So many people linked, tweeted and posted on Facebook about my VMworld presentation submition #3221 Built to Fail. I just wanted to say thanks to everyone for spreading the word. I should find out on June 1st whether I am presenting.

Again, thanks to everyone for all of your support.Similar Posts:

• How to succede in 2007 – By Tim O’Reilly
• VMworld 2009 Schedule
• Witch fire in San Diego – Notes from an evacuee
• New Buzzword Enterprise Service Bus
• New features in VMware 3.1
• What does it take to pass the CCIE exam?

--Colin McNamara

Thank you for voting (VMworld Presentation)

The boundary between server team and network team responsibilities has become “fuzzy”

Cisco address’s this issue by putting a switch that can be managed via the same methods common to other network devices inside the ESX cluster. This switch runs the same code that has become standard on Cisco’s Nexus series of Data Center switches – NX-OS.

Prior to adoption of virtualization, when there was a connectivity problem with a host it was quite common for the network team to verify functionality down to the switch port. The server team would do the same. This allowed for each team to focus on areas that met their core competancy. Once we moved from a real switch port, to a dumb bridge inside ESX, lots of finger pointing resulted.

Now, with a Nexus 1000V sitting virtually inside the ESX clusters, the boundary between network and systems teams has been re-estabilished. Now when there is a problem with a host inside an ESX cluster, the network team can use the same day to day troubleshooting tools available to them in other portions of the network to resolve issues faster, and with less finger pointing.

Security controls have been moved further away from the hosts then we would like

A best practice for applying security policy is to apply controls as close to the source as possible. Think of this analogy – Your kids are blasting Radio Disney from their computer. Which of the following do you do?

A. Turn down the speakers at the source

B. Distribute earplugs to all members or the household

Of course, the obvious action is to go to the source, and apply a control (turn down the volume, and tell the kids to clean their rooms). The same principle is valid on the networking side. The best practice is to apply security policies such as VLAN ACL’s and TrustSec policies directly to the switchports that host your switches. Before the Nexus 1000V this was impossible to do in ESX, and forced many environments to move security controls further up into the distribution layer. The side effect of this was that now the security stance from host to host inside ESX clusters was diminished.

The Nexus 1000V brings something called port policies to the table to address this. What these are is pre-configured application security descriptions that are available to you systems administrators to apply in a point and click fashion. Once these policies are applied to the virtualized host, they follow the host where ever it is moved in your virtual cluster.

Provisioning and integrating the networks of VMware ESX clusters with classic networks for most is challenging at best

I wrote an article in march about this specific issue in my post – Challenges integrating VMware into Cisco networks . The core of this issue is that in general that the network integration portions of VMware ESX clusters is not really designed to address server teams , or network teams. In fact, you need to be pretty savy with both portions to successfully integrate VMware clusters into your network. In the real world, you generally find people that are good at one or the other, not both.

By putting a Nexus 1000V in your VMware clusters, you know give the networking teams something they can understand without having to learn Linux, and how it handles bridges (key to understanding ESX networking). With a Cisco switch running virtually inside your clusters, network teams can follow standard core / distribution / access models with the access layer now residing inside the ESX clusters. The network teams can also leverage their existing LAN switching skills for integrating the virtual switches in the clusters with the existing Data Center switching fabrics.

With these roadblocks addressed, Cisco is moving to further the DC 3.0 vision

To realize the DC 3.0 vision, the network inside of VMware clusters had to be under control, and follow the same architectural guidelines that the rest of our network is subject to. With the Nexus 1000V this is now a reality. The next steps withing the DC 3.0 vision to are to extend virtualization and mobility throughout our storage fabrics, and to continue to extend virtualization to the network as a whole, as well as focusing on application virtualization and acceleration to truly realize the vision of cloud computing in the data center.

On the storage virtualization side, Cisco will be using a technology called FlexAttach to enable virtual and physical hosts to change locations in the datacenter without storage team intervention (more on this in a near future post). And on the application virtulization and acceleration side, expect Cisco to continue to enhance it’s existing Application Control Engine (ACE) and Wide Area Application Services (WAAS), and further integrate these into their virtualization offerings.

Want to learn more ?

Introduction to VN-Link network services – Cisco.com

Nexus 1000V overview – Cisco.com

VMware distributed vNetwork switch demo – VMware.com

Challenges integrating VMware into Cisco networks – colinmcnamara.com

Douglas Gourley speaking about how Cisco and VMware will drive Cloud Computing in the Data CenterSimilar Posts:

• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware
• Cisco Nexus 4000 Blade Switch
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?

--Colin McNamara

Cisco releases Nexus 1000V virtual switch for VMware

Sadly, I have the unfortunate situation of being tagged as an insider (work in the partner community). So I have to play nice, and cannot reveal any juicy tidbits. Suffice it to say, that Jashree Ullal and Doug Gourlay weren’t pulling anyones leg in the past two years when the DataCenter 3.0 vision was established.

Stay Tuned

–ColinSimilar Posts:

• Me and the Nexus 7000 last week at the Data Center VT
• Thanks and farewell to Jayshree Ullal
• Usability features in Cisco’s Nexus 7000
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Colin has left ePlus Technology
• Sun Project Backbox

--Colin McNamara

BIG Cisco – VMware announcement – 1:30 Pacific time

He writes about “the VLAN leaking myth” and how it encourages clients to utilize physically separate network infrastructure in the DMZ’s. Now first things first, I wouldn’t call VLAN leaking a myth. At one time it was a very real and serious vulnerability that was exploited by overflowing the capacity of the switch you were attacking, and causing it to “downgrade” from switch to a hub. Once this happened you now had access to previously protected devices, as well as having the ability to sniff data as it passed through the shared hub backplane.

As he mentions though, this is 8 years ago. Most switches have evolved to the point where backplanes far exceed the traffic that could ever be injected into their switchports. Even beyond backplane enhancements there are many ways to further firm up your security stance – Virtual Device Contexts, not using Layer 3 SVI’s on a DMZ VLAN, utilizing PVLANs, using port security, virtual routing instances, and many more. Of course, there are still many other attack vectors that still remain, but can be mitigated by utilizing features built into the majority of enterprise switches available today.

I think the real question is not “are VLANs safe in a DMZ”. The important question is have you mitigated the probability of compromise (the actual threat) to levels that are acceptable to your business. This question remains whether you have a standalone switch or not. So many times we hear about risk risk and more risk. But risk alone is meaningless in a business context. What is important is combining risk with likelihood. For that I like to use a simple table to come up with the true threat.

For example, as I drive to Fry’s there is the risk of me dying due to a car crash. The impact of me dying is very high (risk) however the likelihood of an accident is low, and furthermore I reduce (mitigate) the latent risk (threat) by wearing my seat belt. So all in all the threat of me dying on my way to Fry’s is pretty darn low.

In a business context this may be that I have public facing web servers and network devices in my DMZ. The impact of them being compromised is that my public image may be tarnished for a short time, and my end users may lose productivity if they are not able to VPN into work, or access the Internet while on premise. I mitigate this risk by using firewalls and both host and network based Intrusion Prevention Systems as well as implementing best security practices on my network and systems devices. The latent risk (threat) remaining is at a level that is acceptable to the business leaders, so the system is allowed.

One question that I have seen coming up more often as we move towards fully virtualized data centers is centered around commingling of virtual infrastructure. There are some hard questions which challenge some practices that we have held true over the years.

• Should you allow sharing of physical memory on a host virtual machine between an internal and DMZ server?
• Should you allow virtual infrastructure from multiple security zones to share a storage array or cluster of arrays?
• Should you allow multiple virtual switches in different security zones commingling on the same ESX or Hyper-V cluster?
• Should you allow virtual firewall and load balancing instances protecting internal and external zones to reside on the same hardware?
• Should you allow virtual routing instances from multiple zones to share a physical infrastructure?

In the past world of standalone systems, the additional cost of providing a wholly separate infrastructure for DMZ environments was relatively low. Each system generally had internal disk, or at most direct attached storage. Network devices themselves were scaled down to support one chassis one function. This fit quite neatly into the Enterprise Composite Network model that was quite common from 1999-2003.

Now, many data centers have moved to the Service Oriented Network Architecture (SONA). In this model the cost of a virtualized data center is primarily focused on foundation elements such as the virtual storage and virtual fabrics, virtualized network, and virtual systems elements. The cost of providing additional virtualized services off these elements is low, however the cost of duplicating the physical infrastructure is quite high on both the capital and operational levels. This is forcing the technical and executive leadership at many companies to take a long hard look at the true threats they are facing in previously physically separate security zones such as DMZ’s, Financial and other secure zones. In the end, they are having to decide whether the threat remaining after their security controls is worth duplicating hundreds of thousands of dollars worth of infrastructure or not.

These are hard questions, with really no single good answer. My gut feel is that over the next few years we will continue the move towards the fully virtualized data center where components such as memory, PCI-X buses, storage and network devices are even further decentralized. This will make the cost of duplicating the infrastructure more and more significant, causing consolidated data center (or compute) fabrics to be the norm. At this point the discussion will move away from securing zones by creating separate infrastructure, to providing end to end security, starting integrated application level security, maybe with TrustSec or a dirivative, all the way down to securing the data at rest on disk. For the time being however, the best we can do is sit down and do an honest appraisel of our security stances, mitigate what we can, and do our best to design data center architectures that provide the flexibility of implementing whatever choice the technical and business leaders agree on.Similar Posts:

• Moving towards a Green Data Center – Truth behind the hype
• Cisco’s Cloud Computing Offering
• About Colin McNamara
• Vote for my VMworld presentation – #3221 Built to fail (shameless pandering)
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Interesting TechWise TV episode on virtualization

--Colin McNamara

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

As a CCDE beta participant on the qualification exam, you have given us your time and feedback and have made a significant commitment to making this a valuable program in the market. As a token of our appreciation for your commitment to the success of the program, if you qualify, we are offering the beta of the practical exam to you at a reduced price of $700, a savings of $280 off the retail price of the beta exam along with a priority seat. Cisco will be offering this beta delivery of the exam on October 1, 2008, in Chicago, IL at a Pearson professional testing center. This is an exceptional offer and opportunity to be one of the first individuals in the world to obtain their CCDE certification.

There is a catch here, and hopefully everyone who is participating is able to pull their heads out of current projects soon enough to catch it.

We can’t keep priority seats forever so we’ll need your commitment by August 1, 2008. After August 1, 2008 you will be registering under open enrollment rules and we cannot guarantee your seat.

That’s right, you have 11 days to reply to the email, or forever hold your peace. In my case, them email is already sent. Hopefully I can talk my VP into letting me take that $280 I “saved” him and apply it to a really posh hotel.

–ColinSimilar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested
• Cisco’s Cloud Computing Offering
• My experience taking the CCDE Practical Beta

--Colin McNamara

CCDE Practical – Beta candidate deadline August 1 2008

I think Rick (5x CCIE) put it best in a company wide email earlier this afternoon  -

Please join me in congratulating Darrel in obtaining his Storage CCIE. There are only 24 double CCIES (RS/Storage) in the world, so he is probably about 1 of 15 or less in the world to hold all three.

What is everyone’s vote what is next in his career?  And, NO, you don’t have a say, Darrel

A) Service Provider

B) VOICE

C) CCDE

Thanks,

Rick Davis

ePlus, Senior Network Engineer

CCIE – Storage, Voice, Security, Service Provider, Routing and Switching (#5672)

Great job Darrel, everyone is really proud of you. and our apologies in advance to the wife for stealing you for choices A, B or C. (My vote is for C)

–Colin

Similar Posts:

• Updated CCIE numbers
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• About Colin McNamara
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Are you a kick ass engineer looking to grow?

--Colin McNamara

Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

The CCDE just got VERY real in a big way.The following announcement was posted in the CCDE zone at the Cisco Learning Network. (If you haven’t checked the Cisco Learning Network out yet, I recommend it. Its like NetPro on steriods, but focused around certifications.)

REGISTER NOW for the BETA Practical Exam
Cisco is now registering beta candidates for the CCDE Practical Exam. Cisco has finished development of the second exam needed to attain the CCDE certification, the practical exam, and is now soliciting candidates for the beta delivery.

Cisco will be offering this beta delivery of the exam on October, 1 in Chicago, Illinois at a VUE professional testing center. Only candidates that have a passing score on the CCDE qualification exam may register and participate in this exam. Exam beta pricing is $980US. Register Now by email at:ccdebeta@cisco.com

For my CCIE, it always seemed like a switched turned the moment I put my credit card information in and secured a seat. Before that button was pushed, it was a “future” item to deal with. Once that button was pushed it was a “now” item. Things like going out, having a beer with the guys, video games, etc all got shut down so my focus could burn a hole in the subject matter.

I just sent in my registration email for the CCDE practical. I’ll be in Chicago Oct 1, ready to give it my all. But, the more important lesson I learned from my CCIE was that if you focus your efforts on your lab day, you will fail. However if you focus your efforts consistently over the months before, you have a chance of passing. Now that my registration email has been sent, it is time to turn that focus dial up, lock to the door to my office and earn the CCDE through months of hard work.

See you in Chicago

–Colin

Similar Posts:

• CCDE Practical – Beta candidate deadline August 1 2008
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• My experience taking the CCDE Practical Beta
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• Protecting the integrity of the CCIE lab – Verbal Interviews being tested

--Colin McNamara

It’s on like Donkey Kong – CCDE practical registration is open

Luckily we made it to the party without dying, ePlus is safe for the time being. It was nice to have Cisco show appriciation to their biggest chearleaders, and even better to run into your peers and share a drink.

The venue was nice, though I am sure in retrospect that the organizers now now that if you pack hundreds of nerds in a room with video games and beer, there is bound to be a line. The party itself did seem to die out pretty quickly, but I do have to thank the folks at Cisco for taking the time to put the vent together for us.

Next year, Cisco is on its home turf. I think I’ll be the first to put my vote into the suggestion box. My vote is for Conference Room “G” . Where ever it does end up, lets look forward to seeing each other again next year.Similar Posts:

• VMworld 2009 Schedule
• Weddings, Measles and Podcasting -
• It’s on like Donkey Kong – CCDE practical registration is open
• Cisco Live 2009 – Networkers class schedule
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Witch fire in San Diego – Notes from an evacuee

--Colin McNamara

CCIE Party 2008 Recap – Cisco Live Networkers 2008

This is the first step towards sitting for a practical examination that will hopefully be released this October. And, in response to Micheal Morris’s blog post – Yes Mike, I can pass the CCDE written.

The second big item on my todo list was to recertify my CCIE. Thankfully, Cisco counts the CCDE written towards my recertification requirements. I am waiting for the system to update, but I think this will set me up to be certified till June of 2011.

There is one interesting side effect of passing my CCDE written the week before networkers. I had originally planned on using the free exam at networkers as a “safety” exam in case I struck out on this attempt. Now of course, that is not necessary. Since I am already a CCIE, there isn’t much incentive to take a professional level exam.

So, after weighing my options, I have decided to take the CCIE Service Provider written. It covers much of the MPLS / IP Next Generation Networks material that I have been studying. I only have 7 days to prepare, so the odds are against me. However, with the heavy service provider focus in the CCDE blueprint, I have a feeling after I battle the CCDE practical I will be set to roll right into the CCIE Service Provider lab.Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• CCDE Practical – Beta candidate deadline August 1 2008
• Cisco Certified Architect – Board examination above the CCIE and CCDE
• My experience taking the CCDE Practical Beta
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• What does it take to pass the CCIE exam?

--Colin McNamara

Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

When I work with data center infrastructure I expect the following – clean, remotely manageable, secure devices that runs on the same power and similar cabling, and everything can have a 24x7x4 support contract for hardware replacement. For the most part, you get this when dealing with Cisco, HP, Sun and similar manufacturers.

More often then not (with a few very cool exceptions), when I run into video surveillance infrastructure the video management infrastructure runs on some random third tier manufactured server. It never fails that the video management software is on Windows (normally XP or win2k). I have even seen some systems where the vendor requires you to have a session open to run the software.

And then when you get to the encoders themselves, it never fails. You have two choices.

1. The Uber package that can run a Casino, Identify and track dust mites , and if you point it at space, determine if there is life on mars.
2. Individual dinky encoders that run one or two camera’s each. They have limited encoding choices, limited camera control, no remote management, and normally run on 110 volt system that require different power distribution then the 220 that is common in systems today.

Cisco’s answer to this mess

Cisco has released both a video management solution, as well as a video encoding solution in a network module form factor for the Integrated Services Router (ISR).

The first part of this system, the Video Management and Storage System (VMSS) module fills the following roles -

• Management of multiple video streams from one interface, including IP cameras, 3rd party encoders, and streams from Cisco’s video encoding module
• Streaming of live and archived footage through a web browser interface
• This one is pretty cool – The module can mount external storage via iSCSI. So, in addition to its 160 gig internal drive, you can mount a filer and utilize external storage to scale the system.
• “fast forward” to events, as well as notify security and other personnel through SMS and email

The second part of the system (the module on the left in the picture above) is the Analog Video Gateway Network Module (EV-IPVS-16A). It has a couple functions -

• It can take up to 16 analogue video inputs and encode them with MJPEG or MPEG4 codecs
• You can use the first two ports to output video to a external monitors
• If you are using MPEG4, it can be used as a motion detector (handy for fast forwarding to important events, or triggering alerts)
• It can control pan and tilt cameras. This is good for pointing the camera at the janitor unplugging your servers each night to vacuum
• You can configure analogue contacts as an alarm. This can be bound to a door switch, or even temperature and water level monitors in a remote data center. This one will be very handy.

The third part of this solution is Cisco’s Video Surveillance Operations Manager. It manages, archives, displays and distributes the content that was created and collected on the two previous modules. You would use this if you had many branches to aggregate, or needed to staff a video wall (e.g. casino gaming commission operations). Now, you can run each of these components individually. Buy run together as a whole, Cisco has an enterprise class security solution.

Want to learn more ?

Branch office security page on cisco.com http://www.cisco.com/en/US/products/ps9671/prod_module_series_home.html

Cisco’s product page for the Video Managment Module – http://www.cisco.com/en/US/prod/collateral/modules/ps9671/data_sheet_c78_462225.htmlSimilar Posts:

• Interesting TechWise TV episode on virtualization
• About Colin McNamara
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Simplifying remote site security with Cisco’s new video surveillance modules on the ISR

UPDATE  – Sorry for the RSS spam, I have been playing with twitter (and frankly am failing to see its draw) and setup twitter tools to integrate my blog with my twitter microblog. I apparently left the create daily twitter summaries on. My appologies for the RSS spam.

–ColinSimilar Posts:

• Fibre Channel over Ethernet is taking off
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Unified Computing System Quoting and Configuration with Netformx
• Colin has left ePlus Technology
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0

--Colin McNamara

Twitter Updates for 2008-06-05

Please join me in welcoming John McCool to his new position as the leader of (in my opinion) Cisco’s most strategic business units. Similar Posts:

• Thanks and farewell to Jayshree Ullal
• Jayshree Ullal takes the helm of Arista Networks
• Cisco Nexus 4000 Blade Switch
• How to succede in 2007 – By Tim O’Reilly
• Certguard, Ethan Banks, Network World and Common Sense
• BIG Cisco – VMware announcement – 1:30 Pacific time

--Colin McNamara

John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)

Please join me in thanking Jayshree for all the positive contributions she has given to Cisco and the industry, and wishing her the best in her future endeavors.

Similar Posts:

• John McCool chosen as Jayshree Ullal’s replacement to lead Cisco’s Data Center Switching and Services Group (DSSG)
• Jayshree Ullal takes the helm of Arista Networks
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Cisco Nexus 4000 Blade Switch
• BIG Cisco – VMware announcement – 1:30 Pacific time
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Thanks and farewell to Jayshree Ullal

Legal implications of a breach

Losing control of personal data means means more then just replacing a tape in your backup rotation. Laws vary from state to state, however generally you are required to contact the identity holders who were breached, as well as fund some sort of remediation. This has huge implications on consumer confidence, and at the end of the day stock price of your company. In some cases, such as ChoicePoint a company can be completely decimated by a breach.

Data protection regulations

There are an ever increasing number of regulations that concern the control of sensitive data. These can vary from laws focused on patient data, to financial data, to personal identification data. The most most well known laws are HIPPA, GLBA, and Sarbanes Oxley (SOX). Past that there are laws that pop up every day at the state and municipality level that further increase the requirements and expense of dealing with a breach. In short, it is becoming an expensive and in some cases criminal offense to lose control of your sensitive.

What you can do to protect your backup tapes

First things first, putting a lock on that Iron Mountain box is just not good enough. You must assume that no matter what, a determined attacker will get physical access to your tapes. So many times companies thing that just because their data format is unique or proprietary that an attacker won’t be able to access it. The cold reality is that any format can be read, and yours is not that special.

The only way to be assured that your data is safe is to encrypt it with a complex cipher. In short, you need to treat your data the same way on tape as you would if it was sitting on a public ftp site (with anonymous access enabled). Luckily Cisco has a technology that allows you to encrypt and decrypt your data coming on and off tape. This technology is storage media encryption.

Cisco Storage Media Encryption (SME)

Cisco’s Storage Media Encryption (SME) technology allows for the seamless encryption of your data flows on and off your backup tapes using AES256 standard encryption. Whether you have VSANS segregating your data, a core / edge architecture, or Virtual Tape Libraries (VTL), you can use SME to protect your data at rest, removing the possibility of an attacker getting access to your critical data.

Storage Media Encryption works by leveraging a multifunction chipset available in the 18/4 module that comes default with the 9222i and is an option for the 9500 series director class SAN switches. Chipset has a couple functions, including line rate encryption of iSCSI and FCIP data streams at gigabit speeds, as well as line rate encryption of data as it streams your tape or virtual tape library’s (VTL).

Want to learn more ?

SAN and NAS, Oreilly Press – In the classic Oreilly style by W. Curtis Preston, this book is a great starting place to understanding the fundamentals of San and Nas architectures that many people are likely to face.

Storage Media Encryption for Cisco MDS SAN Switches – http://www.cisco.com/en/US/products/ps8502/index.html . Cisco has lumped together a couple good data sheets here, though I may have to write a future article taking a deap dive on what really drives SME.Similar Posts:

• Identity aware networking using Cisco TrustSec
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• My CCIE Storage Shopping List
• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• How to succede in 2007 – By Tim O’Reilly

--Colin McNamara

Encrypting your backup tapes with Cisco Storage Media Encryption (SME)

This switch answers a fundamental problem that has been presented by blade centers and VMware. The problem is increasing density of 10 Gig Ethernet, as well as the creation of SAN islands to provide storage access to VMware ESX clusters.  The nexus 5020 provides a solution that address both of these challenges, as well as supporting Fibre Channel Over Ethernet (FCOE) for the eventual move to a consolidated data center fabric in the years to come.

Want to learn more ?

Mastering VMware Infrastructure

Nexus 5020 Video Data Sheet

Unified Data Center Fabric whitepaperSimilar Posts:

• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Cisco Nexus 4000 Blade Switch
• Fibre Channel over Ethernet is taking off
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco releases Nexus 1000V virtual switch for VMware

--Colin McNamara

Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel

In the past couple years, VMware has changed from a product hidden in development and testing environments to a full fledged enterprise computing platform. It brings many benefits to the companies that implement it, however with those benefits come changes to the access layer of your data center. Your access layer is no longer a top of rack Cisco switch, or end of row aggregation chassis. It is now a virtual bridge that exists logically within your VMware ESX server.

This causes an interesting question to come up in many customers – Who is responsible for the configuration and maintenance of this Vswitch? At first glance most groups reference the port on the last Cisco switch as the division of responsibility between network operations and systems operations. This has worked well in the past for a three main reasons.

First, it divided responsibilities based on technical skillset. For example a network engineer understands spanning tree, trunking, routing protocols, firewalling. While a systems engineer understands file systems, databases and Linux and Windows operating systems.

Second, it provided for a interconnection point where standardized configurations could be applied by an operational group, versus complicated configurations that could impact overall network designs and require an architectural board review.

Third it provided for a clean hand off for troubleshooting. Both network and systems operations could agree on layer 2-4 functionality in an area that provided for detailed debugging on both sides.

Lack of a defined access layer

VMware ESX throws a wrench in this model. We no longer have this well defined edge at the access layer. The access layer now exists virtually inside a server. More specifically, it is a logical devices running in a Linux server. This presents a challenge because it requires cross over knowledge. Whoever is responsible for this integration has to be fluent in Linux systems administration , and also fluent in network design and operations. Frankly this is a rare skill set to come across, as it requires and engineer who has attained high proficiency in both systems and network engineering.

I see this fuzzy line of demarcation often as a failing point for many VMware integrations. Many times I see network operations teams not involved in ESX cluster design because its a “server” , and systems operations teams generally don’t have the networking skills necessary to design and implement an fully functional system.. The solution to this problem is education and collaboration.

The need for collaborative design sessions

The single most powerful element in a successful VMware integration is the creation of strong design documents. These are created by holding planning sessions where both your systems and networking leads hash out a strong design that takes both short and long term virtualization and network goals into account. Also, many times when people hear the word design, they think it is a high level Visio and a bill of materials. That is a just a fraction of the effort required. A proper design should cover everything from a 10,000 foot overview Visio down to protocol flow diagrams and configuration examples. By created a detailed design like this it is likely to bring up common issues such as 10 gig aggregation, trunking, VMotion security, layer two adjacency and layer 7 network service delivery on a white board instead of a production environment.

To create this detailed design, both your Network and Systems leads have to understand this product. VMware recognizes this is critical to successful implementation (and to further sales of their product) an offers the VMware Certified Professional certification. If you have the resources, I would recommend sending both your network and systems leads to this training at the same time. Having them attend training together allows them to leverage each others strengths and bring up questions specific to their network and their goals.

A real world example of this is the company I work for, Eplus. Last April forty of us, all senior engineers attended VMware Certified Professional training at the same time. The class was mixed up so there was an even distribution of CCIE’s, Systems Experts, and Storage Experts. Needless to say this presented our instructors with some extremely challenging questions, but more importantly it set the stage and created a venue for collaboration between these different practices within our own company.

Real world benefits

A great example of this model’s success this occurred last month. Rick and I were sitting in the engineering side of our Sunnyvale office, catching up on email after giving presentations at Cisco that morning and afternoon. In the bullpen behind us, one of the Microsoft architects was engrossed in a troubleshooting call with a large customer on the other line. It turns out a large systems vendor (who shall remain nameless) had been trying for a week to integrate the first ESX cluster into this network and just could not get the networking portion to work correctly. Our account manager received the call from a the customer, and asked the technical teams to step in to see if we could help out in any way.

The systems engineers were able to isolate the problem down to the network interconnections, but needed to bring in networking resources to resolve the problem. Rick and I were waved over and were given an overview of the problem and introduced us to the customer the far side of the call. We asked a few questions about the physical and logical architecture of their network and created a diagram of their network on the whiteboard. With this we were able to ask them to execute commands continuously isolating the problem domain until we found and resolved the issue.

Seven minutes had passed from the point Rick and I were waved over to the point the customer had a working installation. This allowed the customer to focus on moving their business forward instead of fixing a failed implementation. Three of us on the call had attended VMware Certified Professional training together. We had spent at a minimum 50 hours each creating a baseline of understanding in class, as well as many discussions in engineering meetings. The solution came in seven minutes not because of any one teams individual strengths, but because of collaboration. The systems engineers were able to isolate the problem domain very specifically. And as network engineers trained on VMware were able to quickly understand and digest the issues, and tie it together with our larger understanding of networks as a whole. Only at that point, when the team was able to leverage each others strengths were we able to address the problem so quickly.

There will come a point in the next few years where this fuzzy boundary between the “network” and the “server” is established again. My call is that this will coincide with Cisco finishing development of their Vswitch that will reside inside the ESX server. This switch will require both Cisco and VMware improve their design and integration guides for ESX which are both frankly lacking substance. Until those detailed architecture, integration and troubleshooting guides exist the key to successful ESX cluster implementation will be a strong cross trained systems and network teams that are collaborating on the next level of virtual network design in your enterprise.

Want to learn more?

Cisco – Integrating Virtual Machines Into Cisco Data Center Architecture

This is Cisco’s main design guide regarding the integration of virtual machines. You can use it as a decent high level overview if you are a network engineer who is curious how VMware ESX, or Xen servers for that matter will fit into your network.

VMware – Virtual networking Concepts

This VMware document goes between high level overviews and detailed descriptions. It is a decent resource for a network engineer, and provides an overview of ESX network features, however it misses the target for providing configuration examples.

Blog of Scott Lowe – Technical Lead for Virtualization at Eplus Technology

Scott is an engineer that works with me at Eplus Technology. He is based out of the east coast and covers servers, storage and virtualization. His blog is chock full of good of information. A recent post of interest was how to enable Cisco Discovery Protocol (CDP) on VMware ESX server network interface cards.Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Arista Networks – Their approach to cloud networking
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Resume – Colin McNamara, CCIE #18233
• New features in VMware 3.1

--Colin McNamara

Challenges integrating VMware into Cisco networks

Mike Writes -

“Hi Colin,
I’m an avid reader of your blog and had a question that I figured you could answer. I don’t have CCIE knowledge like I’m sure a lot of your readers do. I have worked for the same company for 6 years and during that time had been promoted into the Network Group where I was sent through class and earned my CCNA. The company I worked for decided to relocate across the country and so I have been looking for a new job. Finding a new job doesn’t seem to be that big of a deal but I noticed a lot of job descriptions are asking for BGP experience. We didn’t use BGP at my last job and I thought BGP is used primarily by ISPs for routing between Autonomous systems? If that is the case why do so many non-ISP companys list BGP experience in Networking job descriptions? What are they doing with it? Shouldn’t the ISP be doing the BGP routing for them?
Thanks!
-Mike”

Well Mike there are 3 primary reasons why a company would require (or want) BGP knowledge from its candidates.

Scenario 1. The company has an redundant Internet edge.

In this case lets call our company sample_company. Sample_company has its website hosted in a publicly facing DMZ and wants to make sure that its web servers are available in the case of an ISP failure. Normally in this case the company would request and Autonomous Systems Number (ASN) from ARIN and would get assigned a block of publicly routeable IP address’s (normally /24) that they can advertise. Sample_company would then peer with multiple ISP’s for example one connection to AT&T and the other to Sprint. Sample_company would advertise their ASN through both these ISP’s, and in the case of a failure of one of their ISP’s, the rest of the Internet would be able to calculate a path to sample_company’s web servers via the backup ISP.

Scenario 2. The company is utilizing MPLS for its WAN connectivity.

From a customer perspective MPLS is a private BGP based WAN where all edge devices connected to the MPLS provider utilize BGP to inject and learn routes. One note, some providers do support advertisement of routes via OSPF and even EIGRP now, but the most common scenario is to use BGP as your internal WAN protocol while running MPLS. One trend I am starting to notice, is that since companies are already using BGP on the MPLS WAN, they have started utilizing BGP as their primary routing protocol for their sites to avoid running multiple routing protocols and having to redistribute into BGP to cross the WAN.

Scenario 3. The company is using MPLS inside their data centers for segregation of business units.

In essence they are using the same tools and technologies that MPLS service providers are, however applying it inside of their data center and campus networks. In this case, BGP is the routing protocol necessary to carry the routes between the seperate MPLS VPN’s that are running inside the corporate data center. While this sounds pretty complicated, it actually simplifies many of the designs that you would normally implement to attain the same goals.

Learn more about BGP - Of course, there are many other reasons why you may see BGP on a job listing, but I think the previous covers the most common. If you are curious, and want to learn more about BGP I recommend buying Routing TCP/IP volume 2 by Jeff Doyle. This covers many great scenarios and configuration examples in EGP protocols. It is also written in plain English which can be a challenge with many technical books.

Learn more about MPLS in the enterprise - If you are feeling like learning about how you can implement MPLS inside of your own enterprise network then I would recommend buying Network Virtualization by Kumar Reddy and Victor Moreno. I was lucky enough to have Rick Davis translate the whole idea of utilizing MPLS in a campus environment into plain English for me a couple years back. From that point I was able to really expand my knowledge base and start asking the right questions from a firm foundational understanding of the technology. Kumar and Victors book took my understanding to the next level, showing how to incorporate many very cool features to make a MPLS network stand on its head if you want to. I can say (and actually have said to Kumar Reddy) that this book redefined my data center designs for large corporate and enterprise customers. I really recommend that you add this to your collection.Similar Posts:

• Simplifying your Data Center with Cisco’s Nexus 2000 Fabric Extender (FEX)
• Identity aware networking using Cisco TrustSec
• Challenges integrating VMware into Cisco networks
• Where is Colin ? Passing the VCP exam (VMware Certified Professional)
• Jayshree Ullal takes the helm of Arista Networks
• Arista Networks – Their approach to cloud networking

--Colin McNamara

Reader question – Why are corporations looking for BGP experience?

For new readers to this site, please you might enjoy the following articles -

Who is Colin McNamara ?

Usability features on the Nexus 7000

Overview of NX-OS 4.0 (the operating system for the Nexus 7000)

Why did I choose to get a CCIE in storage networking?

What does it take to pass the CCIE exam?Similar Posts:

• And it begins again – On the road to my CCIE in Storage
• What does it take to pass the CCIE exam?
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Cisco Nexus 4000 Blade Switch
• created a new map of ashley’s site
• Certguards inflamitory post about Ethan Banks removed from Network World Magazine

--Colin McNamara

Featured on Network World – 20 useful sites for Cisco networking professionals

• Cisco Certified Design Expert – CCDE – officially released by Cisco
• PHP / MySQL / FLASH website integration
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It
• User experience testing – enhanced
• Weddings, Measles and Podcasting -
• Dragged to the hospital

--Colin McNamara

What do you do for fun?

As with any vendor specific event, there is a mix of for public knowledge and for private consumption content, so I generally choose not to talk or write about subjects that may have been covered in the VT unless I can find some public documentation on that subject. So don’t expect to find any juicy pre-release information or gossip here. I don’t want to have the NDA police knocking at my door, and its just not cool to let stuff slip. So, I will generally avoid the subject.

What I can tell you is this – There is a lot of buzz about the Nexus 7000. It is a rocking platform, and we spent the majority of a day going over it. I can’t share much more then I did the night before the VT just yet (will wait till I get lab access to one) but I can share this.

Yes, most people are proud of their shots with Tom Cruise, or Oprah, Richard Stephens or BSD Girl. But I can Top that.. I have a picture of me and the Nexus 7000.

The DC Channels team was nice enough to take us down to the DataCenter and Network Applications (DNA) lab. Where the Nexus 7000 has taken its new throne. They allowed to ooh and ahh and poke and prod it. Weirdly enough, the one thing that struck most was the attention to detail that went into the physical design of this chassis. It is not only good looking, but has some super usability enhancements that really impressed me.Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• Where was Colin in 2010?
• Cisco releases Nexus 1000V virtual switch for VMware
• Humor inside the Nexus 5000 switch fabric architecture
• BIG Cisco – VMware announcement – 1:30 Pacific time
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

--Colin McNamara

Me and the Nexus 7000 last week at the Data Center VT

GoDaddy, one of the nations largest registrars and hosting providers is distributing bloated and possibly insecure code that will cause the average user to more then double their hosting costs. In the pages below you will learn exactly what GoDaddy is doing to your server, how their support staff will try to upsell you, and the steps you need to take to ensure proper operation of your Virtual Dedicated Server.

Background

One of my new years resolutions this year was to consolidate hosting accounts into one virtual server (hosted). I had my domains, and my old hosting with Godaddy already so it was a no brainer to try out one of GoDaddys VDS (Virtual Dedicated Servers).

I went with their 29.99 a month package, with Centos5, unlimited domains, 10Gb disk, and 256 MB of memory. This should be perfectly fine for hosting a couple MySql driven sites, and a couple gallery instances. Let me emphasise this is only handling 4 active domains, two of which only have static HTML.

Provisioning was a breeze, from order to shell account only took 4 hours. I was provided with shell access, pre-configured yum repositories, and this web control panel – simple control panel, or TurboPanel (seems to have two different names). I was able to pop into GoDaddy’s control panel interface with a direct link from their server manager console, and was setting up domains in no time. (Let me throw this caveat out though, don’t buy this product for your mom’s hosting…. the documentation is horrible, and by horrible I mean non-existant).

So I get my server all set up a couple weeks ago, transfer all my files from 2 Cups Solutions and set up my new www.colinmcnamara.com site. Things go just fine, I changed over to wordpress as a CMS and am totally thrilled. My applications and email are working perfectly. Plus, I have a shell account at GoDaddy which is a very handy thing to have as a network engineer. Things are going so well, that I give my buddy Rick a Christmas present and get ricksdavis.com and el-cinco.net for him, and host it on my GoDaddy VDS.I go ahead and purchase the domain through godaddy’s domain manager. This is obviously GoDaddy’s core competency, and goes flawlessly as usual. Next step, I go into the Turbo Panel web interface. Let me give you a little background on TurboPanel. This is the “free” equivalent “to plesk or cpanel. It is actually ok for automating your domain provisioning, though if you are a normal skill level user, I would recommend paying the extra 9.99 a month for Cpanel.

Server Error

I open up my TurboPanel interface and go to provision ricksdavis.com into the domain manager. It comes back with the least descriptive error I have ever received.

Server Error
We are sorry, the system has encountered an error while processing your request.

Home

If you continue to receive this error, please contact your system administrator.

Your URL: /domain/edit.do

Error details:

CommandFailedException: Unable to get min/max uids
at c.g.t.f.systems.user.LinuxUserSubsystem.loadUids:825
at c.g.t.f.systems.user.LinuxUserSubsystem.getMinUid:780
at c.g.t.f.systems.user.LinuxUserSubsystem.loadUserInfo:670
at c.g.t.f.systems.user.LinuxUserSubsystem.getUserInfo:646
at c.g.t.w.actions.domain.ActionDomainEdit.process:84
at c.g.t.w.actions.AbstractSpringAction.execute:118
…
at c.g.t.w.filters.AuthorizedResourceFilter.doFilter:38
…
at c.g.t.w.filters.RequestPopulationFilter.doFilter:117
…

This is the most descriptive error ever right? it tells you what is wrong, has a link to the support system, and gives you actionable information…. I would say a resounding NO. This is a classic example of why friends don’t let friends program in Java. When I got this error last night, I was scratching my head. As an engineer, the first thing I will look at is the last change to the system. Coincidentally I had installed awstats two nights before, and looking at my change logs, I saw that I had upgraded my perl version. So, with no fast response to the support email from GoDaddy I chose to put in a server re provision request (fully automated) and restore from my backups. That process took about an hour, but afterwards I was back online with no errors. Eureka! I found it (I thought). I provisioned Rick’s domain, wordpress, gallery2 etc and then went to bed.

GoDaddy Support Response

Fast forward to this morning, and I finally recieve an email reply from godaddy support. The email is pasted below-

(I have replaced the agents name with John Doe. Tech support is a hard job and I see no reason to highlight him specifically)

Before re-provisioning the server, I went ahead and tried the old three finger salute (reboot) the error still existed. So even if this email would have came to me on time, it would not have helped.

But that is besides the point. lets dig into the solution

The agent suggested the following fix -

Restart tomcat – which I was NOT using for any of my web applications (not an ejb guy)

/etc/init.d/tomcat55 restart

Restart TurboPanel (or simple control panel now – they haven’t updated their init scripts)

/etc/init.d/turbopanel restart

GoDaddy tried to upsell me, instead of fixing their code

He gives the standard, run less stuff on your server speech (remember, I only have 4 domains on this server)

Now here is the kicker – To remedy this issue long-term, you could either setup a server with 512mb RAM, or upgrade to a Dedicated server.

What the heck is with that? I should not need an upgrade with only 4 domains on a server. Especially when in the setup the default Cpanel implies support of 30 domains. Is this Tech Support or a Sales Call?

But, since my server was working fine I don’t pay much attention to the email and move on with my life.

Fast forward an hour, and I am show Rick how to access all the features of his new site, and I figure that I need to change an email account on his domain to forward to his old account. Fine, this should take two minutes. I log onto the TurboPanel interface to put the email forward in.. and there it, a big useless error screen. What the heck is with that?

So this time I actually read the email, and try the fix. Results = nothing. GoDaddy offers shell access so I log in, run top and filter for %memory used. Low and behold, there is only 8142 bytes of memory free, and a Java process owned by root is using 300Mb of virtual memory, and 132Mb of real memory, and Tomcat is using 115Mb of virtual memory and 86Mb of real memory.

Let me translate this into English – Godaddy’s control panel application was using 218 Megabytes of the 256 Megabytes of memory I had purchased. That left me with 34 Megabytes of memory . Let me clarify this, I had paid for a virtual server with 256Mb of ram, up to 1000Mb bursted (which I think is their code for swap). I am only running 4 domains on this server, and two pop3 email servers. This should not be a problem.So what is the cause of the problem? I can sum it up, crappy Java programming. Someone decided to write this program in Java (probably easier to outsource) instead of optimising it to run on lean systems. Their code effectively takes up all the available memory. And on top of that, they are are running a webserver process as root… yes as root. It is like asking for your server to get hacked.

Now, that I am done ranting, let me highlight how to fix this problem.

If you are on Windows use the following procedure to get shell access to your GoDaddy VDS -

• you will want to download a ssh client called putty – Download Here
• Copy this file to your desktop, double click putty.exe , and you should see something like this -

• In the host name field I have www.yourdomain.com . replace yourdomain with your domain name.
• Click on the open button on the bottom right, and a shell should pop up, along with a warning that looks like this (you can click OK to the warning)

• Now skip past the linux section

If you are running Linux or Unix start here -

• Open up a command line terminal
• ssh using your godaddy simple control panel username example -

ssh your-godaddy-control-panel-username@www.yourdomain.com

• If this is your first time connecting to this server, you will be prompted to accept an unkown ssh key into known_hosts, choose yes to accept

Both Windows, Linux and Unix Continue Here –

• Enter your the password you use to access your GoDaddy Simple Control Panel Interface
• You will be presented with what looks like a DOS window, this is called a secure shell terminal. Type in the username you use to access your Godaddy Simple Control Panel and then hit enter

• Now type in the password that you use to access your Simple Control Panel Interface and hit enter

• Congratulations, if you see the window below you are now shelled into your virtual dedicated server.

Change to the Root user

• Now that you are shelled into a Linux device you need to escalate your privileges to get administrator level access. In the Unix world this user is known as Root. You can change to this user, and get full system privileges by using the following command.

su – root

• You will be presented with a password prompt, enter in the same password that you have used to log into your Simple Control Panel Interface
• You are now root, be careful with what command you enter under this user, as you can do some damage if you are careless

Clean out your servers memory

• Most recent Redhat direvatives (including Centos) utilize a tool called yum to add and remove packages. This is also true with your linux servers at GoDaddy.
• you need to install a tool called memhog, it is part of a package called numactl that is normally used to assign specific process’s to specific cpu’s in a multi-core system. We will be using it today to fix GoDaddy’s memory hogging application

yum install numactl

• choose yes to all the prompts, and numactl will automatically be downloaded and installed on your server

Stop GoDaddy Simple Control Panel, and Tomcat, and tell them not to start automatically when your server restarts.

• Tomcat is a special type of webserver for Java based applications. Godaddy uses it to run their control panel interface. 99.99999 percent of users will not need to use Tomcat. If you do need to use Tomcat then you are a technical user and will know what to do.
• In Linux, server applications are called daemons. The are executed by init scripts. We will use these scripts to turn off these server applications
• Turn off the TurboPanel daemon ( this is the process that runs your simple control panel web interface

/etc/init.d/turbopanel stop

• Next we need to turn off Tomcat

/etc/init.d/tomcat55 stop

• Now that we have these services turned off, we need to make sure that they don’t come back when we reboot the server. We can do this by using the chkconfig command.
• Stop the Simple Control Panel Interface from starting automatically by executing the following command

chkconfig turbopanel off

• Stop the Tomcat server from starting automatically by executing the following command

chkconfig tomcat55 off

Clean the mess GoDaddy made of your servers memory

• A couple steps back we installed numactl. The executable we wanted out of this package is memhog. Issue the following command to take your memory back. This command will overwrite 200 megabytes of your memory, allowing the rest of your applications to get access to that memory.

memhog 200m

• This will Clear out the memory that GoDaddy’s application took over, and allow the rest of your daemons to run fine.

Great, my server is running better now. But I want to use my Simple Control Panel Interface. How do I do that?

• Easy, all you need to do is temporarily start the turbopanel daemon. When you are done making changes, you can turn it off again

/etc/init.d/tomcat55 start

/etc/init.d/turbopanel start

• When you are done, don’t forget to turn it off

/etc/init.d/turbopanel stop

/etc/init.d/tomcat55 stop

*** UPDATE *** *** UPDATE ***

I managed to stay with Godaddy and use their Virtual Dedicated Servers for 12 months. However I have moved to a new hosting provider (rimuhosting) in the spring of 2009. My last straw with GoDaddy occurred when I noticed that even with my memory utilization under control my applications were performing poorly. I shelled into verify and found that the virtual disk I/O was severly limited.

Performance issues –

Simple command to determine directory size on GoDaddy VPS

[root@ip-72-167-15-128 home]# time du -hs
1.3G    .
real    0m49.013s
user    0m0.011s
sys    0m0.062s

Simple command to determine directory size on Rimuhosting VPS
[root@colinmcnamara home]# time du -hs
1.3G    .
real    0m0.343s
user    0m0.050s
sys    0m0.290s

Translated into english, it took 49 seconds to execute a simple command on my GoDaddy server, and it too 0.34 seconds (under 1 second) to execute the same command on my virtual server at Rimuhosting.

On top of that, I was paying $32 dollars a month to GoDaddy for a server with 256 megs of ram as well as a FTP backup account. When I created my short list of hosts, I noticed that I was not getting the best deal by staying with GoDaddy.

Pricing at Rimuhosting

• Virtual Dedicated Server 190 Megabytes RAM – $19.95
• Virtual Dedicated Server 400 Megabytes RAM – $29.95
• Virtual Dedicated Server 900 Megabytes RAM – $39.95
• Virtual Dedicated Server 1150+ Megabytes RAM – $49.95

One thing you may notice, is that for the same price as the base GoDaddy VDS ($29.95) you get 400 Megabytes of RAM instead of 256. (and they won’t put on a memory sucking turbopanel app) On top of that, things that I had to pay extra for at GoDaddy such as backup space, backup mail relays, and DNS service came bundled for free.

I made the choice to move to Rimuhosting, and the service has been superior to GoDaddy in every single way. If you get sick of GoDaddy like I did, you might want to check Rimuhosting out, I think you’ll like them.Similar Posts:

• What should I do this thanksgiving break?
• Zone based IOS firewalls
• Routers can email you when they go down
• New features in VMware 3.1
• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Identity aware networking using Cisco TrustSec

--Colin McNamara

Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It

Kylie Launching in Yosemite while sledding, originally uploaded by Colin_McNamara.

This is the best vacation ever, 4 days in Yosemite over Christmas. This may turn into a yearly thing.

Similar Posts:

• Ashley stole my new Lense…
• Christmas Trivia
• Google Translate API and speech recognition
• Witch fire in San Diego – Notes from an evacuee
• New features in VMware 3.1
• Gall stones update – Kaiser sucks

--Colin McNamara

Kylie Launching in Yosemite while sledding

CERTIFICATIONS / ACCREDITATIONS HELD

• CCIE – Cisco Systems Internetwork Expert #18233
• VCP – VMware Certified Professional
• CDCUCSS – Cisco Data Center Unified Computing Support Specialist
• VSP – VMware Sales Professional
• VTSP – VMware Technical Sales Professional
• TSS – Cisco Technical Solutions Specialist, Data Center
• GCIH – GIAC Certified Incident Handler
• CCVP – Cisco Certified Voice Professional
• CSNSSS – Cisco Storage Networking Solutions Support Specialist
• CSNSDS – Cisco Storage Network Solutions Design Specialist
• CADCNSS – Cisco Advanced Data Center Networking Infrastructure Support Specialist
• CCIE Storage Networking
• RHCE v4/5 – Redhat Certified Engineer #804006368822511
• RHCT v4/5 – Redhat Certified Technician #804006368822511
• EMCPA – EMC Proven Professional Associate – Information Storage and Management
• NSCA – Netscaler Certified Administrator #2005072
• NACE – Network Appliance Certified Expert #12912
• NACP – Network Appliance Certified Professional #12017 – Data Protection
• NACP – Network Appliance Certified Professional #11985 – Storage Area Network
• NACP – Network Appliance Certified Professional #12911 – High Availability

Retired Certifications

• Cisco Qualified Specialist – IP Telephony Support
• Cisco Qualified Specialist – IP Telephony Design
• Cisco Qualified Specialist – IP Telephony Operations
• Cisco Wireless LAN Design Specialist
• Cisco Wireless LAN Support Specialist

PROTOCOL PROFICIENCY

EIGRP, OSPF, RIP, BGP, MPLS,  Spanning Tree, Rapid Spanning Tree, VPC, VSS, VDC, TRILL, Fabric Path, OTV ATM, RTP, SIP, H.323, LWAPP, RADIUS, TACACS+, Ethernet, Fibre Channel, iSCSI, NFS FCIP, FCP, FSPF, NDMP 802.11a, 802.11b, 802.11g, RBE, ISDN, SNMP

Virtualization , Parallel and High Performance Compute Platforms

VMware ESX, Kernel Virtual Machine, Xen, Platform LSF, Sun Grid Engine, Hadoop

VOICE and VOICE OVER IP

CallManager, Unity, ICS7750, PBX Trunking, SRST, Active Directory Integration, Extended Services, Call Detail Recording, Automated Attendant, Extension, Mobility, Asterisk, Callware and VSR VM.

HARDWARE

Cisco Unified Computing System (UCS) 6100, 2100, 5100, Nexus 7000, Nexus 5000, Nexus 2000 and Nexus 1000v switches, Catalyst 1900-6509 switches, 1600-7500 series routers, Cisco PIX firewalls, Cisco Load Balancers, Cisco

MDS , F5 Load Balancers, Netscreen / Juniper Firewalls, Cisco VPN3000 VPN concentrators, Cisco ASA Adaptive Security Appliances, Nortel Contivity VPN Concentrators,  Aironet Access Points and Bridges, Airespace LWAPP

concentrators. 3com TotalConnect racks, Ascend dial concentrators, Netscaler Load balancers, SSL accelerators, SSL VPN concentrators. Brocade Silkworm, HP Eva Storage

NETWORK MANAGEMENT

Nagios, Cacti, NTOP, IPswitch What’s Up Gold, BIG Brother, Spectrum Network Management, Kiwi Syslog,, MRTG , HP OpenView, Cisco Secure Intrusion Detection system,

Cisco Network Based Application Recognition, Snort IDS, Netscreen Firewall Manager, Unified Compute System Manager

OPERATING SYSTEMS

Redhat, Suse and Ubuntu Linux, Windows 2000, Windows 2003, Windows 2008, Windows XP, NT4.0, BSD, Solaris, OSX

BUSINESS ENVIRONMENTS

Consulting, Valued Added Reseller, Large Enterprise, Startup, Banking, Service Provider, Software Development, Manufacturing, Military

EMPLOYMENT

6/11 -  Present , Nexus IS

Director, Data Center Practice

Responsible for got to market strategy for Nexus IS, a national Cisco DVAR.

Accomplishments

• TBD

1/07 – 6/11, ePlus Technology

Consulting Systems Engineer – Data Center (10/08 – 6/11)

Transformed ePlus western region from a #3 and #2 ranked voice and campus partner to the #1 ranked Data Center partner in Northern California

Accomplishments

• Changed regional sales focus from technology silo’s to solutions based selling covering network, systems, storage and applications under one umbrella
• Developed and deployed go to market strategy for Cisco’s Unified Computing System resulting in significant competitive advantage in the western United States.
• Deployed the first Nexus 7000/5000/2000 architecture into production securing competitive advantage across multiple verticals.

• Increased Data Center revenues year over year in the worst economy in a century.
• Attracted and retained top industry talent.
• Leveraged unique technology positioning to win multiple key global clients.
• Partnered with business units inside of Cisco, resulting in key product enhancements as well as increased revenue for both ePlus and Cisco.
• Passed multiple certifications resulting in ePlus being able to sell and install EMC Vblock.

1/07 – 6/11, ePlus Technology

Senior Systems Engineer (1/07 – 10/08)

Accelerate Technical Sales, design and implement network, storage, voice and systems solutions for ePlus Southern California customers.

Accomplishments

• Changed regional sales focus from technology silo’s to solutions based selling covering network, systems, storage and applications under one umbrella.
• Established a trend of Advanced Technology account wins.
• Accelerated ePlus’s southern California sales by providing high-end engineering support.
• Integrated MPLS service provider designs into cutting edge Enterprise and Casino Gaming solutions.
• Filled PM and lead network engineer roles for large publicly traded company data center migrations.
• Created modular Cisco design / quote format and menu based hardware and services options to address rapidly changing customer needs.

9/05 – 1/07 ID Analytics

Lead Network Engineer

Lead team of four engineers, Define network and application integration architecture for large SaaS (financial cloud) analytics deployment , Leverage networking technology to increase security and availability, and decrease development and product deployment timelines

Accomplishments

• Led team of engineers responsible for all Production and Back Office systems in 2 offices and 3 datacenters
• Designed and Implemented ID Analytics Phase2 datacenter, processing 1.8 million financial transactions daily.
• Designed and Implemented Contents Switching and SSL offloading solution, enabled non-disruptive scaling of core products
• Integrated ID Analytics product with the largest card processors in the world – Equifax, Visa, TransUnion, etc.
• Designed and integrated centralized Fiber Channel and ISCSI SAN solution, increasing application speed and decreasing production database refresh times from 4 weeks to 1 week.
• Managed and maintained over 130 terabytes of storage
• Created lights out server imaging and deployment solution for remote datacenters
• Deployed and integrated monitoring solutions utilizing open source technology
• Created user emulation probes for real time application monitoring and trending of production systems
• Worked with development and Analytics to create structured Development and QA environments
• Spearheaded project to change Analytics / Informatics environment from “unix for workgroups” to high performance computing environment (HPC)
• Provide structured documentation to US Government and Corporate auditors
• Utilized project management skills for international rollouts

2/04 – 8/2005 Openwave Systems
Senior Network Engineer, Strategic Design and Integration Group
Provide technical leadership, Define network architecture, Establish standards and technical vision. Responsible for researching, developing, and architecting technical solutions to business needs.

Accomplishments

• Designed Openwave’s new Pacific Datacenter Networks, with 900 production, and 2000 development servers.
• Designed Openwave’s Pacific Shores Campus Networks, and Showcase Datacenter.
• Responsible for hardware acquisition budget of 1.7 million dollars
• Established ISCSI IP based SAN infrastructure with DR components in 4 major datacenters worldwide
• Promoted from the ranks, moving from running our VOIP phone systems, to Network team lead, to Senior Network Engineer in the Strategic Design and Integration team.
• Active and engaged member of multiple boards covering design review, change control, and security
• Negotiated with Cisco and SBC regarding datacenter purchases saving $906,000 off list price.
• Renegotiated Cisco support saving Openwave nearly $600,000 over our three year term
• Established improved data center controls, allowing Openwave to pass Sarbanes Oxley (SOX) audits
• Wrote and ran multiple RFP, RFQ, and RFI’s
• Utilized project management skills for international rollouts
• Managed, Piloted, and Installed new wireless systems for our Customer Briefing Center
• Responsible for 6 VOIP clusters around the world
• Recipient of multiple awards recognizing dedication and quality work.
• Attended continuing training for security management (CISSP)

2/03 – 1/04 USMC Reservist activated in support of Operation Enduring Freedom
Information Services Coordinator
Implement and maintain Tactical Data Networks, Provide consulting services to hosting units. Maintain Microsoft Exchange servers in both tactical and garrison environments. Perform security audits and remediation. Train support personnel.

Accomplishments

• Performed Disaster recovery of routed ATM LANE environment for Marine Corps Air Station Yuma enabling over 3000 users to resume work (awarded the Navy and Marine Corps Achievement Medal for that event)
• Performed security audit and created a security and performance remediation plan for MCAS Yuma
• Provided project management and security audit skills to 3^rd Marine Air Wing Yuma server support teams, managed server security audit, security remediation, and SMS rollout.
• Designed and implemented Nagios network monitoring system at Marine Corps Air Station Yuma.
• Implemented Norton Antivirus server for MWSS 473
• Provided training on to data teams from MWSS 473, MCAS Yuma Station IT, and 3^rd Marine Air Wing Yuma server teams.

12/02 – 2/04 2 Cups Solutions, Pleasanton , Ca
Principal Consultant
Founded 2 Cups Solutions to provide cutting edge Voice, Data, Wireless and Security services to clients in the San Francisco bay and Fresno areas.

Accomplishments

• Implemented WAN failover solution at two City of Hayward fire stations.
• Implemented email and web solution for Express Mobile Notary.
• Developed and implemented business plan focusing on State and Local Government contracts.

2/02 – 12/02 ExtraTeam, Pleasanton , Ca
Senior Systems Engineer
Design, Installation, Configuration and Maintenance of network systems consisting of Cisco CallManager, Unity, Cisco Secure ACS, LEAP secured wireless, Aironet, Cisco routers and switches, PIX firewalls, and VPN3000 concentrators. Integrating all systems with Active Directory. Performed VOIP feasibility studies. Managed the entire business cycle including sales, design, installation, training and maintenance.

Accomplishments

• Integrated CallManager voice system with Active Directory
• Recovered a failed CallManager implementation at Phase 2 Strategies (PR firm for Logitech). Implemented CallManager with up to date hardware and software, upgraded Unity up to reasonably current levels. Brought up remote office in Phoenix utilizing SRST.
• Implemented City wide wireless network integrated with active directory for the City of Hayward
• Implemented VPN Concentrators in conjunction with multiple levels of firewalls for City of Hayward and Hayward PD to meet CLETS requirements.
• Implemented network configuration management system responsible for the city of Hayward.
• Implemented new wan for Livermore Pleasanton Fire department moving fire stations from isdn to T1 and Gigabit fiber lines in conjunction with moving the location for the network core.
• Designed and implemented IPSEC based wan for Universal life resources, allowing nationwide secure remote office connectivity while minimizing wan connection costs.
• Designed CallManager based VOIP system for a 27 site school district
• Provided emergency support to Fire and Police agencies across the bay area
• Performed security remediation for a large bay area company
• Participated in large switched network cutover from 7500 to a 6509 with flex-wan modules for Stanislaus County.
• Achieved technical certifications for ExtraTeam to become certified under both the Wireless and IP Telephony revised specifications.

7/01 – 2/02 Infobond Inc. Burlingame , Ca
Network Engineer

Responsible for engineering duties in a leadership role. Integrated legacy PBX’s using VOIP technology. Used Quality of service to ensure VOIP service levels. Support legacy voice over IP and voice over Frame Relay technologies. Upgrade from legacy voice integrations to state of the art VOIP integrations. Create project plans and act on them.

Accomplishments

• Cut over evergreen lines shipping terminal from legacy 3com equipment to VOIP enabled Cisco routers and switches. Accomplished all work during Union stand downs.
• Contracted to Openwave, Inc. to run Remote Access while the engineer was on leave. Ran Remote Access for 5 weeks, resolving DSL RLAN issues and IPSec issues, while reducing trouble ticket backload to manageable levels. Assisted other engineers when needed.
• Implemented Cisco 6509’s to replace aging core network of a Benchmark Capital (bay area investment firm).
• Diagnosed and resolved VOIP issues that were stopping call center rollouts for Embarcadero Systems (a large bay area shipping company).

03/00 – 7/01 Knapp Publishing Corporation, San Ramon, Ca
Network Systems Administrator

Responsible for day-to-day operations of e-commerce data center, and wide area networks Performed DNS changes for both internal and external networks. Designed, piloted, and implemented network changes. Installation configuration and maintenance of NT, and Windows 2k file, print, and web servers

Accomplishments

• Improved service levels from 90% to 99.99%, enhanced security and increased bandwidth were benefits derived from implementing a state-of-the-art web hosting data center
• Implemented a network monitoring system to document, report, and notify of network status.
• Designed and implemented ISDN failover of Frame-Relay Network.
• Designed, piloted, and implemented network changes.
• Replaced NT servers with Linux based servers, integrated with the Windows network

01/98 – 03/00 DKA Computers Inc. Clovis, Ca
Manager Information Services (01/99 – 03/00 )

Ran day to day operations of a large valley ISP. Worked with systems manufacturing to bundle client software with all new PC’s. Partnered with local ISP’s to provide access numbers across the valley.

Accomplishments

• Managed web development, and professional services
• Moved web hosting from IIS on Windows NT to APACHE on Linux based servers, drastically increasing site availability
• Produced a forms based web application to configure custom systems online.
• Designed and implemented an IPSec based WAN connecting 3 stores point of sales systems.
• Managed corporate office and data center relocation project.

Senior PC Service Technician (01/98 – 01/99)

Provide on call service. Staff PC help desk. Provide direct customer systems support while maximizing company revenues. Configured all servers ordered from manufacturing.

Accomplishments

• Responsible for all day to day service activities for a 13 million dollar company. Management of 4 team members. Directly responsible for customer satisfaction
• Implemented hard drive imaging system, decreasing both warranty costs and turnaround time
• Installed and configured SCO Unix reservation system for National Park service, Kings Canyon
• Deploy Citrix Winframe Systems, Windows NT 4.0 Systems
• Designed, implemented inventory tracking database, reducing required stock on hand by $40,000

MILITARY

1996 – 2004 UNITED STATES MARINE CORPS RESERVE
Have held U.S. Government security clearance – Secret

EDUCATION

Ongoing professional education

Sans CISSP + Track

University of Oklahoma extension – Fire Science

Cisco Networking AcademySimilar Posts:

• What does it take to pass the CCIE exam?
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• About Colin McNamara
• Cisco Certified Design Expert – CCDE – officially released by Cisco
• Challenges integrating VMware into Cisco networks
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

--Colin McNamara

Resume – Colin McNamara, CCIE #18233

Colin is best known for providing designs that incorporate disparate technologies under a shared virtualized infrastructure. He is a proponent of both network virtualization and the utilization of service provider technologies inside enterprise networks to support the security delivery of Voice, Video, Storage and Real Time Application traffic over shared network infrastructure.

He resides in the San Ramon (San Francisco Bay Area) , California with his Wife and two kids. And is active in multiple boards and organizations, including -

• Cisco Partner Technology Advisory Board
• Consortium of Internet Technology Experts

He can be contacted via information found on his CCIE Resume page . by contacting him via Linkedin or at colin@2cups.com

Similar Posts:

• Colin has left ePlus Technology
• Cool new features in 12.4(15)T
• Are you a kick ass engineer looking to grow?
• Resume – Colin McNamara, CCIE #18233
• I’ll be at Cisco Live 2008 (networkers) in Orlando all week
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

About Colin McNamara

1. The first and foremost goal is to only use “white hat” or legal ways of increasing her visibility
2. Get Ashley on page 1 for four target keywords
3. Get An indented listing

Well, it looks like I met my initial goals. Now to move to some more generic keywords and see what goes from there.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks
• Great TCL and EEM preso found on IOS hints and tricks -
• Sun Project Backbox

--Colin McNamara

What being married to a geek who does search engine optimization gets you

http://www.ashleymcnamara.com/index2.php

http://www.ashleymcnamara.com/htmlver/
http://www.ashleymcnamara.com/articles/
http://www.ashleymcnamara.com/htmlver/info.php?num=1
http://www.ashleymcnamara.com/htmlver/galleries.php?sec=1&galnum=1
http://www.ashleymcnamara.com/htmlver/multipage.php
http://www.ashleymcnamara.com/htmlver/proofing.php
http://www.ashleymcnamara.com/htmlver/calendar.php
http://www.ashleymcnamara.com/htmlver/contact.php
http://www.ashleymcnamara.com/articles/2007/12/31/happy-new-year/
http://www.ashleymcnamara.com/articles/2007/12/19/thank-you/
http://www.ashleymcnamara.com/articles/2007/12/02/30/
http://www.ashleymcnamara.com/articles/2007/11/20/baby-t/
http://www.ashleymcnamara.com/articles/2007/11/17/the-wilson-strauss-family/
http://www.ashleymcnamara.com/articles/2007/11/11/the-naritomi-family/
http://www.ashleymcnamara.com/articles/2007/10/31/tot-trends-weekly/
http://www.ashleymcnamara.com/articles/2007/10/31/cotton-candy-sky/
http://www.ashleymcnamara.com/articles/2007/10/30/southern-california-wildfires/
http://www.ashleymcnamara.com/articles/2007/09/21/baby-g/
http://www.ashleymcnamara.com/articles/page/2/
http://www.ashleymcnamara.com/articles/about/
http://www.ashleymcnamara.com/articles/wp-login.php
http://www.ashleymcnamara.com/htmlver/index.php
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=1&sec=1&tstart=2
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1
http://www.ashleymcnamara.com/htmlver/multipage.php?num=3
http://www.ashleymcnamara.com/htmlver/multipage.php?num=2
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=01&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=02&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=03&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=04&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=05&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=06&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=07&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=08&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=09&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=10&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=11&yearC=2008
http://www.ashleymcnamara.com/htmlver/calendar.php?monthC=12&yearC=2008
http://www.ashleymcnamara.com/articles/2007/09/16/ive-been-tagged/
http://www.ashleymcnamara.com/articles/2007/08/15/the-pirraglia-family/
http://www.ashleymcnamara.com/articles/2007/06/21/baby-sophia/
http://www.ashleymcnamara.com/articles/2007/06/03/my-kidlets/
http://www.ashleymcnamara.com/articles/2007/05/23/11/
http://www.ashleymcnamara.com/articles/2007/05/20/baby-emily/
http://www.ashleymcnamara.com/articles/2007/08/09/good-to-be-back/
http://www.ashleymcnamara.com/articles/2007/07/12/oh-baby/
http://www.ashleymcnamara.com/articles/2007/08/15/baby-viv/
http://www.ashleymcnamara.com/articles/2007/08/27/miss-livia/
http://www.ashleymcnamara.com/articles/2007/08/14/the-jones-family/
http://www.ashleymcnamara.com/articles/2007/06/08/baby-v/
http://www.ashleymcnamara.com/articles/page/3/

http://www.ashleymcnamara.com/articles/2007/05/19/mama-rocks/

http://www.ashleymcnamara.com/articles/2007/05/22/cuteness-overload/
http://www.ashleymcnamara.com/articles/2007/05/15/motherly-love/
http://www.ashleymcnamara.com/articles/2007/05/16/birthday-girl/
http://www.ashleymcnamara.com/articles/wp-login.php?action=lostpassword
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=1&sec=1&tstart=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1&tstart=2
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=1&sec=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1&tstart=2
http://www.ashleymcnamara.com/htmlver/multipage.php?num=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1&tstart=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=2&sec=1&tstart=3
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1&tstart=1
http://www.ashleymcnamara.com/htmlver/galleries.php?galnum=3&sec=1&tstart=3

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Tour of Ashley’s new site !
• Featured on Network World – 20 useful sites for Cisco networking professionals
• Cool new features in 12.4(15)T
• PHP / MySQL / FLASH website integration
• Cisco Nexus 7000 DataCenter switch released – Welcome to DataCenter 3.0
• Certguard, Ethan Banks, Network World and Common Sense

--Colin McNamara

created a new map of ashley’s site

Here is the flash version of her site

Here is the HTML beginning of her site

Direct to the HTML version

Her about page titled your San Diego Photographer

Her maternity portfolio, featuring some great shots of San Diego moms

Her baby portfolio feature babies in San Diego

Her children portfolio

Her frequently asked questions

Her price sheet

Ashley’s Charity Work

Her client proofing, where her clients can preview all their images

One that I really like is a place where you can check her schedule

And last but not least, a place where you can contact her

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• PHP / MySQL / FLASH website integration
• created a new map of ashley’s site
• San Diego Maternity Photographer
• Ashley stole my new Lense…
• Weddings, Measles and Podcasting -
• What being married to a geek who does search engine optimization gets you

--Colin McNamara

Tour of Ashley’s new site !

This tactic address one key failing of ISCSI. Specifically an ISCSI interface running at 400 megabit will take 16% of a 3 ghz 64 bit cpu while using a software initiator or target. This can create some interesting issues where you don’t want to have them. By removing the layer3 information, and transposing fibre channel commands over the Ethernet transport a major cpu hit is avoided.

My gut feel is that this technology will follow a similar track as ISCSI did. ISCSI had a very low adoption in the first 3 years. Storage guys are naturally timid, as there are stiff consequences for failure, but eventually engineers warmed up to ISCSI and started deploying it where it was most appropriate, in lower bandwidth utilization hosts. FCOE will follow this same path, however this time we won’t have to fight the FUD of storage of a network transport. What is in FCOE’s favor is that as a protocol it is optimized for the general ISCSI setup of flat layer two transport between target and initiator.

That all being said, we are going to have to see some product releases from Cisco and Intel for FCOE to really take off. If we don’t, then FCOE will fall down the same hole that ATA over Ethernet disappeared down.

Colin McNamara
CCIE #18233 (Storage Networking)
2 Cups Solutions
“The difficult we do immediately, the impossible just takes a little longer”

References -

Intel Project Page

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel
• Cisco Nexus 4000 Blade Switch
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• My CCIE Storage Shopping List
• What being married to a geek who does search engine optimization gets you
• Will Cisco succede where Sun has failed?

--Colin McNamara

Fibre Channel over Ethernet is taking off

read more | digg story
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• San Diego WildFIre Update
• Study on Perspective – Set 1
• Taking a closer look
• Tour of Ashley’s new site !
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks

--Colin McNamara

San Diego Maternity Photographer

Though CCIEs are members of an exclusive group, they can be found in countries on every continent. Use the map and tables below to discover your peers around the world.

Americas EMEA Pacific Rim Africa Asia Cana Europe Middle East Pacific Islands South America United States

Total of Worldwide CCIEs:		15658 (last updated 11.14.2007)
Total of Routing and Switching CCIEs:		14329
Total of Security CCIEs:		1207
Total of Service Provider CCIEs:		650
Total of Storage Networking CCIEs:		99
Total of Voice CCIEs:		601

Multiple Certifications:

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• What does it take to pass the CCIE exam?
• About Colin McNamara
• Cool new features in 12.4(15)T
• And it begins again – On the road to my CCIE in Storage
• Passed CCDE written and Recertified my CCIE – Killed two birds with one stone

--Colin McNamara

Updated CCIE numbers

”

By Ivan Pepelnjak

John S. Pumphrey recently asked an interesting question: “Can the router send an e-mail when an interface goes down?” The enterprisey solution is obvious: deploy a high-end EMS to collect SNMP traps and use its API to write a custom module that would use a MQ interface to alert the operator. Fortunately, Event Manager applets in Cisco IOS provide action mail command (available in 12.3(14)T and 12.4) that can send an e-mail to a SMTP server straight from the router.

There are two ways you can detect that an interface went down with EEM: either you track the interface status with a track object and start an EEM applet when the track object changes state or you catch the syslog messages reporting that the interface line protocol changed state to down. The second approach is obviously more generic, as a single applet can act on multiple interfaces.

event manager applet MailOnIfDown event syslog occurs 1 →    pattern "LINEPROTO-5-UPDOWN.*to down" →    period 1

Notes:

• If you want to limit the applet to serial interfaces only, you could change the pattern to LINEPROTO-5-UPDOWN.*Serial.*to down.
• The → continuation character is used to indicate that a single configuration line has been split to increase readability.

The action mail command specifies the mail server‘s address (use a hostname and DNS lookup or ip host configuration command to make the EEM applet more generic), from and to address, message subject and body. In each of these fields, you can use EEM environment variables that you can define with the event manager environment configuration command. Each EEM event also defines a few environment variables that you can use (see the table of EEM system-defined variables on CCO). For example, you can define the e-mail recipient in the router’s configuration and use the _syslog_msg variable to include the syslog message in the e-mail body:

event manager environment _ifDown_rcpt admin@lab.com!event manager applet MailOnIfDown event syslog occurs 1 →    pattern "LINEPROTO-5-UPDOWN.*to down" →    period 1 action 1.0 mail server "mail-gw" →    to "$_ifDown_rcpt" from "R1@lab.com" →    subject "Interface down on R1" →    body "$_syslog_msg"

You can make the applet even more generic with the help of action info type routername command, which stores the current router’s name into the $_info_routername environment variable:

event manager environment _ifDown_rcpt admin@lab.com!event manager applet MailOnIfDown event syslog occurs 1 →    pattern "LINEPROTO-5-UPDOWN.*to down" →    period 1 action 1.0 info type routername action 2.0 mail server "mail-gw" →    to "$_ifDown_rcpt" from "$_info_routername@lab.com" →    subject "Interface down on $_info_routername" →    body "$_syslog_msg"

"

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Zone based IOS firewalls
• What should I do this thanksgiving break?
• Cool new features in 12.2(33)SXH
• Application Extension API notes – Cisco Live 2008
• Interesting TechWise TV episode on virtualization
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It

--Colin McNamara

Routers can email you when they go down

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• San Diego WildFIre Update
• Happy Birthday Marines!!
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks

--Colin McNamara

How close did the fire come?

Mandatory evacuations for our neighborhood were lifeted at 11:30 this morning. We returned home, and everything is here. The fire burned on three sides of our neighborhood, and took out a couple of the homes up on the hill.

Thanks to everyone for being so supportive.

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• How close did the fire come?
• San Diego Maternity Photographer
• Gall stones update – Kaiser sucks
• Why can’t I post from docs.google.com to blogger beta?
• Study on Perspective – Set 1
• Taking a closer look

--Colin McNamara

San Diego WildFIre Update

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• San Diego WildFIre Update
• Happy Birthday Marines!!
• Cool new features in 12.2(33)SXH
• I am back on the market !!!
• Gall stones update – Kaiser sucks
• Cisco Storage Partners – California… a very small list

--Colin McNamara

Evacuation status update

On the fire maps of the San Diego Witch fire, we are pretty much under the big red spot (directly under lake hodges, to the west of the 15). We moved to 4s ranch in June , on the intersection of rancho bernardo and ralphs ranch road. (pretty much right under the big red spot). We left on on monday at around 10 am with fire on 3 sides of our community.We got out with a couple changes of clothes, important documents, and the kids. Almost everything else is replaceable.

the fire directly upwind of us, coming up the ridge -

Getting out of 4s ranch was crazy though, traffic was jammed up through camino del sur, and the police were not helping. We ended up sneaking out through a backroad and coming out through Del Mar. Our final destination (and temporary home base) is the Ramada plaza hotel in Anaheim.

The winds were blowing 60 mph +

While it is rough having to flee from our home, we are much more fortunate then those people stuck at Qualcom, or Del Mar, etc. While they have been sleeping on the cold cement for two days my family has enjoyed two queen size beds + a fold out couch. Kylie is a little shell shocked, I think fleeing from her home was a bit much, while Chris is just being a normal little two year old terror.

Fireman going after the fire where it wrapped around our neighborhood -

We have also been very fortunate to have many supportive friends. I thank everyone of them for all the support and help they have given. It makes things much easier when you know that you aren’t alone in this struggle. We have a couple standing offers of homes to stay in, a home cooked meal (from the best mexican food cook I have ever met) waiting for us tonight, clothes / diapers for Chris, pretty much everything we could have wanted.

The view as we were leaving (sorry about the blur, we were in the truck)

During this whole ordeal I there have of course been challenges, but I am amazed how everyone is pulling together. In the hour before the police forced the evacuation neighbors were helping each other with information, people were grabbing hopping in trucks and running to help with the fire lines. While it was a post apocalyptic scene with the choking smoke, ash everyone, and blood red sun, people were helping each other. It is to see the best of people when they are under the worst conditions.

The blood red Sun

The two big questions every day are – Is my home still there ? and If it is there, when can I go back? As of right now the evacuation order still stands for my neighborhood. It is directly downwind (about 1 kilometer) from the homes in Rancho Bernardo they have been showing on the news. When we left, fire was coming up the Ridge that separates our neighborhoods. On signonsandiego.com ‘s firemap it looks like we may have been spared, but we are still in the middle and downwind of the major fire. The only thing that will signal a change an all clear is for the santa anna winds to subside.

neighbor checking taking pictures of the fire prior to the evacuation order

One thing that is important in any emergency is to go through a lessons learned.

The things that worked well were -

1. Having a 4×4, it allowed us to choose creative escape routes, and avoid the possibility of getting stuck in traffic with the fire behind us.

2. Having decent non-perishable snacks (granola, raisins, etc)

3. Having lots of water bottles laying around – dehydration is a big issue with the dry air.

4. having travel kits ready – because I travel a bit, I normally have my carry-on bags prepped.

5. Bringing a toy, and a little video player for Chris – this saved lots of heartache for everyone

Things that I could have done better -

1. Inspected my wife, daughters, and sons bags before we left – they didn’t pack enough clothes, my daughter forgot things like underwear, socks, etc.

2. Had the key to the breachlock on my shotgun handy – i couldn’t find the key to unlock my weapon. If this would have devolved to Katrina standards then this would have been essential. In retrospect I would have done better with a semi-auto handgun. It is easier to transport and conceal while traveling.

3. I should have had better radios. I am a ham operator, have my license. But I have always used peoples base stations tethered through the Internet (basically a big ip based microphone / speaker connected to their transceiver. Ham operators are a godsend in situations like this, and having a mobile unit in my truck would have added valuable information in a time when we had none.

Colin McNamara
CCIE #18233

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• San Diego WildFIre Update
• How close did the fire come?
• How to succede in 2007 – By Tim O’Reilly
• Happy Birthday Marines!!
• The emergence of MDS features in Cisco’s datacenter networking equipment
• Interesting thoughts from Mark Cuban

--Colin McNamara

Witch fire in San Diego – Notes from an evacuee

Cisco has finally included zone based firewalling in the IOS firewall feature set. The configuration guide can be found here -

Zone Based Firewall Design and Configuration Guide

The things that really got me interested are -

1. It is VRF aware (works well with network virtualization strategies)
2. No more CBAC’s
3. Policing built into firewalling classes
4. Content inspection including HTTP,P2P, and Instant Messenger

I think the biggest plus for this release is that IOS firewalls are finally following the general trend of zone based firewalling. By moving this way, configuration errors resulting in lax controls are likely to be minimized.

Excerpts from the documentation -

Cisco IOS Software Release 12.4(6)T introduced a new configuration model for the Cisco IOS Firewall feature set. This new configuration model offers intuitive policies for multiple-interface routers, increased granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall zones until an explicit policy is applied to allow desirable traffic.

Nearly all firewall features implemented prior to Cisco IOS Software Release 12.4(6)T are supported in the new zone-based policy inspection interface; supported features are as follows:

•Stateful packet inspection

•Application inspection

–HTTP

–Post Office Protocol (POP3), Internet Mail Access Protocol (IMAP), Simple Mail Transfer Protocol/Enhanced Simple Mail Transfer Protocol (SMTP/ESMTP)

–Sun RPC

•VRF-aware Cisco IOS Firewall

•URL filtering

•Denial-of-service (DoS) mitigation

Zone-based policy firewall generally improves Cisco IOS performance for most firewall inspection activities.

The only Cisco IOS Firewall features that are not supported in zone-based policy firewall in Cisco IOS Software Release 12.4(6)T are as follows:

•Authentication proxy

•Stateful firewall failover

•Unified firewall MIB

Zone-based policy firewall completely changes the way you configure a Cisco IOS Firewall.

The first major change to the firewall configuration is the introduction of zone-based configuration. Cisco IOS Firewall is the first Cisco IOS Software threat defense feature to implement a zone configuration model. Other features might adopt the zone model over time. The classical Cisco IOS Firewall stateful inspection/context-based access control (CBAC) interface-based configuration model employing the ip inspect command set will be maintained for a period of time, but few, if any, new features will be configurable with the classical command-line interface (CLI). Zone-policy firewall does not use the stateful inspection/CBAC commands. The two configuration models can be used concurrently on routers but not combined on interfaces; an interface cannot be configured as a security zone member as well as being configured for ip inspect simultaneously.

Zones establish the security borders of your network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of your network. Zone-Policy Firewall’s default policy between zones is to deny all. If no policy is explicitly configured, all traffic moving between zones is blocked. This is a significant departure from stateful inspection’s model, in which traffic was implicitly allowed unless it was explicitly blocked with an access control list (ACL).

The second major change is the introduction of a new configuration policy language known as CPL. Users familiar with the Cisco IOS Software Modular quality-of-service (QoS) CLI (MQC) might recognize the format being similar to QoS’s use of class maps to specify which traffic will be affected by the action applied in a policy map.

Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Cisco is using Linux virtualization and 40 core CPU’s for its next generation routers
• Cool new features in 12.4(15)T
• Identity aware networking using Cisco TrustSec
• Routers can email you when they go down
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

Zone based IOS firewalls

Hell has frozen over, you now no longer need to explicitly configure peers in a BGP configuration. You now can set up peer group templates that allow connections from a range of ip address’s. This has a multitude of implications. The main scenarios that I can think of are -

1. dynamic configuration of peers in a fully bgp enabled datacenter (replacement for eigrp / ospf)
2. dynamic advertisement of host routes from servers

Other cool things include tracking of SSO status in hsrp / glbp groups and an embeded syslog manager which allows you to have full filtering capability on device without needing an external server. I see this will be great for troubleshooting.

Colin McNamara
CCIE #18233
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Routers can email you when they go down
• I found a great tutorial on PHP + MySQL+Flash integration
• New features in VMware 3.1
• PHP / MySQL / FLASH website integration
• The emergence of MDS features in Cisco’s datacenter networking equipment
• Cool new features in 12.4(15)T

--Colin McNamara

Cool new features in 12.2(33)SXH

http://www.cisco.com/application/pdf/en/us/guest/products/ps6555/c1161/cdccont_0900aecd805456f7.pdf

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• I found a great tutorial on PHP + MySQL+Flash integration
• San Diego Maternity Photographer
• San Diego WildFIre Update
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?

--Colin McNamara

Great TCL and EEM preso found on IOS hints and tricks -

* Solid State Drive (SSD) boot support
As initially discovered last month, VMware will make available a special version of ESX Server (mentioned with terms like ESX Lite and Embedded ESX) for OEM vendors, to be installed into bootable Solid State storage devices (flash drives, etc.). This option will allow creation of ESX Server hardware appliances for easy jumpstart, granting smaller form-factors and improved reliability.
Dell, IBM and possibly other vendors will offer this option at announcement time in Q3 2007.
* DMotion
Unofficially introduced with ESX Server 3.0.1, in its first version DMotion is a special VMotion operation only capable of moving running virtual machines from an ESX Server 2.5.x host to a new ESX Server 3.x., without shared SAN LUN mandatory requirement.
In ESX Server 3.1 this capability will be extended, allowing hot migration of running virtual machines between ESX 3.1 hosts through the Ethernet cable.
* Patch management system for host and virtual machines (Update Manager 1.0)
ESX Server 3.1 will finally introduce an automated patch management system called Update Manager. This solution will be able to update both host itself and virtual machines (both Microsoft Windows and Red Hat Enterprise Linux).
Update Manager will look for available updates from Shavlik Technologies website (a possible acquisition after IPO), and will allow VI administrators to decide which patches to deliver to virtual machines.
Before applying them, Update Manager will take a snapshot and will even rollback automatically if something goes wrong.

(this product was originally codenamed VM Integrity and its developement started more than one year ago, when virtualization.info discovered it in June 2006)
* VMware Consolidate Backup (VCB) and VMware Converter 4.0 integration
VirtualCenter 2.1 will now allow restoring VCB images with an integrated version of VMware Converter, which reaches 4.0 release number.
* Server consolidation advisor
VirtualCenter 2.1 will expose a server consolidation assistant able to analyze which physical machines should be converted in virtual ones, and where to move existing VMs among available hosts.
(note that with this feature VMware is further extending competition with PlateSpin, covering both features with PowerRecon and PowerConvert)
* Guest OS disaster recovery capability
VirtualCenter 2.1 will be able to recognize a failure inside a virtual machine and restart it through VMware HA module.
* Support for VMware Server 2.0
VirtualCenter 2.1 will be finally able to seamless manage both ESX Server and VMware Server 2.0 hosts.
* Lockdown Mode
ESX Server 3.1 will expose a new security feature to completely disable local administrative account after a VirtualCenter 2.1 takes remote control.
* Power saving capability (Distributed Power Management)
VirtualCenter 2.1 will introduce a new resources utilization analysis feature, able to verify when a physical host can be powered off, VMotion-ing its virtual machines on other hosts without impacting performances.
* Support for Cisco Discovery Protocol (CDP)
VirtualCenter 2.1 will be able to recognize and use CDP to discover physical and virtual network topologies.
It stays unconfirmed if ESX Server 3.1 will already expose new virtual network architecture, allowing 3rd party virtual switches, as it will be announced by Cisco CEO at VMworld 2007.
* Support for 10Gbit Ethernet network cards
* Support for TCP/IP Offload Engine (TOE) network cards
* Support for network load balancing algorithms
* Support for 200 hosts and 2000 virtual machines
* Support for 128GB RAM per host and for 64GB RAM per virtual machine
* Support for SATA storage devices
* Support for N_Port ID Virtualization (NPIV)
* Support for VCB over iSCSI SANs
* Support for IPv6 in virtual networking
* Support for Para-virtualization guest OSes

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco releases Nexus 1000V virtual switch for VMware
• Is your network ready for Cloud Computing with Virtual Infrastructure 4?
• Cisco EMC and VMware partneship VCE VBlocks Acadia and the Partner Ecosystem
• Interesting TechWise TV episode on virtualization
• Cool new features in 12.2(33)SXH
• VMworld 2009 Schedule

--Colin McNamara

New features in VMware 3.1

Link – http://www.cisco.com/application/pdf/en/us/guest/products/ps8258/c1161/cdccont_0900aecd80679ce3.pdf

From Cisco’s site -

Cisco IOS Software Release 12.4T integrates a portfolio of new capabilities, including security, voice, and wireless, with powerful hardware support to deliver advanced services for enterprise and access customers. It will be issued as a series of regularly scheduled individual releases, which Cisco will ultimately consolidate to form the next major release.

Release 12.4(15)T, the sixth release of the 12.4T family, streamlines the Cisco IOS Software upgrade process, provides sub-second link failure detection and faster convergence, delivers next-generation Layer 2-7 flexible packet classification, enhances intrusion protection and SSL VPN capabilities, and provides support for the new Cisco 7201 Router, amongst other features.

Like all releases in the 12.4T family, Release 12.4(15)T integrates innovations that span multiple technology areas, including Cisco IOS Security, Voice, Cisco IOS Infrastructure, Access, High Availability, Management Instrumentation, Quality of Service, IP Multicast, Broadband, IP Routing, and IP Services. Release 12.4(15)T delivers these integrated technologies on the broadest range of hardware in the industry, including the Cisco Integrated Services Routers, Cisco 7200 Series, and Cisco 7301 Router.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• The emergence of MDS features in Cisco’s datacenter networking equipment
• About Colin McNamara
• Application Extension API notes – Cisco Live 2008
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!
• New features in VMware 3.1

--Colin McNamara

Cool new features in 12.4(15)T

For those that have been watching, there has been a trend of helpful MDS (Cisco’s director class storage switch) features into core networking products. The first feature I have noticed is the “do” command now available in configuraiton mode in ios 12.4. It allows you to execute exec commands from the configuration section in IOS. Needless to say this is very handy, primarily due to not having to exit to your shell to do a show command.

Things like that make me very happy. They decrease the time needed complete tasks, and improve your accuracy.

One of the features that I have always loved with the MDS is call home. It is a deamon that monitors the hardware and software for faults, and when one is found it posts an email to TAC and your support staff.

This feature now has made it into the 6500 series switches as of 12.2(22)SXH which should be out mid August. It will integrate directly with Cisco TAC, and your own internal Monitoring and management systems. The really cool thing is that this ties right into the GOLD (Generic On Line Diagnostics) tests. If your GOLD tests find a hardware problem TAC will automatically be contacted, a RMA issued, engineer contacted, and parts shipped to the devices location. The target for this is SmartNet time + 1.5 hours. So if you had 4 hour smartnet, you could expect hardware onsite, with no additional troubleshooting in 5.5 hours.

Cisco portal for smartcall is located at http://www.cisco.com/go/smartcall

Colin McNamara, CCIE #18233
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco NX-OS 4.0 | Next Generation Internet Operating System
• Routers can email you when they go down
• Zone based IOS firewalls
• Cool new features in 12.4(15)T
• What being married to a geek who does search engine optimization gets you
• What does it take to pass the CCIE exam?

--Colin McNamara

The emergence of MDS features in Cisco’s datacenter networking equipment

My background is all over the place. It goes from running a small ISP when I was 18 to managing international CallManager clusters, to enterprise data center design and migrations. I swear that I have tech ADD. I see something new and I am like.. oooooh shiny, lets do a sniff and see how it works.

I actually attempted the Route Switch lab twice in 2002 (still had token ring and dlsw still) but got activated for the war before I could get my number. I can tell you.. that sucked horribly.

So, why did I choose to get my Storage CCIE first instead of finishing up my Route Switch first? Well, over the past couple years I have done a significant amount of IP storage (NFS, ISCSI, ATA over Ethernet, etc) including building my own IP storage heads based on linux. I had also done a little bit of fiber channel work. I felt that I had a significant advantage compared to most network engineers in the storage networking space. And, I think more importantly, the topics that I had to study were new and fresh. Whereas when I cracked open my Route Switch books.. I honestly wasn’t to excited about it at the time ( I think I was holding a grudge from my first attempts in 2002).

The partner e-learning central portion of Cisco has an Excellent lab access to labgear.net. It gives you 2 hour segments of time with 2 mds’s (both with IPS blades), 1 2 port jbod, and 2 2 port servers. They also have introductory tutorials for most major technology segments.

I did all of those, along with the every E-learning class that was on PEC. I think the major ones were the Design, Support, and CASSI classes.I took that, sat for the design and support specialist exams, and took my written last December.

After doing all that work, I was honestly 70% there. I took a little break for january and febuary (There was no open lab dates) and then started hitting the labs I think at the end of febuary.

For the majority of my practice I used the labs available through PEC. I also was able to weasel my way into 8 hour sessions every sunday from our channel SE. (I owe him plenty of drinks at networkers this year) For those 8 hour sessions I had labs created to summarize the major technology areas and to be as evil as possible to myself.

I had one attempt which didn’t work out as well as I would have liked. In RTP the lab starts at 7:15. This means if you are from the west coast like I am you will be getting up at 3:00 am in the morning for your lab. That royally kicked my but. I diverted from my attack plan and ended up
running out of time. It was a classic example of letting the lab run you, instead of you running the lab.

Luckily a data opened up just over a month later. I spent that time just working on my speed (speed is the secret sauce). I migrated to using Fabric Manager (gui interface) instead of command line. After 2 practice runs my time had dropped 25%. I also flew out to RTP 3 days before, and made sure to relax and get on east coast time.

For my final prep I got access to iementor’s lab. Their lab is excellent. I cannot reinforce enough how much it contributed to my confidence in that final week. Roman was really cool about working with an existing candidate to get me squeezed in. They are really cool guys, and they have the only workbook on the market right now.

So, I used their lab 2 days before mine, and then just chilled the day before. The day of the lab I had 70 points by lunch, and had completed configuration of the lab by 12:30. I spent the rest of the day reviewing my configurations (found 2 errors), fixing one bug, and generally harassing the proctor to make sure I didn’t misinterpret anything.

So.. if I had it all to do over again what would I do. I would still do the PEC stuff, and continue to primarily live in the Doc CD. Though I would probably pony up the cash and buy the iementor book and more lab time with them.

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233
“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• What does it take to pass the CCIE exam?
• Fibre Channel over Ethernet is taking off
• And it begins again – On the road to my CCIE in Storage
• Are you a kick ass engineer looking to grow?
• My CCIE Storage Shopping List
• Where was Colin in 2010?

--Colin McNamara

Why was Storage Networking my first CCIE? And What did I do to prepare?

For those who haven’t heard yet, I passed my CCIE Lab on June 14th. Now I can officially put CCIE #18233 after my name.

Anyone who has been down the same path understands how long of a road this is.
I started down this path in the spring of 1999 as the 432nd student ever in Cisco’s Networking Academy (which I promptly dropped out of to move to the bay area). I grew my networking skills all the way to passing my CCIE Written in 2001. I attempted my Route Switch lab in 2002, however I got called away to war for a year. Being away from it all for a year really cramped my style technically. In that time many of my certs expired, and I lost much of the momentum I had built of the past half decade.

Since I got back to the real world I had focused on work to the detriment of my certifications. I really did some great things, however I really neglected my resume.
In July of 2006 I had worked 2038 hours that year (for those not mathematically inclined, that is a full work year, in 1/2 a year) . At that point I decided it was time to stop neglecting my certifications. At that point I dedicated 8 hours each saturday, along with two nights a week to studies. By December of that year I had Certified on a few of the technologies that I had tons of experience in.

I managed to get my RHCE, Cisco Storage Support and Design Specialist, update my old IP Telephony specialist certifications to CCVP, get my Netapp Certified Administrator, and pass my CCIE Written for storage networking all by the end of the year. This spring I finished my Netapp Certified Expert and scheduled my Storage lab for early summer.

Anyone who knows me well knows how closely I track my time. That time tracking extends to my training. I tracked my training (reading, lab practice, testing, etc) just like any other part of my professional life. I spent around 150 hours studying for my Design, Support specialist certs, along with reading the recommended books of the CCIE reading list, and around 300 hours preparing for my lab exam. That is 300 hours configuring every possible combination and permutation of technology that could be setup, and then refining my speed in configuring those technologies until i got to the point where speed as well as brains would be an advantage in the lab.

So now that I have my CCIE, whats next? Well, oddly enough.. I am thinking of getting my second CCIE cert. In my office I will be the Jr guy by only having a single CCIE (on of our guys has all five). I also need to take my VMware certified professional cert, and probably get my HP Master Accredited Storage Engineer. I guess I am just a glutton for punishment.

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”Similar Posts:

• Where was Colin in 2010?
• About Colin McNamara
• Updated CCIE numbers
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• And it begins again – On the road to my CCIE in Storage
• Update on the Cisco / Nuova connection

--Colin McNamara

What does it take to pass the CCIE exam?

An eagle was sitting on a tree resting, doing nothing. A small rabbit saw the eagle and asked him, “Can I also sit like you and do nothing?”
The eagle answered: “Sure, why not” So, the rabbit sat on the ground below the eagle and rested.
All of a sudden, a fox appeared, jumped on the rabbit and ate it.

Management Lesson:
To be sitting and doing nothing, you must be sitting very, very high up.

Lesson Two:
A turkey was chatting with a bull. “I would love to be able to get to the top of that tree,” sighed the turkey, “but I haven’t got the energy.”
“Well, why don’t you nibble on some of my droppings?” replied the bull.” They’re packed with nutrients.”
The turkey pecked at a lump of dung, and found it actually gave him enough strength to reach the lowest branch of the tree. The next day he reached the second branch and, finally, after a fourth
night, the turkey was proudly perched at the top of the tree. He was promptly spotted by a farmer, who shot him out of the tree.

Management Lesson:
Bullshit might get you to the top, but it won’t keep you there.

Lesson Three:
A little bird was flying south for the winter. It was so cold, the bird froze and fell to the ground into a large field. there, a cow came by and dropped some dung on him. As the frozen bird lay there in the pile of cow dung, he began to realize how warm he was. The dung was actually thawing him out! He laid
there all warm and happy, and soon began to sing for joy.
A passing cat heard the bird singing and came to investigate. Following the sound, the cat discovered the bird under the pile of cow dung, and promptly dug him out and ate him.

Management Lesson :
(1) Not everyone who craps on you is your enemy.
(2) Not everyone who gets you out of crap is your friend..
(3) And when you’re in deep crap, it’s best to keep your mouth shut!

This ends the three minute management course.

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• A little trivia to start the week
• And it begins again – On the road to my CCIE in Storage
• Christmas Trivia
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• Google Translate API and speech recognition
• Application Extension API notes – Cisco Live 2008

--Colin McNamara

3 minute management course

The first lesson was that knowledge alone is not suffient to pass the lab.
The second was that the lab is not the real world, and the procotors do not intend to replicate real world problems.
The third lesson was that speed is as important as brains.
The fourth lesson is that you can’t make it alone.

This time I am taking a different tack. I am studying with a partner. My focus will not be real world implementations, it will be on all possible hellish combinations a proctor could come up with. . I will be spending many late nights working on my speed.

I have passed All of Cisco’s storage exams, including the Written qualification for the CCIE Storage Networking exam. At first I thought the biggest challenge would be getting ahold of lab gear. It is not like this stuff is cheap. However I have been finding more gear out there then I had though I would. This is a good sign.

I will be posting my experiences throughout this entire process. I am not under the illusion that it will be easy. Luckily I have the lessons learned from my attempts before the war, and a new found enthusiam.

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• It’s on like Donkey Kong – CCDE practical registration is open
• What does it take to pass the CCIE exam?
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• 3 minute management course
• My CCIE Storage Shopping List
• Updated CCIE numbers

--Colin McNamara

And it begins again – On the road to my CCIE in Storage

A traditional Christmas dinner in early England was the head of a pig prepared with mustard.

“White Christmas,” released in 1954, starring Bing Crosby and Danny Kaye, was the first movie to be made in Vista Vision.

The holiday classic, “It’s A Wonderful Life,” was originally a box office flop.

The real Santa Claus was born in 280 A.D. as Nicholas. He commonly wore a red and white Bishop’s robe.

“Xmas” is considered by some to be a disrespectful abbreviation. But the Old English word for Christmas begins with X. The Greek word for “Christ,” from which the English is derived, begins with the Greek letter chi, or X. So, X is an appropriate abbreviation for Christ.

The first electric Christmas tree lights were telephone switchboard lights.

About 400,000 people get sick each year from consuming tainted Christmas leftovers.

In 1907, Oklahoma became the last U.S. state to make Christmas a legal holiday.

America’s official national Christmas tree grows in California’s King’s Canyon National Park. The tree is a giant sequoia standing more than 300 feet high, and it’s called the “General Grant Tree.”

Christmas trees are edible. Many parts of pines, spruces and firs can be eaten.

According to the laws of the time, Joseph could have had Mary stoned to death for becoming pregnant.

“Hot Cockles” was a popular game at Christmas in medieval times. In the game, players took turns striking a blindfolded player, who had to guess the name of the person delivering each blow.

Toys for Tots held its first toy drive in 1947.

Boris Karloff was the voice of the Grinch in the animated classic, “How the Grinch Stole Christmas.”

During the Christmas shopping season, Visa cards alone are used an average of 5,340 times every minute in the US

According to a recent survey, seven out of 10 dogs in Great Britain get Christmas gifts from their owners.

“Wassail” comes from the Old Norse term, “ves heill,” meaning “to be of good health.” This evolved into the popular holiday tradition of visiting neighbors on Christmas Eve and drinking to their health.

The average American household will send out 28 Christmas cards each year, and will receive the same number in return.

Boxing Day, celebrated in Canada, has nothing to do with fighting. It refers to the custom of giving gift boxes to employees the day after Christmas. Originally, it was the day Christmas presents were given in England.

Jesus Christ was born in a cave, not in a stable.

The first Christmas card was made in England on December 9, 1842.

The ancient Druids believed the sparks from a burning log carried wishes for a prosperous New Year to the gods, hence the tradition of yule logs.

According to the National Christmas Tree Association, Americans buy 37.1 million real Christmas trees each year.

Charles Dickens wrote several Christmas stories after “A Christmas Carol,” one each year, in fact, but none could match the success of the original.

The Julbock is a common Christmas decoration in Sweden. It’s a small figurine of a goat made from straw.

In Sweden, the “tomte” is a Christmas gnome.

According to “How the Grinch Stole Christmas,” the Grinch was so mean because his heart was two sizes too small.

There are about 5,000 “choose and cut” Christmas tree farms in the US

St. Nicholas is the patron saint of children, scholars, merchants, sailors and women without dowries.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• 3 minute management course
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• A little trivia to start the week
• Kylie Launching in Yosemite while sledding
• What does it take to pass the CCIE exam?
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It

--Colin McNamara

Christmas Trivia

Founder and CEO, O’Reilly Media

Put Yourself at the Center of the Action

The rules for marketing a conference like our Web 2.0 event are pretty much the same as those for marketing anything else. Here are the ones we follow.

1. Be first. This is one of the immutable laws of marketing. Who was the first person to fly across the Atlantic? Lindbergh. Who was the second? No idea.

2. If you can’t be first, create a new category so you can be first. Who was the first woman to fly across the Atlantic? Amelia Earhart. New category. We didn’t have the first Web conference out there, but when we applied “Web 2.0″ to the category, we created something new.

3. Position yourself at the leading edge of a new wave. The way to make sure you recognize the next big wave is by watching what I call the alpha geeks. You find people who are cool, by whatever metric you want to apply. It would be the same thing if you were marketing sneakers. And then you find out what the cool people are doing and you spread the word about it. This isn’t to say there aren’t audiences for whom cool might not be the right measurement, but it works for us.

4. Tell a big story. We don’t market products narrowly. We market big stories about the industry, things that matter to a lot of people. In 1992 we came out with The Whole Internet User’s Guide and Catalog. Instead of marketing the book, we marketed the Internet using the book, and said the Internet is coming and by the way here’s a book where you can learn about it. In planning Web 2.0 in 2003, we came up with a goal to reignite enthusiasm in the computer industry. We said, here’s something that distinguishes the companies that survived the dotcom bust, here is something that is bubbling up again, so we gave it a name – Web 2.0 – and started telling a story about what was new and important in technology. Sometimes giving it a name helps people to see it.

5. Make it an A-list party. Conferences are really like parties, and an A-list party is one where A-list people are in attendance. You figure out who are the really important people to invite and get them to show up as speakers or as guests. Then everybody wants to be there. If you don’t know who the important people are, you shouldn’t be doing a conference.

6. Care about the attendees. There are a lot of lousy conferences that pander to sponsors. They end up creating an opportunity for boring speakers who are paid shills for their companies. We still get a few of those, but we really try to police it. Think about who the audience is and what works for them, and deliver high-quality content.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Where was Colin in 2010?
• My CCIE Storage Shopping List
• Reader question – Why are corporations looking for BGP experience?
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• Me and the Nexus 7000 last week at the Data Center VT

--Colin McNamara

How to succede in 2007 – By Tim O’Reilly

	Search Criteria Search Criteria
	Note : Only 150 random matches will be displayed
	Partner List Sort By Select Sort Type Company Name Country Company Name Country Authorizations Sites

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Cisco Storage Partners – California… a very small list
• How close did the fire come?
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks

--Colin McNamara

Storage partners nationwide – 14

Partner List

Sort By Select Sort Type Company Name Country

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Storage partners nationwide – 14
• How close did the fire come?
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks

--Colin McNamara

Cisco Storage Partners – California… a very small list

The shepherd looks at the man, obviously a yuppie, then looks at his peacefully grazing flock and calmly answers: “Sure. Why not?” The yuppie parks his car, whips out his Dell notebook computer,connects it to his AT&T cell phone, surfs to a NASA page on the internet, where he calls up a GPS satellite navigation system to get an exact fix on his location which he then feeds to another NASA satellite that scans the area in an ultra-high-resolution photo.

The young man then opens the digital photo in Adobe Photoshop and exports it to an image processing facility in Hamburg, Germany. Within seconds, he receives an email on his Palm Pilot that the image has been processed and the data stored. He then accesses a MS-SQL database through an ODBC connected Excel spreadsheet with hundreds of complex formulas. He uploads all of this data via an email on his Blackberry and, after a few minutes, receives a response. Finally, he prints out a full-color, 150-page report on his hi-tech, miniaturized HP LaserJet printer and finally turns to the shepherd and says:

“You have exactly 1586 sheep.”

“That’s right. Well, I guess you can take one of my sheep.”, says the shepherd. He watches the young man select one of the animals and looks on amused as the young man stuffs it into the trunk of his car. Then the shepherd says to the young man: “Hey, if I can tell you exactly what your business is, will you give me back my sheep? ” The young man thinks about it for a second and then says:“Okay, why not?”

“You’re a consultant.” says the shepherd.

“Wow! That’s correct,” says the yuppie, “but how did you guess that?”

“No guessing required”, answered the shepherd.

“You showed up here even though nobody called you; you want to get paid for an answer I already knew, to a question I never asked; and you don’t know crap about my business… Now give me back my dog.”

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Ashley stole my new Lense…
• My CCIE Storage Shopping List
• Interesting thoughts from Mark Cuban
• Weddings, Measles and Podcasting -
• I am back on the market !!!
• Kylie Launching in Yosemite while sledding

--Colin McNamara

The difference between a consultant and a partner

Lets just start this out by saying, darn.. this is going to be expensive.
Now that that is out of the way, lets get started. Cisco publishes the hardware that is in the Storage lab.

Here is the hardware summary -

• Cisco Routers
• Cisco Catalyst Switches
• Cisco Secure Access Control System
• MDS 9506*
• MDS 9216*
• Port Analyzer Adapter
• JBOD
• RAID storage
• HBA
• 3rd Party Fibre Channel Switch

My guess is that this equals a basic routed network with a CS-ACS server on the backend.
It looks like there is also at least 1 pc with an HBA connected into one MDS. The one big question I have is on the connected storage.
My guess is that Cisco’s JBOD reference = Fibre Channel connected storage, and the RAID array mentioned is connected to at least one server.
If my guess is right then there is the 9506 and 9216 – (note, no I in the name) and a third party switch.

So lets start the shopping list.

1. Cisco Routers
I have those coming out of the yinyang, no need to purchase anymore for this lab.

2. Cisco Catalyst Switches
Mine are a little old, but I don’t expect a storage exam to have anything challenging in the switching arena. No need to upgrade there.

3. Cisco Secure Access Control System
Thankfully Cisco provides VAR’s with NFR binders. ACS will be loaded on HMB-SERVER1 in a vmware image. No expenditure needed.

4. MDS 9506*
Holy smokes, this is a lot of money. I have seen them on ebay for $8,000. This includes both sup modules. I would need to buy a line card, which I see going for about 1k. so $9000

5. MDS 9216
Still bad, but not horrible. I just saw one on ebay for $5500. Depending on lab requirements it may be smart just to get to 9216′s. so $5500

6. Port Analyzer Adapter
Best I can find is $2000 refurbished. I have a feeling practicing using this, and seeing the ethereal dumps is going to be integral to success. worst case this is 2k, best case beg or borrow $2000

7. JBOD
Normally you are looking at 2-4k for one of these. My strategy is to find an old Netapp shelf, and low level format it. I found one on ebay that ends in 22 hours for $89. Sounds good to me.

8. RAID storage
I am going with my guess that this is just to facilitate data transfers between storage and host. My tactic is to use the existing storage inside one of my servers. $0

9. HBA
Interesting – Only one HBA .This can be up to $2000 to buy new. Luckily ebay is my friend. I found a qlogic 2340 card for $50. My kind of deal

10. 3rd party Fibre Channel Switch
Luckily Brocade resells to everyone and their mother. IBM, Dell, HP, Compaq, ETC. I have found some Silkworm 2800′s for as low as $50 on ebay.
I do have my eye on a 3800 that is going for $24 right now (I hope it stays low).

So how much is the damage?

$16,700

Holy smokes I could sell my truck just to buy the lab gear.

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Update on the Cisco / Nuova connection
• Why was Storage Networking my first CCIE? And What did I do to prepare?
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Cisco Nexus 5020 and 5010 FCOE video ordering guide
• Fibre Channel over Ethernet is taking off
• Cisco Nexus 4000 Blade Switch

--Colin McNamara

My CCIE Storage Shopping List

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• How close did the fire come?
• I found a great tutorial on PHP + MySQL+Flash integration
• Study on Perspective – Set 1
• Taking a closer look
• Gall stones update – Kaiser sucks
• Happy Birthday Marines!!

--Colin McNamara

Why can’t I post from docs.google.com to blogger beta?

2. Update the Real Time System config generator

Existing Features-
Generates Content Switching configs from application data
Has a web interface for development access
Notifies help desk
New Features -
Create firewall definition files
Create nagios probe config
Integrate XML submission probe generation
Thoughts
Nice to have, but 90% of the functionality is already there

3. Update Nagios system config generator (nagiosuploader)

Existing Features-
Grabs system info when run locally
Posts configs to monitoring server for processing
New features
Host auditing to determine services monitored
Clean up error condition handling
Web interface for config generation
Thoughts
Having a web interface for users to fill out would lower my workload

4. Automate web application error reporting

Existing features -
None, well.. manually executed text processing on log files. I wouldn’t call that an application
New features -
Automation of customer / error code matrix grep statements
Output in XML / http format web page and email
Text only output in commented form <– text –> for command line mail clients
Thoughts -
Proves the point that certain people can be replaced by very small shell scripts (Unix humor)
Should be a big with with Client services
Could drive the application “digital dashboard”
Should be a fun to practice using AWK for formatting data in a standard output
Serious danger of scope creep
May be better implemented in a MySQL back-end

5. Do some personal growth items

Finish the Vmware image for the 7206 emulator and post to Vmware Technology Network for general use (delete IOS files before uploading)
Read some more of Long’s storage book
Write a sample chapter for Stay at Home Photography
Get GTK pod to run under my cmcnamar account, not root (I think the IPOD’s file system doesn’t like changing ownership or file attributes)
Redo the 2cups homepage
Clean the Garage……..
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• User experience testing – enhanced
• Usability features in Cisco’s Nexus 7000
• Google Translate API and speech recognition
• Why GoDaddy Linux Virtual Dedicated Hosting Sucks & How to Fix It
• RSS feeds – an intranet aggregation solution?
• Cisco NX-OS 4.0 | Next Generation Internet Operating System

--Colin McNamara

What should I do this thanksgiving break?

Security Threat Mitigation and Response: Understanding Cisco Security MARS
by Dale Tesch, Greg Abelar
Publisher: Cisco Press
Pub Date: September 28, 2006
Print ISBN-10: 1-58705-260-1
Print ISBN-13: 978-1-58705-260-6
Pages: 408

This book had so much potential to be a great. Sadly it turned out to be an overgrown technical manual. The author does try to lighten things up by interspersing real world technical details throughout the book, however he could have just written a “hacks” style book with that material and been much better off.

This book is organized into four major divisions. The first, Security threat identification and response challenge reviews basic security theory and response. A network engineer breaking into security may find this interesting. Anyone else can just skip over this chapter.

I actually found the second, CS-MARS theory and operation to be the most useful. The author laid out a pretty good flowchart of the designing process used to process alerts. He also hinted out the back end architecture supporting the device.

The third section, CS-MARS operation was just blatantly lifted from the users guide. The only difference is that the online users guide is organized a little more clearly. I recommend skipping this chapter and going straight to the on-line documentation, you will be much happier.

The fourth section, CS-MARS in action had great potential, however the author just stuck in some really salesy usage scenarios. I can’t reinforce this enough – This needs to be updated. I have been to customer talks where users presented how the MARS box has made their life easier in many ways. The stories presented here do a disservice to the product, and do not highlight the core differentiators that this product offers.

Would I recommend this book? Yes and No. I would recommend that entry level engineers with no security experience, and business users pick this up. Other then that, log onto CCO and just read through the docs. You will learn more in less time. And as a plus, you will have $50 sitting in your wallet still.

Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”

Similar Posts:

• RSS feeds – an intranet aggregation solution?
• Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments
• Simplifying remote site security with Cisco’s new video surveillance modules on the ISR
• What should I do this thanksgiving break?
• Cool new features in 12.4(15)T
• Altor Virtual Network Security Analyzer (VNSA) integrated with Cisco’s Nexus 1000v for VMware

--Colin McNamara

Book Review – Security Threat Mitigation and Response: Understanding Cisco Security MARS

I couldn’t even try to come up with a better punchline
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Gall stones update – Kaiser sucks
• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Great TCL and EEM preso found on IOS hints and tricks -
• Happy Birthday Marines!!

--Colin McNamara

Sun Project Backbox

231 years old, and still kicking.
To all my brothers and sisters in the sandbox, keep your head down and make it home safely.

Semper Fi

Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Study on Perspective – Set 1
• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks
• Great TCL and EEM preso found on IOS hints and tricks -
• Sun Project Backbox

--Colin McNamara

Happy Birthday Marines!!

Going through bludomain’s source code really got my interest going on the possibilities for dynamic flash content generation. Some Google searches brought up this tutorial – http://www.creativecow.net/articles/brimelow_lee/php_mysql/php_mysql_flash.html

Colin McNamara

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• PHP / MySQL / FLASH website integration
• Great TCL and EEM preso found on IOS hints and tricks -
• Why can’t I post from docs.google.com to blogger beta?
• Study on Perspective – Set 1
• Taking a closer look
• Gall stones update – Kaiser sucks

--Colin McNamara

I found a great tutorial on PHP + MySQL+Flash integration

We had it designed by Bludomain.com. At first I was a little reticent about using them, but now I am very happy about the move. The interface for maintaining gallery’s is superior to how I was doing them before. In the past Ashley would bug me to update her pictures, and I would bug her to provide them in for proper format. Now she just logs onto a web interface and uploads her pictures, updates her content, and whaam.. the site is updated. All this happens without one honey do this. I say that is worth its price in gold

Once I saw this “seamless” interface I had to figure out how they are doing it. After a little pocking around their source code I found out that they were using PHP to pull information out of a MySQL database, and use that for dynamic content insertion into a flash template. From what I can tell, the first thing that happens is the base flash template loads. Each button shape is hard coded in flash, and an actionscript is bound to each button.
This actionscript runs a PHP web application that logs into a local MySQL database, selects from a table, creates an array, then runs a for loop to populate each submenu for items in each drop down.

The net net of this is that you can have a few default templates, and just populate unique configuration options a MySQL db. This simplifies the whole content management issue while still providing the Content Protection that flash gives you.

–Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• I found a great tutorial on PHP + MySQL+Flash integration
• Tour of Ashley’s new site !
• What should I do this thanksgiving break?
• San Diego Maternity Photographer
• What being married to a geek who does search engine optimization gets you
• Ashley stole my new Lense…

--Colin McNamara

PHP / MySQL / FLASH website integration

YOUSERVER=`cat /var/lib/YaST2/you/config | grep LastServer= | sed ‘s/LastServer=”//g; s/;;”//g’`
YOU64=$YOUSERVER/$PLATFORM/update/SUSE-CORE/9/rpm/x86_64
YOU32=$YOUSERVER/$PLATFORM/update/SUSE-CORE/9/rpm/i586

if [[ `uname -i` = x86_64 ]]; then
echo $YOU64/kernel-source-$KERNELVER.x86_64.rpm

else
echo $YOU32/kernel-source-$KERNELVER.i586.rpm
fi

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• I found a great tutorial on PHP + MySQL+Flash integration
• PHP / MySQL / FLASH website integration
• Why can’t I post from docs.google.com to blogger beta?
• Study on Perspective – Set 1
• Taking a closer look
• Gall stones update – Kaiser sucks

--Colin McNamara

Why does SUSE linux make it so rough?

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Study on Perspective – Set 1
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks
• Great TCL and EEM preso found on IOS hints and tricks -
• Sun Project Backbox
• Happy Birthday Marines!!

--Colin McNamara

Taking a closer look

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Taking a closer look
• Why can’t I post from docs.google.com to blogger beta?
• Gall stones update – Kaiser sucks
• Great TCL and EEM preso found on IOS hints and tricks -
• Sun Project Backbox
• Happy Birthday Marines!!

--Colin McNamara

Study on Perspective – Set 1

I found an intersting article on Light Reading
Let me summarize the interesting Items.

Team hightlights
1. Nuova is led by Cisco’s former Chief Development Officer, Mario Mazzola
2. J.R. Rivers, a Cisco Distinguished Engineer who led the team that developed the Catalyst 3750 switch is on board.
3. Tom Lyon, who founded Ipsilion is also on board.

Visibility
This company is almost entirely in stealth mode. No press releases or released products.

Funding
Asside from Cisco’s investments they have refused all offers of VC funding.

Gossip
from Light Reading –

“The startup is presumed to be working on a virtualization project in the storage networking space — at the intersection of storage, networking, and computing.

The idea is that they’re trying to “aggregate compute IO from the server and centralize it into a single or small number of network elements, connected back to the servers via a high-speed low-latency ‘closed’ network,” one source says. This frees up processor memory and CPU cycles so that larger clusters of servers are possible.”

My opinion

I think that Cisco plans to jump into the clustered storage market head first. Netapp has just finished the integration of Spinnaker software with the deployment of Ontap GX. Isilion is making a killing on distributed storage. And everyone in their mother is trying to copy Googles GFS filesystem.

I think that Cisco is going to leverage the recently deployed Storage Services Module with its storage virtualization features to create an abstraction layer between products such as Nuova’s and the classic FC or SCSI connected server.

–Colin McNamara

Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Will Cisco succede where Sun has failed?
• My CCIE Storage Shopping List
• Interesting TechWise TV episode on virtualization
• About Colin McNamara
• Link Round Up – L2TPv3 FCOE Trill Wounded Warriors
• Featured on Network World – 20 useful sites for Cisco networking professionals

--Colin McNamara

Update on the Cisco / Nuova connection

This news is interesting as it shows that Cisco is continuing their push into the application layer.
Its Application Oriented Networking blade directly competes with IBM. The content services switch competes with Sun, F5, Juniper and Netscaler. If Cisco can bring a distributed backend to the market that integrates smoothly with the middleware solutions they are currently proposing it will be unstopable. Anybody care to jump on this bandwagon?

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• New Buzzword Enterprise Service Bus
• San Diego WildFIre Update
• How close did the fire come?
• Great TCL and EEM preso found on IOS hints and tricks -
• Cool new features in 12.4(15)T
• Gall stones update – Kaiser sucks

--Colin McNamara

Will Cisco succede where Sun has failed?

The wedding was great. A classic SoCal wedding, complete with the surfer priest. No joke, he even had a soul patch. The reception was held at the Costa Mesa Country Club. This place is shwank, 100k a year for membership. Erin’s parents really came through on this one. Aside from the location, it was great seeing Adam, Erin, Dan, Lott, and Linda again. I have changed so much, that no one recognized me at first. I guess 60 pounds, a beard, and longer hair can hide things .

Ashley and I drove north of LA that night, and made it to scenic Buttonwillow. Or maybe it was buttwillow. We got a room at the scenic Motel 6, the best room in town. After 5 hours sleeping in this room we recieved a call from the red cross. The lady on the phone informed my wife that someone who had german measles stayed in the room the night before. Ashley turned white on the phone. She responded “I am nine months pregnant” and the lady on phone said “Oh my god”. Shortly after the lady asks if we were in a specific room. Luckily it was a large number off. Then at the end, she asks if we were in Nebraska. At that point Ashley returned to a normal color. Crisis averted, same thing for sleep.
So that trip ended about 3:00 pm that day. I had a little break, fixed my laptop, got everything set up to be autonomous again. Did some phone interviews looking for that right place to land. Checked surflines (sadly it has been pretty flat), worked on the motorcycle, gossiped with friends, chatted up Kylie, surfed the net, did pretty much everything I have been putting off for so long.

Later that week I was back down south for the day. Sadly I had to get back up to the city that evening, or I would have gotten dinner with Dan down in PB. So everything went well down south, and I ended up being late for my flight. Luckily Southwest has pretty much the nicest employees on earth. I ended up on the next available flight without any charge or problem. You can’t beat that. I ran into some interesting people on the flight up. One was a MIT Business school grad. He moved up to the bay to do work with alternative energy development. Things like this give me that 1999 vibe. The bay is starting to get that buzz again. There are deals dropping everywhere. All that money the VC’s have held back is starting to flow. Even podcasting startups are getting 9 million in funding. I mean, come on – Podcasting ? Are we in this build a cool product, advertise, get rich mode again? Scary and fun at the same time. I guess its time to party like its 1999.

–Colin McNamara
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Tour of Ashley’s new site !
• Google Translate API and speech recognition
• Dragged to the hospital
• CCIE Party 2008 Recap – Cisco Live Networkers 2008
• Ashley stole my new Lense…
• PHP / MySQL / FLASH website integration

--Colin McNamara

Weddings, Measles and Podcasting -

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

• Why can’t I post from docs.google.com to blogger beta?
• Study on Perspective – Set 1
• Taking a closer look
• Gall stones update – Kaiser sucks
• Great TCL and EEM preso found on IOS hints and tricks -
• Sun Project Backbox

--Colin McNamara

I am back on the market !!!