Clint Miller's questions

Here's the setup:

Two companies (A & B) share office space and a LAN. A 2nd ISP is brought in and company A wants its own Internet connection (ISP A) and company B wants its own Internet connection (ISP B).

VLANs are deployed internally to separate the two companies' networks (company A: VLAN 1, company B: VLAN 2, shared VOIP: VLAN 3).

With separate VLANs it's simple enough to use separate DHCP servers (or separate scopes on the same server) to assign the default gateway to each company's gateway for their Internet connection. Static routes can be created on each gateway to point traffic destined for the other company's VLAN or the voice VLAN so that all nodes are reachable as expected.

However, I think this is a form of asymmetrical routing, right? (The path from node A1 to node B1 is not the same as the path back from node B1 to node A1).

Can I set up policy-based routing to correct this? In that case, can I assign the same default gateway to every device on all VLANs and create a routing policy on a L3 switch to look at the source address and forward traffic to the appropriate next hop? In that case, I want the routing logic to go like this:

1. If the destination address is known, forward the traffic (traffic destined for a different VLAN).
2. If the destination address is unknown, forward the traffic to ISP A's gateway if the source address is on VLAN A; or forward the traffic to ISP B's gateway if the source address is VLAN B.

Am I thinking about this problem in the correct way? Is there another way to solve this problem that I am overlooking?

UPDATE

I tried Kyle's solution below and had some issues. Here's the relevant bits of my config (I'm testing this with a 2821 BTW):

interface GigabitEthernet0/0
 ip address 10.0.1.1 255.255.255.0
 no ip proxy-arp
 duplex auto
 speed auto
 no mop enabled
!
interface GigabitEthernet0/0.100
 description VoIP VLAN stub
 encapsulation dot1Q 100
 ip address 10.0.100.1 255.255.255.0
 no ip proxy-arp
!
interface GigabitEthernet0/0.110
 description RT VLAN stub
 encapsulation dot1Q 110
 ip address 10.0.110.1 255.255.255.0
 no ip proxy-arp
 ip policy route-map RT-out
!
interface GigabitEthernet0/0.120
 description TCI VLAN stub
 encapsulation dot1Q 120
 ip address 10.0.120.1 255.255.255.0
 no ip proxy-arp
 ip policy route-map TCI-out
!
interface GigabitEthernet0/1
 ip address 192.168.1.20 255.255.255.0
 no ip proxy-arp
 duplex auto
 speed auto
!
ip route 192.168.0.0 255.255.0.0 192.168.1.2
!
ip access-list extended match-RT-out
 permit ip 10.0.110.0 0.0.0.255 any
ip access-list extended match-TCI-out
 permit ip 10.0.120.0 0.0.0.255 any
!
route-map TCI-out permit 11
 match ip address match-TCI-out
 set ip next-hop 192.168.12.2
!
route-map RT-out permit 10
 match ip address match-RT-out
 set ip next-hop 192.168.11.2
!

And the output of show ip route:

     10.0.0.0/24 is subnetted, 4 subnets
C       10.0.1.0 is directly connected, GigabitEthernet0/0
C       10.0.110.0 is directly connected, GigabitEthernet0/0.110
C       10.0.100.0 is directly connected, GigabitEthernet0/0.100
C       10.0.120.0 is directly connected, GigabitEthernet0/0.120
C    192.168.1.0/24 is directly connected, GigabitEthernet0/1
S    192.168.0.0/16 [1/0] via 192.168.1.2

And here's the problem: It doesn't seem like my route-maps are working (well, I think they are matching, but they don't seem to be modifying the next-hop result). Output of debug ip policy for one ping to an external IP address:

*May  5 21:26:11.631: IP: s=10.0.120.100 (GigabitEthernet0/0.120), d=209.85.225.100, len 52, FIB policy match
*May  5 21:26:11.631: CEF-IP-POLICY: fib for address 192.168.12.2 is with flag 0
*May  5 21:26:11.631: IP: s=10.0.120.100 (GigabitEthernet0/0.120), d=209.85.225.100, len 52, FIB policy rejected - normal forwarding
*May  5 21:26:11.631: IP: s=10.0.120.100 (GigabitEthernet0/0.120), d=209.85.225.100, len 52, policy match
*May  5 21:26:11.631: IP: route map TCI-out, item 11, permit
*May  5 21:26:11.631: IP: s=10.0.120.100 (GigabitEthernet0/0.120), d=209.85.225.100, len 52, policy rejected -- normal forwarding

So you can see in that output that it looks like it matches...followed by an immediate FIB policy rejected - normal forwarding. I get back a ICMP Destination Host Unreachable from my router (10.0.120.1) in this case (when I've tried to ping 209.85.225.100).

This is getting long, but hopefully it explains where I'm having trouble.

I have an XServe running Snow Leopard Server (10.6.2). It has some local administrator accounts on it and it is also an OpenDirectory master.

I noticed earlier today that I was not able to login with local administrator credentials via a VNC connection. However, I was able to login with a directory account. Once logged in, I could escalate privileges to perform any privileged operation with local administrator account credentials.

Even after a reboot I was unable to login with my local credentials. So I opened Directory Utility and modified the Search Policy tab to be Automatic. When I did so, I noticed it removed the LDAP directory from the search policy, so I applied my changes and logged out.

As you may surmise by now, I can't log in any more- with either my directory credentials (because I removed them: OOPS!) or with my local credentials (because they still aren't working).

So my question is two-fold:

1. How do I log in to this server now with no credentials that seem to work? Is there a configuration file I can change if I can mount this machine's disk? Maybe in single user mode?
2. How do I get the search policy working like it should be all along? (I.e., check local user accounts, then directory accounts). This had previously worked, but like I said, seemed to stop working for no apparent reason.

Background: I want to separate our web server/app server functions onto separate machines (logically or physically). Meaning, I want to dedicate certain resources to serving static content (static HTML, images, Javascript, CSS, videos, etc...) and want to dedicate other resources to generating dynamic HTML (my web app, which happens to be a ColdFusion app and you may consider to be any J2EE app).

I'm familiar with several J2EE vendors methods for connecting their app servers with web servers. For instance, Adobe provides mod_jrun, Tomcat offers mod_ajp, mod_proxy_ajp, & mod_jk, Caucho (Resin) offers mod_caucho, etc... Several of these connectors allow for load balancing functionality. I guess they are communicating with a part of the app server that can function as a cluster controller.

One thing I've noticed is that these connectors are made for use with Apache (and often IIS on Windows). We are considering moving away from Apache to one of the lighter webservers, like Nginx or Cherokee. If I do that, it appears that I won't have the option for using a connectors like I mentioned above. The consistent suggestion in documentation for these servers is to just configure their HTTP reverse proxy capability in order to connect them to your app server (via the app server's HTTP implementation).

I'm interested in your experience with the performance implications of HTTP vs. other protocols used in a connector like I mentioned above. I assumed that those other connectors would function at a much lower level and have higher performance as a result. They obviously can bring new "features" like exposing an app server's load balancing functionality as I mentioned above.

So what do you think? Is the simplicity & flexibility of HTTP for communicating between the web and app tiers more attractive than the additional features of a more customized connector? Are there other issues in planning a multi-tier architecture like this that I haven't considered?

Can I get a certificate from a root CA that I can then use to sign my own web server certificates? I would, if possible, use a signed certificate as an intermediate to sign other certs.

I know that I would have to configure my systems in a certain way with "my" intermediate certificate in order to supply information about the chain of trust to my clients.

Is this possible? Are root CAs willing to sign a certificate like this? Is it expensive?

BACKGROUND

I'm familiar with the basics of SSL as it pertains to securing web traffic over HTTP. I also have a basic understanding of the way the chain of trust works, in that web traffic is secured "by default" if you encrypt with a certificate that has a valid chain all the way back to a root CA, as determined by the browser/OS vendor.

I am also aware that many of the root CAs have begun signing certificates for end users (like me) with intermediate certificates. That may require a bit more setup on my end, but otherwise, those certificates will work fine. I guess this has to do with protecting their all-valuable private key for the CA and the disaster that it would be if i were ever compromised.

EXAMPLES

1. https://www.microsoft.com
2. https://www.sun.com
3. https://ecomm.dell.com/myaccount/ga/login.aspx?c=us&cs=19&l=en&s=dhs

Now, we are definitely not the size of any of those organizations, but they seem to be doing something like this. It would definitely make the management of these certificates a lot more palatable, especially considering one way we are expanding the reach of our e-commerce platform.

First off, this isn't a question about sub-domains or host headers and SSL.

What I want to know is can I build a certificate request or find a certificate provider that will issue a certificate with multiple CNs (Common Names) such that secure access to https://www.abcde.com -or- https://www.qwert.com doesn't appear to the browser to be mismatched to the CN in the SSL certificate?

BACKGROUND

We have a e-commerce application that runs a under the URL http://www.abcde.com. The application also has a secured portion, accessed as https://www.abcde.com. This is a very normal setup, with the exception of using a SSL wildcard certificate (*.abcde.com) because the sub-domain may vary depending on business use of this app. This sub-domain/domain name variance of the application has to do with customizing it's look-and-feel and transaction-cut percentage for selected partners of ours.

We now have a desired business use of the exact same application where by it would be accessed via the URL http://www.qwert.com, and of course, have a secure portion accessed as https://www.qwert.com.

This poses a problem because my certificate has been issued for *.abcde.com. According to Ken Schaefer, it's possible to generate a CSR with multiple CNs.

Have you heard of multiple CNs in a cert? Do you know how to create a CSR for this? And will any certificate vendor fulfill a request like this?