Musings on IT-Teams für qualifizierten Eigenbetrieb

Dieses Jahr habe ich wieder mehrmals die Gelegenheit, an prominenter
Stelle die Eigenheiten zeitgemäßen IT- Betriebes zu diskutieren und in Summe
einige der fest zementierten Glaubenssätze der deutschen IT Community in
Frage zu stellen. Dabei wiederholt sich ein Aspekt der Diskussion regelmäßig
wieder, gleich ob es um die Cloud, neue Plattformen zur Virtualisierung,
Hyperconvergenz, des Anwendungsbetriebes oder gleich ganz allgemein um
eine zeitgemäße IT Organisation geht.

Das ist mühsam, zumal sich gerade bei den Glaubenssätzen um mit Millionenbudgets
gefestigte Aussagen all derer handelt, welche an der Cloud oder XaaS –
Irgendetwas As A Service – ein ernst zu nehmendes Gewinn- Interesse haben und
allein mit der Effizienz der Skala zu argumentieren versuchen. Dass diese
Continue reading

Switch Benchmark Automated

Considering buying a new switch. Typically not all to big an issue. Check Datasheet and fine. For smaller use cases this is probably feasible but I experienced never the less reaching some limits. So what to do?

Right now I started to do a benchmark and wanted to test out in which configuration a network switch actually maxes out. Besides max- MAC entries, max routing entries or multicast groups particular the number of differen VLANs results in memory consumption, since each one needs dedicated buffering.

On top most VLANs need IP configurations set up and depending on your applications probably multiple of them. Unfortunately in my case exactly the later.

Now you may consider configuring max configurations some fun, but after several loops to find the setup maximum, this does not exactly look like productive work. To create multiple configurations which then might be Continue reading

#Reboot

Im November habe ich ja schon einmal von Juicing geschrieben. Seither gingen doch sehr regelmäßig Säfte durch den Gang und ich habe regelmäßig unregelmäßig Mahlzeiten durch Saft ersetzt. Zeit für die Nächste Stufe, einen Reboot.

Die einschlägige Literatur sagt, ein Reboot von sieben bis zehn Tagen reicht eigentlich um raus zu kriegen, was einem so blüht. Da ich das Frustrationspotential in Grenzen halten wollte und auch die Erfahrungen eines Heilfasten von vor acht oder so Jahren noch nach hingen, erstmal die Entscheidung für sieben Tage. Continue reading

How To: Firmware Upgrade on an VSF-Stack

Having created a VSF stack of Aruba 2930Fs, the immediate need of firmware maintenance is obviously raising the question of how!. Dealing with that, luckily a new software had been released and I was able to test.

Daring the result … it was shocking simple and runs as every other Aruba / Procurve firmware upgrade and you just have to cover the second vsf stack member.


vsf member 1
copy tftp flash 192.168.2.5 WC_16_07_0002.swi primary
vsf member 2
copy tftp flash 192.168.2.5 WC_16_07_0002.swi primary

 

Verify the upload with a show flash the firmware image something like, even you may Continue reading

How To: IRF Caveats on FF5700 Flex Fabric

Some time ago, I posted on the configuration of an IRF independent resilient fabric with the HPE Flex Fabric FF5700 datacenter switches. During the operation some things arose to my attention which either have been corrected or perhaps not necessarily clear from the first place.

1.) Activate MAD

There needs to be a mechanism to detect multiple actives. This could be considered something like a quorum for the switch-cluster, intended to prohibit split brains. In my case I preferred to do so with LACP. This brings MAD (Multiple Active Detection) to the layer two and is rather simple. It should be configured on an appropriate Bridge Aggregation Group – resulting in an configuration like:

interface Bridge-Aggregation1
description DOWNLINK_SOMESTRANGESWITCH_WITH_MAD_ENABLED_ON_THE_SAME_LAG
port link-type trunk
port trunk permit vlan all
link-aggregation mode dynamic
mad enable

so specifically pay attention to the last command: Continue reading

HowTo: Enable Traceroute on HPE FF5700

On HPEs Comware based FlexFabric switches by default answering to traceroute is disabled. To enable traceroute on a FF5700 families switch you need to activate:


ip unreachable enable
ip ttl-expires enable

As of then, the switch should show up in traceroutes with something different than timeouts.

Kyp. F.

HowTo: Broken SMB Communication through PanOs 8.1. Firewalls Fix

Anybody who installed PanOS 8.1 on his Palo Alto firewall – we use the PA 220 in quite some numbers, may have experienced quite some strange behaviour if through IPSEC tunnels connected file shares user SMB. So did I.

With the latest firmware upgrade, no write or read jobs through any of these VPN tunnels succeded. The mapped drives lit up in the file explorer. in some cases even browsing directories may have succeded … perhaps even two or three levels down. Then the explorer started to hang, crashed, even some systems blue screened. Copied files showed perhaps up in the destination with a filename aka. directory entry but never any content showed up.

Since we updated the Microsoft world on top, the assumption some backward compatibility stack or group policy setting may have caused the headache. Many Continue reading