Vendor Frustrations

Today I sit here, last day of vacation. Skimmer though work email just so it doesn't overflow. (I am pretty bad at the disconnection part). I have received 2 emails from vendor $. Basically telling me that my renewal is about 60 days past and wondering am I going to renew. Oh and they have graciously allowed me to continue to use the product. Along with this was a quote for 3 years for the product.

Where the frustrations comes in is as follows.

Back in late October I get an out of the blue renewal quote for 33% higher. I have a discussion with multiple sales people about this. Standard line about "We haven't raised rates in x years... Blah Blah."

I get price changes, but 33% in one year, and with zero notice. My budget just doesn't work like that. July to June budget cycle with budget planning submitted in January. That makes it tough, to take. And yes I did plan for a small increase.

Finally got a "New Sales person", He understood where I was coming from with the large increase. We worked through to a number that I was comfortable with. I never heard another word.

Right before the holidays, after I started vacation I get a voicemail and email that my Sales person had been out of medical leave, and was hoping that this sales person was hoping that I would still renew.

I have never seen the agreed upon price in writing. Which seems to be lost at this point. And frankly I have spent way more time than this product maybe worth. I wear a lot of hats at work and any vendor wrangling is just frustration and keeps me from doing the thin
gs that are need of me.

So I tweeted out this: Link to tweet.

So that is where I am right now. Will my renewal or not make a difference to this vendor? Only time will tell.

Vendor $ = Monitoring Company

Useful Office365 Command - Removal of Email

So in the aftermath of a targeted Phishing attack, we had several users who were the grand prize winners of the NDR floods. Now if you were a normal user how would you deal with 20,000 NDR messages in your inbox, I know most would freak out and not know what to do.

What are some of the methods to clean that up?

Inbox rule to delete the messages. Sounds like an OK thing to do. Took 4 hours for the rule to run. Yeah that is helpful.

Use the Compliance Center of Office 365 ? That is closer, but through the management console you can find the messages but putting a legal hold is not quite what I had in mind.

It turns out that you can use the Search-Mailbox powershell command with a -DeleteContent to remove the email from the users mailbox. You will need some of the Compliance Center permissions for the cmdlet to show up for you.

Using remote powershell connected to your Office 365 Tenant you can run the following command:

get-mailbox <users mailbox> | Search-mailbox -SearchQuery 'Subject:"Insert Subject Line"' -DeleteContent

The SearchQuery has a few options to use to search the mail, subject, to, from, and attachments.

Hey that is a little easier, since you don't have to open the users mailbox to place a rule inside it.

There is a limit to the number of items in the search query, it is limited to 10,000. So if you have more matches you will need to run multiple times. This still takes time to run. I have found it does run faster off-peak hours. (Unscientific)

https://technet.microsoft.com/en-us/library/dd298173(v=exchg.160).aspx

http://help.outlook.com/en-ca/140/gg315525.aspx

Rambling Thoughts - July 21th

Thoughts for the week/day:

• SD-WAN: Lots of buzz about SD-WAN in media and such.  This got me thinking. For me the killer app piece of this would be to easily change the path for software deployments to the branch. Instead of trying to push it down the higher cost "Private Circuit" switch that traffic over to a VPN tunnel on a low cost cable/dxl circuit that maybe in the branch. Why push software from a central SCCM server down the private circuit because it didn't fit in the QOS model that you may or may not have setup. I mean really how many of us have time to change QOS models on the WAN?

Projects: PacketFence Upgrade, Switching out HP 5412 in our Data Center to 4 - Brocade VDX 6740's.

Core Network Replacement Part 1

Core Network Replacement

I read a timely post by Tom Hollingsworth @NetworkingNerd about writing. I've realized that I have not written anything on my blog in quite sometime. I could write down a list of excuses but what is the point in that? Most others have the same or similar. And when did I actually get this posted?

I decided to capture some of the thought processes and steps that have and are going into the network core replacement at the $DayJob.

History:

Last Core network replacement was in was in 2007. Link to the vendor press release: http://www.thefreelibrary.com/Indiana+Tech+Builds+High+Performance+Campus+Network+With+Force10...-a0168505385

That update brought 10 gig between serveral buildings on campus and a push to 1 gb to the computer labs on campus. This also moved us away from a very Cisco centric network. It was new and different. The design contained Force10 E300 as well as a handful of S50 "classic" switches. 3 line cards in the E300, 8 port 10gig card, 24 port 1 gb SFP card, and a 48 port 1 gb copper card. At the time this seemed reasonable with room for growth. The 8 ports of 10 gig was not completely populated at first, but moving from 1 gb between buildings to 10 gig seemed like a huge jump. The 1 gig connections were not being used up, so 10 gig was a super highway.
After a couple of years a few flaws showed up. 1. My S50's didn't make the cut for running FTOS and continue to run STOS. 2. Some vlan troubles between STOS devices and no Force10 gear. 3. End of Sale / Dell purchase 4. Account forgotten.

In the pursuing years I found HP Procurve switch gear to be suitable and cost effective for use in my campus and branch offices. The last few building projects I used HP 5400 series switches either standalone or in a VRRP pair. I thought through whenever the next core upgrade came around, that maybe a good starting point. Possibly the 8200 series (Due to multiple "supervisors").

With the last building built Brocade offered a solution with their ICX 6610 and 6450 switches. I was intrigued with the performance in the 1 RU form factor. Being able to stack the switches across 10gig Ethernet links was very useful as the closets changed around from 3 to 4 due to design changes to the building. I had to compromise on the redundancy of each closet due to the change in cable paths and overloaded a closet from initial design. Since I wasn't stuck with fixed chassis I was able to shift one switch to the other closet. The use of high performance 1 ru switches showed value.

Current Selection:

So the ICX 6610 seemed to offer a redundant scalable cost effective solution to network core. Stack multiple to expand available 10gig ports. I was a bit concerned about having to stack multiple switches just to scale the 10gig ports without using the other ports on the switch.


Enter ICX 7750, 6 40gig Ports and 48 10gig port put that in a redundant pair. That is a lot of 10gig ports in 2U of switches. Which maybe more than I need at this point but the nice thing about SFP+ ports is the use of 1gig SFP's in them. So this is the direction that I went.


Next post will be a quick step through of the process that I used to swap them out.

Rambling Thoughts - July 9th

In an effort to post a few more things I am going to write down some idea's and opinions on current goings on.

• Network Break podcast - I really enjoy the Network Break podcasts from @packetpushers. Drew Conry-Murry @Drew_CM brings a new dynamic to the conversations between Ethan and Greg.

• On the recent announcement by @OpenDNS about being acquired by Cisco. First reaction was the flying F-bomb. Why? Because I like OpenDNS, I like the team. Culture swallowed by Corporate Giant Cisco - doesn't end well. But I am waiting to see the final outcome. Still a customer and still an advocate.

Project that I am working on:

• Packetfence upgrade/refresh - Many of my post cover things with Packetfence. I have used it for many years and advocate the use, especially if you don't have the budget for the Commercial products. Inverse has done a great job in development and also providing support.

• Just finished swapping out the core of my network. Replaced a Force10 E300 with a pair of Brocade 7750's. Write-up forth coming.

Also would have to mention Nick @buraglio for telling me once again to write more.

Vlans into Hyper-V VM Machines

A couple months I posted about running CentOS under hyper-v and some challenges related to the integration kit (or so I thought).

I recently came across what I was really looking for.

If I want the Linux (Or whatever) VM to have multiple vlans to a single nic into the vm, the solution is not in the GUI. Big shock there. You will find the following powershell command very useful.

Set-VMNetworkAdapterVlan

This command along with it's Get counterpart is very useful yet obscure. This command is like setting the port on the switch to pass the vlans that you want, only this is the virtual hyper-v switch.

Here is the link to the TechNet article explaining it: http://technet.microsoft.com/en-us/library/hh848475.aspx

From the article here is an example:

PS C:\> Set-VMNetworkAdapterVlan -VMName Redmond -Trunk -AllowedVlanIdList 1-100 -NativeVlanId 10

There is the keyword -Trunk. which makes the magic happen. Now if only MS would make reference to the status of the virtual switch port to the vm in GUI this might not have been such an wayward adventure. I believe that VMWare at least show the vlans in the gui. 

Hopefully this little bit of info will help others with this simple but confusing piece of MS setup.

Tallac Networks - Wireless SDN

A week or so ago I received a briefing on Tallac Networks wireless SDN solution. I have been interested in what Tallac was doing in this space since they started. Matthew Davy gave me the briefing. And yes that is the same Matthew Davy from Packet Pushers Episode 40. I was fortunate enough to have an introduction to openflow around the same time as that podcast, maybe sooner, by Matt when he was at IU. Matt had given a talk about a week or so before to members of the state higher edu network, I was unable to attend due to work schedule, there was a stream which didn't work for me. But it was a good thing since Matt spent most of the time doing a basic SDN intro. The room was not very familiar with it.

On to the meat of it. 

Tallac Networks has two major focus:

• Wireless SDN
• SDN Training

They are a major provider of SDN training materials. The training is what provides the cash for the wireless SDN work. Instead of going after major VC funding and then just burning through it.

Their target market is a Managed Service Provider. They have a AWS-Cloud based portal which can be customized for the MSP, then down to the MSP clients. Currently the AP model is a pretty high end 3x3 (I believe) model white box unit. They do have plans for other models. But currently it is a dual radio 3 stream unit. What runs on the ap is what makes the solution:

That is right, the Tallac SDM agent has two components, SDM Cloud Service and an OpenFlow Agent. 

• SDM Cloud Service is the management piece that talks to the cloud service. This is the "traditional" management agent, which ssid, traffic info, radio control etc is sent back and forth from the cloud management instance. 
• OpenFlow Agent, does that mean?? Yes it does. You can attached the AP to an OpenFlow controller (OpenDayLight,Floodlight,etc) and push OpenFlow rules down onto the hardware. I am told that the Openflow controller is/can be separate from the SDM Cloud Service. But what if I'm not ready to use the OpenFlow component? That is ok, too.

Part of the Tallac API/Cloud service is once a site is setup in the portal, meaning Address/Billing info. The hardware can/is ordered through the portal and then is shipped direct from the factory (White box hardware manufacturer) to the site. The AP comes with the Agent loaded and it's identifiers are attached to the site in the portal. This means when the unit is plugged in and talks to the cloud service, it gets attached to the site without user intervention. 

Another feature is an on-demand  network push. Where a SSID & network policy get instantiated based on demand for that network. So if I have a unit at my house which I have configured a corp SSID with a ssl vpn back to the office, when I leave the SSID and ssl vpn get removed from the unit, after the timeout. So corp SSID is not broadcasting at my house when not corporate devices are there. When a device returns and "probes" for that SSID , the policy comes back onto the device. This could be applied inside an enterprise as well.

A list of their features is here: http://www.tallac.com/key-features

A bigger look at the solution stack is here:

The Orchestration API is what brings the pieces together. This allows the multi-tenancy, customization of the end-user interface, etc. Information from other systems can be pulled into the orchestration api to drive policy. The API is used to drive the vNET Manager and NFV components.

This is a basic overview of how Tallac is creating SDN Wireless. Why this is cool is that this solution can function like any other wireless solution out in the market. But they have the added bonus including in the api's and openflow feature that can be used/experimented with will little impact to the operation of the network.

One last note, Matt mention the possibility of a SDN starter kit that they are working on. I think that it is an excellent idea, one that I hope they do release here shortly. I believe in the coming months we will hear more about the work that Tallac is doing in this space.

CentOS 6.5 under Hyper-V - Help Needed

So I have a need to run CentOS 6.5 under Hyper-V and need certain features which are not working.

Why Hyper-V?

• Because we are a mostly MS shop
• Education Licensing
• It is what I have to work with, so dumping it is not an option.

And the Problem is:

CentOS contains LIS 3.1 for Hyper-v. which shows degraded Networking under Hyper-V console. (Upgrade Needed)

LIS 3.5 contains the networking components to do vlans directly on the host.

LIS 3.5 does not install, says it does but component check shows 3.1 versions.

Only workaround is to present the vm multiple NIC's which I would like to avoid.

If you have some validated working instructions or resources please respond in the comments.

Thanks

Update 8/27/2014:
This is normal for the Intergration kit to be off. Things still work. The answer I was looking for can be found here: http://mrfogg97.blogspot.com/2014/08/vlans-into-hyper-v-vm-machines.html

OpenDaylight on Windows - Hydrogen

A couple weeks ago OpenDaylight released Hydrogen, which is the first production release of code. This is a pretty significant milestone as it wasn't that long ago that ODL started.

Now I have detailed getting the controller up and running on windows in a previous post, that was actual building from source.

After a bit of try and fail of running the controller on x86 32-bit windows, I remembered that the Java seemed to run better on x64 version of Windows.

My test system:

Dell 2850 - 4 gig of ram running Windows Server 2008 R2

Installation:

Install Java SE 1.7.0_51

Set JAVA_HOME Environment Variable on system.

 ** Important note ** Use the 8.3 path name  This comes into play when starting the controller from the batch file.

Download pre-built zip file from http://www.opendaylight.org/software/downloads

Unzip into a directory

Open a Command Prompt as Administrator

Change to opendaylight directory in the folder extracted from the zip file.

Type run -start  to start the controller in the background. It takes a little bit before it is ready. If you are impatient like I am, run netstat -a in another command window. When you see localhost is listening on port 8080 you are ready to go.

Then point a web browser to http://localhost:8080

Login as on previous builds:

Where did the time go? - December 2013 Edition

The other day in reading a few blog posts I notice that some of my favorites were a little neglected. I was about to give them a little jab over twitter, then I thought when was your last post? Umm, Umm, Yeah got myself. August 25th. It's December, where did the time go?

I realize that I am not the master of content, churning out daily posts or even weekly posts. But I think it was time for something.

I could go down a list of thing of how we got to this point but let me filter out the more technical highlights.

Things that have kept me busy since the last post:

• Fall Semester started - now is almost over, couple more days.
• Limited packetfence work other that keep it running. FreeRadius issue - patched with restart script
• Cloud storage vendor change
• Twinstrata implementation - Lots of data move from one provider to another
• Office 365 Implementation - Still in process
• Initial setup was contracted, production migrations up to us
• Migrations scheduled into early next year (2014)
• Personal device Printing - Still in process
• IOS/AirPrint - Papercut
• Bonjour over Cisco controller based wireless
• Family - busy with activities for the kids

With Christmas break coming up, unlike some who get a change freeze, I get a change window, including some during the middle of the day.

Looking forward past the current items: 

• Testing of new gear
• Airtight AP - received that in late November, have to dig into the interface to see all the nerd knobs
• Brocade switches
• Received 2 - 6610 and 2 - 3450 switches to evaluate uses as campus switches
• The 6610 has the potential to be used as a core replacement, with the stacking and L3 features. 
• Getting back to OpenDaylight. 
• Writing a few more posts. The list above has more than enough topics to write on, just have to do it.

If anyone picked up on that little tidbit a few lines back, yes my core switch is slated for EOS in a couple years, so I think it is time to evaluate what is out in the market. 

PacketFence 4.0.x Game System Registration

I came across a little snafu in the Gaming System registration in Packetfence 4.0.X. In PacketFence you can have a page that allows users to register systems that don't have web browsers on them. You can access it by https://<packetfence ip>/gaming-registration .

Great since Xbox's are notorious for not getting registered, due to collision in the OS fingerprinting. This is a well documented problem. In my previous install they would fingerprint to OEM Wireless Router, this time it seems RIM BlackBerry. Either way they miss my auto-registration violation rule, which I may just get rid of.

So trouble started when several students tried to register their Xbox's using the registration page.

 They would authentication to the first page then enter the MAC address:

 Then it would throw this error:

So what gives looks valid. Turns out there is a file: <PF install dir>/lib/pf/web/gaming.pm Which has a list of the first part of MAC addresses allowed to be entered into this page. Added the first 3 octets of the address to the file in the correct spot. Save the file and you are back in business.

I recommend that you verify the manufacturer  of the mac. I use this site: http://www.coffer.com/mac_find/ this allows you to verify that it is a microsoft mac. Hope this helps if you come across this problem.

Packetfence 4.0.5 - Notes

Packetfence 4.0.5 was released on 8-12-2013. Slight bit of craziness, since there were a couple problems with it. But Inverse issued patches within hours. Now the downloaded version is stable and works fairly well.

I however ran into a couple bumps with that upgrade/patch.

First one was I ran into this bug: http://www.packetfence.org/bugs/view.php?id=1676
Which basically the radius server was throwing SOAP errors and would not return the correct vlan, and then after a few hours just stop running. The patch listed here: https://github.com/inverse-inc/packetfence/commit/4861189ba7faf680eef257d5b1c157d7260fe0de  Was missing/didn't apply to the update. So I found the line in the source and edited it to reflect the change. This resolved the issue and the radius server has been running since.

The other was the retrieval for role for gaming device registration. This was a quick two lines added to module described here: https://github.com/inverse-inc/packetfence/commit/36bacc02289afb01a1abd38420585c7f792a4511

At this point I have to freeze the code, no more updates as this is completely in production. And the students are back on campus. The only changes I think we be made are page edits to fix the wording or add more information to the pages.

Update to this post:

After experiencing some problems, I found that my installation is still at 4.0.1 - which is why these patches were not there. Only a certain part of PF was upgraded. Not anything to make it matter.
 {Link to new post when done}

7Signal - Thoughts [Pre-WFD5]

[I have received a Webex presentation and in-person demo of the 7Signal product. This is also a stream of thought post.]

7Signal is a wireless performance and optimization company. Their products do not provide wifi, they monitor and test your wireless network, so that you can optimize it and get the best potential out of your investment.

There solution is listed below- [straight from the data sheet]

Solution components

Sapphire consists of three elements that measure, record, report, alarm, analyze, troubleshoot and verify 

WLANs:

1. Sapphire Eye: Unobtrusive ceiling-mounted scanners that measure large wireless coverage areas.

2. Sapphire Sonar Server: Sonar test servers are located in close proximity to application servers. 

Sonar Server is the endpoint for user experience measurements performed by the Eye units. Sonar 

reports results back to Eye units and then forwards those reports to the Carat Management Server.

3. Sapphire Carat Management Server: A centrally located Carat server stores, manages and 

analyzes the collected data from the Eyes. It provides reports and alarms and includes analyzer 

software. 

So there is the Sapphire Eye which you mount on the ceiling in your environment in the area in which you want to monitor and test. The Eye has 7 directional antennas which are utilized in all of the test. To say that it is "unobtrusive" I will beg to differ. It looks like a upside down flower pot. I know that I have some areas in which if I hung it from those ceilings, someone would hit their head. With that said, I understand the reason why it it so big, the antennas are not your cheap usb adapter 1.5 db antennas. They are big! There is a compass feature in the unit so that you can always know the direction of the antennas no matter how you mount it. 

The software is in two pieces, server software which runs/controls the test that the Eye performs, collects data and such. Second piece is the management console which you can access the reports and data that has been collected and processed. Graphs and charts and all sorts of data is displayed.
Since I didn't drive the console and have only a limited feel for it. Watch the videos and read the data sheets for a better look.

My explanation of the product is: "Hang a wireless engineer from the ceiling with all his tools 24/7 and get data. Giving you a real time site survey and analysis"

Pricing:
As explained, you can go with a CAPEX model, OPEX, or hybrid of the two. These models allow some flexibility depending on your organization.

My feelings without naming price, is it is on the expensive side. (I'm pretty cheap so take that how you will... Actually just contact a partner and find out for yourself.) If you take the offering and break it down into what a professional wireless engineer would bring to the job, then if think they are on par.

The OPEX model has a lot of intrigue. The list price is like buying an mid-level AP per month per Eye.

Include or not depending on options is a start-up analysis/recommendations from their engineers.

I was ask if I thought is was worth it from a colleague. I believe it has value and great potential for me, not sure that I can justify the price for my organization. The costs used in their calculator seem not to be in my ballpark as ROI and such. (If I could plug my own values in, might change a bit.) Now there is flexibility to move the EYEs around into spots that are having trouble and then work through that area.   

Currently I am thinking more about the product and the value. I will be watching the WFD5 stream to see what they present. I hope to update this post in the coming weeks as I will have flushed out some ideas further.

Packetfence Guest Email Domains Check - Updated

So in my quest for latest version of Packetfence 4.0.x I am enabling the guest access. This is done so that guest account creation for wireless will be reduced to only the special cases. The user contact info is captured so I know who is on the network from a rough perspective.

Inside of Packetfence the guest module check the email against the local domain of the packetfence server so you can block your normal users from getting guest accounts. Since they expire in a short fashion and a limited network access it really does the trick.

I ran into a little problem, multiple email domains which need to be blocked. After a post to the listserv and a response that indicated to look in the guest.pm module here is what I did:

my $email_type = pf::Authentication::Source::EmailSource->meta->get_attribute('type')->default;
    my $source = &pf::authentication::getAuthenticationSourceByType($email_type);
    if ($source) {
        unless (isenabled($source->{allow_localdomain})) {
            # You should not register as a guest if you are part of the local network
            my $localdomain = $Config{'general'}{'domain'};

# Added explicated second domain for check below 

my $localdomain1 = ‘second domain name’;

            if ($cgi->param('email') =~ /[@.]$localdomain$/i) {
                return ($FALSE, $GUEST::ERROR_EMAIL_UNAUTHORIZED_AS_GUEST, [ $localdomain ]);
}

if ($cgi->param('email') =~ /[@.]$localdomain1$/i) {
                return ($FALSE, $GUEST::ERROR_EMAIL_UNAUTHORIZED_AS_GUEST, [ $localdomain1 ]);
            }
        }
    }

I added a second check for another explicitly defined domain $localdomain1 yes I could change that but it was quick and dirty. Added is the code in orange. 

Tested and this does exactly what I wanted it to. Just thought I would share.

Updated: 7-25-2013

On the advice of Inverse, I took the above code blob with the surrounding sub and transferred it to the custom.pm and changed the section to reference the pf::web::guest so that this new sub would take precedence.

Thanks again to the Inverse Team.

Packetfence 4.0.1 - First load

As the summer window of working on projects before the day students return is rapidly shrinking, I needed to start on my Packetfence upgrade. If you read my blog before you may know I am a pretty big user of it.

As I wrote back in May it is a fresh install, no direct upgrade path. Getting started, I loaded up a vm with CentOS 6.4 and started down the PacketFence Admin Guide to install. The install guide is fairly straightforward to follow. There is a section on install which on RHEL/CentOS system you have to add additional repos to get things going.

Great been here, not sure I remember the last one from the last install. Ok no big deal, right? I hit a small roadblock with this one. There is only 1 copy of that repo, and it was down. Argh!

Read some more into the doc:

 Debian and Ubuntu
All the PacketFence dependencies are available through the official repositories.

Ok scrap the CentOS 6 install, load up Debian and lets rock. Everything went smooth after that.

PacketFence install within 15 minutes of Debian system being up.

Initial Impressions:

Web Configurator: Awesome to help get things setup.
New Admin Portal: Awesome, leaps and bounds better than 3.5x, the amount you can change inside the interface is great.  I was editing the AUP_Text and save and refreshing the captive portal with the changes live. (Couldn't do that before.)

System performance: Not in production yet so can't say.

The interface is snappy. The search is great with the ease that you can add on more rules to search for to narrow down the person/node that you are looking for.

Guest management is just what I was looking for.

This is NAC that Excites. Hats off to the Inverse.ca team for this work.

Certification - Where do I start from?

So I have been working in IT since 1996, did mostly PC work until 2000 when I started doing this network thing... We had all this Cisco gear, and I wanted to go get my Cisco certs. But it was clear that they were not going to help in my current employment (Financially). Put it on the back burner, kids came along, further back.... Less and less Cisco gear, some staleness in learning on my part, also additional responsibilities. Finally decided to get my Masters degree (price was right, working in EDU does have some perks).

Now after starting this blog, using twitter, connecting with others in the industry, I have decided that maybe it is time to move ahead with a certification. My goal is not too accumulate certs for the sake of doing so. It really is about learning and growing.

Daily tasks cover lots of topics not just networking. Server Admin, Telecom, Networking, PC, Database, Security, etc. The "All other duties as assigned" part of the job description fits quite well. This happens when working in a department of IT department of 7, err maybe 8 now.

On my goals in my review this year I put down obtain one certification. The $64,000 question is which one?
That is what I am asking, I would appreciate some feedback as to options?  Cisco, HP, Security related. Just looking for a place to start with, and the value of it.

So please leave a comment, send me a idea on twitter.

Thanks

PacketFence 4.0

Well, the Inverse team released a new version of PacketFence. Current release is 4.0. This is a jump up from 3.6.1. http://www.packetfence.org/news/2013/article/packetfence-40-released.html


Highlights from the news release:

New Features

• Brand new Perl-based Web administrative interface using the Catalyst framework
• New violation actions to set the node's role and deregister it
• Support for scanning dot1x connections for auto-registration by EAP-Type
• Support for auto registering dot1x node based of the EAP-Type
• New searchable MAC Addresses module to query all existing OUI prefixes
• New advanced search capabilities for nodes and users
• New memory object caching subsystem for configuration files
• Ubuntu packages

Enhancements

• Authentication sources can now be managed directly from the GUI
• Roles (previously called categories) are now computed dynamically using authentication sources
• Portal profiles and portal pages are now managed from the GUI
• Fingerprints and User Agents modules are now searchable
• Translated all remediation pages to French
• Updated Brazilian Portuguese and Spanish translations

Lots of good features listed. I am looking forward to the new admin ui. That is something in the current version which needed help. A heavily loaded system moved slow trying to admin it. 

New search is something which was needed. If you didn't get it quite right the first time you could be sitting a while when waiting for the results to load.

Overall the list of changes looks like a big step forward in usability for the system.

A big gotcha listed in the release notes is the recommendation to start with a fresh install. With the major rewrite it would be difficult to just upgrade in place. See UPGRADE document.

I will be starting my migration in the next month or so. I plan on posting a review once I get my system updated.

OpenDaylight SDN on Windows

So following the tutorial from @networkstatic found here: http://networkstatic.net/opendaylight-openflow-tutorial/ I was able to easily modify the steps and install/build OpenDaylight on Windows.

I used Windows Server 2008 R2 as my base system.
Components added:

• Git for Windows : http://code.google.com/p/msysgit/downloads/list
• Apache Maven: http://maven.apache.org/download.cgi
• Java JDK/JRE: http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html

Install Git for Windows, I selected the option during install to use the windows command shell for git.

Extract Apache Maven from the zip file. Add the path of the extracted files to the system path so you can call maven from anywhere. Makes life a little easier when you get to the directory inside of the clone source.

Install the JDK/JRE and add an environmental variable: JAVA_HOME and the path to the JDK. Things don't go without it.

Once you have the prerequisites done you can pull down the source from git.opendaylight.org

From a command prompt:

git clone http://git.opendaylight.org/gerrit/p/controller.git
Next change directories into: controller\opendaylight\distribution\opendaylight\




Run the following command:

mvn clean install

If your path is correct Maven should start going. This is the long part. If you read through Brent's tutorial you can see this step is long and will be a possible trip up. It is possible that something doesn't build right, this is active code being changed by many all the time. 

Once built you can change directories to: target\distribution.opendaylight-0.1.0-SNAPSHOT-osgipackage\

As you can see the path is pretty long, but there is a run.bat. Call that file and you can then browse to: http://localhost:8080 , on the machine in which you just built the project.

You can login using username: admin password: admin

And there you have it. 

From there it is up to you. I am still working down this journey as are lots of us. Thanks for following along.

Starting with OpenFlow

So after about 8 months of having Openflow code running on a switch, I was able to get a controller up and going. This is because using Openflow is not a business necessary project.

So why Openflow?

There are a few reasons in which I would like to use it.

• Redirecting a copy of user flows for analysis- Remote packet capture
• Traffic Engineering - Using different paths for flows based on policy
• Management Abstraction 

Now some will say that there are other ways to do these things, yes that is true. When you are using switches  that support Openflow it makes send to look into using it. 

My university is connected to Regional Optical Network - Ilight, which is managed by Indiana University. There will be a day when Openflow services will be sitting at my campus wan edge from them. It would be nice to be able to take advantage of them and also to inter-operate with them. If you look at Brocade's presentation at Network Field Day 5 you will see projects in which Indiana University is involved with OpenFlow.

I will probably post somethings about what I am doing with it as they happen. But I do have a lot of business critical project and task that are higher on the priority list. 

Currently looking at the following:

• Controller: Floodlight
• Switches: HP 6200yl currently running OF code K.15.06.5008 , 5400zl in production without OF code. Have 2 5406zl's in staging.
• Avior - GUI for adding flows to controller. 

For more OpenFlow info look to the Open Networking Foundation and OpenFlowHub.org
Check out Brent Salisbury's blog listed in the blog roll to the right, Brent has some tutorials on getting started, with some code snippets as well.

Complexity & Change Management - A Lesson for the Week

Complexity in IT is common place. No matter how hard we try to reduce complexity some solutions are complex. Sometime over the life-cycle of a system, changes cause the once simple solution to be complex.

Change Management - "Change management is an approach to shifting/transitioning individuals, teams, and organizations from a current state to a desired future " - from wikipedia. Every organization has different practices ranging from the formal to the informal.

My organization has a fairly informal change management process, outside of certain changes going through a form in the help desk system, changes are on the less documented side. Now let me be clear with 7 members of the IT department, most of us are all aware of the changes that are happening. Yes there is room for improvement into the process.

So to the lesson this week, needing to elevate the Windows Domain and Forest to 2008 level instead of the mixed mode we have been in. Being in mixed mode is now limiting us in GPO tasks and other important projects moving forward.  Server admin's task was to demote 6 DC's across two domains this week.

This started off by consulting the Department's - Jedi Holocrons

Image from moddb.com

That starts by yelling over the cube walls "Hey Dave! If we are going to do this what are we going to break? " I rattle off the things that I know that will be effected plus a couple more that are maybes.

Demotion of DC's start, and are moving a quick clip. Server Admin works with our developer to make sure some custom user provisioning process get moved.

Bump number one - Several web apps point at the demoted dc's for authentication. Fix for one was change in web.config and iisreset. Other was a bit more complex as in change authentication.config then push that into the app.

Bump number two - Custom user provisioning code is hard coded to specific DC's. Stood over the developer's shoulder to verify changes were correct, then install all the dependencies for it to run on the server that we moved the code to.

So hopefully the last DC will get demoted this weekend without any trouble and we can move forward.

Luckily only one set of our users were affected by these bumps, and yes that was faculty/staff opposed to students.

So what seems to be a simple process turns into a bigger one with the lack of complete documentation and change management processes. I am not an advocate of ITIL or a strict rigid change management process, but having a process will help.

In this situation we could have avoided the bumps if some more documentation was kept and read through. But by understanding the overall picture and knowing what we needed to get through we were able to work through the bumps.