murisonc's questions

What is the recommendation for installing DHCP failover; domain controllers or member servers?

I can't seem to find any recommendations either way. I did find an old question here pertaining to security suggesting DHCP should never be on a Domain Controller but that was for Sever 2003.

In this case I'm looking at Server 2012R2. I can either add the DHCP role to two domain controllers or fire up two new virtual member servers on our Hyper-V cluster.

This is an Intranet with 7 existing domain controllers running 2008R2 with approximately 300 hosts using DHCP (servers are static IPs on a seperate subnet). We will be adding 2 new DCs and a new Hyper-V cluster.

I'm looking for advice with RHEL patch management in a Windows environment.

We run an Intranet that is completely disconnected from the Internet. Currently the network spans a half dozen sites with ~80 servers (most virtual using Hyper-V) and a few hundred Win 7 workstations. Most servers are 2008R2. We now have a single virtual RHEL 5 server that is required for us to run specialized security scanning software (no choice). We currently use SCCM 2007R2 for all our patch management but now we also need to patch the RHEL server.

I've researched setting up an offline yum repository but from what I read it would require another RHEL server? I've also read that SCCM 2012R2 will patch RHEL but I'm having a hard time understanding how to get updates in a similar way to WSUS for a disconnected system. I've also looked at Chef and Puppet but it seems like overkill to manage a single RHEL server.

The situation is a separate group has created an LDAP domain. We'll call it foo.bar. (fyi, none of these are connected in any way to the Internet) They also have a Windows domain and renamed it to foo.bar so, in their words, they can connect the two so it becomes one domain in the future.

At this point I'm lost because I don't know enough about LDAP on RHEL. I know in AD that you can't just connect two domains with the same name and expect it to work because they are independent entities. I got involved because they want to include the network I manage as well (an AD domain called good.bar)

Can someone confirm and maybe provide a reference for why this won't work and is a stupendously bad idea?

I'm going to be installing a switch and 40 workstations/printers in a building. All the rooms have raised floors with cable trays running in various grids and there are cable trays going between the rooms accessible from the basement. Most of the runs will be between 200' and 300'. All the runs will be going from the switch in the computer room, under the floor in cable trays and then popping up and directly connecting to the workstations/printers.

I remember back in the day it was a big deal to use solid cable for horizontal runs but that was usually between a switches or other stationary devices. I've been seeing problems with similar situations where a solid cable was used because people move stuff around and eventually the conductors break.

Now in the modern day does anyone see a problem with using stranded cables for this type of installation?

We have an existing 3 node cluster running 2008R2 Hyper-V. Back end storage is an EqualLogic iSCSI SAN. We are replacing the host servers in this cluster and are looking at upgrading to server 2012 at the same time. Is there any way to do this without downtime? Maybe add a 2012 server to the 2008R2 cluster and migrate virtual machines? From what I've read I'll have to plan an outage to move the virtual machines between the 2008R2 cluster and a new 2012 cluster. Is this right? No zero downtime upgrade path?

While cleaning up the office today we ran across two odd looking cables still in bags. On one end is a female DB 9 connector and the other end is a 3.5mm plug with 4 contact points. The types of equipment we have are: Dell workstations and servers, HP SANs, Equallogic SANs, Cisco network gear, and symmetricom time servers.

The only thing I found on the net is a speakercraft adapter cable but we've never had anything to do with speakercraft.

UPDATE: We don't have any cameras or video/audio equipment in the area. It can't possibly be for a camera, cell phone, or some other home consumer item since we just can't have that stuff in the area.

I have an ACL to prevent regular workstations from accessing the management vlan on our switch. Every 5 minutes we get the following log entry:

%SEC-6-IPACCESSLOGS: list mgtvlan-acl denied 0.0.0.0 20 packets

The switch is a Cisco 3750G running IOS C3750-IPBASEK9-M, Version 12.2(52) SE

The acl is:

ip access-list standard mgtvlan-acl
permit [management workstation netowrk]
permit [other management networks]
deny any log

The acl is applied to the layer 3 interface called Vlan50

interface Vlan50
  description management vlan
  ip address 199.254.98.xx 255.255.255.192
  ip access-group mgtvlan-acl in

I've tried various debug commands and ip accounting on the vlan50 interface. I also turned on terminal monitor just to make sure I could see everything without relying on the syslog server.

Is there any way I can get more information on what these packets are or where they are coming from (which physical interface) without going through the hassle of setting up wireshark?

I'm familiar with all the standard Cisco shapes to depict various types of switches and routers. I've also come up with a pretty good shape to show encryption devices. I'm having a hard time trying to come up with something that would show a media converter (Ethernet to fiber and vice versa) on my network drawings using Visio. Do anyone know of a standard shape that's used?

We have a 3 node Hyper-V cluster with each server having 96GB RAM and 2 73GB disks in a RAID 1 for the host machine OS (2008 R2). The last thing we want to happen is for the host to expand the pagefile.sys and consume the entire C drive. It is currently a little over 16GB. What would be the recommendation for setting the min and max pagefile.sys size?

Note: This is for the hosts, not the guests. 96GB RAM and 73GB C drive.

Don't think it matters but just in case. All three host machines have dual 1 Gbps Ethernet connections to an iSCSI SAN using the Broadcom iSCSI offload engine, multipathed. They are Dell R610 servers running 2008 R2 Datacenter with Hyper-V.

This is similar to enabling jumbo frames on an iSCSI network after the fact but in our case we configured the switches and then went through all the hosts, enabling jumbo frames (we may have screwed ourselves here). The SAN is a Lefthand (actually 2 SANs mirrored). So the plan is to configure one of the SANs for jumbo frames, bring it back on line, wait for replication and then do the same with the other SAN. Are we in for a world of hurt with one SAN having jumbo enabled and the other not yet configured while we wait for SAN replication? Of course all of this has to be done live. Should we go through the pain of resetting all the hosts back to 1500 MTU and then configure the SANs for jumbo first?

Some clarifying info. Each SAN device is connected to two dedicated switches (each SAN has two nics). The switches have an ether channel link between them. The SANs have MPIO configured. Each host has two nics configured for the SAN network connected to each switch (full mesh configuration).

UPDATE: It worked. When taking the second SAN offline all the hosts experienced problems connecting to the SAN for about a minute (very scary), but they all came back except for our OCS server which we had to reboot.

Here is the configuration. Private network and domain (foo.bar). 2 file servers running 2K8R2 (file1.foo.bar and file2.foo.bar). Created a share on each server (\\file1\share and \\file2\share). Setup DFS on the domain and created a namespace (\\foo.bar). Created a folder (dfsshare) in DFS with 2 targets (\\file1\share and \\file2\share). Created the replication group and everything works except...

During testing (Win 7 SP1 x64 client) if I copy a large file (230MB) to the DFS share (\\foo.bar\dfsshare) I get the following error:

Error 0x8007003B: An unexpected network error occured.

If I copy the same file directly to one of the file servers (\\file1\share) I don't get the error and the file replicates to the other file server and shows up in the DFS share. No error when copying small files to the DFS share.

I found hotfix 983620 http://support.microsoft.com/kb/983620 but that hotfix was included in SP1 for Windows 7.

UPDATE: Narrowed it down to ~41MB file size. Above that and I get the error. Below that and it works fine. Also, network is a LAN (no routers between me and the servers) running 1000Base T.

UPDATE2: Also verified that Windows XP SP3 machines work fine so this is limited to the Windows 7 SP1 boxes.

UPDATE3: Configured the same way on our dev network and it works. Move the workstation to an OU that blocks all the DISA GPOs and it was still broke. Turned off DFS replication and it works. Turned DFS replication back on and it continued to work (very confused at this point). Put the workstation back in the proper OU and it broke again. This means it must be one of the DISA settings being applied by the GPOs. Moved the workstation back to the blocking OU and it remains broke until I turn off replication.

UPDATE4: Going through all the GPOs and we found out which one it was. It's a GPO that sets up 802.1x which seams very strange. We started googling DFS replication and 802.1x and found the real culprit. Not sure how the interaction of the 802.1x and the real culprit causes the problem (maybe someone can answer that). Anyway, if someone else answers with the correct culprit, or better yet, can explain why the interaction to the 802.1x GPO would cause the problem, I'll award the rep. After the bounty is expired I'll put the answer in here.

SOLUTION: It turns out the problem was McAfee on the workstation. We had do disable "scan network drives". Once we did this everything worked. This error only occurs when you have 802.1x configured and the DFS share is set to replicate. We now have an exception from security since the network shares are being scanned on the server. There were no errors in the windows logs or on the ePO server.

We have our Cisco network devices configured to authenticate network administrators using their domain accounts via RADIUS running on a Windows 2008R2 server with the network protection role. This works great for logging into the switch via SSH when configuring the devices.

We are now in the beginning stages of deploying smart cards for logins. Does anyone know of a way to login to a Cisco switch using a smart card instead of a domain username and password?

The SSH client we are using is Putty. Workstations are Windows 7. RADIUS is running on Windows 2008R2. We are running our own certificate authority on Windows 2008; network is not connected to the Internet.

We prefer to not have to purchase additional proprietary devices for this functionality.

I've heard that there are compatibility problems when using 50um fiber with some fiber converters. After some research I'm thinking this is a legacy issue when using slower devices (100 Base FX) that used LEDs. I was told that the fiber converters are made for a certain size of fiber core and wont work with 50um fiber. Am I right in thinking this is just a corporate knowledge thing that is outdated when using 1000 Base SX converters (which should be using lasers instead of LEDs)?

I'm looking at the feasibility of terminating multi-mode fiber connections ourselves. We would be using LC connectors. I've done some research and found two different methods. One requires polishing the ends and using epoxy while the other doesn't. I like the idea of not having to polish the ends but there doesn't seem to be much information on quality or ease of use. I've found two vendors (3M and Corning) that offer kits for terminating fiber without polishing or using epoxy. Does anyone have any experience with both methods that can offer some advice? Copper is easy but fiber seems to be a whole different animal.

EDIT: After looking into fusion splicing suggested in the answer I've determined it's not for us. It's my understanding that is primarily used for outside plant and is better suited for single mode fiber. It's a good answer but doesn't address the question directly.

Some more information about our situation. We will only be terminating multi-mode fiber inside a building and only doing between 4 and 20 pair a year. Hiring an outside person won't work due to our location. There are currently a couple people on-site that can terminate fiber (working for another company and charging large fees) but they can only do ST and SC connectors and we only use LC. So once again does anyone have experience with terminating using both epoxy type connectors and the other type (similar to Corning Unicam)?

I'm setting up a bunch of static routes (this is a security requirement so don't ask why I'm not using routing protocols).

A static route can either be created by specifying the next hop

199.199.199.0 255.255.255.0 199.199.200.1

Or by secifying the outgoing interface

199.199.199.0 255.255.255.0 GigabitEthernet0/23

In this case Gi 0/23 has an ip of 199.199.200.2 and is directly connected to 199.199.200.1. There are multiple other static routes going out this same interface.

What is the best practice in this situation?

Edit: Based on the difference of answers I had to dig into this some more. From my experience Cisco doesn't give you two ways to do the same thing and this is what I found. Specifying an interface is not recommended if the interface has many destinations. Here are the links I found and thanks Vlad H for the accurate answer.

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800ef7b2.shtml http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfindp1.html#wp1054112

I'm continuing to lock down my network gear using the DISA standards. After implementing an ACL on a multi-layer switch that denies access to unknown subnets, the syslog server started recording two IP addresses about every 7 minutes that are being blocked. The IP addresses are in the 169.254.0.0 /16 network. This seems to indicate that the machines used a link local address, probably because they didn't have an IP address set (no DHCP on this isolated network). Without physically touching each machine is there a way to find out which port(s) these packets are coming in on? The multi-layer switch is a stack of Cisco 3750Gs with cross-stack ether-channel to 4 Cisco 2960Gs.

I'm going through DISA security hardening on our network devices. Our iSCSI SAN network uses 2 Cisco 2960G layer 2 switches. The SAN consists of 2 HP P4000 devices. Servers are 3 Dell R710s in a Hyper-V cluster. DISA has a rule about enabling port security or 802.1x but will that mess up multi-path IO or NIC teaming?

Edit: Each SAN and server has a connection to each switch and there is an etherchannel between the 2 switches so it's a full mesh configuration. Probably doesn't help the question but it may help visualize the configuration.

Where I work all the switches in a rack are mounted in the rear of the rack, but this presents a problem with hot isle cold isle cooling. The alternative is to mount the switches in the front of the rack with patch panels. But this wastes rack space because you are doubling or tripling the U's needed for a typical 48 port switch. We recently implemented hot isle cold isle in the server room leaving the switches to consume hot isle air. Do we need to suck it up and install pass through patch panels for each switch and sacrifice the rack space to get proper cooling? Maybe leave a 1U space above or below front mounted switches for cable routing to the rear of the rack where the server connections are located?

I've studied the NEC 2008 version and I can't find any requirement for an EPO to be mounted on each rack. For some reason the place I work requires them at the top of the rack and it's connected to the Pulizzi power distribution units at the bottom of the rack. They also have an EPO at the entrance to the server room which cuts power to all the circuits and CRACs. Is this a legacy thing?