Colin McNamara - CCIE 18233 , VCP, RHCE, GCIH, GEEK » san

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

colinmcnamara — Tue, 09 Sep 2008 20:36:57 +0000

Ivan Pepelnjak over at IOS Hints and Tricks wrote a post about DMZ VLAN leaking that got me thinking.

He writes about “the VLAN leaking myth” and how it encourages clients to utilize physically separate network infrastructure in the DMZ’s. Now first things first, I wouldn’t call VLAN leaking a myth. At one time it was a very real and serious vulnerability that was exploited by overflowing the capacity of the switch you were attacking, and causing it to “downgrade” from switch to a hub. Once this happened you now had access to previously protected devices, as well as having the ability to sniff data as it passed through the shared hub backplane.

As he mentions though, this is 8 years ago. Most switches have evolved to the point where backplanes far exceed the traffic that could ever be injected into their switchports. Even beyond backplane enhancements there are many ways to further firm up your security stance – Virtual Device Contexts, not using Layer 3 SVI’s on a DMZ VLAN, utilizing PVLANs, using port security, virtual routing instances, and many more. Of course, there are still many other attack vectors that still remain, but can be mitigated by utilizing features built into the majority of enterprise switches available today.

I think the real question is not “are VLANs safe in a DMZ”. The important question is have you mitigated the probability of compromise (the actual threat) to levels that are acceptable to your business. This question remains whether you have a standalone switch or not. So many times we hear about risk risk and more risk. But risk alone is meaningless in a business context. What is important is combining risk with likelihood. For that I like to use a simple table to come up with the true threat.

For example, as I drive to Fry’s there is the risk of me dying due to a car crash. The impact of me dying is very high (risk) however the likelihood of an accident is low, and furthermore I reduce (mitigate) the latent risk (threat) by wearing my seat belt. So all in all the threat of me dying on my way to Fry’s is pretty darn low.

In a business context this may be that I have public facing web servers and network devices in my DMZ. The impact of them being compromised is that my public image may be tarnished for a short time, and my end users may lose productivity if they are not able to VPN into work, or access the Internet while on premise. I mitigate this risk by using firewalls and both host and network based Intrusion Prevention Systems as well as implementing best security practices on my network and systems devices. The latent risk (threat) remaining is at a level that is acceptable to the business leaders, so the system is allowed.

One question that I have seen coming up more often as we move towards fully virtualized data centers is centered around commingling of virtual infrastructure. There are some hard questions which challenge some practices that we have held true over the years.

Should you allow sharing of physical memory on a host virtual machine between an internal and DMZ server?
Should you allow virtual infrastructure from multiple security zones to share a storage array or cluster of arrays?
Should you allow multiple virtual switches in different security zones commingling on the same ESX or Hyper-V cluster?
Should you allow virtual firewall and load balancing instances protecting internal and external zones to reside on the same hardware?
Should you allow virtual routing instances from multiple zones to share a physical infrastructure?

In the past world of standalone systems, the additional cost of providing a wholly separate infrastructure for DMZ environments was relatively low. Each system generally had internal disk, or at most direct attached storage. Network devices themselves were scaled down to support one chassis one function. This fit quite neatly into the Enterprise Composite Network model that was quite common from 1999-2003.

Now, many data centers have moved to the Service Oriented Network Architecture (SONA). In this model the cost of a virtualized data center is primarily focused on foundation elements such as the virtual storage and virtual fabrics, virtualized network, and virtual systems elements. The cost of providing additional virtualized services off these elements is low, however the cost of duplicating the physical infrastructure is quite high on both the capital and operational levels. This is forcing the technical and executive leadership at many companies to take a long hard look at the true threats they are facing in previously physically separate security zones such as DMZ’s, Financial and other secure zones. In the end, they are having to decide whether the threat remaining after their security controls is worth duplicating hundreds of thousands of dollars worth of infrastructure or not.

These are hard questions, with really no single good answer. My gut feel is that over the next few years we will continue the move towards the fully virtualized data center where components such as memory, PCI-X buses, storage and network devices are even further decentralized. This will make the cost of duplicating the infrastructure more and more significant, causing consolidated data center (or compute) fabrics to be the norm. At this point the discussion will move away from securing zones by creating separate infrastructure, to providing end to end security, starting integrated application level security, maybe with TrustSec or a dirivative, all the way down to securing the data at rest on disk. For the time being however, the best we can do is sit down and do an honest appraisel of our security stances, mitigate what we can, and do our best to design data center architectures that provide the flexibility of implementing whatever choice the technical and business leaders agree on.Similar Posts:

--Colin McNamara

Measuring and mitigating risk involved with sharing virtual infrastructure between DMZ and Internal environments

Who Moved My Brain ? – A must see presentation

colinmcnamara — Tue, 19 Aug 2008 04:43:44 +0000

Who Moved My Brain? Revaluing Time and Attention

view presentationtags: gtd time

Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

colinmcnamara — Fri, 18 Jul 2008 03:54:20 +0000

My bud Darrel from our Dallas office passed his third CCIE this afternoon.

I think Rick (5x CCIE) put it best in a company wide email earlier this afternoon -

From: Rick Davis
Sent: Thursday, July 17, 2008 4:46 PM
To: Technology Sales & Services
Subject: Darrel Hinshaw – New Triple CCIE [Storage]!!!!!!!

Please join me in congratulating Darrel in obtaining his Storage CCIE. There are only 24 double CCIES (RS/Storage) in the world, so he is probably about 1 of 15 or less in the world to hold all three.

What is everyone’s vote what is next in his career? And, NO, you don’t have a say, Darrel

A) Service Provider

B) VOICE

C) CCDE

Thanks,

Rick Davis

ePlus, Senior Network Engineer

CCIE – Storage, Voice, Security, Service Provider, Routing and Switching (#5672)

Great job Darrel, everyone is really proud of you. and our apologies in advance to the wife for stealing you for choices A, B or C. (My vote is for C)

–Colin

Heading home – Cisco Live 2008

colinmcnamara — Fri, 27 Jun 2008 04:18:15 +0000

Sunday morning twenty two coworkers and I got off various planes bright eyed and bushy tailed ready to attack a week of learning, networking and having a great time. After a week of classes, and entertaining till 2:00 am each night, we look more like the walking dead.

Of course, it was all worth it. Some people see networkers as primarily an opportunity to prepare for a certification. Others got to learn something completely new. Some even go just for the world of solutions and the various booth babes. What I value the most is the opportunity to see old friends, and make new ones, to sit down with someone you have just met and have a half hour conversation on distribution / access layer technologies, or just throw some darts. No matter what, the goal is to connect, learn and collaborate with my peers. This year, I can say that these goals have been achieved. See you next year at the Moscone Center in San Francisco at Cisco Live Networkers 2008.Similar Posts:

--Colin McNamara

Heading home – Cisco Live 2008

Link Round Up – L2TPv3 FCOE Trill Wounded Warriors

colinmcnamara — Thu, 29 May 2008 04:40:25 +0000

I come accross alot of very interesting material each week, only some of which I write about. These are some links that I found interesting this week.

1. Layer 2 Tunneling Protcol (V3) static and hairpin configuration example - my buddy Rick was nerding it out in the lab and sent a great configuration doc for L2TPv3 my way. L2TP(V3) is used to create a layer 2 psuedowire across layer 3 routed links. This is a great service provider tool that you can use in your own network, no MPLS needed .

2. SNIA Education – Fiber Channel Over Ethernet – There is a lot of buzz going around right now about Fiber Channel Over Ethernet (FCOE). There is also a lot of misunderstanding about the fundamentals of this architecture. This Storage Networking Industry Association (SNIA) does an outstanding job of covering FCOE at both at an architectural level, as well as going over low level messaging structures.

3. Trill (Rbridge) architecture – IETF internet draft – I think the last time I was this interested in an internet draft was when iSCSI was first being proposed in the IP Storage working group. Trill, in my opinion is basically a light weight version of MPLS / VPLS. It has as far as I can tell most of the advantages of this architecture, without some of the configuration and hardware requirement drawbacks. Fair warning, reading this document started a doc hunt that killed my Saturday.

4. Cisco’s Security Response to Sebastian Muniz’s IOS rootkit – Security is a very important aspect of network design. Sebastian’s IOS rootkit demonstration is going to force some customers who in the past have been “OK” with having older, possibly vulnerable IOS versions floating around to update their operational practices and start keeping their routers and switches operating systems as often as they do their servers. Thankfully, Cisco has been embracing technologies such as kernel virtual machines, in service software upgrades and more to lesson or remove the impacts of software upgrades.

5. Turning Wounded Warriors into Network Ninja’s – As a former Marine (well, always a Marine, formerly employed by the USMC) this program goes straight to the heart. Cisco is partnering with Naval Medical Center San Diego (NMCSD, or Balboa Naval Hospital for us locals) to provide technical training to Marines and Sailors who have recieved service ending wounds in Afghanastan and Iraq.Similar Posts:

--Colin McNamara

Link Round Up – L2TPv3 FCOE Trill Wounded Warriors

Encrypting your backup tapes with Cisco Storage Media Encryption (SME)

colinmcnamara — Sat, 03 May 2008 22:58:37 +0000

IT staff at the University of Miami are having a very bad week. They are having to deal with the fact that two million private health records were stolen from from them. While it wasn’t directly their fault that their backup tapes were stolen from a off site storage providers transport van. The responsibility does fall on their shoulders to protect sensitive data no matter who has access to the physical media.

Legal implications of a breach

Losing control of personal data means means more then just replacing a tape in your backup rotation. Laws vary from state to state, however generally you are required to contact the identity holders who were breached, as well as fund some sort of remediation. This has huge implications on consumer confidence, and at the end of the day stock price of your company. In some cases, such as ChoicePoint a company can be completely decimated by a breach.

Data protection regulations

There are an ever increasing number of regulations that concern the control of sensitive data. These can vary from laws focused on patient data, to financial data, to personal identification data. The most most well known laws are HIPPA, GLBA, and Sarbanes Oxley (SOX). Past that there are laws that pop up every day at the state and municipality level that further increase the requirements and expense of dealing with a breach. In short, it is becoming an expensive and in some cases criminal offense to lose control of your sensitive.

What you can do to protect your backup tapes

First things first, putting a lock on that Iron Mountain box is just not good enough. You must assume that no matter what, a determined attacker will get physical access to your tapes. So many times companies thing that just because their data format is unique or proprietary that an attacker won’t be able to access it. The cold reality is that any format can be read, and yours is not that special.

The only way to be assured that your data is safe is to encrypt it with a complex cipher. In short, you need to treat your data the same way on tape as you would if it was sitting on a public ftp site (with anonymous access enabled). Luckily Cisco has a technology that allows you to encrypt and decrypt your data coming on and off tape. This technology is storage media encryption.

Cisco Storage Media Encryption (SME)

Cisco’s Storage Media Encryption (SME) technology allows for the seamless encryption of your data flows on and off your backup tapes using AES256 standard encryption. Whether you have VSANS segregating your data, a core / edge architecture, or Virtual Tape Libraries (VTL), you can use SME to protect your data at rest, removing the possibility of an attacker getting access to your critical data.

Storage Media Encryption works by leveraging a multifunction chipset available in the 18/4 module that comes default with the 9222i and is an option for the 9500 series director class SAN switches. Chipset has a couple functions, including line rate encryption of iSCSI and FCIP data streams at gigabit speeds, as well as line rate encryption of data as it streams your tape or virtual tape library’s (VTL).

Want to learn more ?

SAN and NAS, Oreilly Press – In the classic Oreilly style by W. Curtis Preston, this book is a great starting place to understanding the fundamentals of San and Nas architectures that many people are likely to face.

Storage Media Encryption for Cisco MDS SAN Switches – http://www.cisco.com/en/US/products/ps8502/index.html . Cisco has lumped together a couple good data sheets here, though I may have to write a future article taking a deap dive on what really drives SME.Similar Posts:

--Colin McNamara

Encrypting your backup tapes with Cisco Storage Media Encryption (SME)

Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel

colinmcnamara — Wed, 09 Apr 2008 14:27:42 +0000

Cisco released an addition to their Nexus series data center switching line, the Nexus 5020. The Nexus 5020 packs 1.04 terrabit of switching capacity into a 2 ru top of rack chassis. Inside this chassis you have 40 10 Gig Ethernet ports, as well as modular slots that can accept 12 extra 10 Gig ports, or 8 port Fibre Channel cards for a total of 56 available ports

This switch answers a fundamental problem that has been presented by blade centers and VMware. The problem is increasing density of 10 Gig Ethernet, as well as the creation of SAN islands to provide storage access to VMware ESX clusters. The nexus 5020 provides a solution that address both of these challenges, as well as supporting Fibre Channel Over Ethernet (FCOE) for the eventual move to a consolidated data center fabric in the years to come.

Want to learn more ?

Mastering VMware Infrastructure

Nexus 5020 Video Data Sheet

Unified Data Center Fabric whitepaperSimilar Posts:

--Colin McNamara

Nexus 5020 – Consolidated 10 Gig Ethernet and 4 Gig Fibre Channel

What do you do for fun?

colinmcnamara — Mon, 11 Feb 2008 01:10:53 +0000

One of the best parts of my job is that I get to meet new people almost ever day. Many of them have interesting ways of blowing off steam. Some build race cars, others build fish tanks, others like me enjoy photography. Josh Carley IT Director at a local Casino tops us all, he is the lead singer for a local San Diego rock band called FM Revolver. They headlined Saturday night at the Brick by Brick, putting on an amazing show. I was lucky enough be invited, and be allowed to shoot. Check out some of the pictures I took that night -

To see this in a full size window please click hereSimilar Posts:

--Colin McNamara

What do you do for fun?

Me and the Nexus 7000 last week at the Data Center VT

colinmcnamara — Thu, 07 Feb 2008 19:45:01 +0000

I spent the majority of last week at Cisco’s San Jose headquarters attending the Partner DataCenter Virtual Training. We spent three days going over new product releases, getting briefed and trained on new features as well as new products, as well as socializing with other engineers who focus on DataCenter technologies.

As with any vendor specific event, there is a mix of for public knowledge and for private consumption content, so I generally choose not to talk or write about subjects that may have been covered in the VT unless I can find some public documentation on that subject. So don’t expect to find any juicy pre-release information or gossip here. I don’t want to have the NDA police knocking at my door, and its just not cool to let stuff slip. So, I will generally avoid the subject.

What I can tell you is this – There is a lot of buzz about the Nexus 7000. It is a rocking platform, and we spent the majority of a day going over it. I can’t share much more then I did the night before the VT just yet (will wait till I get lab access to one) but I can share this.

Yes, most people are proud of their shots with Tom Cruise, or Oprah, Richard Stephens or BSD Girl. But I can Top that.. I have a picture of me and the Nexus 7000.

The DC Channels team was nice enough to take us down to the DataCenter and Network Applications (DNA) lab. Where the Nexus 7000 has taken its new throne. They allowed to ooh and ahh and poke and prod it. Weirdly enough, the one thing that struck most was the attention to detail that went into the physical design of this chassis. It is not only good looking, but has some super usability enhancements that really impressed me.Similar Posts:

--Colin McNamara

Me and the Nexus 7000 last week at the Data Center VT

Cisco NX-OS 4.0 | Next Generation Internet Operating System

colinmcnamara — Tue, 29 Jan 2008 08:05:25 +0000

The latest product to make its way from the storage networking arena into the data center networking arena is Cisco’s new NX-OS, next generation network operating system. Cisco has taken the highly succesful MDS line of switches, and expanded on their success by taking their core operating system – SAN-OS and expanding it to provide the operating platform for the new Nexus 7000 series DataCenter switching platform. NX-OS 4.0 takes your DataCenter to storage level availability by decoupling the forwarding planes. This allow “always on” upgrades, millisecond failure response, and 5 nines services levels that the converged DataCenters of today require.

One feature that is new, and frankly extremely exciting is Virtual Device Contexts. Each virtual device runs with its own process, vs the use of tagged differentiators in technologies such as VRF-Lite. This provides for paravirtualized management instances, and clear lines of delineation for both software and hardware for a resource that can be shared between different groups within an enterprise.

Chassis that run NX-OS will support In Service Software Upgrades (NSSU) to allow operations groups to upgrade operating systems with zero downtime. This is accomplished through a combination of modular software architecture, and the decoupling for the control and forwarding planes.

One of my favorite features in SAN-OS is the embedded is fabric analyser. This is a tool that can sniff management traffic without having to plug in a sniffer, or provision a span port. You can dump in real time to a tcpdump like interface in the command line, output to a local file, or map to the ip of a wireshark instance that layer 3 access to the management port. Cisco again has taken the best of SAN-OS and bundled it with NX-OS. You will be able to remotely span management traffic without having to set up rspan, or trudge down to the datacenter to set up a sniffer.

Now, your router can call home right now so that is not a totally new feature. Smart Call Home was released recently into IOS. But that still doesn’t stop it from being a great feature. This allows you to configure NX-OS powered devices to mail an xml formatted troubleshooting email to TAC, and / or your support staff. This has been proven to drop the average time to resolution from 16-30 hours to 6 hours.

Now the drum roll…… All IP routing features are VRF aware. This has been a point of contention with me for a while. As Cisco and the market in general has embraced virtualization as an answer to pressing business concerns of leveraging shared infrastructure, while retaining security controls segregating disparate environments technologies such as MPLS and VRF within the datacenter have become more and more prevalent. That is great, however it never fails that the feature you need at that moment always seems to be coming out in the NEXT IOS release. With Cisco NX-OS 4.0 this is no longer a question.

Now, if I was a CIO and I was reading about all these new technologies that Cisco was pushing with NX-OS, I would frankly be cautious, and rightfully so. The thing is, most of these features are not new, they have been in use, and in production under the most stringent uptime conditions in the world – storage networking. They have been tried and tested on Cisco’s MDS line of storage networking switches. So get comfortable, get educated, but most importantly get on board for DataCenter 3.0.Similar Posts:

--Colin McNamara

Cisco NX-OS 4.0 | Next Generation Internet Operating System

Resume – Colin McNamara, CCIE #18233

colinmcnamara — Sun, 06 Jan 2008 17:24:24 +0000

Colin McNamara, CCIE #18233 – (858) 927-4515 – colin@2cups.com

CERTIFICATIONS / ACCREDITATIONS HELD

CCIE – Cisco Systems Internetwork Expert #18233

VCP – VMware Certified Professional

CDCUCSS – Cisco Data Center Unified Computing Support Specialist

VSP – VMware Sales Professional

VTSP – VMware Technical Sales Professional

TSS – Cisco Technical Solutions Specialist, Data Center

GCIH – GIAC Certified Incident Handler

CCVP – Cisco Certified Voice Professional

CSNSSS – Cisco Storage Networking Solutions Support Specialist

CSNSDS – Cisco Storage Network Solutions Design Specialist

CADCNSS – Cisco Advanced Data Center Networking Infrastructure Support Specialist

CCIE Storage Networking

RHCE – Redhat Certified Engineer #804006368822511

RHCT – Redhat Certified Technician #804006368822511

EMCPA – EMC Proven Professional Associate – Information Storage and Management

NSCA – Netscaler Certified Administrator #2005072

NACE – Network Appliance Certified Expert #12912

NACP – Network Appliance Certified Professional #12017 – Data Protection

NACP – Network Appliance Certified Professional #11985 – Storage Area Network

NACP – Network Appliance Certified Professional #12911 – High Availability

Retired Certifications -

Cisco Qualified Specialist – IP Telephony Support

Cisco Qualified Specialist – IP Telephony Design

Cisco Qualified Specialist – IP Telephony Operations

Cisco Wireless LAN Design Specialist

Cisco Wireless LAN Support Specialist

TECHNICAL PROFICIENCY

PROTOCOL PROFICIENCY

EIGRP, OSPF, RIP, BGP, MPLS, Spanning Tree, Rapid Spanning Tree, ATM, RTP, SIP, H.323, LWAPP, RADIUS, TACACS+, Ethernet, Fibre Channel, ISCSI, FCIP, FCP, FSPF, NDMP 802.11a, 802.11b, 802.11g, RBE, ISDN, SNMP

Virtualization Platforms

VMware ESX, Kernel Virtual Machine, Xen

VOICE and VOICE OVER IP

CallManager, Unity, ICS7750, PBX Trunking, SRST, Active Directory Integration, Extended Services, Call Detail Recording, Automated Attendant, Extension, Mobility, Asterisk, Callware and VSR VM.

HARDWARE

Cisco Unified Computing System (UCS) 6100, 2100, 5100, Nexus 7000, Nexus 5000, Nexus 2000 and Nexus 1000v switches, Catalyst 1900-6509 switches, 1600-7500 series routers, Cisco PIX firewalls, Cisco Load Balancers, Cisco MDS , F5 Load Balancers, Netscreen / Juniper Firewalls, Cisco VPN3000 VPN concentrators, Cisco ASA Adaptive Security Appliances, Nortel Contivity VPN Concentrators, Aironet Access Points and Bridges, Airespace LWAPP concentrators. 3com TotalConnect racks, Ascend dial concentrators, Netscaler Load balancers, SSL accelerators, SSL VPN concentrators. Brocade Silkworm, HP Eva Storage

NETWORK MANAGEMENT

Nagios, Cacti, NTOP, IPswitch What’s Up Gold, BIG Brother, Spectrum Network Management, Kiwi Syslog,, MRTG , HP OpenView, Cisco Secure Intrusion Detection system, Cisco Network Based Application Recognition, Snort IDS, Netscreen Firewall Manager, Unified Compute System Manager

OPERATING SYSTEMS

Redhat, Suse and Ubuntu Linux, Windows 2000, Windows 2003, Windows 2008, Windows XP, NT4.0, BSD, Solaris, OSX

BUSINESS ENVIRONMENTS

Consulting, Valued Added Reseller, Large Enterprise, Startup, Banking, Service Provider, Software Development, Manufacturing, Military

EMPLOYMENT

1/07 – Present, ePlus Technology

Consulting Systems Engineer – Data Center

Accelerate Data Center sales, design and implement network, storage, and systems solutions for ePlus west coast customers.

Accomplishments

Developed and deployed go to market strategy for Cisco’s Unified Computing System resulting in significant competitive advantage in the western united states.

Increased Data Center revenues year over year in a the worst economy in a century.

Changed regional sales focus from technology silo’s to solutions based selling covering network, systems, storage and applications under one umbrella.
Established a trend of Advanced Technology account wins.
Accelerated ePlus’s southern California sales by providing high end engineering support.
Increased sales for ePlus’s northern California office by overlaying and training field sales.
Integrated MPLS service provider designs into cutting edge Enterprise Solutions.
Filled PM and lead network engineer roles for large publicly traded company data center migrations.
Created modular Cisco design / quote format and menu based hardware and services options to address rapidly changing customer needs.

9/05 – 1/07 ID Analytics

Lead Network Engineer

Lead team of four engineers, Define network and application integration architecture for large SaaS analytics deployment, Leverage networking technology to increase security and availability, and decrease development and product deployment timelines

Accomplishments

Led team of engineers responsible for all Production and Back Office systems in 2 offices and 3 datacenters
Designed and Implemented ID Analytics Phase2 datacenter, processing 1.2-1.8 million financial transactions daily.
Designed and Implemented Contents Switching and SSL offloading solution, enabled non-disruptive scaling of core products
Integrated ID Analytics product with the largest card processors in the world – Equifax, Visa, TransUnion, etc.
Designed and integrated centralized Fiber Channel and ISCSI SAN solution, increasing application speed and decreasing production database refresh times from 4 weeks to 1 week.
Managed and maintained over 130 terabytes of storage
Created lights out server imaging and deployment solution for remote datacenters
Deployed and integrated monitoring solutions utilizing open source technology
Created user emulation probes for real time application monitoring and trending of production systems
Worked with development and Analytics to create structured Development and QA environments
Spearheaded project to change Analytics / Informatics environment from “unix for workgroups” to high performance computing environment (HPC)
Provide structured documentation to US Government and Corporate auditors
Utilized project management skills for international rollouts

2/04 – 8/2005 Openwave Systems
Senior Network Engineer, Strategic Design and Integration Group
Provide technical leadership, Define network architecture, Establish standards and technical vision. Responsible for researching, developing, and architecting technical solutions to business needs.

Accomplishments

Designed Openwave’s new Pacific Datacenter Networks, with 900 production, and 2000 development servers.
Designed Openwave’s Pacific Shores Campus Networks, and Showcase Datacenter.
Responsible for hardware acquisition budget of 1.7 million dollars
Established ISCSI IP based SAN infrastructure with DR components in 4 major datacenters worldwide
Promoted from the ranks, moving from running our VOIP phone systems, to Network team lead, to Senior Network Engineer in the Strategic Design and Integration team.
Active and engaged member of multiple boards covering design review, change control, and security
Negotiated with Cisco and SBC regarding datacenter purchases saving $906,000 off list price.
Renegotiated Cisco support saving Openwave nearly $600,000 over our three year term
Established improved data center controls, allowing Openwave to pass Sarbanes Oxley (SOX) audits
Wrote and ran multiple RFP, RFQ, and RFI’s
Utilized project management skills for international rollouts
Managed, Piloted, and Installed new wireless systems for our Customer Briefing Center
Responsible for 6 VOIP clusters around the world
Recipient of multiple awards recognizing dedication and quality work.
Attended continuing training for security management (CISSP)

2/03 – 1/04 USMC Reservist activated in support of Operation Enduring Freedom
Information Services Coordinator
Implement and maintain Tactical Data Networks, Provide consulting services to hosting units. Maintain Microsoft Exchange servers in both tactical and garrison environments. Perform security audits and remediation. Train support personnel.

Accomplishments

Performed Disaster recovery of routed ATM LANE environment for Marine Corps Air Station Yuma enabling over 3000 users to resume work (awarded the Navy and Marine Corps Achievement Medal for that event)
Performed security audit and created a security and performance remediation plan for MCAS Yuma
Provided project management and security audit skills to 3^rd Marine Air Wing Yuma server support teams, managed server security audit, security remediation, and SMS rollout.
Designed and implemented Nagios network monitoring system at Marine Corps Air Station Yuma.
Implemented Norton Antivirus server for MWSS 473
Provided training on to data teams from MWSS 473, MCAS Yuma Station IT, and 3^rd Marine Air Wing Yuma server teams.

12/02 – 2/04 2 Cups Solutions, Pleasanton , Ca
Principal Consultant
Founded 2 Cups Solutions to provide cutting edge Voice, Data, Wireless and Security services to clients in the San Francisco bay and Fresno areas.

Accomplishments

Implemented WAN failover solution at two City of Hayward fire stations.
Implemented email and web solution for Express Mobile Notary.
Developed and implemented business plan focusing on State and Local Government contracts.

2/02 – 12/02 ExtraTeam, Pleasanton , Ca
Senior Systems Engineer
Design, Installation, Configuration and Maintenance of network systems consisting of Cisco CallManager, Unity, Cisco Secure ACS, LEAP secured wireless, Aironet, Cisco routers and switches, PIX firewalls, and VPN3000 concentrators. Integrating all systems with Active Directory. Performed VOIP feasibility studies. Managed the entire business cycle including sales, design, installation, training and maintenance.

Accomplishments

Integrated CallManager voice system with Active Directory
Recovered a failed CallManager implementation at Phase 2 Strategies (PR firm for Logitech). Implemented CallManager with up to date hardware and software, upgraded Unity up to reasonably current levels. Brought up remote office in Phoenix utilizing SRST.
Implemented City wide wireless network integrated with active directory for the City of Hayward
Implemented VPN Concentrators in conjunction with multiple levels of firewalls for City of Hayward and Hayward PD to meet CLETS requirements.
Implemented network configuration management system responsible for the city of Hayward.
Implemented new wan for Livermore Pleasanton Fire department moving fire stations from isdn to T1 and Gigabit fiber lines in conjunction with moving the location for the network core.
Designed and implemented IPSEC based wan for Universal life resources, allowing nationwide secure remote office connectivity while minimizing wan connection costs.
Designed CallManager based VOIP system for a 27 site school district
Provided emergency support to Fire and Police agencies across the bay area
Performed security remediation for a large bay area company
Participated in large switched network cutover from 7500 to a 6509 with flex-wan modules for Stanislaus County.
Achieved technical certifications for ExtraTeam to become certified under both the Wireless and IP Telephony revised specifications.

7/01 – 2/02 Infobond Inc. Burlingame , Ca
Network Engineer

Responsible for engineering duties in a leadership role. Integrated legacy PBX’s using VOIP technology. Used Quality of service to ensure VOIP service levels. Support legacy voice over IP and voice over Frame Relay technologies. Upgrade from legacy voice integrations to state of the art VOIP integrations. Create project plans and act on them.

Accomplishments

Cut over evergreen lines shipping terminal from legacy 3com equipment to VOIP enabled Cisco routers and switches. Accomplished all work during Union stand downs.
Contracted to Openwave, Inc. to run Remote Access while the engineer was on leave. Ran Remote Access for 5 weeks, resolving DSL RLAN issues and IPSec issues, while reducing trouble ticket backload to manageable levels. Assisted other engineers when needed.
Implemented Cisco 6509’s to replace aging core network of a Benchmark Capital (bay area investment firm).
Diagnosed and resolved VOIP issues that were stopping call center rollouts for Embarcadero Systems (a large bay area shipping company).

03/00 – 7/01 Knapp Publishing Corporation, San Ramon, Ca
Network Systems Administrator

Responsible for day-to-day operations of e-commerce data center, and wide area networks Performed DNS changes for both internal and external networks. Designed, piloted, and implemented network changes. Installation configuration and maintenance of NT, and Windows 2k file, print, and web servers

Accomplishments

Improved service levels from 90% to 99.99%, enhanced security and increased bandwidth were benefits derived from implementing a state-of-the-art web hosting data center
Implemented a network monitoring system to document, report, and notify of network status.
Designed and implemented ISDN failover of Frame-Relay Network.
Designed, piloted, and implemented network changes.
Replaced NT servers with Linux based servers, integrated with the Windows network

01/98 – 03/00 DKA Computers Inc. Clovis, Ca
Manager Information Services (01/99 – 03/00 )

Ran day to day operations of a central valley ISP. Worked with systems manufacturing to bundle client software with all new PC’s. Partnered with local ISP’s to provide access numbers across the valley.

Accomplishments

Managed web development, and professional services
Moved web hosting from IIS to APACHE based servers, drastically increasing site availability
Produced a forms based web application to configure custom systems online.
Designed and implemented an IPSec based WAN connecting 3 stores point of sales systems.
Managed corporate office and data center relocation project.

Senior PC Service Technician (01/98 – 01/99)

Provide on call service. Staff PC help desk. Provide direct customer systems support while maximizing company revenues. Configured all servers ordered from manufacturing.

Accomplishments

Responsible for all day to day service activities for a 13 million dollar company. Management of 4 team members. Directly responsible for customer satisfaction

Implemented hard drive imaging system, decreasing both warranty costs and turnaround time
Installed and configured SCO Unix reservation system for National Park service, Kings Canyon
Designed, implemented inventory tracking database, reducing required stock on hand by $40,000

MILITARY

1996 – 2004 UNITED STATES MARINE CORPS RESERVE
Have held U.S. Government security clearance – Secret

EDUCATION

Ongoing professional education

Sans CISSP + Track

University of Oklahoma extension – Fire Science

Cisco Networking Academy

Similar Posts:

--Colin McNamara

Resume – Colin McNamara, CCIE #18233

About Colin McNamara

colinmcnamara — Sun, 06 Jan 2008 04:35:55 +0000

Colin McNamara is a seasoned professional with over 10 years experience with network technologies. Holding many certifications, including CCIE, VCP and RHCE, he specializes in enterprise network design, with a focus on converged data center technologies.

Colin is best known for providing designs that incorporate disparate technologies under a shared virtualized infrastructure. He is a proponent of both network virtualization and the utilization of service provider technologies inside enterprise networks to support the security delivery of Voice, Video, Storage and Real Time Application traffic over shared network infrastructure.

He currently works as an Enterprise Consulting Engineer, focusing on Advanced Technologies with Eplus Technology, a publicly traded technology employing 18 CCIE’s as principle consultants with 31 CCIE certifications between them.

He resides in the San Ramon (San Francisco Bay Area) , California with his Wife and two kids. And is active in multiple boards and organizations, including -

Cisco Partner Technology Advisory Board
Consortium of Internet Technology Experts

He can be contacted via information found on his CCIE Resume page . by contacting him via Linkedin or at colin@2cups.com

Similar Posts:

--Colin McNamara

About Colin McNamara

What being married to a geek who does search engine optimization gets you

colinmcnamara — Sat, 05 Jan 2008 03:35:00 +0000

I have been learning all the right ways to build a website that Google can understand. Along the way I set a couple of goals.

The first and foremost goal is to only use “white hat” or legal ways of increasing her visibility
Get Ashley on page 1 for four target keywords
Get An indented listing

Well, it looks like I met my initial goals. Now to move to some more generic keywords and see what goes from there.
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

What being married to a geek who does search engine optimization gets you

Tour of Ashley’s new site !

colinmcnamara — Fri, 04 Jan 2008 01:35:00 +0000

Ashley got a new site from blu-domain a couple weeks ago and it is finally live.
let me take you on a tour -

Here is the flash version of her site

Here is the HTML beginning of her site

Direct to the HTML version

Her about page titled your San Diego Photographer

Her maternity portfolio, featuring some great shots of San Diego moms

Her baby portfolio feature babies in San Diego

Her children portfolio

Her frequently asked questions

Her price sheet

Ashley’s Charity Work

Her client proofing, where her clients can preview all their images

One that I really like is a place where you can check her schedule

And last but not least, a place where you can contact her

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

Tour of Ashley’s new site !

San Diego Maternity Photographer

colinmcnamara — Sun, 16 Dec 2007 03:30:00 +0000

Great gallery of newborn and maternity pictures shot in san diego and laguna beach

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

San Diego Maternity Photographer

How close did the fire come?

colinmcnamara — Fri, 26 Oct 2007 18:40:00 +0000

On google maps, it shows that the fire came withing two thousand feet of our place. It circled us on three sides, basically surrounding the valley. I took a screenshot from one of the news sites for everyone. The little red houses are homes that did not make it. The neighborhood to the right (just over the hill is rancho bernardo).

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

How close did the fire come?

San Diego WildFIre Update

colinmcnamara — Fri, 26 Oct 2007 03:25:00 +0000

Great news,

Mandatory evacuations for our neighborhood were lifeted at 11:30 this morning. We returned home, and everything is here. The fire burned on three sides of our neighborhood, and took out a couple of the homes up on the hill.

Thanks to everyone for being so supportive.

–Colin
Copyright ©2008 | Colin McNamara | CCIE 18233 | All Rights Reserved”

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

San Diego WildFIre Update

Witch fire in San Diego – Notes from an evacuee

colinmcnamara — Wed, 24 Oct 2007 13:32:00 +0000

On the fire maps of the San Diego Witch fire, we are pretty much under the big red spot (directly under lake hodges, to the west of the 15). We moved to 4s ranch in June , on the intersection of rancho bernardo and ralphs ranch road. (pretty much right under the big red spot). We left on on monday at around 10 am with fire on 3 sides of our community.We got out with a couple changes of clothes, important documents, and the kids. Almost everything else is replaceable.

the fire directly upwind of us, coming up the ridge -

Getting out of 4s ranch was crazy though, traffic was jammed up through camino del sur, and the police were not helping. We ended up sneaking out through a backroad and coming out through Del Mar. Our final destination (and temporary home base) is the Ramada plaza hotel in Anaheim.

The winds were blowing 60 mph +

While it is rough having to flee from our home, we are much more fortunate then those people stuck at Qualcom, or Del Mar, etc. While they have been sleeping on the cold cement for two days my family has enjoyed two queen size beds + a fold out couch. Kylie is a little shell shocked, I think fleeing from her home was a bit much, while Chris is just being a normal little two year old terror.

Fireman going after the fire where it wrapped around our neighborhood -

We have also been very fortunate to have many supportive friends. I thank everyone of them for all the support and help they have given. It makes things much easier when you know that you aren’t alone in this struggle. We have a couple standing offers of homes to stay in, a home cooked meal (from the best mexican food cook I have ever met) waiting for us tonight, clothes / diapers for Chris, pretty much everything we could have wanted.

The view as we were leaving (sorry about the blur, we were in the truck)

During this whole ordeal I there have of course been challenges, but I am amazed how everyone is pulling together. In the hour before the police forced the evacuation neighbors were helping each other with information, people were grabbing hopping in trucks and running to help with the fire lines. While it was a post apocalyptic scene with the choking smoke, ash everyone, and blood red sun, people were helping each other. It is to see the best of people when they are under the worst conditions.

The blood red Sun

The two big questions every day are – Is my home still there ? and If it is there, when can I go back? As of right now the evacuation order still stands for my neighborhood. It is directly downwind (about 1 kilometer) from the homes in Rancho Bernardo they have been showing on the news. When we left, fire was coming up the Ridge that separates our neighborhoods. On signonsandiego.com ’s firemap it looks like we may have been spared, but we are still in the middle and downwind of the major fire. The only thing that will signal a change an all clear is for the santa anna winds to subside.

neighbor checking taking pictures of the fire prior to the evacuation order

One thing that is important in any emergency is to go through a lessons learned.

The things that worked well were -

1. Having a 4×4, it allowed us to choose creative escape routes, and avoid the possibility of getting stuck in traffic with the fire behind us.

2. Having decent non-perishable snacks (granola, raisins, etc)

3. Having lots of water bottles laying around – dehydration is a big issue with the dry air.

4. having travel kits ready – because I travel a bit, I normally have my carry-on bags prepped.

5. Bringing a toy, and a little video player for Chris – this saved lots of heartache for everyone

Things that I could have done better -

1. Inspected my wife, daughters, and sons bags before we left – they didn’t pack enough clothes, my daughter forgot things like underwear, socks, etc.

2. Had the key to the breachlock on my shotgun handy – i couldn’t find the key to unlock my weapon. If this would have devolved to Katrina standards then this would have been essential. In retrospect I would have done better with a semi-auto handgun. It is easier to transport and conceal while traveling.

3. I should have had better radios. I am a ham operator, have my license. But I have always used peoples base stations tethered through the Internet (basically a big ip based microphone / speaker connected to their transceiver. Ham operators are a godsend in situations like this, and having a mobile unit in my truck would have added valuable information in a time when we had none.

Colin McNamara
CCIE #18233

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

Witch fire in San Diego – Notes from an evacuee

New features in VMware 3.1

colinmcnamara — Sun, 12 Aug 2007 19:11:00 +0000

New features in VMware 3.1

* Solid State Drive (SSD) boot support
As initially discovered last month, VMware will make available a special version of ESX Server (mentioned with terms like ESX Lite and Embedded ESX) for OEM vendors, to be installed into bootable Solid State storage devices (flash drives, etc.). This option will allow creation of ESX Server hardware appliances for easy jumpstart, granting smaller form-factors and improved reliability.
Dell, IBM and possibly other vendors will offer this option at announcement time in Q3 2007.
* DMotion
Unofficially introduced with ESX Server 3.0.1, in its first version DMotion is a special VMotion operation only capable of moving running virtual machines from an ESX Server 2.5.x host to a new ESX Server 3.x., without shared SAN LUN mandatory requirement.
In ESX Server 3.1 this capability will be extended, allowing hot migration of running virtual machines between ESX 3.1 hosts through the Ethernet cable.
* Patch management system for host and virtual machines (Update Manager 1.0)
ESX Server 3.1 will finally introduce an automated patch management system called Update Manager. This solution will be able to update both host itself and virtual machines (both Microsoft Windows and Red Hat Enterprise Linux).
Update Manager will look for available updates from Shavlik Technologies website (a possible acquisition after IPO), and will allow VI administrators to decide which patches to deliver to virtual machines.
Before applying them, Update Manager will take a snapshot and will even rollback automatically if something goes wrong.

(this product was originally codenamed VM Integrity and its developement started more than one year ago, when virtualization.info discovered it in June 2006)
* VMware Consolidate Backup (VCB) and VMware Converter 4.0 integration
VirtualCenter 2.1 will now allow restoring VCB images with an integrated version of VMware Converter, which reaches 4.0 release number.
* Server consolidation advisor
VirtualCenter 2.1 will expose a server consolidation assistant able to analyze which physical machines should be converted in virtual ones, and where to move existing VMs among available hosts.
(note that with this feature VMware is further extending competition with PlateSpin, covering both features with PowerRecon and PowerConvert)
* Guest OS disaster recovery capability
VirtualCenter 2.1 will be able to recognize a failure inside a virtual machine and restart it through VMware HA module.
* Support for VMware Server 2.0
VirtualCenter 2.1 will be finally able to seamless manage both ESX Server and VMware Server 2.0 hosts.
* Lockdown Mode
ESX Server 3.1 will expose a new security feature to completely disable local administrative account after a VirtualCenter 2.1 takes remote control.
* Power saving capability (Distributed Power Management)
VirtualCenter 2.1 will introduce a new resources utilization analysis feature, able to verify when a physical host can be powered off, VMotion-ing its virtual machines on other hosts without impacting performances.
* Support for Cisco Discovery Protocol (CDP)
VirtualCenter 2.1 will be able to recognize and use CDP to discover physical and virtual network topologies.
It stays unconfirmed if ESX Server 3.1 will already expose new virtual network architecture, allowing 3rd party virtual switches, as it will be announced by Cisco CEO at VMworld 2007.
* Support for 10Gbit Ethernet network cards
* Support for TCP/IP Offload Engine (TOE) network cards
* Support for network load balancing algorithms
* Support for 200 hosts and 2000 virtual machines
* Support for 128GB RAM per host and for 64GB RAM per virtual machine
* Support for SATA storage devices
* Support for N_Port ID Virtualization (NPIV)
* Support for VCB over iSCSI SANs
* Support for IPv6 in virtual networking
* Support for Para-virtualization guest OSes

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

New features in VMware 3.1

Why was Storage Networking my first CCIE? And What did I do to prepare?

colinmcnamara — Thu, 21 Jun 2007 04:59:00 +0000

I got a question on groupstudy about my background, and why I chose Storage as my first CCIE. It seems like a good idea to post it here also.

My background is all over the place. It goes from running a small ISP when I was 18 to managing international CallManager clusters, to enterprise data center design and migrations. I swear that I have tech ADD. I see something new and I am like.. oooooh shiny, lets do a sniff and see how it works.

I actually attempted the Route Switch lab twice in 2002 (still had token ring and dlsw still) but got activated for the war before I could get my number. I can tell you.. that sucked horribly.

So, why did I choose to get my Storage CCIE first instead of finishing up my Route Switch first? Well, over the past couple years I have done a significant amount of IP storage (NFS, ISCSI, ATA over Ethernet, etc) including building my own IP storage heads based on linux. I had also done a little bit of fiber channel work. I felt that I had a significant advantage compared to most network engineers in the storage networking space. And, I think more importantly, the topics that I had to study were new and fresh. Whereas when I cracked open my Route Switch books.. I honestly wasn’t to excited about it at the time ( I think I was holding a grudge from my first attempts in 2002).

The partner e-learning central portion of Cisco has an Excellent lab access to labgear.net. It gives you 2 hour segments of time with 2 mds’s (both with IPS blades), 1 2 port jbod, and 2 2 port servers. They also have introductory tutorials for most major technology segments.

I did all of those, along with the every E-learning class that was on PEC. I think the major ones were the Design, Support, and CASSI classes.I took that, sat for the design and support specialist exams, and took my written last December.

After doing all that work, I was honestly 70% there. I took a little break for january and febuary (There was no open lab dates) and then started hitting the labs I think at the end of febuary.

For the majority of my practice I used the labs available through PEC. I also was able to weasel my way into 8 hour sessions every sunday from our channel SE. (I owe him plenty of drinks at networkers this year) For those 8 hour sessions I had labs created to summarize the major technology areas and to be as evil as possible to myself.

I had one attempt which didn’t work out as well as I would have liked. In RTP the lab starts at 7:15. This means if you are from the west coast like I am you will be getting up at 3:00 am in the morning for your lab. That royally kicked my but. I diverted from my attack plan and ended up
running out of time. It was a classic example of letting the lab run you, instead of you running the lab.

Luckily a data opened up just over a month later. I spent that time just working on my speed (speed is the secret sauce). I migrated to using Fabric Manager (gui interface) instead of command line. After 2 practice runs my time had dropped 25%. I also flew out to RTP 3 days before, and made sure to relax and get on east coast time.

For my final prep I got access to iementor’s lab. Their lab is excellent. I cannot reinforce enough how much it contributed to my confidence in that final week. Roman was really cool about working with an existing candidate to get me squeezed in. They are really cool guys, and they have the only workbook on the market right now.

So, I used their lab 2 days before mine, and then just chilled the day before. The day of the lab I had 70 points by lunch, and had completed configuration of the lab by 12:30. I spent the rest of the day reviewing my configurations (found 2 errors), fixing one bug, and generally harassing the proctor to make sure I didn’t misinterpret anything.

So.. if I had it all to do over again what would I do. I would still do the PEC stuff, and continue to primarily live in the Doc CD. Though I would probably pony up the cash and buy the iementor book and more lab time with them.

--Colin McNamara

Why was Storage Networking my first CCIE? And What did I do to prepare?

Christmas Trivia

colinmcnamara — Tue, 19 Dec 2006 02:53:00 +0000

Christmas comes from Old English, “Cristes maesse” or “Mass of Christ.”

A traditional Christmas dinner in early England was the head of a pig prepared with mustard.

“White Christmas,” released in 1954, starring Bing Crosby and Danny Kaye, was the first movie to be made in Vista Vision.

The holiday classic, “It’s A Wonderful Life,” was originally a box office flop.

The real Santa Claus was born in 280 A.D. as Nicholas. He commonly wore a red and white Bishop’s robe.

“Xmas” is considered by some to be a disrespectful abbreviation. But the Old English word for Christmas begins with X. The Greek word for “Christ,” from which the English is derived, begins with the Greek letter chi, or X. So, X is an appropriate abbreviation for Christ.

The first electric Christmas tree lights were telephone switchboard lights.

About 400,000 people get sick each year from consuming tainted Christmas leftovers.

In 1907, Oklahoma became the last U.S. state to make Christmas a legal holiday.

America’s official national Christmas tree grows in California’s King’s Canyon National Park. The tree is a giant sequoia standing more than 300 feet high, and it’s called the “General Grant Tree.”

Christmas trees are edible. Many parts of pines, spruces and firs can be eaten.

According to the laws of the time, Joseph could have had Mary stoned to death for becoming pregnant.

“Hot Cockles” was a popular game at Christmas in medieval times. In the game, players took turns striking a blindfolded player, who had to guess the name of the person delivering each blow.

Toys for Tots held its first toy drive in 1947.

Boris Karloff was the voice of the Grinch in the animated classic, “How the Grinch Stole Christmas.”

During the Christmas shopping season, Visa cards alone are used an average of 5,340 times every minute in the US

According to a recent survey, seven out of 10 dogs in Great Britain get Christmas gifts from their owners.

“Wassail” comes from the Old Norse term, “ves heill,” meaning “to be of good health.” This evolved into the popular holiday tradition of visiting neighbors on Christmas Eve and drinking to their health.

The average American household will send out 28 Christmas cards each year, and will receive the same number in return.

Boxing Day, celebrated in Canada, has nothing to do with fighting. It refers to the custom of giving gift boxes to employees the day after Christmas. Originally, it was the day Christmas presents were given in England.

Jesus Christ was born in a cave, not in a stable.

The first Christmas card was made in England on December 9, 1842.

The ancient Druids believed the sparks from a burning log carried wishes for a prosperous New Year to the gods, hence the tradition of yule logs.

According to the National Christmas Tree Association, Americans buy 37.1 million real Christmas trees each year.

Charles Dickens wrote several Christmas stories after “A Christmas Carol,” one each year, in fact, but none could match the success of the original.

The Julbock is a common Christmas decoration in Sweden. It’s a small figurine of a goat made from straw.

In Sweden, the “tomte” is a Christmas gnome.

According to “How the Grinch Stole Christmas,” the Grinch was so mean because his heart was two sizes too small.

There are about 5,000 “choose and cut” Christmas tree farms in the US

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

Christmas Trivia

Happy Birthday Marines!!

colinmcnamara — Sat, 11 Nov 2006 04:24:00 +0000

Happy Birthday Marines!!

231 years old, and still kicking.
To all my brothers and sisters in the sandbox, keep your head down and make it home safely.

Semper Fi

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

Happy Birthday Marines!!

Redhat AS3.3 and VMware ESX network issues

colinmcnamara — Mon, 27 Jun 2005 20:27:00 +0000

OK, normally I can say nothing bad about VMware. However today I can definately say that I have gone past annoyed. Let me set the mood for you.
At work we have a pretty decent VMware envioronment. We have an IBM Blade Center, Gig switches, hooked to a Netapp San. All and all pretty bitchen. Once of the things we run in VMware is our M$ Exchange 2003 staging envioronment, along with a working copy of Active Directory. Needless to say, this has to be seggregated from our production copy, or all sorts of hell breaks loose.

Now this system work pretty good, except when we have to do usability testing. Its just not the same on a XP image, as it is from your laptop, on wireless, at home.. etc etc. So we decide we need some sort of VPN solution into our Exchange staging environment. After not alot of thought, I decide to set up a linux PPTP server. Its a protocol that pretty much everybody can use, pretty lightweight, and free .

I have set these boxes up before, and its not terribly hard. Until I had to do it on VMware. Let me set the stage for you – Redhat AS 3.3 / VMware Esx server / VMware tools installed / 1 nic . One NIC generally isn’t best for a VPN server, so I used Virtual Center to deploy a 2nd NIC to my PPTP box.
For anyone reasonably familiar with Redhat or Manadrake, we are used to installing well known hardware and seeing Kudzu add it on boot. Not this time. I rebooted, Kudzu came.. Kudzu went. I ran Kudzu manually no dice.

I know I know, auto anything never works… So I moved on to manually defining this network adapter. The first thing to check – is it actually plugged in. LSPCI reports the adapter as plugged in, and recognises it as a pcnet32 adapter. Normally I would take this as a positive sign, but not today. I issue IFCONFIG -a , network adapter is still not found. I was definately feeling a bit frustrated at this point. To be sure it wasn’t me, I bugged a friend and a co-worker (remind you of a game show?). Anson, who runs the VMware enviornment tried removing VMware tools, adding them…. still no dice. Shad tried to help through Yahoo, although to no avail.

By this time, I am frustrated, feeling like a moron, and ready for a break.
I went to get lunch from the Cafe, and settled down to eat at my desk.
Funny thing, how when you aren’t thinking about a problem is when you normally think of the solution. Let me give you a little background. Earlier when we were troubleshooting this problem, I googled this usenet post -
http://content.ix2.net/arc/t-4236.html . This fellow describes his headaches with debian, in which he had a very similar problem.

His problem, along with mine was that the proper modules werent loading for his network devices. He had tried, along with me to add the module listing to /etc/modules.conf. The one thing however that I hadn’t tried was manually loading pcnet32 using modprobe.

needless to say, modprobe pcnet32 now sits in my rc.local file. Its lame, but it works.

http://www.2cups.com

“The difficult we do immediately, the impossible just takes a little longer.”Similar Posts:

--Colin McNamara

Redhat AS3.3 and VMware ESX network issues