I Hate NAT! Or Do I…?

Posted on by
15

Thanks to Packet Pushers episode 43, it appears that I’m going to be known as Tom the Networking Nerd, the guy that hates NAT.  I suppose that’s as good as anything to be known for, and the trick to being a famous celebrity blogger is getting yourself a hook, like Apple Fanboy or General Grumpy Networking Guy.  I know that I made some pretty bold statements during the show, and while some of it may have been playing into a image, I’d like to take a few words to clarify my position on why I dislike NAT.

Network Address Translation goes all the way back to RFC 2663.  At its heart, it is simply a mechanism for modifying IP packets and the information in their headers when the cross a routed boundary.  As I said in my IPv6 presentation, I do really believe that basic NAT serves a purpose in a network.  As a protocol, NAT isn’t inherently bad or good.  Instead, it is the application of the protocol by people that colors it in my eyes.  Allow me to give an example that I feel is very similar to NAT: Bittorrent.  I think the Bittorrent is a very useful protocol for file downloading.  By using the number of users accessing a file to amplify the speed at which it is downloaded, it helps alleviate the effect of having thousands of people downloading a file at once.  It also has built-in error correction, as each file piece is hashed upon receipt.  It’s very useful for downloading large, error-prone files like Linux ISOs or even World of Warcraft patches.  However, Bittorrent has an evil side.  Since it is so useful for downloading large files or collections of files, it has been appropriated by the underground file sharing movement as a method for distributing movies, games, and applications less-than-legally.  The opponents of this activity say that Bittorrent encourages people to break the law, much in the same was the the motion picture industry argued that VCRs encouraged movie piracy back in the 1980’s.  The counter argument here is that Bittorrent isn’t good or bad, instead the intentions of the user must be taken into account.  I feel the same way about NAT.

NAT breaks things.  End-to-end communications between nodes are disrupted by NAT boundaries.  VoIP packets die when they hit NAT walls.  VPNs don’t particularly care for it either.  We’ve had to come up with things like STUN and ICE to workaround a workaround.  It’s getting embarrassing when you have to fix the fix that you put in place.  That’s not to say that NAT doesn’t have its good points, however.

NAT is great when two companies need to merge and have the same address space be in use during the transition.  NAT is a good idea if you need to obscure IP addresses for some reason.  Note that I didn’t say anything about securing them.  If you hear a security “expert” claim that NAT provides security, you have my explicit permission to beat them within an inch of their life.  Beyond a few cases, I think NAT has been used as a kind of “Internet duct tape” and has been stretched long past its original use case into something dastardly.  I realize that without RFC 1918 and Port Address Translation (PAT), we would have run out of IPv4 addresses long ago.  NAT has become a necessary tool in the IPv4 world, and I accept that.  However, the paradigm of NAT is started to be extended into IPv6 unecessarily.  That’s the part that I don’t agree with.

People are looking at IPv6 and wondering how to apply their IPv4 knowledge to it.  That in and of itself is nothing new.  When I was first learning how to do VoIP stuff, I used my networking background to assimilate new terms.  I used to say things like, “Oh! A calling search space is just like an access list.”  While it was great for me when I was just learning, I found out later than metaphor wasn’t quite accurate.  In much the same way, network engi…rock stars are starting to plan IPv6 deployments and they are looking for analogies for the IPv4 things they are used to.  When they don’t see things like NAT or RFC 1918, it makes IPv6 feel alien to them.  For proof of this, you need not look any further than RFC 1884 – site local addresses.  This was an idea to reserve fec0::/10 for use only within a specific site.  While link-local addressing has many uses, the idea of what amounts to RFC 1918 addresses for IPv6 is kind of silly.  Why not just use your IPv6 global addresses instead?  RFC 3879 thankfully removed site local addressing from our lexicon for the time being, until it was reintroduced again in RFC 4193 with a slighly different name.  The same thing happened (in my opinion) with NAT-PT.  People were looking for something they saw in IPv4 in IPv6 unnecessarily.

I feel that NAT in IPv6 will encourage laziness.  I know there is no such thing as infinite address space, but we’ve got enough address space right now to outlast this Internet and whatever the next revision is going to look like.  If we allow NAT64 to take hold in the networking world, we are giving our blessing to people to keep doing the same things they’ve been doing with IPv4 all over again.  It’s the networking equivalent of the famous Santayana quote, “Those who forget the past are doomed to repeat it.”  If we allow people to implement IPv6-as-IPv4, we aren’t going to do ourselves any favors.  Many of the non-address space related reasons to go to IPv6 evaporate when NAT is introduced.  We eliminate wonderful things like end-to-end communications solely for the sake of ease-of-configuration.  Bah, I say.

I’ve always been a proponent of building it right the first time.  Even if it takes a little long to learn how to do it, as long as the implementation is done correctly at the end everything will work out.  As an integrator, a large portion of my time is spent cleaning up after other people’s mistakes.  All too often in IT, we patch a problem and declare it “good enough” only to spend twice as long down the road fixing what we should have fixed the last time.  If we start using NAT unnecessarily in IPv6, it will come back to bite us down the road.  People will avoid using IPv6 internally because “it’s too much trouble”, and just use NAT64 to talk to the IPv6 Internet.  A lot of good work will have been for naught due to the laziness of some.

There are already a lot of v4-to-v6 transition mechanisms out there.  F5 is looking at using load balancers to do 4-to-6 translation.  Proxy servers can help.  Tunneling can be had in any flavor you want, even the much-hated Teredo protocol.  Incidentally, Teredo was developed because Microsoft needed a specification to get around…NAT boundaries.  If we absolutely need to do something other than the ideal of running dual stack, we can use some of the other mechanisms that have been devised that will allow us to transition to where we need to be rather than coming back to our old NAT kludge.

Tom’s Take

I once was able to work on a network that didn’t have NAT.  Globally routable IP addresses as far as the eye could see.  And yet, due to a voice implementation that didn’t have enough address space, NAT still came back to bite me in the ass over and over again.  You can see why that might make me grumpy.

In the end, I really don’t hate NAT as much as I might let on.  Yes, it’s a necessary evil in IPv4.  I don’t want people to keep using it as a crutch instead of designing proper networks with good security policies.  I want people to start thinking about IPv6 as a great new opportunity instead of thinking about it in the same old way.  If designers had kept thinking about phones in the same old way, we would never have gotten the iPhone or the Nexus S.  If computer designers had thought about portable PCs in the same old way, we wouldn’t have iPads or Galaxy Tabs or Chrome CR-48s.  I want to encourage people to solve problems with the new tools they have been given rather than falling back on broken ideas from the 90s.  I may not be as opposed to NAT64 if it had an expiration date.  Use it if you want, but be sure to have it out of your network no later than December 21, 2012 or the world will end.  I suppose I could live with that.  But it doesn’t mean I have to like NAT.

Nerd Tips – Broken Execution Association

Posted on by
2

Here’s a quick tip for those of you out there that might find yourself fighting off an offending virus or malware program that keeps coming back no matter what you try, such as Win 7 Antivirus 2011.  This particular program does have a little trick that it likes to pull in order to keep itself in memory.  When an executable file (EXE) is launched in the system, usually a set of keys in the registry are consulted to find out what to do with the file.  Most often, the file itself is run with a command string like “%1”, which calls the file.  The malware program inserts itself in front of the execution string, so that every time you try to launch a program to fight off the crapware, like Malwarebyte AntiMalware for instance, the virus just launches instead and reinfects your system.

Should you find yourself in this quandry, unable to launch the programs needed to disinfect yourself, take heart.  An old DOS trick can be used to get yourself right as rain.  In the old days, executable files came in a format other that EXE.  DOS used a file format of COM to execute simple little programs like COMMAND.COM or DOSSHELL.COM.  COM files were orginally simple, with very little code and no metadata in the header.  Likewise, when Windows 3.x was just a program executing on top of DOS, it preserved the executable format of the COM programs.  Fast forward to Windows 7, and you will see that this convention is still honored.  If you find yourself unable to launch REGEDIT.EXE or MBAM.EXE and instead keep launching the virus, do the following:

1.  Launch a command prompt (CMD.EXE or COMMAND.COM if necessary).  You might have to launch it as an administrator to make some changes to system files.

2.  Find the file you need to execute, like REGEDIT.EXE.

3.  Use the follwing command to rename the file: ren REGEDIT.EXE REGEDIT.COM


Sounds simple, eh?  You’ll find that when the file is displayed, it won’t have the neat icon it used to.  Instead, it will look like a generic DOS executable file.  That’s perfectly fine.  When you double-click the file to launch it, it will fire right up.   This is because the COM file association as an executable file format is usually not changed by the malware writers, since very few COM files are still used on modern systems.  Following these steps, you can get Malwarebytes to load and disinfect your system, bypassing the EXE file lockout.  Malwarebytes will even repair the EXE association for you, so when you reboot you’ll be back to normal.  Just remember to go back and rename the file you change to a COM file back to an EXE file.

As a disclaimer, this process doesn’t work 100% of the time, and if the malware writer was smart enough to screw up the COM file association, you’re doubly screwed.  Don’t go mucking around in your system registry changing things unless you know what your doing, since a screwed registry will really kill your system fast.  Use caution, logic, and if all else fails, find a systems rock star to help you out.

Note, I reference Malwarebytes as a removal tool not because of any consideration on their part, but instead because it just works.  I’ve installed the trial on many computers for people that tend to get infected over and over, and it really helps cut down on their infection rates.  Try it out, and don’t forget to buy it if you find it useful.  Every penny they get goes to help cut down on the amount of crap out there trying to infect your system over and over again.

Tech Movies

Posted on by
3

On occasion, a trending hashtag pops up on Twitter that I think is quite funny.  Today, it was #TechMovies.  However, I know that most people that follow me probably don’t care to listen to my inane ramblings about these kinds of things.  I’m pretty sure that if I gave it my all, I’d have about 2 followers by the end of the day.  In an effort to spare my followers the horrors that swim around in my mind, I decided instead to post my list to my blog.  Read ahead at your own peril…

Still here?  Okay, here come the #TechMovies:

A Root Bridge Too Far

A View to a TRILL

On Her Majesty’s Shared Secret Service

Event Split Horizon

SDLC Punk!

Friday the 0xd

Licesne to Kill -9

Fort httpd

The ’emerge world’ according to ARP (two for one)

BGP Neighbors

The Matrix “shutdown -r now”

DNS the Menace

The OS X 10.7 Lion King

SLAXers

Hard Route Target

Harry Potter and the Chamber of Enable Secrets

A League of Their PWN

Chitty Chitty ! !

DOS Bootdisk

Universal Image Soldier

Major Version League

ntop Gun

10 Fast 10 Furious

What About Microsoft Bob?

Visual BASIC Instinct

The EIGRP Sanction

Manos: Hands of Fate Sharing

Under Siege 2: Dark Fiber Territory

IPv6 for Enterprise Networks – Review

Posted on by
1

Unless you’ve been living in a cave with Tony Stark for the past several months, you are well aware that IPv6 is a reality that can’t be ignored by today’s networker.  Part of the issue affecting IPv6 adoption is the lack of good reading material.  Yes, there are mountains of RFCs out there that talk about IPv6 in nauseating detail.  However, these documents aren’t all that accessible for the average network rock star that is working 50 hours a week and doesn’t have time to pour over page after page of dry Internet-ese.  There have been some great posts about IPv6 for the common man from people like Jeremy Stretch and Chris Jones but there is a segment of the population that would rather read about the subject from a vendor source.  Enter Shannon McFarland and company:

IPv6 for Enterprise Networks Cover

Cisco Press graciously provided a copy of this book for my evaluation.  Clocking in at a svelte 361 pages, this tome has a great wealth of IPv6 information from a design perspective.  There are some code examples for your networking gear, but much of the discussion in this book revolves around IPv6 design and building your network right the first time.

Chapter 1 starts off the same way many network rock stars will start off pitching IPv6 to their company, with a discussion of the market drivers for IPv6 adoption.  Even though networking professionals know IPv6 is inevitable, the C-level executives will most likely need some additional convincing.  This chapter is great for them to hear about the reasons why IPv6 is necessary.  Chapter 2 is an overview of the Cisco hierarchical network design, now expanded to include IPv6 content.  If you’ve seen any network design documentation in the past decade, this should be a review for you.  Just note the IPv6 sections.

Chapter 3 starts the meat of the book.  This chapter discusses the coexistence mechanisms that you are likely to face when prepping your network, since we are going to need to run IPv4 alongside IPv6 no matter how much we might not want to.  Tunnels and NAT64 get some discussion, along with running IPv6 over MPLS.  Chapter 4 discusses the various network services that will need to be IPv6 aware to help run your network, such as OSPFv3 or BGP.  Great discussion is made about multicast, since multicast is such a crucial component in IPv6.  Chapter 5 is a short one, discussing the planning that one will need to go through for implementing an IPv6 infrastructure.  This is more of the paperwork and staging behind the scenes that might be boring, but in an enterprise is critical for painless IPv6 deployment.

Chapter 6 is the largest chapter and will most likely be where you spend most of your time.  This is a soup-to-nuts campus IPv6 deployment.  The authors analyze the deployment from three different perspectives, the dual stack (my favorite), the hybrid model that is useful for non-IPv6 applications, and the service block model, which allows you to bring IPv6 online in sections.  Every facet of your network is analyzed in this chapter, from VLANs to routing protocols to QoS and other network services.  If you are going to be deploying IPv6 in your network in the future, you’d do well to just dog ear Chapter 6 so you can turn back to it quickly.

Chapters 7 through 10 deal with specific cases of IPv6 deployment to support use-cases, such as virtualization, branch offices, datacenters, or remote access.  They exist so that you can quickly reference these scenarios as needed, since you may not need to worry about deployment of IPv6 in a datacenter in your environment for instance.  The authors do a wonderful job of explaining all the things you might need to take into account in your deployment of ancillary technologies, such as Microsoft protocols to be aware of or application requirements that may not necessarily be network dependent.

Chapter 11 is all about managing your shiny new IPv6 network through things like Netflow and SNMP.  Careful attention should be paid if you don’t want to find yourself chasing poltergeists in your network at 3 a.m. on a Sunday.  Chapter 12 gives you a great breakdown of parts and pieces that would be great to construct a lab to pilot your IPv6 implementation before unleashing it on your live network.  That way, IPv6 doesn’t call the Resume Generating Event (RGE) protcol.

Tom’s Take

I liked this book quite a bit.  There is a ton of good information to be found inside for all levels of network rock star, from those just learning about deploying IPv6 to the poor souls that find themselves mired in a remote access IPv6 deployment gone wrong.  With a big focus on proper network design, IPv6 for Enterprise Networks ensures that you don’t have to rebuild your IPv6-enabled network after a short time due to bad design decisions or compromises. Every scenario I’ve seen discussed concerning IPv6 deployment is laid out in clear language, with both pros and cons for deployment.  I highly recommend picking up this book as soon as you can so your journey down the IPv6 yellow brick road starts off smoothly and you can avoid the pitfalls before you encounter them.

As a bonus, if you are going to Cisco Live 2011 in Las Vegas, Shannon McFarland is giving a session based around this book, BRKRST-2301 Enterprise IPv6 deployment.  If you aren’t adverse to 8 a.m. sessions the morning after the Customer Appreciation Event you should sign up and check it out.  I plan on bringing my book so that Shannon can autograph it.  That way, I can claim I met him before he became a gigantic IPv6 rock star.

Laser Beam Eyes – My LASIK Experience

Posted on by
5

Just like any good nerd out there, I have vision issues.  While I’m capable of reading things close up, once you get past arm’s length it all gets blurry.  I wore glasses for a couple of years in middle school before switching to contact lenses for my primary form of vision correction.  Allow me to state for the record that I was the worst contact lens wearer imaginable.  30-day extended wear pairs would last me 8 months.  I left them in all the time, even when I slept.  The only time I wore glasses is when I couldn’t stand the contacts any longer, and that usually lasted about an hour because I couldn’t stand my glasses either.  I always wanted to be free of the plastic and glass I was forced to use to avoid bumping into large objects.

Enter laser vision correction, commonly referred to as LASIK.  I’d looked at getting it for several years, but I never looked too deeply.  I figured I’d get around to it sooner or later.  Last year, my eye doctor asked me if I’d ever considered getting LASIK.  It seems that having a stable prescription for a decade makes you a good candidate.  She did some preliminary tests in her office and found that my corneas were the proper thickness to perform the procedure.  And with that, I started investigating all the possibilities.  There are lots of different options out there for people that want to use the power of the almighty laser to fix vision issues.  Lucky enough for me, I fell into the category of “average”, meaning my prescription wasn’t too crazy to cause issues with the fixing my eyes.

For those not familiar with the process, the doctor essentially cuts a flap in your eye, peels back that flap, and uses the laser to correct your vision on the cornea itself.  In essence, the doctor is creating a permanent contact lens for your eye.  No need to take it out every night and wash it, or worry about losing it in the ocean.  Always there, always correcting your vision.  After chatting with a couple of different doctors, I settled on Dr. Gary Wilson at ClearSight Center.  His plan seemed to meet my needs and wasn’t over priced.  While I was willing to spend whatever it took to make sure I could see at the end of the procedure, I also didn’t want to break the bank on useless add-ons.

The pre-op appointments were pretty standard.  The measured my eyes and double-checked my prescription.  They told me that I would need to have my glasses on for at least two weeks, since the eyeball needs to settle back into a normal shape if you are a long-term contact wearer.  Seems contacts deform the eye slightly.  Once I had my contacts out for the requisite two weeks, there were a few last minute checks and I thought I was off and running.  Except…since Dr. Wilson is the only eye surgeon at the center, if he’s sick the whole operation shuts down.  And since Dr. Wilson caught a bit of a stomach bug, my surgery was off the table for its original date, April 15th.  A reschedule for the following Tuesday was also met with disappointment, as Dr. Wilson was still not quite up to surgery.  As I would rather have my eye doctor performing at full capacity, I rescheduled for April 26th.  As a side note to you network people out there, this goes to show that a one-person operation can be a disaster when that one person is unavailable for any reason.  Spread out your knowledge so that having a single person down doesn’t mean having your whole business down.

Surgery day started out a little nerve wracking.  I had to fill out a few forms, including writing out a paragraph of an agreement long hand.  It had been so long since I’ve written anything in cursive I almost forgot how to write.  After the forms were filled out, the waiting began.  It took about an hour before they were ready for me.  After stepping back into the operating area, I was given a sexy shower cap to wear on my head and cool shoe covers as well.  I asked for one of those peek-a-boo hospital gowns but was met with blank stares and shivers of revulsion.  Then, the eyedrops started.  Antibiotic drops, anesthetic drops, drops to clear my redness.  All in all, I think I had eight different eyedrops administered over the course of the next twenty minutes.  Not just a drop or two either.  It felt like Niagara Falls splashing against my face.  I also got to take a steroid to aid the healing process and two different anti-anxiety medications to keep me from being jittery.  Not that they helped totally, as the idea of having my eyes operated on coupled with the hosptial-like atmosphere (not my favorite of places) lead me to have a small panic attack right before I went back.  Thankfully, the nurse was right there with a 7-UP and package of delicious crackers.  Maybe the crackers had Valium hidden in them…

Once the doctor was ready, it was showtime.  I walked back into the room and laid down on what was essentially a massage table.  I fit my head back into the little headrest and the doctor and nurses explained the procedure to me.  All I really had to do was stare straight ahead and follow a little light.  Easy, right?  After taping my left eye shut to prevent me from getting hurt by errant laser blasts, the doctor placed a device over my right eye. This was basically the most uncomfortable portion of the procedure, as it felt someone was pressing down on my eye for about thirty seconds, during which time everything was black.  What was happening was the device was creating the flap on my eye, slicing off a section of my cornea.  I elected to go with a bladeless cornea cut, as the idea of having someone put a razor blade close to my eyeball wasn’t pleasant.  Once the flap was created, the device was removed and my vision returned.  I then had to stare at a green light over my head so the laser could get a reference point for my eyeball.  There was a tracking system positioned around my head so that if my eye twitched even slightly, the laser would shut off instantly to prevent damage. Not that it was entirely necessary, as the amount of medication I’d been subjected to made sure my eyes didn’t twitch.  The doctor warned me that my vision was about to get very blurry.  Boy, he wasn’t kidding.  Like, fifteen beers blurry.  The green light I was supposed to be staring at went from looking like a pinpoint to a whole constellation.  This was due to the doctor flipping my cornea flap up to laser my eye.  Once ready, a 9-second laser burst was all it took to correct 20 years of bad vision.  The chemical smell in the air from the laser light being produced smelled like burning hair, but I tried not to think about it as I stared at the green constellation of lights above me.  Nine seconds later, the doctor flipped my cornea flap back down and smoothed it out with a little plastic tool.  As my eyeball was numbed to the point of barely existing at that point, it was a little surreal to watch him touch my eye with something that I couldn’t feel.  He made me close my eye and taped it shut so he could move on to the left eye, since I had elected to have them both done at once.  The left eye required an eleven second laser burst, due to a slight amount of astigmatism.  Afterwards, my eyes were rinsed out with some saline solution, and I stood up for the first time in twenty years able to see without glasses or contacts.

The post-op was fairly uneventful.  I was informed I shouldn’t read or use a computer for about 24 hours.  I should only watch TV and try to take as many naps as I could so my eyes would start healing.  I was given a regimen of eye drops to take four times daily to help prevent infection.  I was told that any time I felt my eyes getting dry, I should use artificial tears to keep them wet and lubricated.  Other than that, it was pretty easy compared to other post-op instructions I’ve heard.

Tom’s Take

Overall, LASIK was a great success for me.  Twenty-four hours later my vision was 20/16, which is a step better than the average person.  I know that over the course of the next few months the healing process will cause my vision to fluctuate some.  As long as I end up with 20/20, I’ll be damn happy.  I haven’t tried to drive at night yet, so I’m not sure of the effects of night halos around light sources.  I can say that I’m a little more sensitive to sunshine.  It’s not painful, but I do notice the sun being a lot brighter than usual outside.  I hope that the next few months will prove to be as good as the last forty eight hours.

If you are a good candidate for LASIK, I highly recommend the procedure.  The ability to not worry about glasses or contacts when you wake up in the morning is more than worth it.  There was no pain at all, and the procedure was the epitome of fast and easy.  There is no reason why everyone shouldn’t enjoy the fruits of modern technology like this.

The (Trendy) Games People Play

Posted on by
Reply

A few weeks ago, Twitter decided to push out an update to the iOS client software that helped them better monitize their service.  The quick bar at the top of the window that has now become infamously known as the “Dick Bar” forced me to look at all the trending topics on Twitter at the present time.  I don’t normally care for the junk that starts trending on Twitter, and after taking a good look at some of the inane things that kept popping up, I thought I was going to go insane.  It was right then and there that I had to take drastic measures to restore my sanity.

My distaste for Network Address Translation (NAT) is no secret to the people that follow me on Twitter.  That in and of itself could be a whole series of blog posts.  Instead, I decided to take my hatred of all things NAT and combine it with a trending hashtag in an attempt to have a little fun with things.  Usually, the hashtags I pick are simple questions or statements.  I figure by tacking on something about NAT, I’ll either confuse the non-network rock star people on Twitter or get a few laughs out of my followers.  Either way, it keeps me from doing more devious things in my insanity.  As such, some examples of what I have come up with so far:

#ifitwasuptome NAT would require an advanced feature license. That way, if you really want to use it, it’s gonna cost you.

NAT is a really bad idea. #SixWordFact

#saynoto NAT. It’s a gateway drug that leads to NAT-on-a-stick, policy-based NAT, and worst of all carrier-grade NAT.

As you can see, a seemingly innocuous hashtag has been corrupted for my crusade against the WD-40 of the network world.  WD-40 because if the packets are stuck on an RFC 1918 network, NAT helps get them unstuck.  I plan on having a lot more fun with this game.  I’ll even start adding in more topics, like IPv4.  If you have suggestions, don’t hesitate to shout them out.  If nothing else, it’ll help make Twitter a little more sensible for those of us in the networking profession.

Live with the Nerd – My Cisco Live 2011 Schedule

Posted on by
1

Since my friend Jeff posted his Cisco Live schedule, I thought I’d do the same so you could see what I’m going to be interested in when I get to Las Vegas in July.

SaturdayArrive at the Mandalay Bay in Las Vegas

Sunday
4:30 PM
6:00 PM
 GENCOL-1001 Collaboration Welcome Session
6:30 PM
8:30 PM
 GENCOL-1002 Collaboration Welcome Reception
Monday
8:00 AM
9:30 AM
 CUG-4663 IP Communications Product Direction
10:00 AM
11:30 AM
 CUG-4665 Unified Communications and Messaging Product Direction
12:30 PM
2:30 PM
 BRKUCC-2006 SIP Trunk design and deployment in Enterprise UC networks
Tuesday
8:00 AM
9:30 AM
 BRKEVT-3304 Advanced CUCM – Tandberg Call Control Troubleshooting
10:00 AM
11:30 AM
 Conference Event GENKEY-4700 Keynote and Welcome Address
12:30 PM
2:30 PM
 BRKNMS-2035 Ten Cool LMS Tricks to Better Manage Your Network
Wednesday
8:00 AM
10:00 AM
 BRKUCC-3000 Advanced Dial Plan Design for Unified Communications Networks
10:30 AM
11:30 AM
 Conference Event GENKEY-4701 Cisco Technology Keynote
12:30 PM
2:30 PM
 BRKUCC-1903 Migration and Co-Existence Strategy for Unified Communications (UC) or Collaboration Applications on Unified Computing Systems (UCS)
Thursday
8:00 AM
10:00 AM
 BRKRST-2301 Enterprise IPv6 Deployment
2:30 PM
3:30 PM
 Conference Event GENKEY-4702 Closing Keynote: William Shatner
4:00 PM
5:30 PM
 BRKUCC-2061 IPv6 in Enterprise Unified Communications Networks


As you can see, I’m going to be spending a lot of my time with voice and IPv6.  Voice is because that’s what I spend most of my time doing nowadays.  IPv6 because that’s what I expect to be spending most of my time doing fairly soon.  Plus, with all the IPv6 talk on Packet Pushers, I’m going to need to stay on the cutting edge if I want to be able to hold a conversation.

A couple of highlights:

– The sessions on Monday with a “CUG” are for the Cisco Collaboration Users Group.  This is a great program that I’ve been involved in for the past couple of years that allows me to have a say in the direction of the product lines in Cisco’s collaboration space.  It also gives me the opportunity to interact directly with the business units (BUs) and get early access to beta programs.  If you aren’t already a member of the Collaboration Users Group, head over to their site and sign up now.  You’ll get access to a great group of people focused on collaboration, and if you play your cards right, maybe even an invitation to a kick-ass part on Monday night!

– BRKUCC-1903 is a class about migrating CUCM from any 4.x or newer version to the current version (8.5 as of right now).  It’s taught by Brandon Ta, who is one of the smartest people I’ve ever talked to.  He knows the ins and outs of CUCM like no one else.  His migration strategies and recommended tools have saved me so much time in the past on the migrations I’ve had to do.  He also gives tips on Unity/Unity Connection, IPCC, and Presence, so don’t hesitate to sign up if you’ve got one of these migrations coming up soon.

If you’re headed to Cisco Live, make sure to hop on over to Dane DeValcourt’s Cisco Live Twitter page and check out all the tweeps that are going to be putting in an appearance.  There’s already a great list of networking people that have affirmed they are attending.  Make sure to let him know if you’re going as well so he can put your name on the list.

My Thoughts on IOU-For-Learning

Posted on by
Reply

This week, Learning@Cisco announced a new program designed to help those people out there that want a virtualized router platform upon which to study for the CCNA and CCNP.  While the idea behind an emulated IOS platform is one that has been desired for a long time, what Cisco released today isn’t quite what we’ve been clamoring for.  The new programs use the now-famous IOS on Unix (IOU) setup that has been used internally at Cisco for a while now and was made famous by Jeremy Gaddis in this post.  This is also the same platform that is used in the troubleshooting section of the CCIE Routing & Switching Lab.

The new program is completely hosted by Cisco.  All of your access to the IOU environment is done via web and SSH.  You, as the end user, have no access to the files that comprise IOU.  Since the emulator is presented as a component of a learning package, there is no opportunity to modify the topologies presented.  They are canned and align with the courseware you purchase.  This is great for people that are just starting out in the networking world that have no access to the proper gear to learn how to enable telnet sessions and address an interface.  By limiting the access you have to a topology, you get rid of some of the confusion that surrounds tools such as GNS3, namely the dearth of options that tend to confuse the first-time users.

I have a couple of problems with what Cisco’s released so far:

1.  IOU isn’t a true layer 2 emulator.  The software that comprises IOU is great at simulating IOS running on a router.  That’s because it’s essentially an IOS image that has been modified to run on a different “hardware” platform.  So long as all you are worried about is working with routers, IOU is a great resource.  However, if you really want to dive into the second layer of the OSI model, you’re going to come up short rather quickly.  Basic layer 2 configuration is fine for a CCENT/CCNA type of student, but by the time you reach the CCNP level of switching, you’re going to find the interface of IOU wholly unsuitable.  Since IOU emulates a router, it has to emulate switching as it would be on a router with an ESM switch module.  That means that anything that relies on an ASIC to function, such as QoS, is right out the window.  Which means that some of the more esoteric and hard-to-learn parts of using IOS on a switch remain off-limits.  I’ve been able to use 16-port switching modules in GNS3 to emulate switches for some of my studies, but I quickly reached the limits of this configuration with things like advanced spanning tree configuration or specialized tasks like Storm Control.  I think that Cisco needs to put a little more effort into providing an emulated environment for switching.  Finding a way to emulate the ASICs of the QoS functions would make those learning VoIP QoS on 3560/3750 switches much happier.

2.  There’s still no proof-of-concept for engineers.  As luck would have it, I have a small lab at $employer to test some of the things customers ask me about.  It’s been cobbled together with bits and pieces of cast off equipment over the years.  Where I run into trouble are those cases where the customer has a setup that I can’t quite reconstruct with the equipment I have.  What would be nice is a kind of emulation environment that allows me to reconstruct this setup quickly.  This is the perfect scenario for something like IOU.  Being able to quickly reconstruct a customer’s environment or duplicate your own environment for things like change control and internal testing would be a dynamite idea.  By utilizing a Cisco UCS cluster with the right topology files, I could have my WAN configuration duplicated and run several sample configs for maintenance window changes quickly with the capability to roll them back if something horrible breaks.  That’s where the true power of having an emulator lies for the advanced engineer.

3.  Strict control of IOU cuts out the “gray market”.  It’s no big shock that Cisco has taken the stance with the 360 Program that you’re either with us or you’re the “gray market”.  Vendors like Internetwork Expert (INE) and IPExpert have their own courseware and rack space designed to aid their students.  These racks use real routers and switches to allow students the ability to do practical studying.  However, these kinds of study aids are prohibitively expensive for a training provider to get into.  Now, imagine if you could fire up and virtual rack of routers and switches for your students at the touch of a button.  The barrier to entry becomes much lower to those companies wishing to get involved in the training market.  The possibility then exists that you could have some bad apples in the bunch that might dilute the training offered to students and put a black mark against your name.  By holding all the cards in the IOU discussion, Cisco ensures that the technology never leaves their house, so any training partners wishing to leverage the power behind the emulated IOS platform must abide by Cisco’s rules if they want to keep playing.  Cisco can then force training partners to use 360 materials or the equivalent for CCNP/CCNA/CCENT training.  That forces the non-Cisco approved partners out of the space sooner rather than later.

Tom’s Take

Cisco’s getting to the educational platform party ahead of some of the other network vendors, like HP and Juniper, but they’re doing it with baby steps.  High level engineers have been hoping for a truly unlimited emulator for testing things for quite a while now.  I think they’re still going to be waiting for a while to come.  This new learning program is leveraging IOU to replace aging programs like the Boson Network Simulator or the NetSim products.  By tailoring it toward the entry-to-mid learner, it allows them to work out the kinks in the presentation while still keeping control over the platform for the time being.  I’ve heard that they will expand this idea to encompass security offerings and one day the CCIE as well.  I think that the IOU Learning Platform will be integrated into the 360 program and will only be offered as a part of the materials that you receive from your subscription to it.  I seriously doubt that even a CCIE-level student will have unfettered access to IOU in their own lab, since the possibility of a non-crippled version of IOU being readily available creates too many complications for Cisco support.  It’s already fairly easy to get a copy of IOU if you know where to look.  Imagine what would happen if a copy from a CCIE candidate got out into the wild without fixed configurations or limitations that you face in the hosted CCNA version?  I applaud Cisco for the steps they’ve taken in the right direction for allowing students access to emulated educational software.  Now it’s time to observe what happens and meet the needs of those of us on the other end of the scale.

If you think that Cisco needs to offer a full IOS platform for educational purposes, please head over to Greg Ferro’s site and put your digital signature on the educational IOS petition.  The more signatures that are gathered, the more pressure that can be brought to bear on Cisco to show them the will of the engineer.

Why the Flip Didn’t Fail

Posted on by
7

Cisco announced today that it is restructuring its consumer line of products and closing down the Flip business.  R.I.P Flip, it appears.  The Twitter is alive with the sound of people commenting about this move, ranging from “Wait…what?” to what I think are the sounds of champagne corks popping and party music popping up all over.  To many of my peers, Flip represented all that was wrong with Cisco’s decision to get in front of a new perceived market transition toward consumerization and video.  By chasing the golden calf of Flip, Cisco deserted their core business and alienated customers towards alternatives, such as HP and Juniper, or so this line of thinking goes.  These people will now point to the retirement of the Flip brand and say that they were right and that Cisco needs to kill off the other consumer products and get back to what the do best: moving packets around as fast as possible.  Not the Flip was entirely bad.  It made for a great line of door prizes to be handed out by Cisco people at the events I attended.

I’m going to take a slightly different line of reasoning here.  I don’t think Cisco failed with the Flip.  I don’t consider something to be a failure so long as you learned something from it.  Apollo 13 wasn’t a failed moon landing.  It was a successful astronaut rescue.  We learned how to think on the fly when the pressure was on and bring people home safely when it counted.  In a slightly different way, I think Cisco learned a lot about what went wrong with the Flip and dissecting it over the coming months should yield a lot of information about how to avoid things like this in the future.

– Consumers don’t care about gadgets. Bold statement from someone that has both Fruit Company Mobile devices on his desk, right?  Funny thing about consumers is that they don’t really want a separate phone, still camera, video camera, and GPS receiver in their pocket.  If they can get all that functionality in one device, they’ll do it.  Even if it means that they won’t have the Super Whiz-bang 1080pqrstu Video.  I still have an iPhone 3GS, which was the first model to include video.  I don’t use the video camera all that much, only in cases where it’s convenient.  Others tend to use the video camera for anything and everything.  I don’t own a separate GPS receiver, I use Google Maps on my phone.  I don’t carry a point-and-shoot camera any more, I use my phone.  The ubiquity of having a video camera built into your phone has really hurt the low-end fixed-focus video market.  Not just Flip, but Kodak and others have really been pinched because people are now looking at buying a $200 video camera and saying to themselves “Why bother?  I’ve already got one on my phone that works almost as well.”  I figured Flip was headed for hard times when I saw many of the HD models on sale at deep discounts at my local office supply store.  Reducing inventory means they aren’t flying off the shelves like you wanted.

– Consumers want to do something with content. Once upon a time, people used to shoot video of their kids and then copy the tape and send it to Grandma and Grandpa for hours of watching over and over again.  Now, we just post it all to Youtube/Vimeo/Facebook and tell Grandma to check it out there.  In a world where Cisco says everyone wants video, people tend to fall back on these outlets to let the world know about what you have to say.  I do it myself.  My kids riding a bike for the first time? Facebook.  My first ride on a Segway? Youtube.  My IPv6 Presentation? Vimeo.  I want to share things with people.  Rather than coming up with a new and unique hardware device to capture these moments, what Cisco needs to do is focus on a way to expedite sharing this content.  Other than having a button that says “Upload to Youtube”, do you know how hard it is to get video off of a Fruit Company Mobile Device?  Not that easy.  iMovie exists to edit videos on these devices because they are such a captive platform.  Once you’ve edited the movie how you’d like it, you just upload it to the content aggregator of choice.  Imagine, though, that you want to share this content with someone and not necessarily have to send them to Youtube.  That’s where Cisco Digital Media Manager needs to come more into play.  By allowing consumers to upload content to a…cloud-based version that can then be pushed down to a local digital signage endpoint.  Think of a school where users want to take video of a football game or a band concert and make short clips available at signage endpoints in the common areas.  How would you do that seemlessly today?  You’d have to force people to go to Youtube and play the video instead of making it instantly available at their fingertips.  Concentrate on writing the middleware to make the sharing process invisible to users, and I promise you’ll make more money than you would with another hardware device.

– People want to use hardware as they want. This is probably the biggest gripe about Flip to me.  Shop the Flip accessories page (while you can).  What do you find?  Cables and tripods and image designers to make skins for your camera.  Where’s the external Bluetooth microphone so my presentations don’t sound like they’re in a tin can?  How about different lens options besides the single wide-angle one?  How about a wireless option to allow me to NOT have to plug my camera in every time I want to offload a video or I simply want to upload it to Youtube?  That last one is where the Flip really missed the boat.  People constantly complain that Apple won’t allow them to wirelessly sync their Mobile Devices.  They would much prefer just hitting a button once you were within range to synchronize everything.  Now think about the Flip.  If I want to upload the cute video of my kids being chased by the AFLAC duck, I need to break out my laptop, download the video from my camera, find a wireless hotspot, and then upload that video to Youtube.  How would I do that on my phone?  Take video, push “Upload to Youtube”, done.  Quick and easy.  I didn’t need to think about how to accomplish the task, I just did it and let the hardware sort it out.  I have no doubt that Cisco would have eventually released a wireless Flip.  And I would have loved to have bought one.  It would have allowed me much more freedom to do things I wanted with my videos.

Tom’s Take

The Flip ultimately didn’t fail.  In my mind, the umi was a much bigger failure in terms of R&D-to-revenue.  Flip taught Cisco that the consumer market is a dog-eat-dog world of products made by the lowest bidder and people too focused on getting the most bang for their buck to care about cutesy things like graphics skins.  A few years ago, the Flip might have succeeded to the point of driving a different kind of video revolution.  Instead, Cisco tried to jump ahead of the transition and guessed wrong.  Rather than trying to provide the hardware to drive the transition, create the software to take advantage of it.  Integration is more important that manufacturing.  Think about the coup you could pull off if you could integrate Apple Facetime with CUCM or Telepresence.  That’s where Cisco needs to be headed, not to plastic video cameras.  Just as long as Cisco learns from what happened with Flip, it will never truly be a failure.

Any Transport over Unicorn (AToU)

Posted on by
5

I spent most of my Friday assisting a fellow engineer with a curious issue.  Packets were being sent from one network to a default gateway on a totally different subnet.  Efforts to investigate the issue turned out to be mostly futile.  Due to a strange interaction of proxy ARP and a dying router bridging network segments, I was frazzled to the limit of my patience.  Then the customer asked me what was going on.  Rather than admit that this networking problem had me baffled, I came up with something that I hoped explained my consternation:

“Your packets are being ferried to the Internet by unicorns.”

Now, my friend Greg Ferro is fond of saying that certain “magical” technologies must be powered by Unicorn Tears™, so when it came time for me to tell this non-technical person how the packets were jumping from one subnet to a gateway on another, I knew the only explanation that made sense involved those single-horned mythical creatures loading the packets up and carrying them across the network.  It sufficed for the time being until I could actually resolve the problem by shutting down the dying router and tossing it into a river.  Plus, the look of utter shock on my co-worker’s face when I explained the issue was worth the price of admission.

Afterwards, I started thinking that you could use unicorns to transport all kinds of protocols.  IPX/SPX, Appletalk, even SNA.  Once you get the right kind of unicorn trained to ferry IPX, for example, you just point him to the right stable (gateway) and off he goes.  He should be able to carry large payloads quickly and efficiently.  As well, since unicorns are mythical creatures, there’s no need to worry about encryption, since people can’t see them anyway.  If you could build up an entire herd of unicorns, you could be capable of transporting massive amounts of data at once.  I’m not sure what unicorns eat, but being mythical creatures means they shouldn’t eat too much.  Then there’s the issue of having lots of stars and glitter all over the floor of your data center.  But I think that’s a small price to pay for the advantage of such a fabulous transport method.