Chris McKeown's questions

I'm a little confused by the output of the puppet resource commands, and the documentation isn't helping me.

If I run puppet resource user myuser for example, it yields:

user { 'myuser':
  ensure  => 'present',
  comment => 'Ubuntu',
  gid     => '1000',
  groups  => ['cdrom', 'floppy', 'sudo', 'audio', 'dip', 'video', 'plugdev', 'netdev'],
  home    => '/home/myuser',
  shell   => '/bin/bash',
  uid     => '1000',
}

This command gives the same output whether the user account is Puppetized or not. In this case, the node has no Puppet manifests applied that affects this user. I could delete this account and it would not be re-created. So, what is this output telling me? The ensure => present attribute is certainly not telling me that Puppet will ensure that the account is present.

Is this basically telling me 'if you want Puppet to keep this user account in it's current configuration state, here's what you'd stick in a manifest'? Or am I completely misunderstanding the point?

Is it possible to disable/overwrite Windows TCP/IP filtering settings via a Group Policy object?

I have a server running 2012 R2 which I was setting up RRAS on, and I inadvertently cut myself off from remote access by allowing the wizard to secure the network connection (the server has a single NIC).

I've recently replaced our old consumer-grade NetGear access points with a SonicPoint Ne Access Point to work with our SonicWALL NSA 3500. The old NetGears kept kicking everyone off the network and required a power cycle to get the network up again.

I thought that dropping in something enterprise class might result in a more stable wireless experience. How wrong I was! Personally, my phone and laptop connect to the new SonicPoint with no problems. But the rest of the office have a range of different issues, from random disconnects, not being able to connect at all, being able to connect but not access anything on the network and so on.

• The NSA is at the latest firmware level and it has upgraded the SonicPoint to the latest version.

• Frame Aggregation is disabled

• Short Guard Interval is disabled

• Channel width is set to 20 MHz

• Channel has been set manually since 'Auto' chose a very congested channel

• RF analysis shows that the channel has low interference - rating of 10/10

I have opened a case with SonicWALL about this but they have as yet not given any advice above what I've already done.

We may require some more access points to support the number of clients that we have, but regardless of that the overall experience is worse than when we had a supposedly 'less able' consumer grade AP. Even with relatively few clients connected, we still see problems.

Any thoughts before I put it back in the box and return it?

I have a problem with a couple of Dell PowerConnect 6248 switches (latest firmware) connected to a pair of external (3rd party) switches providing Internet connectivity via HSRP.

I'll post more detailed configuration when I get time, but briefly this is what the setup looks like:

ISP SW1                  ISP SW2
  |                         |
  |                         * (disconnected)
  |                         |
6248 SW1                 6248 SW2
(VLAN 10)                (VLAN 10)
  |                         |
Firewall 1               Firewall 2
  |                         |
6248 SW1                  6248 SW2
(VLANs 20, 30, 40)         (VLANs 20, 30 ,40)
  |                         |
  |                         |
   ----- Port Channel -------
   (Trunking VLANs 20,30,40)

Now, the only things connected to the switchports for VLAN 10 are the ISP switch uplinks and the public interface of the firewall HA pair. Currently VLAN 10 on each switch are not connected together, I'll come to that in a second.

Only one firewall node is active at any one time, therefore all WAN traffic goes through a single firewall.

The remaining backend VLANs are connected to their own interfaces on the firewalls, so the firewalls handles all traffic routing between VLANs. For the backend VLANs, there is a Port Channel that trunks all of them between the switches (so, everything except VLAN 10).

Now, as you can see one of the WAN feeds is currently disconnected. The problem I'm seeing is that if I connect that WAN feed, STP puts the whole Port Channel on SW2 into discarding mode. So it appears to be seeing a loop somewhere, but I can't figure out where. There are no other ports that are members of VLAN 10, and the port channel isn't trunking VLAN 10 traffic, so why is STP choosing to block the channel?

Thanks for the feedback regarding MSTP - We will need to look at this. However, there is one thing that still doesn't make sense. These two 6248 switches are replacements for a pair of old 5324 switches. The old switches did not have this issue, but I've double-checked their configuration and they do not have MSTP explicitly enabled. Could MSTP have been enabled by default on the old switches and not the new?

UPDATE:

I have confirmed that MSTP was not enabled on the old switches. They were configured for RSTP, same as the replacements. No other specific configuration was in place. I'd like to understand why things used to work before I go about enabling MSTP

One thing I have noticed, and I guess it's due to the difference in firmwares, is that the Port Channel on the older switch appears to be trunking VLAN1 and allowing untagged frames by default. The new switch does not. Here's the config from one of the old switches:

# sh interfaces switchport port-channel 1
Port : ch1
Port Mode: Trunk
Gvrp Status: disabled
Ingress Filtering: true
Acceptable Frame Type: admitAll
Ingress UnTagged VLAN ( NATIVE ): 1

Port is member in:


Vlan               Name               Egress rule Port Membership Type
---- -------------------------------- ----------- --------------------
 1                  1                  Untagged          System
20                 20                   Tagged           Static
30                 30                   Tagged           Static
40                 40                   Tagged           Static

And the config from one of the new switches:

#show interfaces switchport port-channel 1

Port: ch1
VLAN Membership mode:Trunk Mode

Operating parameters:
PVID: 1
Ingress Filtering: Enabled
Acceptable Frame Type: VLAN Only
Default Priority: 0
GVRP status:Disabled

Port ch1 is member in:

VLAN    Name                              Egress rule   Type
----    --------------------------------- -----------   --------
20      20                                Tagged        Static
30      30                                Tagged        Static
40      40                                Tagged        Static

I have a clustered Hyper-V environment with four nodes and three PowerVault MD3xxx storage arrays for shared storage.

The servers are using standard Ethernet connections for the iSCSI fabric (not HBAs). MPIO is configured via the Dell storage wizard.

The problem that I seem to be having is that upon rebooting a node, the Ethernet connections seem to be taken down before the iSCSI initiator is ready for it - so the connectivity to any of the LUNs that it happens to own is lost unexpectedly.

Is there a way of preventing this so that a shutdown will be more graceful? In future I will be making sure that a node that is going to be rebooted has any storage it owns shifted to another node first, but I was wondering if this should really happen automatically.

I'm trying to get the Nagios XI virtual machine working on Hyper-V (yes, I know it's not a supported config). I'm trying to get it on the network to download some packages so that I can then install the Enlightenment components and use a synthetic adapter.

I've configured the machine with a legacy adapter which is correctly recognised as eth0, and it picks up a DHCP lease, but after that I can't seem to get any traffic to traverse the network at all. The same virtual network is being used for other guest machines so I know it's working. My Linux skills are limited. Can anyone help?

EDIT: I can ping the leased address from the machine itself, but cannot ping any other address on the same subnet, nor can any other machines ping this erver.

The VM is running CentOS 6.2. Kernel 2.6.32-220.17.1.el6.i686

UPDATE 5-Jul-2012

I have set up a brand new VM on a different server using the same source VHD. This time I configured the machine using a static IP address, but the end result is the same. dmesg | grep eth yields:

Can someone please shed some light on this for me?

I gather that it is possible to use Hyper-V live migration without the need for a Cluster Shared Volume. Given the following:

• Live migration can only migrate one machine at a time (Server 2008 R2, I gather that Server 2012 will be able to migrate multiple machines).

• Since a Cluster Shared Volume isn't being used, ownership of the LUN holding the VM's storage will need to be transferred to the new node.

Therefore, I am correct in assuming that Live Migration without a CSV can only work if each VM has its own LUN?

I have a bizarre issue that seems to be UAC related but I can't figure it out. On the face of it, it seems to be the same issue as this, but it's not quite.

I have a folder which contains the files for a VirtualBox machine. The folder is located in C:\Users\Public\Documents\VM. When launching the VM, VirtualBox complains that it cannot get write access to the VHD unless I run VirtualBox with elevated permissions. VirtualBox has write access to other files in that folder (the logs, for example) because they're being written to when trying to fire up the VM.

If I change the NTFS permissions on the VM folder, all of the files within the folder inherit those changes except the VHD file which gives me an access denied error (VirtualBox is not running and the VHD is not attached via Disk Management either). If I go into the VM folder, I can manually change the permissions directly on the VHD file, and if I disable and then re-enable inheritance, the correct permissions get applied - but the next time I change anything on the folder above, I get the same access denied error on the VHD file.

What on earth is going on? My instinct says that it's UAC but why is it only affecting this one VHD file in a folder?

EDIT: I have since deleted and re-copied the offending VHD, and the problem has gone. Absolutely no idea why that should have had any effect whatsoever, but there you go...