Starting a new series

Posted on by

Hi all,

I’ve got my next general post entitled “Where have all the Integrators gone?” nearly ready to go but I’m going to start a new series that is as much training as it is Blog based around the vendors’ kit that I most like to use and endorse. Most of my last 15 years in the IT field have been spent working around Networking and Unified Communications so they are the areas I’m going to focus on with an emphasis on kit that I like and why I like it. If you would like to know why I use and endorse the following vendors:

  • HP
  • Mitel
  • SonicWall
  • Fortinet
  • Riverbed
  • F5
  • MS Exchange Unified Messaging
  • Procera

Keep watching. Where practicable, I will also post some training information and videos as well; at this stage I only plan to do this for HP (since I’ve already written a course syllabus and I have most of the kit necessary to show demonstrations) but we’ll see how it goes…

About these ads

Some background on HP Networking

Posted on by

I’ve made no secret that I’m a big fan of HP Networking. I like to thing that my belief in their product is based on positive experience and positive results under numerous deployment circumstances (ranging from small business to major government and university campus deployments I’ve been involved with). I believe most particularly that they have had the best edge switches on the market for a decade now and have become a solid player in the distribution and core layers of the LAN over the last 5 years.

One thing that frustrates me though is the impossibility of finding out information about HP networking that is not strictly technical. Their product information and documentation is probably the best around and their engineering training is also first rate. Trying to find out about the history of HP Networking is a something that’s a lot more difficult to turn up. HP has either been on the IETF committee for or invented some of the most significant aspects of Later-2 networking but for some reason they don’t seem to like to talk about it.

Anyway, I pumped one of my sources at HP and got the following out of them. I’m sure that there will be more to come (which I will append to this post) once their more experienced colleagues read this.

The HP Networking story

Throughout its long history, HP has distinguished itself as one of the most innovative and accomplished companies in the computing industry. From electronic test instruments and calculators to large and small computer systems, printers, and networking technologies, HP has led the way.

In the early 1980s, HP opened the doors on its networking business in Roseville, California. HP’s networking division focused on providing advanced, competitive, and timely technology to give its customers reliable and compelling value.

In 1987, HP development engineers invented key elements of 10Base-T, and drove the twisted pair standard that helped promote Ethernet to commercial viability by enabling it to run on low-cost telephone wiring already installed in commercial buildings — and the networking market took off.

Other important innovations from HP followed, including the industry’s first stackable 10Base-T hubs in 1990.

HP quickly became a leader in 10/100Base-T Ethernet switches, and in 1998 the HP ProCurve 4000 series switch broke below the $100 per port 10/100 price barrier.

In 1998, HP’s networking division became ProCurve Networking.

By 2003, ProCurve Networking became the second-largest global enterprise networking vendor in terms of revenue and ports (both PoE and non-PoE). According to Dell’Oro, the Ethernet switching market has grown by 76 percent between 2000 and 2010, while HP Networking has grown by more than twice that, with 166 percent growth over the same period.

In 1998, HP recognized that traditional networks with expensive, complex core devices surrounded by less expensive and less sophisticated access devices couldn’t support the performance, security, and multimedia application requirements coming to the network. Thus, HP created the HP Adaptive EDGE Architecture (AEA), which was introduced in 2000. This revolutionary (for the time) architectural model recognized that network device intelligence needed to be distributed throughout the network, including at the network edge. HP AEA became the architectural root of what has evolved into the HP FlexNetwork Architecture; and has been embodied in every networking product as well as every generation of HP custom-designed networking ASIC (application-specific integrated circuit) since 1998.

There you have it for now. That’s maybe 10% of the history of what is the world’s second largest networking company that should be accessible on The Internet.

 

P.S. The information on Wikipedia (http://en.wikipedia.org/wiki/HP_Networking and http://en.wikipedia.org/wiki/ProCurve) is awful. The official HP History site (http://www8.hp.com/us/en/hp-information/about-hp/history/history.html) barely mentions networking at all

And speaking of Green IT…

Posted on by

I wrote a post last year about Green IT (http://dancingbear.com.au/2012/02/13/does-cisco-hate-the-environment/) where I discussed how Cisco has been pumping more power into  devices rather than looking to make them more efficient. Since I’m doing comparisons (and I openly admit I am less familiar with the power consumption of offerings from Brocade, Extreme, Juniper, etc.) I thought I would throw a few Data Center numbers up. The information I have comes from the vendors and – I believe – has been independently validated by Miercom (NB: I was going to include the venerable Cat6500 switch as it is still being sold and heavily promoted but since it can only deliver a maximum of 176 10GbE ports and would demand around 10KW of power to fire up I left it out) :

Top of Rack Switches

Top of Rack Switches Cisco Nexus 5548 v. HP 5900

 

Cisco Nexus 7000 v. HP 10500
Core Switches – Cisco Nexus 7000 v. HP 10500

HP Networking – an introduction part 1 – the company

Posted on by

Let’s start with HP. This post will be more about the history of HP Networking and where I see its advantages lie. Even though I will touch upon some of the important technologies HP offers with their switching portfolio, I won’t go into much depth until my next post.

First, a brief history (go to http://www.hp.com/networking for the full story). HP is one of the key founders of modern networking along with companies like Cisco, IBM, Intel and 3com. Despite this, for a long time they were more focused on technologies than products.

As we moved into the 2000s, the networking world was somewhat static. 3Com – arguably the biggest player in enterprise Ethernet in the 90s – has pulled out of every market outside of Asia; IBM – the champions of Token Ring – had given up its networking portfolio and Intel had pretty much given up on making switches in favor of just producing NICs (along with CPUs, etc.). This left Cisco as the only big player and they built a dominant position in the business market that rivaled Novell’s position with NOSs in the early 90s.

HP was producing switches in the early 1990s but they weren’t really a core product; they were so low on the totem pole that they actually had to have their own separate R&D location from the rest of the company and reported into the printing group. There were even rumors around 2000 that the division was going to be sold off.

Fortunately, that didn’t happen and HP realised in the early 2000s that the advent of demands for technologies like VoIP, large high-speed wireless deployments and secure, managed networks offered an opportunity to build market share. This was particularly relevant as Cisco has been dominant so long that they weren’t really being pressed to introduce innovations, improvements in technology or reductions in cost to the market. HP jumped in offering all three of these and quickly moved to the #2 position as a network vendor globally; a position they have held since 2003 (and have been #1 in 10GbE networking since 2009).

HP’s earliest successes came in the education space (predominantly secondary schools). Their introduction of what is still the industry’s best switch warranty across their entire range of products coupled with their existing brand recognition (vis-a-vis their File Servers, PCs and Printers) and much lower cost than Cisco made them instantly attractive and they gained market dominance in many countries within this vertical.

Their next three major product leaps greatly related to the demand for VoIP and came out at roughly the same time. The first was the release of their 2600 series switches which provided all the technology necessary to deliver a robust VoIP deployment (i.e. PoE, QoS, VLANs and routing) at less than half the cost of Cisco. The second was the release of the ProVision 4 series ASIC with their 3500 and 5400 series switches which delivered GbE PoE, 10GbE and most of the advanced networking features that larger organisations demanded (such as dynamic routing, advanced security, etc.) with both superior performance and less power consumption than Cisco again at a far lower price. The last was their joint authoring (with Mitel) of the LLDP-MED standard which freed all switch and IP PABX vendors from the need to use Cisco’s proprietary protocols (CDP, CDP2) for the dynamic management of IP handets (a critical need as any engineer in the VoIP industry will attest to).

These technologies, coupled with the the reliability and price of their product led HP to build strong market share in many verticals but they still lacked a product set necessary to push into many large Enterprises. These clients demanded more complex technologies from their switches (even if they rarely if ever employed them); technologies like BGP4 routing; the ability to establish GRE tunnels and policy-based routing amongst others. HP’s focus had been on delivering fundamental networking services that the entire market required rather than on more complex services that tended to only be in use within data centers or large campuses.

In the late 2000s, Cisco introduced their UCS series of File Servers which signified another major industry change. Up to this time, Cisco hadn’t really paid much attention to HP as a networking player as their #2 status still put them a great distance away from #1 (market share charts at the time needed two scales for Networking vendors: 1 for Cisco and one for everyone else as otherwise they would not fit together!). Up until that point, Cisco and HP were strong partners in the DC space with Cisco switches being embedded in HP Modular Server arrays for both Ethernet and Storage networking. Cisco’s release of Enterprise-grade File Servers targeted directly at the DC was seen as a direct attack against what was one of HPs most important markets.

HP responded by making an aggressive move into the Enterprise networking space: they acquired the market leader of the 90s – 3Com. Throughout the 2000s, 3Com has quietly built up a switching and routing portfolio to nearly rival Cisco’s along with a major Asian market dominance. Further, 3Com’s switches offered all the advanced technologies that HP needed to directly target Cisco’s core customer base and unlike Cisco – who had become complacent in their switching R&D due to their lack of effective competition in their core markets of Europe and North America – 3Com (like HP) had been aggressively developing newer and better technologies to offer their customers.

The 3Com acquisition gave HP not only a network switch portfolio to rival Cisco but arguably switches that are class-for-class better (both in features and performance) than what Cisco has on offer. Cisco’s reliance on their venerable Catalyst class of switches (which were excellent switches but are now very outdated) meant that they had to do the unthinkable and acquire another switching company (Nexus) in order to keep up. Even this acquisition wasn’t a resounding success as the Nexus switches still don’t have the feature set of either HPs or even their own Catalyst switches which is one of the reasons why the uptake of Nexus has been so poor and why Cisco is keeping the Catalyst line alive despite its 15 year old roots. At the same time, HP extended their Lifetime switch warranty to all but the highest-end modular 3Com switches and still maintains a list price-point that can be as much as 50% lower than Cisco.

Some specific advantages that I have encountered in the enterprise space:

The ability to deliver 10GbE campus-grade MPLS/VPLS on sub-$10k switches (immensely important in University or large research center environments. Cisco can only deliver MPLS on their routers (and for 10GbE, BIG routers); C6500 or N7000 chassis at many times the price.

Switches with both deep packet buffers and bi-directional flow-control for iSCSI deployments (Cisco inexplicably removed flow-control when they they went from the 3650 to the 3750).

A Virtual Switch technology (IRF) common to the entire 3Com portfolio which allows up to 9 stackable or 4 modular switches to be fully consolidated into a single array which both allows all networking features to seamlessly span the array (such as link aggregation, routing, ACLs, etc) and can survive an outage of up to (n-(n-1)) switches when a “fat tree” deployment is used for uplink/server connectivity (e.g. in a stack of 8 switches, 7 could fail and connectivity and function would still be maintained even though performance would be degraded).

I’m not writing off Cisco. They still have the best Enterprise routers around, and they are definitely working on improving their switch portfolio but as the market stands right now, anyone weighing up features, reliability and price without paying attention to “brand recognition” would find it very hard to choose Cisco over HP for just about any size switch deployment.

Understanding Workplace Surveillance (or why you shouldn’t do that at work!)

Posted on by

The Sydney Morning Herald recently published an article about IT snooping people’s emails (http://www.smh.com.au/it-pro/business-it/email-snooping-it-admins-like-dracula-in-charge-of-the-blood-bank-20120413-1wxnu.html). Whilst I found this to be an interesting article, I don’t think they went far enough on the subject matter so I decided to expand on it a bit. I also think that the article was sponsored by Earthwave in order to sign people up to their services…:)

The focus on this article is thus Cyber-Surveillance.The immediate take away is don’t do anything on your work PCs that you consider personal or confidential.

When you started a job in almost any Australian workplace, you will almost certainly have signed some form of surveillance agreement which provides your employer the right to observe and audit your computer usage. This has been a requirement since Australia introduced some of the world’s most stringent privacy laws around 15 years ago. You will have signed the form because otherwise you wouldn’t have your job. That essentially means that you have granted your employer the rights to completely unrestricted surveillance of everything you do on their equipment. Everything. Every last thing.

Most people think that company surveillance is there to stop people from downloading Porn or copyrighted material but it goes much further than that. The main thing your employer is trying to prevent is “Data Leakage”. Data leakage refers to company data being transmitted away from the company without authorisation. This may include:

  • Emailing out company secrets
  • Copying company data on to removable media (USB drives, DVDs, etc.)
  • Transferring company data over The Internet
  • Installing unauthorised logging or surveillance software on one or more PCs

In order to this, they will monitor everything done on company equipment and there is nothing you can do that they can’t see. The following are the techniques that companies can (and probably will) use to to protect themselves from litigation or data loss:

  • End User Admission/Access Control
  • Proxy Log monitoring/reviewing
  • Random Email checks/keyword checks
  • Data Leak Protection
  • Direct Access
  • SSL Offload and Rewrite
  • Data Mining

Before I continue, I want to make it perfectly clear that I don’t think Australian employers are out to spy on their staff. Data leakage is a real problem for some companies; it’s not uncommon for someone trying to download the entire customer base and history before moving on to a competing company; and trade secrets are even more valuable. Browsing porn is not only wrong, it also opens up a company to sexual harassment lawsuits if someone else sees it and objects (that happened right at the start of my career and it cost a senior executive at one of Australia’s largest insurance companies his job, because he didn’t think the rules applied to him and liked his girly background). Finally, companies can be liable for illegal content being downloaded over their links or on to their equipment.

Let’s cover some of the different techniques that organisations use.

End User Admission/Access Control

EUA software is what has replaced traditional antivirus and is there to ensure that other techniques remain effective. Most security vendors offer software that allows the employer to ensure that staff don’t modify their PCs in any way. They introduce Antivirus, Firewall, Content Filtering and Data Leak Prevention (DLP) to the local PC. With correct configuration, the network will refuse the device access (or quarantine it) if the device’s EUA software is not up to date. EUA is more of a passive defense to ensure that other techniques remain effective.

Proxy Log monitoring/reviewing

In most organisations, absolutely all Internet activity is tracked and logged. Nothing you do on The Internet is secret and if you do something wrong, you will likely be caught. Logs are used with Data Mining techniques to discover patterns and wrong-doing.

Random Email checks/keyword checks

If you read the link at the top, you will know that IT has access to your Emails, beyond that – since the release of Microsoft Exchange 2010 – your team leader can be given the easy ability to search through all his team member’s emails. Nothing in Email is private, never ever send anything personal through work Email.

Data Leak Protection

DLP is a fairly new technique utilising both Firewalls and EUA to track and prevent sensitive information from leaving the company by using Data Mining and similar techniques. DLP will look for things like keywords, attachment sizes are other aspects to intercept and quarantine any suspect material before it leaves the company. DLP is extended through the use of EUA and Direct Access to ensure that it works at the workstation level as well as through the network and the servers.

Direct Access

Direct Access was introduced by Microsoft with Windows 7 to provide greater security and manageability to workstations. DA leverages tradition SSL (encrypted Internet access) to ensure that company devices can be monitored and managed whenever and wherever they are online. Before DA, people had to rely on cumbersome IPSec clients to connect through to the workplace and only used them when they needed them. DA does the same thing but it is embedded into the Operating System and is “always on”. This means that companies can enforce policies and surveillance whether the device is on-network or remote. It can be a pain to set up initially but it is one of the greatest innovations to system management in years.

SSL Offload and Rewrite

This is one of the latest techniques used and possibly one of the most insidious. People think that when they go to encrypted websites (https://whatever.com) are secure and private. Whilst this is essentially true, it may not be true when you are on a work PC. SSL offloading is not new, it’s been used for years to scan incoming traffic for threats. Modern Firewalls (or IPS units, load-balancers, proxies or similar) are able to strip off encryption and scan for threats before data hits their servers. Recently, security experts realised that the reverse could be used to survey encrypted user traffic. This requires the insertion of a certificate into the “Trusted Root Store” of the users’ PCs but its existence allows the company to seamlessly and tracelessly survey any encrypted traffic that goes through that PC. This includes Internet Banking so if you have used online banking at work, you might want to change your passwords since your employer may know it was well (not to mention your balances and transactions). There are some questions about the ethics of using these techniques but the truth is that people that really want to do the wrong thing know enough to use encryption when they are stealing data.

Data Mining

Data Mining is actually the review process of all the data collected by other methods to determine malfeasance. Tools like Arcsight or Splunk can be used to collect data from hundreds of sources and collate them into usable information. The problem with surveillance is that there is too much information and important incidents can slip through the cracks. Data Mining uses forensic tools to determine when and how an incident has occured.

You’ve probably seen a theme here. The tools and techniques employed for surveillance all build on each other to ensure complete coverage and protection for organisations. In a properly secured organisation, virtually nothing can be done without the company either preventing it, knowing it or finding out about it. Your work infrastructure is there for work; smartphones and highspeed mobile links are cheap and easy to get. If you are going to something personal (whether it is as innocuous as Facebook or as private as Online banking), do it on your own equipment with your own data link. Use your work PC for work and your personal device for personal stuff.

Do your own research and understand your exposure and liabilities before you use your work equipment for personal items

Taking a quick break

Posted on by

Hi all,

This has been a good month with what I think are some solid posts and some great and much appreciated feedback. I’ve got a lot on over the next couple of weeks so I’m having a little break. In the meantime, please feel free to suggest any topic within the ICT field that you want me to cover. If it’s something that I have strong knowledge (or opinion) of, I’m more than happy to have a crack at it.

Regards,

Michael
The Dancing Bear