• 15 Terrabit per second backplane
• Support for 40 and 100 gig ports in the future
• Seperate control and data planes
• link layer encryption
• front to back airflow (FINALLY available in a non NEBS chassis)
• Lossless non blocking fabric (VOQ enabled)
• Fibre Channel, Infinaband, and Ethernet blades in one unified platform
• Cisco Data Center Network Manager (MDS Fabric Manager on steroids)
• Virtual Device Contexts (Network Systems virtualization, the next level past VRF route tags)

You can learn more about this switch in upcoming articles, and at http://www.cisco.com/en/US/products/ps9402/index.htmlSimilar Posts:

• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 4000 Blade Switch
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco’s Unified Computing System – It’s not just a blade center
• Humor inside the Nexus 5000 switch fabric architecture
• Interesting TechWise TV episode on virtualization

--Colin McNamara

Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

For the engineering perspective on this, the CCDE is equivalent  to the CCIE. However, the CCDE is focused on design and architecture rather then implementation. Where the CCIE (R&S, Voice, Security, Service Provider, Storage) is focused on implementation, the CCDE is focused more on the pre-sales design and architecture efforts. I am personally looking forward to the lab being released, as it provides a certification to validate the skill set needed to be an sales engineer on Enterprise accounts, or to be a network architect at an Enterprise corporation.

It is funny how small a world it is. Eplus (the company I work for) CEO – Phil Norton was quoted on Cisco’s press release -

“Certifications provide a stamp of approval that validates the quality of our organization’s employees,” said Phil Norton, chairman, CEO and president of ePlus. “The CCDE isn’t about operations; it’s about recognizing the value of network designers and honoring their core skills that provide a real value to our business and our customers.”

My gut feel when I first got invited to the CCDE beta program was that this will become a requirement for the Channel. I think Phil’s statement cements that gut feel into a reality. Obtaining a CCDE will become similar to the CCIE – a check box that you must attain to work with the top VAR’s out there. This makes me extremely grateful that I was lucky enough to be invited into the beta group to be allowed first crack at this gem of a certification.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• About Colin McNamara
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Challenges integrating VMware into Cisco networks
• Cisco Live 2009 – Networkers class schedule

--Colin McNamara

Cisco Certified Design Expert – CCDE – officially released by Cisco

CERTIFICATIONS / ACCREDITATIONS HELD

CCIE – Cisco Systems Internetwork Expert #18233

VCP – VMware Certified Professional

CDCUCSS – Cisco Data Center Unified Computing Support Specialist

VSP – VMware Sales Professional

VTSP – VMware Technical Sales Professional

TSS – Cisco Technical Solutions Specialist, Data Center

GCIH – GIAC Certified Incident Handler

CCVP – Cisco Certified Voice Professional

CSNSSS – Cisco Storage Networking Solutions Support Specialist

CSNSDS – Cisco Storage Network Solutions Design Specialist

CADCNSS – Cisco Advanced Data Center Networking Infrastructure Support Specialist

CCIE Storage Networking

RHCE – Redhat Certified Engineer #804006368822511

RHCT – Redhat Certified Technician #804006368822511

EMCPA – EMC Proven Professional Associate – Information Storage and Management

NSCA – Netscaler Certified Administrator #2005072

NACE – Network Appliance Certified Expert #12912

NACP – Network Appliance Certified Professional #12017 – Data Protection

NACP – Network Appliance Certified Professional #11985 – Storage Area Network

NACP – Network Appliance Certified Professional #12911 – High Availability

Retired Certifications -

Cisco Qualified Specialist – IP Telephony Support

Cisco Qualified Specialist – IP Telephony Design

Cisco Qualified Specialist – IP Telephony Operations

Cisco Wireless LAN Design Specialist

Cisco Wireless LAN Support Specialist

TECHNICAL PROFICIENCY

PROTOCOL PROFICIENCY

EIGRP, OSPF, RIP, BGP, MPLS,  Spanning Tree, Rapid Spanning Tree, ATM, RTP, SIP, H.323, LWAPP, RADIUS, TACACS+, Ethernet, Fibre Channel, ISCSI, FCIP, FCP, FSPF, NDMP 802.11a, 802.11b, 802.11g, RBE, ISDN, SNMP

Virtualization Platforms

VMware ESX, Kernel Virtual Machine, Xen

VOICE and VOICE OVER IP

CallManager, Unity, ICS7750, PBX Trunking, SRST, Active Directory Integration, Extended Services, Call Detail Recording, Automated Attendant, Extension, Mobility, Asterisk, Callware and VSR VM.

HARDWARE

Cisco Unified Computing System (UCS) 6100, 2100, 5100, Nexus 7000, Nexus 5000, Nexus 2000 and Nexus 1000v switches, Catalyst 1900-6509 switches, 1600-7500 series routers, Cisco PIX firewalls, Cisco Load Balancers, Cisco MDS , F5 Load Balancers, Netscreen / Juniper Firewalls, Cisco VPN3000 VPN concentrators, Cisco ASA Adaptive Security Appliances, Nortel Contivity VPN Concentrators, Aironet Access Points and Bridges, Airespace LWAPP concentrators. 3com TotalConnect racks, Ascend dial concentrators, Netscaler Load balancers, SSL accelerators, SSL VPN concentrators. Brocade Silkworm, HP Eva Storage

NETWORK MANAGEMENT

Nagios, Cacti, NTOP, IPswitch What’s Up Gold, BIG Brother, Spectrum Network Management, Kiwi Syslog,, MRTG , HP OpenView, Cisco Secure Intrusion Detection system, Cisco Network Based Application Recognition, Snort IDS, Netscreen Firewall Manager, Unified Compute System Manager

OPERATING SYSTEMS

Redhat, Suse and Ubuntu Linux, Windows 2000, Windows 2003, Windows 2008, Windows XP, NT4.0, BSD, Solaris, OSX

BUSINESS ENVIRONMENTS

Consulting, Valued Added Reseller, Large Enterprise, Startup, Banking, Service Provider, Software Development, Manufacturing, Military

EMPLOYMENT

1/07 – Present, ePlus Technology

Consulting Systems Engineer – Data Center

Accelerate Data Center sales, design and implement network, storage, and systems solutions for ePlus west coast customers.

Accomplishments

• Developed and deployed go to market strategy for Cisco’s Unified Computing System resulting in significant competitive advantage in the western united states.

• Increased Data Center revenues year over year in a the worst economy in a century.

• Changed regional sales focus from technology silo’s to solutions based selling covering network, systems, storage and applications under one umbrella.

• Established a trend of Advanced Technology account wins.

• Accelerated ePlus’s southern California sales by providing high end engineering support.

• Increased sales for ePlus’s northern California office by overlaying and training field sales.

• Integrated MPLS service provider designs into cutting edge Enterprise Solutions.

• Filled PM and lead network engineer roles for large publicly traded company data center migrations.

• Created modular Cisco design / quote format and menu based hardware and services options to address rapidly changing customer needs.

9/05 – 1/07 ID Analytics

Lead Network Engineer

Lead team of four engineers, Define network and application integration architecture for large SaaS analytics deployment, Leverage networking technology to increase security and availability, and decrease development and product deployment timelines

Accomplishments

• Led team of engineers responsible for all Production and Back Office systems in 2 offices and 3 datacenters

• Designed and Implemented ID Analytics Phase2 datacenter, processing 1.2-1.8 million financial transactions daily.

• Designed and Implemented Contents Switching and SSL offloading solution, enabled non-disruptive scaling of core products

• Integrated ID Analytics product with the largest card processors in the world – Equifax, Visa, TransUnion, etc.

• Designed and integrated centralized Fiber Channel and ISCSI SAN solution, increasing application speed and decreasing production database refresh times from 4 weeks to 1 week.

• Managed and maintained over 130 terabytes of storage

• Created lights out server imaging and deployment solution for remote datacenters

• Deployed and integrated monitoring solutions utilizing open source technology

• Created user emulation probes for real time application monitoring and trending of production systems

• Worked with development and Analytics to create structured Development and QA environments

• Spearheaded project to change Analytics / Informatics environment from “unix for workgroups” to high performance computing environment (HPC)

• Provide structured documentation to US Government and Corporate auditors

• Utilized project management skills for international rollouts

2/04 – 8/2005 Openwave Systems
Senior Network Engineer, Strategic Design and Integration Group
Provide technical leadership, Define network architecture, Establish standards and technical vision. Responsible for researching, developing, and architecting technical solutions to business needs.

Accomplishments

• Designed Openwave’s new Pacific Datacenter Networks, with 900 production, and 2000 development servers.

• Designed Openwave’s Pacific Shores Campus Networks, and Showcase Datacenter.

• Responsible for hardware acquisition budget of 1.7 million dollars

• Established ISCSI IP based SAN infrastructure with DR components in 4 major datacenters worldwide

• Promoted from the ranks, moving from running our VOIP phone systems, to Network team lead, to Senior Network Engineer in the Strategic Design and Integration team.

• Active and engaged member of multiple boards covering design review, change control, and security

• Negotiated with Cisco and SBC regarding datacenter purchases saving $906,000 off list price.

• Renegotiated Cisco support saving Openwave nearly $600,000 over our three year term

• Established improved data center controls, allowing Openwave to pass Sarbanes Oxley (SOX) audits

• Wrote and ran multiple RFP, RFQ, and RFI’s

• Utilized project management skills for international rollouts

• Managed, Piloted, and Installed new wireless systems for our Customer Briefing Center

• Responsible for 6 VOIP clusters around the world

• Recipient of multiple awards recognizing dedication and quality work.

• Attended continuing training for security management (CISSP)

2/03 – 1/04 USMC Reservist activated in support of Operation Enduring Freedom
Information Services Coordinator
Implement and maintain Tactical Data Networks, Provide consulting services to hosting units. Maintain Microsoft Exchange servers in both tactical and garrison environments. Perform security audits and remediation. Train support personnel.

Accomplishments

• Performed Disaster recovery of routed ATM LANE environment for Marine Corps Air Station Yuma enabling over 3000 users to resume work (awarded the Navy and Marine Corps Achievement Medal for that event)

• Performed security audit and created a security and performance remediation plan for MCAS Yuma

• Provided project management and security audit skills to 3^rd Marine Air Wing Yuma server support teams, managed server security audit, security remediation, and SMS rollout.

• Designed and implemented Nagios network monitoring system at Marine Corps Air Station Yuma.

• Implemented Norton Antivirus server for MWSS 473

• Provided training on to data teams from MWSS 473, MCAS Yuma Station IT, and 3^rd Marine Air Wing Yuma server teams.

12/02 – 2/04 2 Cups Solutions, Pleasanton , Ca
Principal Consultant
Founded 2 Cups Solutions to provide cutting edge Voice, Data, Wireless and Security services to clients in the San Francisco bay and Fresno areas.

Accomplishments

• Implemented WAN failover solution at two City of Hayward fire stations.

• Implemented email and web solution for Express Mobile Notary.

• Developed and implemented business plan focusing on State and Local Government contracts.

2/02 – 12/02 ExtraTeam, Pleasanton , Ca
Senior Systems Engineer
Design, Installation, Configuration and Maintenance of network systems consisting of Cisco CallManager, Unity, Cisco Secure ACS, LEAP secured wireless, Aironet, Cisco routers and switches, PIX firewalls, and VPN3000 concentrators. Integrating all systems with Active Directory. Performed VOIP feasibility studies. Managed the entire business cycle including sales, design, installation, training and maintenance.

Accomplishments

• Integrated CallManager voice system with Active Directory

• Recovered a failed CallManager implementation at Phase 2 Strategies (PR firm for Logitech). Implemented CallManager with up to date hardware and software, upgraded Unity up to reasonably current levels. Brought up remote office in Phoenix utilizing SRST.

• Implemented City wide wireless network integrated with active directory for the City of Hayward

• Implemented VPN Concentrators in conjunction with multiple levels of firewalls for City of Hayward and Hayward PD to meet CLETS requirements.

• Implemented network configuration management system responsible for the city of Hayward.

• Implemented new wan for Livermore Pleasanton Fire department moving fire stations from isdn to T1 and Gigabit fiber lines in conjunction with moving the location for the network core.

• Designed and implemented IPSEC based wan for Universal life resources, allowing nationwide secure remote office connectivity while minimizing wan connection costs.

• Designed CallManager based VOIP system for a 27 site school district

• Provided emergency support to Fire and Police agencies across the bay area

• Performed security remediation for a large bay area company

• Participated in large switched network cutover from 7500 to a 6509 with flex-wan modules for Stanislaus County.

• Achieved technical certifications for ExtraTeam to become certified under both the Wireless and IP Telephony revised specifications.

7/01 – 2/02 Infobond Inc. Burlingame , Ca
Network Engineer

Responsible for engineering duties in a leadership role. Integrated legacy PBX’s using VOIP technology. Used Quality of service to ensure VOIP service levels. Support legacy voice over IP and voice over Frame Relay technologies. Upgrade from legacy voice integrations to state of the art VOIP integrations. Create project plans and act on them.

Accomplishments

• Cut over evergreen lines shipping terminal from legacy 3com equipment to VOIP enabled Cisco routers and switches. Accomplished all work during Union stand downs.

• Contracted to Openwave, Inc. to run Remote Access while the engineer was on leave. Ran Remote Access for 5 weeks, resolving DSL RLAN issues and IPSec issues, while reducing trouble ticket backload to manageable levels. Assisted other engineers when needed.

• Implemented Cisco 6509’s to replace aging core network of a Benchmark Capital (bay area investment firm).

• Diagnosed and resolved VOIP issues that were stopping call center rollouts for Embarcadero Systems (a large bay area shipping company).

03/00 – 7/01 Knapp Publishing Corporation, San Ramon, Ca
Network Systems Administrator

Responsible for day-to-day operations of e-commerce data center, and wide area networks Performed DNS changes for both internal and external networks. Designed, piloted, and implemented network changes. Installation configuration and maintenance of NT, and Windows 2k file, print, and web servers

Accomplishments

• Improved service levels from 90% to 99.99%, enhanced security and increased bandwidth were benefits derived from implementing a state-of-the-art web hosting data center

• Implemented a network monitoring system to document, report, and notify of network status.

• Designed and implemented ISDN failover of Frame-Relay Network.

• Designed, piloted, and implemented network changes.

• Replaced NT servers with Linux based servers, integrated with the Windows network

01/98 – 03/00 DKA Computers Inc. Clovis, Ca
Manager Information Services (01/99 – 03/00 )

Ran day to day operations of a central valley ISP. Worked with systems manufacturing to bundle client software with all new PC’s. Partnered with local ISP’s to provide access numbers across the valley.

Accomplishments

• Managed web development, and professional services

• Moved web hosting from IIS to APACHE based servers, drastically increasing site availability

• Produced a forms based web application to configure custom systems online.

• Designed and implemented an IPSec based WAN connecting 3 stores point of sales systems.

• Managed corporate office and data center relocation project.

Senior PC Service Technician (01/98 – 01/99)

Provide on call service. Staff PC help desk. Provide direct customer systems support while maximizing company revenues. Configured all servers ordered from manufacturing.

Accomplishments

• Responsible for all day to day service activities for a 13 million dollar company. Management of 4 team members. Directly responsible for customer satisfaction

• Implemented hard drive imaging system, decreasing both warranty costs and turnaround time

• Installed and configured SCO Unix reservation system for National Park service, Kings Canyon

• Designed, implemented inventory tracking database, reducing required stock on hand by $40,000

MILITARY

1996 – 2004 UNITED STATES MARINE CORPS RESERVE
Have held U.S. Government security clearance – Secret

EDUCATION

Ongoing professional education

Sans CISSP + Track

University of Oklahoma extension – Fire Science

Cisco Networking Academy

Similar Posts:

• What does it take to pass the CCIE exam?
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• About Colin McNamara
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Challenges integrating VMware into Cisco networks

--Colin McNamara

Resume – Colin McNamara, CCIE #18233

This tactic address one key failing of ISCSI. Specifically an ISCSI interface running at 400 megabit will take 16% of a 3 ghz 64 bit cpu while using a software initiator or target. This can create some interesting issues where you don’t want to have them. By removing the layer3 information, and transposing fibre channel commands over the Ethernet transport a major cpu hit is avoided.

My gut feel is that this technology will follow a similar track as ISCSI did. ISCSI had a very low adoption in the first 3 years. Storage guys are naturally timid, as there are stiff consequences for failure, but eventually engineers warmed up to ISCSI and started deploying it where it was most appropriate, in lower bandwidth utilization hosts. FCOE will follow this same path, however this time we won’t have to fight the FUD of storage of a network transport. What is in FCOE’s favor is that as a protocol it is optimized for the general ISCSI setup of flat layer two transport between target and initiator.

That all being said, we are going to have to see some product releases from Cisco and Intel for FCOE to really take off. If we don’t, then FCOE will fall down the same hole that ATA over Ethernet disappeared down.

Colin McNamara
CCIE #18233 (Storage Networking)
2 Cups Solutions
“The difficult we do immediately, the impossible just takes a little longer”

References -

Intel Project Page

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 4000 Blade Switch
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• My CCIE Storage Shopping List
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• What being married to a geek who does search engine optimization gets you

--Colin McNamara

Fibre Channel over Ethernet is taking off

Though CCIEs are members of an exclusive group, they can be found in countries on every continent. Use the map and tables below to discover your peers around the world.

Americas EMEA Pacific Rim Africa Asia Cana Europe Middle East Pacific Islands South America United States

Total of Worldwide CCIEs:		15658 (last updated 11.14.2007)
Total of Routing and Switching CCIEs:		14329
Total of Security CCIEs:		1207
Total of Service Provider CCIEs:		650
Total of Storage Networking CCIEs:		99
Total of Voice CCIEs:		601

Multiple Certifications:

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• What does it take to pass the CCIE exam?
• About Colin McNamara
• Cool new features in 12.4(15)T
• And it begins again – On the road to my CCIE in Storage
• Resume – Colin McNamara, CCIE #18233

--Colin McNamara

Updated CCIE numbers

”

By Ivan Pepelnjak

John S. Pumphrey recently asked an interesting question: “Can the router send an e-mail when an interface goes down?” The enterprisey solution is obvious: deploy a high-end EMS to collect SNMP traps and use its API to write a custom module that would use a MQ interface to alert the operator. Fortunately, Event Manager applets in Cisco IOS provide action mail command (available in 12.3(14)T and 12.4) that can send an e-mail to a SMTP server straight from the router.

There are two ways you can detect that an interface went down with EEM: either you track the interface status with a track object and start an EEM applet when the track object changes state or you catch the syslog messages reporting that the interface line protocol changed state to down. The second approach is obviously more generic, as a single applet can act on multiple interfaces.

event manager applet MailOnIfDown event syslog occurs 1 →    pattern "LINEPROTO-5-UPDOWN.*to down" →    period 1

Notes:

• If you want to limit the applet to serial interfaces only, you could change the pattern to LINEPROTO-5-UPDOWN.*Serial.*to down.
• The → continuation character is used to indicate that a single configuration line has been split to increase readability.

The action mail command specifies the mail server’s address (use a hostname and DNS lookup or ip host configuration command to make the EEM applet more generic), from and to address, message subject and body. In each of these fields, you can use EEM environment variables that you can define with the event manager environment configuration command. Each EEM event also defines a few environment variables that you can use (see the table of EEM system-defined variables on CCO). For example, you can define the e-mail recipient in the router’s configuration and use the _syslog_msg variable to include the syslog message in the e-mail body:

event manager environment _ifDown_rcpt admin@lab.com!event manager applet MailOnIfDown event syslog occurs 1 →    pattern "LINEPROTO-5-UPDOWN.*to down" →    period 1 action 1.0 mail server "mail-gw" →    to "$_ifDown_rcpt" from "R1@lab.com" →    subject "Interface down on R1" →    body "$_syslog_msg"

You can make the applet even more generic with the help of action info type routername command, which stores the current router’s name into the $_info_routername environment variable:

event manager environment _ifDown_rcpt admin@lab.com!event manager applet MailOnIfDown event syslog occurs 1 →    pattern "LINEPROTO-5-UPDOWN.*to down" →    period 1 action 1.0 info type routername action 2.0 mail server "mail-gw" →    to "$_ifDown_rcpt" from "$_info_routername@lab.com" →    subject "Interface down on $_info_routername" →    body "$_syslog_msg"

"

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Zone based IOS firewalls
• What should I do this thanksgiving break?
• Cool new features in 12.2(33)SXH
• Application Extension API notes – Cisco Live 2008
• Interesting TechWise TV episode on virtualization
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It

--Colin McNamara

Routers can email you when they go down

Cisco has finally included zone based firewalling in the IOS firewall feature set. The configuration guide can be found here -

Zone Based Firewall Design and Configuration Guide

The things that really got me interested are -

1. It is VRF aware (works well with network virtualization strategies)
2. No more CBAC’s
3. Policing built into firewalling classes
4. Content inspection including HTTP,P2P, and Instant Messenger

I think the biggest plus for this release is that IOS firewalls are finally following the general trend of zone based firewalling. By moving this way, configuration errors resulting in lax controls are likely to be minimized.

Excerpts from the documentation -

Cisco IOS Software Release 12.4(6)T introduced a new configuration model for the Cisco IOS Firewall feature set. This new configuration model offers intuitive policies for multiple-interface routers, increased granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall zones until an explicit policy is applied to allow desirable traffic.

Nearly all firewall features implemented prior to Cisco IOS Software Release 12.4(6)T are supported in the new zone-based policy inspection interface; supported features are as follows:

•Stateful packet inspection

•Application inspection

–HTTP

–Post Office Protocol (POP3), Internet Mail Access Protocol (IMAP), Simple Mail Transfer Protocol/Enhanced Simple Mail Transfer Protocol (SMTP/ESMTP)

–Sun RPC

•VRF-aware Cisco IOS Firewall

•URL filtering

•Denial-of-service (DoS) mitigation

Zone-based policy firewall generally improves Cisco IOS performance for most firewall inspection activities.

The only Cisco IOS Firewall features that are not supported in zone-based policy firewall in Cisco IOS Software Release 12.4(6)T are as follows:

•Authentication proxy

•Stateful firewall failover

•Unified firewall MIB

Zone-based policy firewall completely changes the way you configure a Cisco IOS Firewall.

The first major change to the firewall configuration is the introduction of zone-based configuration. Cisco IOS Firewall is the first Cisco IOS Software threat defense feature to implement a zone configuration model. Other features might adopt the zone model over time. The classical Cisco IOS Firewall stateful inspection/context-based access control (CBAC) interface-based configuration model employing the ip inspect command set will be maintained for a period of time, but few, if any, new features will be configurable with the classical command-line interface (CLI). Zone-policy firewall does not use the stateful inspection/CBAC commands. The two configuration models can be used concurrently on routers but not combined on interfaces; an interface cannot be configured as a security zone member as well as being configured for ip inspect simultaneously.

Zones establish the security borders of your network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of your network. Zone-Policy Firewall’s default policy between zones is to deny all. If no policy is explicitly configured, all traffic moving between zones is blocked. This is a significant departure from stateful inspection’s model, in which traffic was implicitly allowed unless it was explicitly blocked with an access control list (ACL).

The second major change is the introduction of a new configuration policy language known as CPL. Users familiar with the Cisco IOS Software Modular quality-of-service (QoS) CLI (MQC) might recognize the format being similar to QoS’s use of class maps to specify which traffic will be affected by the action applied in a policy map.

Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Cool new features in 12.4(15)T
• Routers can email you when they go down
• Identity aware networking using Cisco TrustSec
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Zone based IOS firewalls

http://www.cisco.com/application/pdf/en/us/guest/products/ps6555/c1161/cdccont_0900aecd805456f7.pdf

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• I found a great tutorial on PHP + MySQL+Flash integration
• San Diego Maternity Photographer
• San Diego WildFIre Update
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?

--Colin McNamara

Great TCL and EEM preso found on IOS hints and tricks -

* Solid State Drive (SSD) boot support
As initially discovered last month, VMware will make available a special version of ESX Server (mentioned with terms like ESX Lite and Embedded ESX) for OEM vendors, to be installed into bootable Solid State storage devices (flash drives, etc.). This option will allow creation of ESX Server hardware appliances for easy jumpstart, granting smaller form-factors and improved reliability.
Dell, IBM and possibly other vendors will offer this option at announcement time in Q3 2007.
* DMotion
Unofficially introduced with ESX Server 3.0.1, in its first version DMotion is a special VMotion operation only capable of moving running virtual machines from an ESX Server 2.5.x host to a new ESX Server 3.x., without shared SAN LUN mandatory requirement.
In ESX Server 3.1 this capability will be extended, allowing hot migration of running virtual machines between ESX 3.1 hosts through the Ethernet cable.
* Patch management system for host and virtual machines (Update Manager 1.0)
ESX Server 3.1 will finally introduce an automated patch management system called Update Manager. This solution will be able to update both host itself and virtual machines (both Microsoft Windows and Red Hat Enterprise Linux).
Update Manager will look for available updates from Shavlik Technologies website (a possible acquisition after IPO), and will allow VI administrators to decide which patches to deliver to virtual machines.
Before applying them, Update Manager will take a snapshot and will even rollback automatically if something goes wrong.

(this product was originally codenamed VM Integrity and its developement started more than one year ago, when virtualization.info discovered it in June 2006)
* VMware Consolidate Backup (VCB) and VMware Converter 4.0 integration
VirtualCenter 2.1 will now allow restoring VCB images with an integrated version of VMware Converter, which reaches 4.0 release number.
* Server consolidation advisor
VirtualCenter 2.1 will expose a server consolidation assistant able to analyze which physical machines should be converted in virtual ones, and where to move existing VMs among available hosts.
(note that with this feature VMware is further extending competition with PlateSpin, covering both features with PowerRecon and PowerConvert)
* Guest OS disaster recovery capability
VirtualCenter 2.1 will be able to recognize a failure inside a virtual machine and restart it through VMware HA module.
* Support for VMware Server 2.0
VirtualCenter 2.1 will be finally able to seamless manage both ESX Server and VMware Server 2.0 hosts.
* Lockdown Mode
ESX Server 3.1 will expose a new security feature to completely disable local administrative account after a VirtualCenter 2.1 takes remote control.
* Power saving capability (Distributed Power Management)
VirtualCenter 2.1 will introduce a new resources utilization analysis feature, able to verify when a physical host can be powered off, VMotion-ing its virtual machines on other hosts without impacting performances.
* Support for Cisco Discovery Protocol (CDP)
VirtualCenter 2.1 will be able to recognize and use CDP to discover physical and virtual network topologies.
It stays unconfirmed if ESX Server 3.1 will already expose new virtual network architecture, allowing 3rd party virtual switches, as it will be announced by Cisco CEO at VMworld 2007.
* Support for 10Gbit Ethernet network cards
* Support for TCP/IP Offload Engine (TOE) network cards
* Support for network load balancing algorithms
* Support for 200 hosts and 2000 virtual machines
* Support for 128GB RAM per host and for 64GB RAM per virtual machine
* Support for SATA storage devices
* Support for N_Port ID Virtualization (NPIV)
* Support for VCB over iSCSI SANs
* Support for IPv6 in virtual networking
* Support for Para-virtualization guest OSes

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Cool new features in 12.2(33)SXH
• Cisco’s Unified Computing System – It’s not just a blade center
• Interesting TechWise TV episode on virtualization

--Colin McNamara

New features in VMware 3.1

Link – http://www.cisco.com/application/pdf/en/us/guest/products/ps8258/c1161/cdccont_0900aecd80679ce3.pdf

From Cisco’s site -

Cisco IOS Software Release 12.4T integrates a portfolio of new capabilities, including security, voice, and wireless, with powerful hardware support to deliver advanced services for enterprise and access customers. It will be issued as a series of regularly scheduled individual releases, which Cisco will ultimately consolidate to form the next major release.

Release 12.4(15)T, the sixth release of the 12.4T family, streamlines the Cisco IOS Software upgrade process, provides sub-second link failure detection and faster convergence, delivers next-generation Layer 2-7 flexible packet classification, enhances intrusion protection and SSL VPN capabilities, and provides support for the new Cisco 7201 Router, amongst other features.

Like all releases in the 12.4T family, Release 12.4(15)T integrates innovations that span multiple technology areas, including Cisco IOS Security, Voice, Cisco IOS Infrastructure, Access, High Availability, Management Instrumentation, Quality of Service, IP Multicast, Broadband, IP Routing, and IP Services. Release 12.4(15)T delivers these integrated technologies on the broadest range of hardware in the industry, including the Cisco Integrated Services Routers, Cisco 7200 Series, and Cisco 7301 Router.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• The emergence of MDS features in Cisco’s datacenter networking equipment
• About Colin McNamara
• Application Extension API notes – Cisco Live 2008
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• New features in VMware 3.1
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

--Colin McNamara

Cool new features in 12.4(15)T

For those that have been watching, there has been a trend of helpful MDS (Cisco’s director class storage switch) features into core networking products. The first feature I have noticed is the “do” command now available in configuraiton mode in ios 12.4. It allows you to execute exec commands from the configuration section in IOS. Needless to say this is very handy, primarily due to not having to exit to your shell to do a show command.

Things like that make me very happy. They decrease the time needed complete tasks, and improve your accuracy.

One of the features that I have always loved with the MDS is call home. It is a deamon that monitors the hardware and software for faults, and when one is found it posts an email to TAC and your support staff.

This feature now has made it into the 6500 series switches as of 12.2(22)SXH which should be out mid August. It will integrate directly with Cisco TAC, and your own internal Monitoring and management systems. The really cool thing is that this ties right into the GOLD (Generic On Line Diagnostics) tests. If your GOLD tests find a hardware problem TAC will automatically be contacted, a RMA issued, engineer contacted, and parts shipped to the devices location. The target for this is SmartNet time + 1.5 hours. So if you had 4 hour smartnet, you could expect hardware onsite, with no additional troubleshooting in 5.5 hours.

Cisco portal for smartcall is located at http://www.cisco.com/go/smartcall

Colin McNamara, CCIE #18233
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Routers can email you when they go down
• Zone based IOS firewalls
• Cool new features in 12.4(15)T
• What does it take to pass the CCIE exam?
• What being married to a geek who does search engine optimization gets you

--Colin McNamara

The emergence of MDS features in Cisco’s datacenter networking equipment

My background is all over the place. It goes from running a small ISP when I was 18 to managing international CallManager clusters, to enterprise data center design and migrations. I swear that I have tech ADD. I see something new and I am like.. oooooh shiny, lets do a sniff and see how it works.

I actually attempted the Route Switch lab twice in 2002 (still had token ring and dlsw still) but got activated for the war before I could get my number. I can tell you.. that sucked horribly.

So, why did I choose to get my Storage CCIE first instead of finishing up my Route Switch first? Well, over the past couple years I have done a significant amount of IP storage (NFS, ISCSI, ATA over Ethernet, etc) including building my own IP storage heads based on linux. I had also done a little bit of fiber channel work. I felt that I had a significant advantage compared to most network engineers in the storage networking space. And, I think more importantly, the topics that I had to study were new and fresh. Whereas when I cracked open my Route Switch books.. I honestly wasn’t to excited about it at the time ( I think I was holding a grudge from my first attempts in 2002).

The partner e-learning central portion of Cisco has an Excellent lab access to labgear.net. It gives you 2 hour segments of time with 2 mds’s (both with IPS blades), 1 2 port jbod, and 2 2 port servers. They also have introductory tutorials for most major technology segments.

I did all of those, along with the every E-learning class that was on PEC. I think the major ones were the Design, Support, and CASSI classes.I took that, sat for the design and support specialist exams, and took my written last December.

After doing all that work, I was honestly 70% there. I took a little break for january and febuary (There was no open lab dates) and then started hitting the labs I think at the end of febuary.

For the majority of my practice I used the labs available through PEC. I also was able to weasel my way into 8 hour sessions every sunday from our channel SE. (I owe him plenty of drinks at networkers this year) For those 8 hour sessions I had labs created to summarize the major technology areas and to be as evil as possible to myself.

I had one attempt which didn’t work out as well as I would have liked. In RTP the lab starts at 7:15. This means if you are from the west coast like I am you will be getting up at 3:00 am in the morning for your lab. That royally kicked my but. I diverted from my attack plan and ended up
running out of time. It was a classic example of letting the lab run you, instead of you running the lab.

Luckily a data opened up just over a month later. I spent that time just working on my speed (speed is the secret sauce). I migrated to using Fabric Manager (gui interface) instead of command line. After 2 practice runs my time had dropped 25%. I also flew out to RTP 3 days before, and made sure to relax and get on east coast time.

For my final prep I got access to iementor’s lab. Their lab is excellent. I cannot reinforce enough how much it contributed to my confidence in that final week. Roman was really cool about working with an existing candidate to get me squeezed in. They are really cool guys, and they have the only workbook on the market right now.

So, I used their lab 2 days before mine, and then just chilled the day before. The day of the lab I had 70 points by lunch, and had completed configuration of the lab by 12:30. I spent the rest of the day reviewing my configurations (found 2 errors), fixing one bug, and generally harassing the proctor to make sure I didn’t misinterpret anything.

So.. if I had it all to do over again what would I do. I would still do the PEC stuff, and continue to primarily live in the Doc CD. Though I would probably pony up the cash and buy the iementor book and more lab time with them.

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233
“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• What does it take to pass the CCIE exam?
• Fibre Channel over Ethernet is taking off
• And it begins again – On the road to my CCIE in Storage
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• My CCIE Storage Shopping List

--Colin McNamara

Why was Storage Networking my first CCIE? And What did I do to prepare?

For those who haven’t heard yet, I passed my CCIE Lab on June 14th. Now I can officially put CCIE #18233 after my name.

Anyone who has been down the same path understands how long of a road this is.
I started down this path in the spring of 1999 as the 432nd student ever in Cisco’s Networking Academy (which I promptly dropped out of to move to the bay area). I grew my networking skills all the way to passing my CCIE Written in 2001. I attempted my Route Switch lab in 2002, however I got called away to war for a year. Being away from it all for a year really cramped my style technically. In that time many of my certs expired, and I lost much of the momentum I had built of the past half decade.

Since I got back to the real world I had focused on work to the detriment of my certifications. I really did some great things, however I really neglected my resume.
In July of 2006 I had worked 2038 hours that year (for those not mathematically inclined, that is a full work year, in 1/2 a year) . At that point I decided it was time to stop neglecting my certifications. At that point I dedicated 8 hours each saturday, along with two nights a week to studies. By December of that year I had Certified on a few of the technologies that I had tons of experience in.

I managed to get my RHCE, Cisco Storage Support and Design Specialist, update my old IP Telephony specialist certifications to CCVP, get my Netapp Certified Administrator, and pass my CCIE Written for storage networking all by the end of the year. This spring I finished my Netapp Certified Expert and scheduled my Storage lab for early summer.

Anyone who knows me well knows how closely I track my time. That time tracking extends to my training. I tracked my training (reading, lab practice, testing, etc) just like any other part of my professional life. I spent around 150 hours studying for my Design, Support specialist certs, along with reading the recommended books of the CCIE reading list, and around 300 hours preparing for my lab exam. That is 300 hours configuring every possible combination and permutation of technology that could be setup, and then refining my speed in configuring those technologies until i got to the point where speed as well as brains would be an advantage in the lab.

So now that I have my CCIE, whats next? Well, oddly enough.. I am thinking of getting my second CCIE cert. In my office I will be the Jr guy by only having a single CCIE (on of our guys has all five). I also need to take my VMware certified professional cert, and probably get my HP Master Accredited Storage Engineer. I guess I am just a glutton for punishment.

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• About Colin McNamara
• Updated CCIE numbers
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Resume – Colin McNamara, CCIE #18233
• And it begins again – On the road to my CCIE in Storage
• Update on the Cisco / Nuova connection

--Colin McNamara

What does it take to pass the CCIE exam?

The first lesson was that knowledge alone is not suffient to pass the lab.
The second was that the lab is not the real world, and the procotors do not intend to replicate real world problems.
The third lesson was that speed is as important as brains.
The fourth lesson is that you can’t make it alone.

This time I am taking a different tack. I am studying with a partner. My focus will not be real world implementations, it will be on all possible hellish combinations a proctor could come up with. . I will be spending many late nights working on my speed.

I have passed All of Cisco’s storage exams, including the Written qualification for the CCIE Storage Networking exam. At first I thought the biggest challenge would be getting ahold of lab gear. It is not like this stuff is cheap. However I have been finding more gear out there then I had though I would. This is a good sign.

I will be posting my experiences throughout this entire process. I am not under the illusion that it will be easy. Luckily I have the lessons learned from my attempts before the war, and a new found enthusiam.

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• What does it take to pass the CCIE exam?
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• CCDE Practical – Beta candidate deadline August 1 2008
• 3 minute management course
• My CCIE Storage Shopping List

--Colin McNamara

And it begins again – On the road to my CCIE in Storage

	Search Criteria Search Criteria
	Note : Only 150 random matches will be displayed
	Partner List Sort By Select Sort Type Company Name Country Company Name Country Authorizations Sites

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco Storage Partners – California… a very small list
• How close did the fire come?
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Great TCL and EEM preso found on IOS hints and tricks -

--Colin McNamara

Storage partners nationwide – 14

Partner List

Sort By Select Sort Type Company Name Country

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Storage partners nationwide – 14
• How close did the fire come?
• Taking a closer look
• Study on Perspective – Set 1
• Why can’t I post from docs.google.com to blogger beta?
• Great TCL and EEM preso found on IOS hints and tricks -

--Colin McNamara

Cisco Storage Partners – California… a very small list

Lets just start this out by saying, darn.. this is going to be expensive.
Now that that is out of the way, lets get started. Cisco publishes the hardware that is in the Storage lab.

Here is the hardware summary -

• Cisco Routers
• Cisco Catalyst Switches
• Cisco Secure Access Control System
• MDS 9506*
• MDS 9216*
• Port Analyzer Adapter
• JBOD
• RAID storage
• HBA
• 3rd Party Fibre Channel Switch

My guess is that this equals a basic routed network with a CS-ACS server on the backend.
It looks like there is also at least 1 pc with an HBA connected into one MDS. The one big question I have is on the connected storage.
My guess is that Cisco’s JBOD reference = Fibre Channel connected storage, and the RAID array mentioned is connected to at least one server.
If my guess is right then there is the 9506 and 9216 – (note, no I in the name) and a third party switch.

So lets start the shopping list.

1. Cisco Routers
I have those coming out of the yinyang, no need to purchase anymore for this lab.

2. Cisco Catalyst Switches
Mine are a little old, but I don’t expect a storage exam to have anything challenging in the switching arena. No need to upgrade there.

3. Cisco Secure Access Control System
Thankfully Cisco provides VAR’s with NFR binders. ACS will be loaded on HMB-SERVER1 in a vmware image. No expenditure needed.

4. MDS 9506*
Holy smokes, this is a lot of money. I have seen them on ebay for $8,000. This includes both sup modules. I would need to buy a line card, which I see going for about 1k. so $9000

5. MDS 9216
Still bad, but not horrible. I just saw one on ebay for $5500. Depending on lab requirements it may be smart just to get to 9216’s. so $5500

6. Port Analyzer Adapter
Best I can find is $2000 refurbished. I have a feeling practicing using this, and seeing the ethereal dumps is going to be integral to success. worst case this is 2k, best case beg or borrow $2000

7. JBOD
Normally you are looking at 2-4k for one of these. My strategy is to find an old Netapp shelf, and low level format it. I found one on ebay that ends in 22 hours for $89. Sounds good to me.

8. RAID storage
I am going with my guess that this is just to facilitate data transfers between storage and host. My tactic is to use the existing storage inside one of my servers. $0

9. HBA
Interesting – Only one HBA .This can be up to $2000 to buy new. Luckily ebay is my friend. I found a qlogic 2340 card for $50. My kind of deal

10. 3rd party Fibre Channel Switch
Luckily Brocade resells to everyone and their mother. IBM, Dell, HP, Compaq, ETC. I have found some Silkworm 2800’s for as low as $50 on ebay.
I do have my eye on a 3800 that is going for $24 right now (I hope it stays low).

So how much is the damage?

$16,700

Holy smokes I could sell my truck just to buy the lab gear.

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Update on the Cisco / Nuova connection
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Cisco Nexus 4000 Blade Switch
• Fibre Channel over Ethernet is taking off

--Colin McNamara

My CCIE Storage Shopping List

Security Threat Mitigation and Response: Understanding Cisco Security MARS
by Dale Tesch, Greg Abelar
Publisher: Cisco Press
Pub Date: September 28, 2006
Print ISBN-10: 1-58705-260-1
Print ISBN-13: 978-1-58705-260-6
Pages: 408

This book had so much potential to be a great. Sadly it turned out to be an overgrown technical manual. The author does try to lighten things up by interspersing real world technical details throughout the book, however he could have just written a “hacks” style book with that material and been much better off.

This book is organized into four major divisions. The first, Security threat identification and response challenge reviews basic security theory and response. A network engineer breaking into security may find this interesting. Anyone else can just skip over this chapter.

I actually found the second, CS-MARS theory and operation to be the most useful. The author laid out a pretty good flowchart of the designing process used to process alerts. He also hinted out the back end architecture supporting the device.

The third section, CS-MARS operation was just blatantly lifted from the users guide. The only difference is that the online users guide is organized a little more clearly. I recommend skipping this chapter and going straight to the on-line documentation, you will be much happier.

The fourth section, CS-MARS in action had great potential, however the author just stuck in some really salesy usage scenarios. I can’t reinforce this enough – This needs to be updated. I have been to customer talks where users presented how the MARS box has made their life easier in many ways. The stories presented here do a disservice to the product, and do not highlight the core differentiators that this product offers.

Would I recommend this book? Yes and No. I would recommend that entry level engineers with no security experience, and business users pick this up. Other then that, log onto CCO and just read through the docs. You will learn more in less time. And as a plus, you will have $50 sitting in your wallet still.

Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”

Similar Posts:

• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• RSS feeds – an intranet aggregation solution?
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• What should I do this thanksgiving break?
• Reader question – Why are corporations looking for BGP experience?
• Usability features in Cisco’s Nexus 7000

--Colin McNamara

Book Review – Security Threat Mitigation and Response: Understanding Cisco Security MARS

I found an intersting article on Light Reading
Let me summarize the interesting Items.

Team hightlights
1. Nuova is led by Cisco’s former Chief Development Officer, Mario Mazzola
2. J.R. Rivers, a Cisco Distinguished Engineer who led the team that developed the Catalyst 3750 switch is on board.
3. Tom Lyon, who founded Ipsilion is also on board.

Visibility
This company is almost entirely in stealth mode. No press releases or released products.

Funding
Asside from Cisco’s investments they have refused all offers of VC funding.

Gossip
from Light Reading –

“The startup is presumed to be working on a virtualization project in the storage networking space — at the intersection of storage, networking, and computing.

The idea is that they’re trying to “aggregate compute IO from the server and centralize it into a single or small number of network elements, connected back to the servers via a high-speed low-latency ‘closed’ network,” one source says. This frees up processor memory and CPU cycles so that larger clusters of servers are possible.”

My opinion

I think that Cisco plans to jump into the clustered storage market head first. Netapp has just finished the integration of Spinnaker software with the deployment of Ontap GX. Isilion is making a killing on distributed storage. And everyone in their mother is trying to copy Googles GFS filesystem.

I think that Cisco is going to leverage the recently deployed Storage Services Module with its storage virtualization features to create an abstraction layer between products such as Nuova’s and the classic FC or SCSI connected server.

–Colin McNamara

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• My CCIE Storage Shopping List
• Will Cisco succede where Sun has failed?
• Interesting TechWise TV episode on virtualization
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• What does it take to pass the CCIE exam?

--Colin McNamara

Update on the Cisco / Nuova connection

This news is interesting as it shows that Cisco is continuing their push into the application layer.
Its Application Oriented Networking blade directly competes with IBM. The content services switch competes with Sun, F5, Juniper and Netscaler. If Cisco can bring a distributed backend to the market that integrates smoothly with the middleware solutions they are currently proposing it will be unstopable. Anybody care to jump on this bandwagon?

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• New Buzzword Enterprise Service Bus
• San Diego WildFIre Update
• Cool new features in 12.4(15)T
• How close did the fire come?
• Great TCL and EEM preso found on IOS hints and tricks -
• Update on the Cisco / Nuova connection

--Colin McNamara

Will Cisco succede where Sun has failed?