Jaluri.com - A Cisco/Network Blog Aggregator

Easy Virtual Network (EVN) – nothing new under the sun

2012-02-06T20:16:44+00:00

For whatever reason, Easy Virtual Network (EVN), a configuration sugar-glaze on top of VRF-lite (oops, multi-VRF) that has been lurking in the shadows for the last 18 months erupted into the twittersphere after Cisco’s latest switching launch. I can’t possibly understand why the implementation of a decade-old technology on mature platform (Catalyst 4500 and Catalyst 6500) makes news at the time when 40GE and 100GE interfaces were launched, but the intricacies of marketing always somehow escaped me.

Nicira uncloaked

2012-02-06T15:53:04+00:00

Nicira, the OpenFlow startup behind the Open vSwitch, has finally dropped the stealthy cloak. Congratulations!!! Their web site is still pretty sparse on details, but you can get an initial impression of what they’re doing from a number of white papers describing Network Virtualization Platform and DVNI architecture. Short summary: I was almost right, but being a routing-and-switching bloke missed a few interesting bits – OpenFlow (and Open vSwitch) can easily combine security and forwarding functionality.

Aerohive – Wireless Field Day 2

2012-02-06T14:53:12+00:00

We kicked off Wireless Field Day 2 with a visit to the Aerohive offices. Since my first interaction with these folks, I’ve been very impressed by their dedication to the wireless industry. I had to laugh when I realized how many Aerohivers I follow on Twitter. They’ve also done a great job of keeping in touch with me during the past year to let me know about new product launches, such as the BR100 branch router.

Aerohive was waiting for us with a smile and a handshake from the very start. The never-shy Devin Akin (@DevinAkin) welcomed us all to the Aerohive offices while we descended on the breakfast we were going to need to fuel the Tech Field Day “Firehose of Information”™. I must take a second here to highlight one of the best puns I’ve seen in a very long time:

#Brownies? Well played, Jeni. Well played.

Once settled with food, we were invited to take a shot of the Devinator’s favorite liquid substance, Diet Peach Tea Snapple, which I should probably start referring to as “Aerohive Kool-Aid” Our first presenter was Matthew Gast (@MatthewSGast), one of the chief archtects at Aerohive as well as a member of the 802.11 committees that drive wireless standards. His presentation was very technical, diving deep into concerns about 802.11n and issues that are already being seen with throughput on controllers today. This segued into the future of Wi-Fi, 802.11ac Gigabit Wireless, and the impact that Aerohive’s design philosophies have on the increased capabilities that wireless devices will have in the near term once 802.11ac sees wider adoption. Matthew really cranked up the Nerd Meter on this one, and I thank him for letting us get our hands dirty with all the talk about layer 1 discussion, which is probably one of the most neglected layers of the OSI model when it comes right down to it.

After Matthew finished melting my brain, we moved on to the newest Aerohive product, the BR100 branch router. Aerohive had given me a briefing on this device before, so much of it was a review. I like the form factor of the BR100, especially for remote offices or teleworkers that don’t need anything more fancy that simple connectivity. My personal use case would be something along the lines of having it available for trips to allow secure wireless connectivity in my hotel room without the need to rely on the hotel’s often-unstable wireless solution. We went through some more particulars of the device, mostly around the new options enabled by the additions to the Aerohive HiveManager interface that allow networking configuration on top of the wireless configuration options.

As the live demo was readied, we got hit with our Aerohive Oprah Moment – chocolate covered bacon! I must say that this was a first for me as a bacon fan. The hog parts were high quality, and the chocolate added a sweet compliment. I doubt it’s something I’m going to eat every day though. Thanks Aerohive for giving me the opportunity (and the extra cholesterol). We also got an Aerohive backpack filled with goodies. An Aerohive water bottle, notepad and pen set, and…a BR100! Yes, I now have a little Aerohive branch router to try out. I plan on putting this little guy through his paces. The unexpected Oprah moments really help me get a chance to evaluate the equipment.

The 15 minute, 15 branch deployment demo from an iPad was pretty impressive. The ability to have no restriction on the configuration device interface is a welcome change from the Java/Flash/client restrictions from other vendors, and it appears to be becoming a drive in the industry to provide that kind of flexibility. A word of caution, however, to those thinking of doing live demos at presentations or other events: Be sure to keep your audience engaged and riveted on the demo. It’s very easy to lose your audience with demos. Not that Aerohive did, but I noticed we were getting a little restless toward the end.

The restlessness seemed to trigger the Devinator’s Oprah Gland again, because he announced that we had reached the end of the presentation and that it was time to award the coveted Gregor Awards. We didn’t know it, but Gregor Vučajnk (@GregorVucajnk) had been monitoring the #WFD2 hashtag during the Aerohive presentation and handed out the awards for the best tweeters. Somehow, I managed to win! I guess the extra snark I packed in my carry-on helped my out on this one. I got an Aerohive AP 350 for causing so much trouble. This impressive piece of hardware is going to get a great workout both at home and the office, as I now have my own “hive” of APs to test and play around with.

If you’d like to learn more, you can check out their website at http://www.aerohive.com. You can also follow them on Twitter as @Aerohive.

Tom’s Take

Overall, Aerohive was a great start to Wireless Field Day 2. I enjoyed the interaction with Matthew Gast and the ability to pick his brain about the nerd knobs of wireless. While the information about the BR100 wasn’t necessarily new, I think this speaks volumes about Aerohive’s ability to keep bloggers and technical people in the loop about new developments and keep their products fresh in our minds. While the Oprah Moments are never a required part of Tech Field Day, it’s nice to see that companies like Aerohive believe so strongly in their products that they are willing to put a few out there in the hands of people that will pick them apart and tell you the good and bad without reservation. That’s a lot of confidence, folks. Something that I’ve never sensed that Aerohive is short on. Keep up the good work, Aerohive. And keep drinking that Diet Peach Tea Snapple Aerohive Kool-Aid.

Wireless Field Day 2 Disclaimer

Aerohive was a sponsor of Wireless Field Day 2. As such, they were responsible for covering a portion of my travel and lodging expenses while attending Wireless Field Day 2. In addition, they provided me with an Aerohive backpack, water bottle, pen and notepad set, an Aerohive BR100 evaluation unit, and an Aerohive AP 350 evaluation unit. They did not ask for, nor where they promised any kind of consideration in the writing of this review/analysis. The opinions and analysis provided within are my own and any errors or omissions are mine and mine alone.

Wake Up Sheeple

2012-02-06T00:00:00+00:00

Show 86 – Connect to the IPv6 Internet for Free Using TunnelBroker.Net

2012-02-04T22:34:07+00:00

Hurricane Electric's Owen DeLong joins Ethan Banks and Greg Ferro to discuss TunnelBroker.net. What's TunnelBroker.net? It's a free service from Hurricane Electric that lets you connect to the IPv6 Internet across an IPv4-only connection. Want to get started with IPv6? This is a great way to go, not only for the connectivity, but also for the IPv6 education Hurricane Electric offers. We keep the show pretty on-topic, and cover the following information. Who is Hurricane Electric? In simple terms, what's the TunnelBroker.net service? Are these "real" routable IPv6 address blocks HE is issuing? Why is HE offering this service (a) at all and (b) for free? Who is eligible to use TunnelBroker.net? Why bother? Isn't carrier grade NAT going to save us all? There are several types of IPv6 over IPv4 tunnels. What kind of tunnel is tunnelbroker.net using, and why was this type chosen over others? What sorts of devices can successfully bring up an IPv6 tunnel to HE? What sort of tunnel termination device is on the HE side? Is it redundant/resilient? In what way? Explain the tunnelbroker.net provisioning process. Is it automated or are there humans involved? Once the tunnel is up, what can you do with it? Can end users do anything crazy like advertise their own RIR-assigned IPv6 allocation to HE via BGP through the tunnel? Or nail up 2 tunnels to HE to have redundant virtual links for their IPv6 block? What happens if the user's IPv4 tunnel endpoint is dynamically assigned, and the address changes? How does a person advertise their IPv6-enabled service with DNS? What resources would you recommend for a person trying to get smart about IPv6? What's a good strategy for a business looking to do IPv6 multihoming? Is IPv6 prefix translation just a lame way for carriers to get out of upgrading their equipment? LINKS Carrier Grade NAT 6in4 Quad-A DNS Records (RFC3596) IPv6 Prefix Translation (IETF Draft) www.theipv6experts.net - where Owen blogs...you know...once in a while.

Internets of Interest for 4th February

2012-02-04T19:54:38+00:00

Collection of useful, relevant or just fun places on the Internets for 4th February and a bit commentary about what I’ve found interesting about them: Real World Technologies – IBM z196 Mainframe Architecture – A amazing insight into the hardware architecture of the IBM mainframe. Lots of insights into how a different hardware architecture works. [...]

I don't often do this...

2012-02-04T04:59:47+00:00

So I don't often do this, but this video was so good It combined both my passion for the Formula 1 and for music, if you have any interest in either of these, I strongly recommend you check this video out:

http://www.lotusf1team.com/

Cheers :)

PacketPushers- Ethan Banks: Why Salespeople Sell to Others in Your Organization but Not You

2012-02-03T09:19:25+00:00

Ethan Banks does it again. This exactly describes what happens to me when I'm discussing technology with a vendor. Whether it's as a #TechFieldDay delegate, or as a customer it's I'm always reworking my mental picture of how a a design change could impact a system.

Virtual Circuits in OpenFlow 1.0 World

2012-02-03T07:34:05+00:00

Two days ago I described how you can use tunneling or labeling to reduce the forwarding state in the network core (which you have to do if you want to have reasonably fast convergence with currently-available OpenFlow-enabled switches). Now let’s see what you can do in the very limited world of OpenFlow 1.0 (if any shipping physical switch supports OpenFlow 1.1 beyond OpenFlow 1.0 functionality, please write a comment)

Prolific USB to Serial on OS X Lion

2012-02-03T04:14:43+00:00

Kudos to this superstar who easily got my USB-to-Serial adapter going on OS X Lion! This now makes two guys named Martijn I admire from the Netherlands...must be a trend.

http://xbsd.nl/2011/07/pl2303-serial-usb-on-osx-lion.html

Wrong Superhero

2012-02-03T00:00:00+00:00

CCIE Numbers Skyrocket – Red Alert?

2012-02-02T17:08:59+00:00

Congratulations to Chris Martin, CCIE# 34310, according to IPExpert’s Successful Candidates page. Thanks to Windows Calculator and my non-binary math skills, that means we’ve had 5,000 new numbers since my pass back in June. That’s not counting the repeat passes that keep the same number. The new numbers have been skyrocketing in the last 3 months, shooting up over 2,000 since Blake Krone passed his lab at the end of October.

I’ve heard a lot of interesting theories in the past couple of weeks about why the numbers are shooting up so quickly. Some attribute it to the official Cisco 360 training program churning out candidates left and right. There are also those that believe there is something hinkey is going on with the numbering scheme. Is Cisco pre-allocating numbers to each lab seat every day and then discarding them if the lab isn’t passed? Are they counting by even numbers now? Is the numbering now logarithmic? Add in the recent troubles that Marc La Porte has had with Cisco and his unofficial CCIE Hall of Fame Webpage and the conspiracy theories started spreading like wildfire. Why is Cisco trying to take down the page? Are they trying to hide something?

After listening to all the theories and rumors and some of the more outlandish theories that I didn’t even bother to put down, I keep thinking back to a conversation that I had with Terry Slattery back at Cisco Live 2011. Being the fanboy that I am, I had a chance to ask Terry what he thought about the CCIE numbers climbing ever so higher. Some of the thoughts he shared with me were rather intriguing and got me to thinking about things in a light that I hadn’t really considered before. With the acceleration of the new numbers being spit out, I think now more than ever that Terry might have been on to something.

Let’s say for the sake of argument that there isn’t anything funny going on with the numbers. Let’s also assume that there isn’t rampant cheating going on, as some have suggested to me. That means that we have a large number of people taking and passing the lab. But we aren’t hearing about them. They don’t have blogs or spend time on Groupstudy or post success stories on LinkedIn. There isn’t any information about them out there. Almost as if they didn’t really have a big presence on the Internet. As if they weren’t really looking to market their skills to others and instead were either already at jobs that required the CCIE or had one lined up and ready to go. Where would such a thing be possible?

China.

Stop and think about it for a minute. According to Cisco, China is seeing explosive growth in networking, everything ranging from power systems to survellience. They’re ramping up and infrastructure that’s going to need to support over a billion people all looking to get connected somehow. China is leading the way in deploying IPv6 internally as a way to alleviate the exhaustion of IPv4 addresses. Ask yourself then: Where are they getting all these engineers? How many of your friends and colleagues are flying to China to work on these massive projects? I’m guessing hardly any. Why’s that? Where is the supply coming from to meet this massive demand?

I believe that there are sponsored learning facilities inside China that are essentially functioning like advanced technology vocational technology centers in an effort to train a workforce to go out and assume the roles needed to build and maintain advanced networking and computing infrastructures. That way, they don’t need to sort out all the details of arranging for a large number of visas to allow foreign engineers to come and work for months at a time. They also don’t have to worry about bad press from said foreign engineers coming back home and discussing things like the Internet filtering policies. Instead, they can focus on creating a highly-skilled group of workers to go out and tackle these huge projects. Because these facilities are likely sponsored or run by the government, profit is of less concern than results. And if you have a populace that is willing to clamor toward a job that doesn’t involve manual labor or other undesirable work, you would have a motivated pool of talent to pick from. Taking into account the mind-bending numbers of people available for these jobs, passing even 1,000 extra CCIEs into the global pool is a blip on the radar for China.

One other thing that I’ve mentioned before lends credence to the Chinese CCIE theory in my mind. Remember those dastardly Open Ended Questions that I hated so much? Guess which testing facility instituted the in-person interview process that led to the OEQs before the new troubleshooting section? That’s right, Beijing. I’m not accusing anyone of wrongdoing. But the fact that the OEQ program originated there means they must have had a very high pass rate they were suspect of in the first place. What if the pass rate is still legitimately high even with the new safeguards against impropriety? Since Cisco doesn’t release numbers on pass rate per lab, I guess we’ll never know.

Tom’s Take

At this rate, we’re looking at seeing CCIE 40,000 before the end of the year. That’s really going to hit home for people if it took almost 3 years to go from 20,000 to 30,000 and then only takes a year to climb up to 40,000. I don’t like to think about the idea that lab cheating is so rampant that Cisco has given up trying to protect the value of the CCIE. Quite the contrary, I’ve heard rumors that the difficulty of the lab is as strong as ever and people are working as hard as they can to get their digits. To me, that says there is a large contingent of people passing the lab and not talking about it, either by their own choice or the choice of someone above them. And since we in the U.S. aren’t seeing the workforce flooded with new CCIEs daily, that must mean those passing are someone other than the U.S. (or Europe). Add in the fact that there aren’t many network rock stars studying Mandarin or watching Ni How Kai-Lan and I am guessing that means that many of our new unknown CCIE brethren are from the Orient. No crazy conspiracies or funny math. Just a group of dedicated people doing their best to make it in the world.

CloudShark Plugin for Wireshark

2012-02-02T03:15:56+00:00

The folks at QA Cafe premiered their impressive (and free) online CloudShark service in the summer of 2010. (If this is the first you've heard of it, stop reading now and go have a look.) Just recently they released a Wireshark plugin to make uploading capture files to the service even more convenient.

Installation

To install the plugin, you'll need a version of Wireshark built with Lua scripting support. See Help > About to check for Lua support in your version (look for "with Lua" in the "Compiled" paragraph).

The plugin is available here for Windows, Mac, and Linux. The simple installation procedure for the Linux version is below. Consult the user guide for additional support.

stretch@Sandbox ~/cloudshark-1.0-136 $ ./install-unix
Starting installation of CloudShark plugin for WireShark

Plugin will be installed into /home/stretch/.wireshark/plugins/cloudshark
Installing default plugin configuration file.
The CloudShark Plugin for Wireshark is now installed.
Please restart Wireshark.

Visit http://appliance.cloudshark.org for additional help

Continue reading · 2 comments

Clarification On Comment Policy

2012-02-02T02:06:27+00:00

Before I get into the Wireless Field Day 2 posts coming up next week, I wanted to take a second and clarify the commenting policy I have on my blog. That way there isn’t any confusion about comment approvals and such.

I have a pretty open policy when it comes to commenting. If you take the time to post a comment, I will usually approve it. I respect the opinions of those that read my blog and welcome any and all feedback. If a particular post inspires you enough for you to take the time to put keyboard to phosphors and create a response, it is my duty as a blogger to make sure that your voice is heard. It doesn’t matter if your opinion is different that mine or if you are correcting misinformation. I will publish all comments in my queue. There are two exceptions, however:

1. Spam – I detest spam comments with the fury of a thousand fiery suns. I don’t need magic pills, Free*** devices (where *** is a ton of crap restrictions and offer signups) or SEO tips, thank you very much. I have managed my blog so far without your help kind marketing people of the underbelly of the Internet. I think I’ll make it a few more posts without you as well. Comments that are definitely spam are approved to /dev/null and forgotten. I will usually err on the side of caution when it comes to non-obvious comments. I also go through the spam folder regularly and rescue non-spam comments. I do see every one of them at some point, so the bad stuff is really bad stuff in my mind, not just a sorting algorithm.

2. Hateful Comments – I don’t mind a good discussion, even a heated one. Hell, I’ve even made a couple of pointed comments myself. But, there has to be a point to the pointedness. If you disagree with a particular position and can elucidate that point, even with some harsh or off-color language, I’ll likely approve your point of view. If your comment is nothing more than “F*** off and die you stupid a**h***!!!!!111!!!”, I will delete it. That comment adds nothing to the discussion and only seeks to inflame people into being dragged down to a low level of name calling. When in doubt, remember that even during the height of the American Civil War, when states were shooting at each other, the members of Congress still referred to each other as “The Distinguished Gentlemen from [...]” even as they were yelling obscenities. A little decorum goes a long way to ensuring your voice is heard, even if it is a bit antagonistic.

With that said, there are times when things slip through or are taken out of context. While I approve every comment without (much) reservation, I also feel it is my duty to leave comments up and not delete them out of spite. I will, however, agree to delete a comment should the commentor contact me with the request to remove a specific comment. I want to be sure that the opinions and positions expressed are accurate for all represented parties. In the event that a comment reply chain spirals out of control, I reserve the right to remove comments of both parties back to the point where the flaming started. I’ll leave the original comments unless otherwise asked to remove them.

I’m not a journalist. I’m not a celebrity blogger. I’m just some random nerdy guy with a keyboard and some thoughts that I want to share. Many of you readers out there want to share your thoughts on my thoughts as well. This post just ensures that we’re all on the same page when it comes to what gets approved and what doesn’t.

I Love Tools Like This: HFS

2012-02-01T20:29:35+00:00

Why do I like TFTPD32? Because it's so freakin' simple! When you're in a data center and need a quick TFTP server...there it is.

...who knew they had one for HTTP? There it is: HFS - A 600KB "insta-web server" for Windows.

http://www.rejetto.com/hfs/

Predicting What Will Not Be Big in 2012

2012-02-01T19:05:32+00:00

I've been working on making some predictions about 2012 and networking. I like to do this in the year of 2012 (not 2011 like everyone else) and I like to go further than anyone else and predict what WILL NOT be big in 2012.

Cisco Easy Virtual Network – Because MPLS Is Too Complicated¡

2012-02-01T17:03:27+00:00

Oh my. Cisco thinks MPLS is too complicated for Enterprises so it's invented a new proprietary protocol called EVN (Easy Virtual Network).

CCIE Security Version 4 Update

2012-02-01T14:57:26+00:00

Note that this announcement from Cisco is sort of a “pre-announcement” in that the official CCIE Security 4.0 change hasn’t been announced but will be really soon. This means if you want to take the v3 Security lab you should book your date ASAP.

From Cisco.com:

The Real Life of an Expert: Introducing the New CCIE Security

CCIE Security 4.0 is unusual among security certificates for its up-to-date, real-world content. It emphasizes security competency and efficient problem solving in networks that use cloud services, carry voice and multimedia traffic, and are accessed by a variety of wireless devices.

The content, currently in development, may include real-world applications that involve:

Securing both wireless and wired networks, including managing security policy by device and service

Extending application awareness to security devices, moving security up to Layer 7 from the stateless packets of Layers 3 and 4, and applying policy on a per-identity basis

Applying security policy in a network that has voice and video traffic

Securing networks that use managed services, dual ISPs, IPv6, or IP multicast

Cisco will soon announce the blueprints for the CCIE Security 4.0 written and lab exams; the first exam will take place approximately six months later.

Although there are no prerequisites for registration, Cisco offers a preparation path through its CCNA and/or CCNP Security levels, and recommends that candidates have at least three years of hands-on network security experience.
more…

Also I hope to see a few of you at the CCIE party here in London tonight. I’ll be easy to spot as I’ll probably be one of the only sober CCIE’s there Lastly if you’re really bored you could follow me on Twitter while I’m here at Cisco Live Europe: http://twitter.com/ccie2210

Where Packets Never Die

2012-02-01T14:04:35+00:00

I talked with a fairly large service provider yesterday regarding quality of service(QoS) possibilities for a particular network. Essentially, we were trying to figure out what was available from a queues perspective so that we could make sure we were … Continue reading →

Forwarding State Abstraction with Tunneling and Labeling

2012-02-01T10:29:35+00:00

Yesterday I described how the limited flow setup rates offered by most commercially-available switches force the developers of production-grade OpenFlow controllers to drop the microflow ideas and focus on state abstraction (people living in a dreamland usually go in a totally opposite direction). Before going into OpenFlow-specific details, let’s review the existing forwarding state abstraction technologies.

Firefox 10 is out

2012-02-01T04:58:36+00:00

Mozilla drop-shipped the 10th version of their browser on the world today. New stuff in Firefox 10 includes bug fixes, developer tools, and some other neat stuff.

You can get the latest version by giving in to the nag box that pops up in previous versions or by clicking here: http://www.mozilla.org/firefox

Junos Basics – OSPF

2012-02-01T02:07:15+00:00

Oh, my. Another Junos post. Somebody stop me before I get my JNCIA!

This isn’t hard stuff at all. I’m sure there are a couple of cool tricks I don’t know yet, but let’s try anyway. I”m working on an SRX240 here running 11.1 and some change.

Let’s put interfaces ge-0/0/0.0 and lo0.0 in OSPF area 0. If you know the Junos configuration hierarchy, this will be very easy to you. Even if you don’t, you can stare at the config for a little bit and see what we’re doing.

set protocols ospf area 0.0.0.0 interface ge-0/0/0.0
set protocols ospf area 0.0.0.0 interface lo0.0

This is the only OSPF configuration you need, but guess what? It won’t work. Since a Junos device is also a firewall, it will drop OSPF packets as they come into the interface; you have to declare that you do indeed want to accept OSPF packets. You do this by creating a security zone, putting the right interfaces in the right zone, and then enabling OSPF on that zone.

We’ll create a zone called INSIDE for our purposes here. Note that there are about billion more steps (I counted) to fully configure your security zones, but that’s way beyond our scope here.

set security zones security-zone INSIDE
     interfaces ge-0/0/0.0
set security zones security-zone INSIDE
     interfaces lo0.0
set security zones security-zone INSIDE
     host-inbound-traffic protocols ospf

You can also allow OSPF on specific interfaces like this. These commands will also put those interfaces in the right security zone.

set security zones security-zone INSIDE
     interfaces ge-0/0/0.0 host-inbound-traffic protocols ospf
set security zones security-zone INSIDE
     interfaces lo0.0 host-inbound-traffic protocols ospf

I’m not sure if you need to do this to lo0.0, but it won’t hurt.

Now you can see your OSPF neighbors come up and start exchanging routing information. That is, of course, assuming you did everything else right.

Send any ~~blog deadlines~~ questions my way.

Baby Names

2012-02-01T00:00:00+00:00

Cisco Wireless Certifications Get a Refresh

2012-01-31T14:00:32+00:00

Cisco recently updated their wireless exams to version 2.0 for both CCNA Wireless and CCNP Wireless.The new version brings a much needed update that is more in line with current Cisco wireless technologies.

Some of the updated content includes more recent versions of WLC and client software. They've also expanded 802.11n support and added more information about Video over wireless and Voice over wireless. Check Cisco's website for more details.

FIB update challenges in OpenFlow networks

2012-01-31T07:00:07+00:00

Last week I described the problems high-end service provider routers (or layer-3 switches if you prefer that terminology) face when they have to update large number of entries in the forwarding tables (FIBs). Will these problems go away when we introduce OpenFlow into our networks? Absolutely not, OpenFlow is just another mechanism to download forwarding entries (this time from an external controller) not a laws-of-physics-changing miracle.

Profit, Passion, Purpose

2012-01-31T05:39:00+00:00

Tony Hsieh, the visionary CEO of Zappos, in his book Delivering Happiness shares how an emphasis on corporate culture can lead to unprecedented success, based on the different lessons he has learned in business and life. One thing I took from his book: most of us work to make profit (or financial gain) in mind at the beginning, then move to a state where we want to work on something we are passionate about, and finally reach the last state where we want to contribute to bigger community; to have a higher purpose other than for ourselves.

Tony is not an ordinary CEO. First, he was already damn rich in 1999 when he sold the company he co-founded, LinkExchange, to Microsoft for $265 million. Second, Zappos started the business in online retailer by only selling shoes at that time. You must be wondering, who's on earth would buy shoes online? The answer is the third point, Tony and his team turned Zappos from a small online retailer with no sale, into doing over $1 billion in gross merchandise sales every year, within 10 years. Until today Zappos is still listed as one of Fortune magazine's 100 best companies to work for, and was acquired by Amazon in 2009 in a deal valued at over $1.2 billion on the day of closing.

I'm still far behind what Tony has achieved in life. Right now I still work for a corporate, with mix target between gaining financial stability and working on the field that I like. I'm nowhere near Tony's courage to drop everything he had in life to focus on developing Zappos. Even currently I've been trying to set up something outside my work. But for a while I have felt that I need to do more, I need to do things to fulfill my purpose: to live life to the fullest and at the same time to provide benefits for others whenever I can.

With that in mind, I set my target in 2012 to focus on helping the IT professionals and students from my country so they can be ready to work and to compete in global market, just like what I do now. I will only do the things that I know best: sharing my knowledge and experience to my country men, with hope that they will gain some benefits from it. I can give advice on career and Cisco certification program to the students, and I can share some network design case studies and my project experiences to the professionals.

On the last week of March, after my trip to Melbourne to present at Cisco Live, I'm planning to pass by Indonesia for few days to conduct free session and workshop for students and professionals. So far I've got positive response: there are 4 universities in two cities that are willing to host the session, and there is one training institute that will provide a location in central Jakarta for me to conduct the free 6-hours workshop.

What I will do, you may consider it as a small contribution.
But I consider it just as the first step.

Updated: Webinar on SDN and OpenFlow on Feb 7th – Now With More “Space”

2012-01-30T21:29:01+00:00

The original Webex session for this event was booked out within two weeks and we closed the event. We have increased the webinar ‘seats’ and have re-opened the bookings. This post is a repeat of the earlier so that you can sign up to the event if you missed out. I’m pleased to announce that [...]

Juniper Networks vGW Virtual Gateway Now Supports VMware vSphere 5.0

2012-01-30T18:37:06+00:00

The wait is over! Juniper Networks vGW Virtual Gateway 5.0 R2, having passed VMware's rigorous testing, verification, and software signing process, now supports VMware vSphere 5.0. This not only highlights Juniper Networks’ longstanding collaborative relationship with VMware, but now gives joint customers a clearer path to the most secure virtualized data center or cloud possible. In fact, vGW is the first virtualization security product to have successfully completed the VMware analysis for the VMsafe kernel integration into vSphere 5.0.

Which WAN Optimization vendor will consolidate and expand its market position on 2011

2012-01-30T11:15:34+00:00

447 votes - Thank you all! I add the results in a blog posts so we can see over years on which optimization technology we were betting in 2011.

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Not sure about the yearly subscription? Start slowly!

2012-01-30T06:54:58+00:00

One of my Twitter friends sent me this question: “Would you honestly recommend your webinar subscription for a young CCIE that knows how routing works but have no real world experience and is a noob in DC/VM/NXOS?” That sounds like a perfect audience to me – I usually assume the attendees have mastered the fundamentals of networking/routing but don’t know much about the topics of the webinar (the whole idea of my webinars is to help you get started in new technology areas).

IOS Zone-Based Firewall

2012-01-30T02:20:31+00:00

A common network implementation for branch offices and other small sites belonging to a larger entity is to have two WAN connections: One is an MPLS or otherwise private connection to the corporate network, and the other is an Internet circuit (often some flavor of broadband) which carries public Internet traffic as well as VPN tunnels which serve as a backup to the private WAN circuit. Typically, the WAN connection requires dynamic routing capability (e.g. BGP) but few security mechanisms given that it merely extends a private network. Conversely, the Internet connection requires strong policy enforcement but no dynamic routing; a default route toward the Internet generally suffices.

Some organizations thus opt to deploy a standalone device to handle each connection at a branch office. The MPLS connection terminates to a branch-level router which supports BGP and offers flexible physical interface options. The Internet connection is typically an Ethernet hand-off which terminates to a low-end firewall. Both the router and the firewall are then typically interfaced with the internal LAN through one or more layer three switches running an IGP. This design is certainly functional and very flexible, however the initial cost of deploying three relatively expensive infrastructure devices in this manner can be prohibitive.

The solution we'll look at today is to move the firewall functionality into the router, so that both circuits terminate into the same device. This removes the requirement for a standalone firewall and the layer three switch, as one device performs all routing for the site. To support security policy enforcement, we'll use Cisco IOS' zone-based firewall feature. Note: The zone-based firewall feature requires a security license and relatively recent code to function properly. IOS 15.0(1)M7 was used in the lab for this article.

Assigning Security Zones

A security zone is a group of routed interfaces which are intended to be treated similarly from a security perspective. For example, if you have two redundant Internet connections from an edge router, both could be placed into a shared "untrusted" zone: It is irrelevant from a security perspective which is the primary connection and which is for failover. A connection into the internal network, however, would be assigned to a separate, trusted zone. Additional zones can also be created with levels of trust which might fall in between the two; for example, a guest wireless network or corporate extranet.

The topology below illustrates a design applicable to what was discussed above, employing three distinct security zones comprising five logical connections.

The three zones are:

Trusted - MPLS and internal LAN connections
Guest - Guest wireless
Internet - Internet connection

Continue reading · 13 comments

Mythbusters – Tech Field Day Edition

2012-01-30T01:01:38+00:00

Minimalist Mythbusters - Image by Joey Vestal

On today’s episode of Mythbusters, we look at Tech Field Day. The brainchild of Gestalt IT and Stephen Foskett, Tech Field Day gathers technical bloggers from all over the world and puts them in front of vendors for 2-4 hours at a time. Far from a normal presentation, the delegate bloggers get to ask tough questions and hear real answers about capabilities and concerns. In this episode, we will look at three myths commonly heard about Tech Field Day to see if they hold water. Remember, we don’t just tell the myths. We put them to the test.

Myth 1 – Tech Field Day Delegates Are Paid Vendor Shills

The number one most-repeated myth about Tech Field Day (TFD) by far. There are many that believe that the TFD delegates are simply brought to a vendor’s office and told what to write. The delegates are merely supposed to regurgitate the party line and “kiss up” to those providing funding for the trip. Supposedly, delegate’s posts must be approved by company PR before going up and being advertised to death to reinforce vendor PR.

Let’s look at this one. Firstly, the delegates aren’t paid. Yes, we have our travel and lodging costs taken care of by the vendors by way of Gestalt IT. But we don’t get a dime to come. In fact, some delegates must use vacation or personal days to attend. We get a good meal or a nice hotel bed, not a paycheck from Vendor X. It’s not all that uncommon for vendors to do this kind of thing for PR people and other types of bloggers. Would it make a difference if the delegates all paid their own way? Probably not. That’s because we aren’t shilling for the vendors. Delegates attending TFD are under no obligation to write only good things about the presenting sponsor companies. In fact, we’re under no obligation to write about anyone at all. I never wrote a post about Embrane, the embargoed presenter from Network Field Day 2. Why? Because I didn’t understand the technology well enough to do it justice. Just because they provided a portion of our meals and hotel room didn’t make me an indentured servant required to regurgitate platitudes about them. They do have a great product that has generated a lot of buzz in the industry. But I doubt I’ll get around to writing that post any time soon. You don’t even need to be a blogger to attend. There are delegates that have attended without any blog to their name. It just happens that the majority are known in the industry by their blogs. I’ve talked about my independence feelings before. You know that I have no compunction about telling things like I see them. My Infoblox review from TFD 5 was all that glowing. My Cisco review from Wireless Field Day 1 was critical. Coming from a CCIE, you figure that if I was going to shill for anyone, it’d be Cisco. But I don’t. And neither does anyone else as far as I know. There are plenty of firms out there that will write whatever they are told for far less than it costs to fly people to San Jose (or wherever). TFD delegates tell the truth about what they see and feel. That’s no myth.

Myth 1 – BUSTED

Myth 2 – TFD Delegates Only Come To Get Free Stuff

TFD delegates supposedly show up with hat in hand to get vendor handouts and other free stuff. They expect to get free items from every vendor and only write good things about those they give them the best stuff.

Um, what? Really? I started hearing this after Wireless Field Day 1. Why? Because a couple of the wireless vendors went out of their way and gave us evaluation units to test with. I was especially called out because I won an AirCheck unit from Fluke Networks. By the way, I gave that very same AirCheck away at the delegate dinner during Wireless Field Day 2. I hope Matthew Norwood (@matthewnorwood) gets more use from it that I did, and I trust that he won’t write nice things about me simply because I gave him something. Yes, it’s a fact that vendors at both Wireless Field Day events have given away products to the delegates. Yes, some vendors in the past have given away discounts codes or products. Guess what? That’s not the reason I go to Tech Field Day every chance I get. Sure, it’s nice to get your hands on equipment and put it through its paces. What about all the other companies that never give us anything other than a pen and notepad? Did they deserve a bad review for being cheapskates? Nothing could be further from the truth. Wireless companies are a bit of a deviation from the norm, since their equipment is all small and easily transported in a carry-on bag. It’s also fairly inexpensive (overall) for them to give away a $100 access point in order to let us review them and generate good blog posts about the equipment. How exactly would I transport a Nexus 7k switch? Would I have to check a Palo Alto firewall or could I put it in the over head bin? Some companies don’t lend themselves to having easy-to-provide evaluation equipment. But even if they did, giveaways are not a requirement of Tech Field Day. In fact, most of the time they happen without the knowledge of the event coordinators. But in the end, you should ask yourself a question about the delegates receiving evaluation equipment. Would you rather we not get anything to test out and put through its paces and then write about it? Or would you rather see us trying out best to break something and really give it a good evaluation before talking about it?

Myth 2 – BUSTED

Myth #3 – The Same People Go To Tech Field Day Each Time

You have to be one of the “cool kids” to get to go to Tech Field Day. The list isn’t really chosen democratically but instead the delegates are all just friends that get invited over and over again. The organizers are afraid to hear new voices and inherently distrust those that offer opinions different than the party line.

I’m going to use strong language this one time – this is a bunch of bullshit. There is no magical list of people that are “friends” and get to go every time. And remember, that statement is coming from someone that has been to four out of the last six Tech Field Day events. Every delegate is evaluated on their own merits and voted upon by the Tech Field Day community. Why? Because we evaluate technical ability as well as interaction capacity. There are people in this world that are insanely smart and afraid to ask questions. There are wonderfully social people that don’t have a lick of technical sense (these people tend to end up in management). Tech Field Day is about bringing in people that can comprehend Matthew Gast from Aerohive or Victor Shtrom from Ruckus when they start talking about a deep wireless rabbit hole. Those same people also need to be able to take what they’ve learned and put it down for everyone to see. That’s why we called the Tech Field Day attendees “delegates”. We stand as representatives for those in the technical community. We take questions from interested parties and forward them on to those that can answer them. We don’t shy away from being tough. Ask yourself a question: How many blogs do you read? Then ask yourself how often you read blogs from new bloggers. Once a week? Once every six months? Never? Blogging isn’t for everyone. Blogs get abandoned every day. People get busy and don’t post. They lose their passion for the subject. They just give up because they have no readers. So the people that do the most blogging and stick around tend to get the majority of the attention. People like Ivan Pepelnjak or Greg Ferro or Brad Casemore. You don’t have to agree with everything they say but you do have to admit that these folks have staying power. So, when it comes time for the vendors to start talking to people, naturally they want to talk to the people that the industry reads. That’s why it seems the same people get asked to come back to Tech Field Day each time. We try to add new blood all the time. People like Blake Krone and Derick Winkworth. But, the vendors also get a say in things. They feel uncomfortable when they see a delegate that no one has heard of before. Would take a chance on being judged by someone that you don’t know? It’s one thing to go into a TFD event knowing that I’m snarky. It’s something else entirely to find out that one of the delegates has a pathological hatred of your product and will never be convinced otherwise. Vendors don’t like taking those kinds of chances. The regular delegates at TFD events represent a kind of “known quantity” for vendors. They can predict how we think and what our reaction will be to things. It’s a reflection of our influence.

Myth 3 – BUSTED

Tom’s Take

For my own part in this, I can kind of explain my attendance at so many events. I’m a rock star at a very small VAR. I have to spend a lot of my time learning every technology. So while I don’t know MPLS as well as Ivan or wireless as well as Andrew von Nagy, I can hold my own in discussions about routing, switching, wireless, security, storage, voice, virtualization, video, or even comic books. As such, I can fill in pretty much anywhere. I fill many roles. I’ll never be the Michael Jordan of any one discipline, but I can be the (somewhat) quiet guy that plays a couple of roles and gets the job done. At Tech Field Day, I can play the network outside among wireless folks or I can be the firewall guy at a security event. This speaks to the heart of what Tech Field Day is all about. When you get different disciplines together to discuss things, you wind up with fun things like Fibre Channel over Ethernet (FCoE). I was even having discussions at WFD2 about routing protocols. I went from being the utility player to being the expert in short order. I never want to displace someone from going to Tech Field Day who might be more qualified than me, but I also welcome the chance to see how deep the rabbit hole of these technologies can go and I love the interaction with a great group of people. I won’t get to go to every Tech Field Day. The logistics don’t work out and there are great people that will go in front of me to events like Virtualization Field Day and Storage Field Day. But whenever the folks at Tech Field Day ask me to come, I can’t very well say no. I owe it to the people that read my blog to learn all I can and dispel as many myths as I can.

Disclaimer

This post has absolutely nothing to do with the Mythbusters televison program. I watch it and respect the talents and knowledge of the hosts. And those that get to meet them in person in the VIP section (I hate you Rocky Gregory).

Etymology-Man

2012-01-30T00:00:00+00:00

Amusement: Python and Netmasks

2012-01-29T21:20:00+00:00

As a network engineer, it's not uncommon for me to need to convert between hex and decimal. While I'm reasonably good at doing this in my head for smaller numbers, when it comes to deciphering stuff like higher TCP or UDP port numbers written in hex, I usually end up using the Python interpreter that's usually open somewhere on my machine. For me, the Python interpreter is the best general purpose calculator app I've found. Using the port number for Flash as an example:

jswan$ python

Python 2.7.2 (v2.7.2:8527427914a2, Jun 11 2011, 15:22:34)

[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin

Type "help", "copyright", "credits" or "license" for more information.

>>> 0x78f

1935

>>> hex(1935)

'0x78f'

The topic of numeric base conversions often makes my mind drift to every former networking instructor's pet topics, IPv4 subnetting. The other day, I started playing with using the Python interpreter to find network IDs, which is really easy as long as you're using hex:

>>> hex(0x0a0a0a25 & 0xffffffe0)

'0xa0a0a20'

This little snippet finds the bitwise-AND of 10.10.10.37 and 255.255.255.224, which as every up-and-coming CCNA knows is the network ID for that subnet: 10.10.10.32. Back when I was teaching Cisco classes full-time, I used to have a never-ending argument with another instructor about the fact that I didn't teach bitwise operations as part of subnetting: my position was that if all you are doing is solving subnet problems with your squishy human brain, you don't need to learn a bunch of truth tables when there are easier ways to do it in human memory. However, if you're writing code you actually do need to do bitwise operations.

Unfortunately most of us (me included) aren't wired for reading IPv4 addresses in hex. So I started wondering how little Python code I could use to calculate network IDs for IPv4 in dotted decimal. A little screwing around and I started wondering if I could fit the entire thing into a Twitter post. Here's what I came up with:

while 1:'.'.join([str(a&m)for a,m in zip([int(n)for n in raw_input('addr?').split('.')],[int(n)for n in raw_input('mask?').split('.')])])

Try it:

addr?1.1.1.37

mask?255.255.255.224

'1.1.1.32'

Now I realize this bit of code is neither particularly clever nor easy to read, which makes it bad code. But hey, it fits in a single tweet. It works by using one of Python's coolest features, the list comprehension. If we start with the innermost parts, it makes more sense:

[int(n) for n in raw_input('addr?').split('.')]

These two sections return lists of integers corresponding to the address and mask the user enters. For example:

[1,1,1,37]

[255,255,255,224]

Next, the "zip" function returns a list of tuples that pair corresponding entries in the two lists:

[(1, 255), (1, 255), (1, 255), (37, 224)]

Next, the outermost list comprehension performs a bitwise-AND of each tuple, returning the octets of our network ID in a new list:

[1,1,1,32]

Finally, the "join" method puts them back together into "1.1.1.32", and "while 1:" makes it a loop until you ctrl-c out of it.

Working with netmasks in CIDR notation is a bit more complicated, and requires more than one line of code--I'll save that for another post.

Interesting links (2012-01-29)

2012-01-29T13:09:39+00:00

Most interesting article in this batch: Ethernet Taps - Don't Get Me Started by Chris Marget, focusing on Ethernet taps: passive, active, aggregators, L1 switches ...

And here are the other interesting links I found in somewhat random order:

My Networking Beliefs

2012-01-29T11:51:54+00:00

Someone wrote me and asked "Greg, What do you believe is the future of Networking". Here is my (mostly) humorous response.

Network Dictionary – “Run That Up the Flagpole”

2012-01-29T11:29:33+00:00

Define "Run That Up the Flagpole"

Show 85 – Sponsored – The Span Port You Always Wanted – Gigamon

2012-01-27T19:27:02+00:00

In this Sponsored show we talk to Gigamon about " making the SPAN port what it always wanted to be". In short, Gigamon makes switch devices that allow for powerful ways to capture traffic from your network, then slice, dice and forward it. If you have ever had problem with "not enough SPAN ports" for packet capture, then take a look at this product. Show Agenda Overview of Gigamon Mid-stage startup; founded in 2004; all product built-in-the-USA; founders from network monitoring industry Bridge the gap between faster-and-flatter networks, and the growing demand for diverse monitoring, management and security tools Establish an out-of-band, pervasive fabric, connecting to the network mirror & SPAN ports, and intelligently delivering the right traffic to the right tool Sounds good, but how do you do that ? A range of systems from 1RU to 1Tb chassis Let's focus on a deployment of just one system (although they are all locally and remotely 'stackable') Traffic on SPAN/Mirror/TAP ports is delivered into the Gigamon Fabric on what we call a "network port" At wirespeed, the traffic is 'manipulated' using GigaVUE software with hardware acceleration "Manipulation" means duplication, slicing, filtering, masking, etc How is the "Manipulation" configured : using "FlowMapping" logic What is FlowMapping ? A L2/3/4 rules engine that overcomes the limitation of ingress and egress filtering Ingress : too much is dropped at the entry .. Good stuff could be lost Egress : too much could be dropped through oversubscription Flow Mapping sits in the heart of the system (and can span multiple systems) How complex / what type of rules can be written ? Very complex, multi-step boolean type decisions Multiple egress (multi-tool as we call it) so that single ingress traffic can go to multiple tools Are they fixed rules/definitions ? We support the L2/3/4 decision criteria Also allow for a set of User-Defined criteria to look for specific traffic characteristics How do you extend beyond a single system ? We offer stacking – to connect multiple system together over n x 10Gb trunks We offer tunneling – to allow systems in remote offices to be part of the central "stack" How do your customers use the systems ? Single-system deployments to smooth the migration from 1Gb to 10Gb To deliver longer and more predictable ROI for monitoring, management and security tools In Data Centers to centralize all monitoring/management system into one rack Service providers around the globe to support the growth of mobile devices What does a normal deployment look like with your technology ? Ranges from a single system to multiple systems stacked together to form one Visibility Fabric Easy/flexible to configure – Network ports and tool port Maps are built to establish the "mapping rules" of traffic on network ports to tool ports Central management from a single GUI system (Citrus) if required How does your solution get deployed in the Data Center ? End of row deployments Each end of row location has uplinks to top-of-rack swicthes GigaVUE devices are connected together using stacking All monitoring and management tools centrally located in one rack "Maps" are changed as needed to forward traffic from any server, any rack, any row to central tools You can also watch a presentation from Gigamon from TechFieldDay at Vimeo - Gigamon where they presented at Network Field Day in Otcober 2011. Thanks to Gigamon for sponsoring the Packet Pushers and sharing this content with the community. Contact You can follow them on twitter at http://twitter.com/gigamon or on the web at http://www.gigamon.com/

Using Underscores, Hyphens or CamelCase in Naming Standards

2012-01-27T17:05:32+00:00

I’ve been considering a small but vital problem in naming conventions in Networking. Namely, the use of underscores and hyphens in object names and devices. It’s a hot topic for argument when the time comes for corporate standards (and when Network Engineers have beverages in a public house). Now, I figure that there are three possible grammar options for making names - hyphens, underscore and CamelCase.

Prefix-Independent Convergence (PIC): Fixing the FIB bottleneck

2012-01-27T07:31:16+00:00

Did you rush to try OSPF Loop Free Alternate on a Cisco 7200 after reading my LFA blog post ... and disappointedly discovered that it only works on Cisco 7600? The reason is simple: while LFA does add feasible-successor-like behavior to OSPF, its primary mission is to improve RIB-to-FIB convergence time.