what did you learn today?

Status
Not open for further replies.

MaxIdiot

Ars Tribunus Militum
2,079
Frennzy":2k8yiol8 said:
One word, my friend. IronPort.

It's expensive as hell, but it's close to perfect.

If by "perfect" you mean "does not have, and apparently has no plans for future, support of IPv6" then sure.

I'd be curious if this is still accurate. John Chambers has said that Cisco is committed to IPv6 support for all their products.
 

afidel

Ars Legatus Legionis
18,224
Subscriptor
Frennzy":1unwyjg7 said:
I'd be curious if this is still accurate. John Chambers has said that Cisco is committed to IPv6 support for all their products

It was accurate as of the end of August, and the people (read: Cisco sales) we spoke to about it said "we have no current plans to implement IPv6 on the ironport, it's not on our roadmap."

Huh? They announced IPv6 support in June: "today Cisco announced the early availability of cloud-based IPv6 support for the Cisco IronPort Email Security portfolio. Cisco email security customers of all form factors — appliance, cloud and hybrid — are able to send and receive IPv6 emails through the Cisco infrastructure" link
 

Frennzy

Ars Legatus Legionis
85,841
Huh? They announced IPv6 support in June: "today Cisco announced the early availability of cloud-based IPv6 support for the Cisco IronPort Email Security portfolio. Cisco email security customers of all form factors — appliance, cloud and hybrid — are able to send and receive IPv6 emails through the Cisco infrastructure" link

This was appliance specific, I'll have to dig up some notes on it, but I wasn't the one doing the investigation. Could have been a specific appliance level.
 

sryan2k1

Ars Legatus Legionis
46,568
Subscriptor++
sryan2k1":iew23gfj said:
We have 4 for about 50 users and yesterday was the first day they got used by everyone. I'm not to worried about the bill.


Do not want:
Code:
C:\Users\sryan2k1>ping -a x.x.23.194

Pinging fw1.interface.xxxcorp.com [x.x.23.194] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for x.x.23.194:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),




"Normally a WiMax installation takes 7-10 days, however there was no cell pointed in your direction, and with the holidays we could not get the parts from our suppliers in our usual window. You should have service by the end of the week"


;_;
 

chris

Ars Praefectus
4,733
Subscriptor
Frennzy":2nerptgj said:
Huh? They announced IPv6 support in June: "today Cisco announced the early availability of cloud-based IPv6 support for the Cisco IronPort Email Security portfolio. Cisco email security customers of all form factors — appliance, cloud and hybrid — are able to send and receive IPv6 emails through the Cisco infrastructure" link

This was appliance specific, I'll have to dig up some notes on it, but I wasn't the one doing the investigation. Could have been a specific appliance level.

Maybe they want to force everybody into their cloud
 

afidel

Ars Legatus Legionis
18,224
Subscriptor
I learned that the Start menu in 2008 R1 defaults to powering the server off! Luckily I learned this 30 nanoseconds before I clicked on the icon. We had jumped directly from 2003 to 2008R2 but I had a server that we were repurposing that lacks 64bit hardware and so we installed 2008 on it. The workaround is to change to classic start menu and add logoff. I can't believe that this got flagged in Beta and was ignored, who in their right mind makes powering off the default action for a *server*, those computers that generally only get shut off when they are being decommissioned?
 

Frennzy

Ars Legatus Legionis
85,841
chris":3ezw6o4z said:
Frennzy":3ezw6o4z said:
Huh? They announced IPv6 support in June: "today Cisco announced the early availability of cloud-based IPv6 support for the Cisco IronPort Email Security portfolio. Cisco email security customers of all form factors — appliance, cloud and hybrid — are able to send and receive IPv6 emails through the Cisco infrastructure" link

This was appliance specific, I'll have to dig up some notes on it, but I wasn't the one doing the investigation. Could have been a specific appliance level.

Maybe they want to force everybody into their cloud

*Some* of the things I'm reading tell me that their declaration of "support for IPv6 on ironport" means that they will now support lookups/validations on IPv6 mail server source addresses. This is not quite the same thing as full support for IPv6...especially in the cloud if they don't have an IPv6 outside presence.
 

sryan2k1

Ars Legatus Legionis
46,568
Subscriptor++
afidel":3dv6y162 said:
I learned that the Start menu in 2008 R1 defaults to powering the server off! Luckily I learned this 30 nanoseconds before I clicked on the icon. We had jumped directly from 2003 to 2008R2 but I had a server that we were repurposing that lacks 64bit hardware and so we installed 2008 on it. The workaround is to change to classic start menu and add logoff. I can't believe that this got flagged in Beta and was ignored, who in their right mind makes powering off the default action for a *server*, those computers that generally only get shut off when they are being decommissioned?



Unless They changed it in 08 (Havent tried) or you explicitally disabled it, the shutdown tracker will come up when you tell it to shutdown and you have to give the system a reason before the shutdown will start.
 

afidel

Ars Legatus Legionis
18,224
Subscriptor
sryan2k1":zaw2a4vh said:
afidel":zaw2a4vh said:
I learned that the Start menu in 2008 R1 defaults to powering the server off! Luckily I learned this 30 nanoseconds before I clicked on the icon. We had jumped directly from 2003 to 2008R2 but I had a server that we were repurposing that lacks 64bit hardware and so we installed 2008 on it. The workaround is to change to classic start menu and add logoff. I can't believe that this got flagged in Beta and was ignored, who in their right mind makes powering off the default action for a *server*, those computers that generally only get shut off when they are being decommissioned?



Unless They changed it in 08 (Havent tried) or you explicitally disabled it, the shutdown tracker will come up when you tell it to shutdown and you have to give the system a reason before the shutdown will start.

Yeah but it comes up for restart too so I probably would have just put the reason in not thinking about it.
 

MaxIdiot

Ars Tribunus Militum
2,079
Frennzy":l8cxd3ap said:
chris":l8cxd3ap said:
Frennzy":l8cxd3ap said:
Huh? They announced IPv6 support in June: "today Cisco announced the early availability of cloud-based IPv6 support for the Cisco IronPort Email Security portfolio. Cisco email security customers of all form factors — appliance, cloud and hybrid — are able to send and receive IPv6 emails through the Cisco infrastructure" link

This was appliance specific, I'll have to dig up some notes on it, but I wasn't the one doing the investigation. Could have been a specific appliance level.

Maybe they want to force everybody into their cloud

*Some* of the things I'm reading tell me that their declaration of "support for IPv6 on ironport" means that they will now support lookups/validations on IPv6 mail server source addresses. This is not quite the same thing as full support for IPv6...especially in the cloud if they don't have an IPv6 outside presence.

Interesting. I would've thought this was the hard part for them given AsyncOS is just mangled FreeBSD.
 

Laslow

Wise, Aged Ars Veteran
199
Manager: We have a problem with the video conference bookings.
Me: Oh?
Manager: We need the VC room on [this day] for [this conference], and the room is already booked.
Me: When did you find out about this?
Manager: The other week. [Third party] said they would contact you.
Me: Oh. Good news, then.
Manager: What's that?
Me: They didn't contact me, so it's not my problem!

I learned today that, since the only in-house developer moved across the country and I inherited her job on top of mine, I can get away with a lot.
 

Frennzy

Ars Legatus Legionis
85,841
Interesting. I would've thought this was the hard part for them given AsyncOS is just mangled FreeBSD.

To be fair to Cisco, deploying native v6 in their cloud service would be a much, much larger undertaking than just turning up a few interfaces and advertising a /48. I'm not sure how large their subcriber base is...but I'm sure it's way, way larger than just throwing up a simple service for.
 

Incarnate

Ars Tribunus Angusticlavius
9,004
Subscriptor++
afidel":14ywnui2 said:
molo":14ywnui2 said:
Das Schwartz":14ywnui2 said:
McAfee E-mail Gateway, a supposedly "enterprise" level product, has the following limitations:

Can't be monitored via SNMP
Doesn't do native SMTP load balancing (like every other mail product...ever)
Doesn't have automatic configuration synchronization between devices
Doesn't have automatic configuration backups
Taking a manual configuration backup incurs ~5 minutes of mail flow disruption
Doesn't integrate with AD to authenticate administrative users


Guess how this makes me feel.

One word, my friend. IronPort.

It's expensive as hell, but it's close to perfect.
Amen, other than when a smart spammer pulls our response key from some public mailing list we get near zero spam, and that is rectified in almost no time (4 clicks maybe?). Other than virtualization I'm not sure I've seen a better ROI in IT.
Even better ROI is outsourcing your email spam and av protection. Thank the computing gods I don't need to manage that crap any longer.

Also, I learned that all you bastards take two weeks of time off (By the lack of posts in this thread during that time), and most likely don't patch your systems prior to the holidays due to dumb "change control" rules near the holidays. :)
 

roamsedge

Smack-Fu Master, in training
84
Incarnate":xbso9irq said:
Also, I learned that all you bastards take two weeks of time off (By the lack of posts in this thread during that time), and most likely don't patch your systems prior to the holidays due to dumb "change control" rules near the holidays. :)

Indeed. It's like pulling teeth to get anything done between Thanksgiving and the New Year. Even if the system you're working with is one that you're the primary admin for, you'll have to justify it to the change control board.

"Really, I just want to turn up some switch interfaces in the datacenter for new servers."

Nuts.
 

roamsedge

Smack-Fu Master, in training
84
roamsedge":g8u6pjdi said:
"Really, I just want to turn up some switch interfaces in the datacenter for new servers."

Nuts.

Speaking of servers. Today I learned that our server team, finally looking at VMware and 10Gig to each host, still wants separate physical links for nearly every network. I'm being asked to provide 6x1Gig and 2x10Gig per server, even though there's not a single server in our environment pushing more than 3Gig total.

I can dream that someone will acknowledge the switchport cost that involves...right?
 

MaxIdiot

Ars Tribunus Militum
2,079
Frennzy":1e9r56bc said:
Interesting. I would've thought this was the hard part for them given AsyncOS is just mangled FreeBSD.

To be fair to Cisco, deploying native v6 in their cloud service would be a much, much larger undertaking than just turning up a few interfaces and advertising a /48. I'm not sure how large their subcriber base is...but I'm sure it's way, way larger than just throwing up a simple service for.

Totally agree, I was only referring to adding support to the appliance itself.
 

ronelson

Ars Legatus Legionis
21,399
Subscriptor
Indeed. It's like pulling teeth to get anything done between Thanksgiving and the New Year.
I wish I could just take off this entire period, instead of merely two weeks. I twiddled my thumb most of these 5 weeks because even though I felt like doing things, everyone I needed to work with was off. Also helps that I get my ducks in a row early rather than waiting till the last minute.
 

afidel

Ars Legatus Legionis
18,224
Subscriptor
ronelson":xbtkcbc1 said:
Indeed. It's like pulling teeth to get anything done between Thanksgiving and the New Year.
I wish I could just take off this entire period, instead of merely two weeks. I twiddled my thumb most of these 5 weeks because even though I felt like doing things, everyone I needed to work with was off. Also helps that I get my ducks in a row early rather than waiting till the last minute.

I did that one year, worked 5 days from Turkey day to Jan 6th, looking back it's one of the easiest periods to work most years so why waste all that vacation time? Then again I now go somewhere warm every other year to avoid the snow =)
 
PaveHawk-":302gsyvz said:
That trying to get licensing details, especially Microsoft licensing details, is an utter mind fuck.

Client bought Open Value Subscription, what do you think the chances are of me working out how to get the order fulfilled in a reasonable time frame is?

I'll give you a hint, its between zero and fuck all.

Oh god, the urge to strangle someone from Microsoft is rising. I can visualise my hands around someone's neck, squeezing the life out of them

I call up MS because I want my damn media kit. This same OVS has SBS 2008 Premium in it. The person at the other end tells me that I have to add the licensing agreement to my Licensing console (cant, its OV Subscription. Note the word 'subscription', you retard. I cant; the stupid system wont let me.) so I can then access the download for the media.

Great, only problem is, is that your own goddamn guidance says that SBS 2008/2008 Premium etc are not available via electronic download (presumably because it usually requires pre-pidded media). See: https://www.microsoft.com/licensing/ser ... lable.aspx

Code:
Products currently not available for digital distribution (Purchase Media Option available)

- Windows Small Business Server Premium 2008
- Windows Small Business Server Standard 2008
- Windows Essential Business Server Premium
- Windows Essential Business Server Standard

Seriously, it cant really be this complex can it?!
 

Danger Mouse

Ars Legatus Legionis
38,881
Subscriptor
That inevitably on the day you finally get access again to the VMWare farm, that it's the day where two of the legacy ESXi servers won't respond to login attempts or anything other than pings.

So the only fix is to shut them off and restart and hope for the best.

If only I had been given access a year ago, so the legacy units could have been migrated over the summer or last spring or anytime earlier than "OMGWTFBBQ DO IT NOW!".

---

Now, if I can just get access to the Cisco Call Manager, then I can take care of that beast while the primary person is gone on vacation (and is not really proficient in dealing with anything other than menus or assigning phone numbers at this point as his skill set is circa 2000 and never updated beyond desktop support).

Although I finally managed to shed a few of my responsibilities (each of which is a separate IT career path), they've started to accumulate on me again while people are on vacation as well as in general shirking their duties.

The primary VM dude is winding up doing assistant manager work (including sticky HR stuff), so I've had to pick up his work.

I'll be digging into our Celerra, Data Domain and Commvault gear later this week. Most of that actually is me. The wireless network issues aren't me, but the primary is on vacation and lacks the skillset. And we still have no official network dude, so it's still up to me to deal with our network when the contractor screws things up.

-randomly swapped fiber pairs to reverse polarity and result in no link (and tries to charge us for the troubleshooting as being off contract)
-randomly unplugs power cables to switch stacks (claims it wasn't them)
-leaves stacking cables on Cisco 3750 PoE unstacked switches, resulting in weird phantom stacked configs in multiple locations
-never puts in proper primary LDAP server or DNS server settings in anything they setup
-confirms wireless network as "working" by validating that their devices which have been entered into the mac filter, are joining and getting on the internet (hello wankers, how about testing the authentication?????)
-For that matter, how about telling us which of you wankers no longer works for your company, so we can remove their access?
-That the same jackasses will ask justification for handing over the RSA token use for VPN access, when it BELONGS TO MY COMPANY, NOT theirs.



---

And then I think I finally figured out why some of our thin clients are "falling off" the domain. We have no NTP settings set via GPO across our domain and some of the thin clients apparently are losing time over the days, such that a week later and blammo.

---

That when one of the junior sys admins is told in private (as a favor) that people have been saying they can't find him/he disappears every day (including calling his cell phone, home, etc) right after start of shift until end of his shift, that it looks like the reason for it is that he's got a girlfriend besides being married with two kids. Either that or he's a stoner or he's sleeping somewhere. Well, at least that jackass knows how to use imaging software. His partner in crime thinks "imaging" a system means doing a manual fresh install of windows, including drivers/etc by hand. Across a lab. That repeated attempts to get them to use this new fangled thing called "Google" to "search" for things is beyond either of them.

---

That a certain very large SOHO computing products company, makes crap for enterprise gear. I knew this already actually, but it was confirmed by them demanding we ship the in production use KVM for repair work. After a few weeks, we'd get the repaired unit back. And today, the trackpad stopped working in it. Well, at least the video actually works normally :p Previously, the monitor did not properly respond to DDC queries, so the resolution could never be set in Solaris on a Sun (Intel CPU) server.

---

That a certain large MFD/copier vendor only posts old versions of their products' firmwares to their website and FTP space. The firmwares that actually fix problems go in their private FTP space and never are provided to customers, unless the other option is breach of contract.

---

That inevitably, when asked with doing data recovery, you find out that part of the critical data to be recovered is porn, some of which appears to feature the wife of the requester with another dude. And the requester is a church deacon. I'll be pretending I didn't randomly check files to prove actual recovery took place, since I was told that filenames and folder structure didn't matter.

---

That the response of the LE is that a stolen laptop must just have been misplaced, since the computrace didn't work as expected. That presumes the laptop wasn't disassembled and sold on the internet and that the BIOS was not reset to disable the computrace agent. Yes, modern systems make it harder, but it's still doable.

List of gear stolen over the last 3 weeks? 2 laptops, 1 project, 2 turtledoves and a partridge in a pear tree. (the last two aren't really stolen, but may be "misplaced")

---

That being able to find a 720p version of your wife's favorite Korean soap opera, makes you a bigger hero than getting a promotion or fixing just about anything in the house or being on the verge of getting your master's degree. I'm not that disturbed by this, as I'm a recovering soap opera addict myself (clean for a decade).
 

Frennzy

Ars Legatus Legionis
85,841
afidel":3a61na02 said:
Ostracus":3a61na02 said:
Is all the current talk about IPv6 because of the governments recent actions?
No because we have at most 18 months till IPv4 address space is fully exhausted.

And because some of us are actually beginning to deploy public v6 services. Every time you run across a device (typically legacy) that doesn't support it, or has "limited support :rolleyes: " it means another unexpected delay, another unexpected change in your project plan, another unexpected kludgey workaround.
 

MaxIdiot

Ars Tribunus Militum
2,079
Frennzy":2pclj532 said:
afidel":2pclj532 said:
Ostracus":2pclj532 said:
Is all the current talk about IPv6 because of the governments recent actions?
No because we have at most 18 months till IPv4 address space is fully exhausted.

And because some of us are actually beginning to deploy public v6 services. Every time you run across a device (typically legacy) that doesn't support it, or has "limited support :rolleyes: " it means another unexpected delay, another unexpected change in your project plan, another unexpected kludgey workaround.

Shouldn't it be an expected unexpected kludge at this point? :)
 

Accs

Ars Legatus Legionis
12,557
Subscriptor
Incarnate":2snjr62w said:
Also, I learned that all you bastards take two weeks of time off
What are you talking about. I did some significant switch recongiguration over the previous two weeks, along with some much needed server maintenance. It's a lot easier to do when the chances of "negative user interaction" have been minimized, due to the complete lack of users.
 

Arbelac

Ars Tribunus Angusticlavius
7,684
Accs":2b5z71rx said:
Incarnate":2b5z71rx said:
Also, I learned that all you bastards take two weeks of time off
What are you talking about. I did some significant switch recongiguration over the previous two weeks, along with some much needed server maintenance. It's a lot easier to do when the chances of "negative user interaction" have been minimized, due to the complete lack of users.

Me as well. I tore down our lab environment, de-racked all the gear, moved the racks and made them face the correct direction, then re-racked all the gear and re-cabled everything, with the cables bundled and held in the wire guides properly.

Amazing how easy it is to find stuff now... the rest of the team is amazed.
 

Uhlek

Ars Tribunus Angusticlavius
6,650
Subscriptor
Is all the current talk about IPv6 because of the governments recent actions?
No, it's the fact that, for all intents and purposes, IANA is out of /8s to allocate. From what I've picked up from reading NANOG, APNIC is virtually guaranteed the next two allocations. When those are gone, the gig is up. The final five are immediately given to each of the five RIRs and the pool is officially exhausted. The RIRs will get stingier and stingier and it will become more and more difficult to get new allocations. We're also probably going to start seeing pressure exerted on legacy space owners to relinquish unused portions back to ARIN and other RIRs (e.g., entities like Apple, Halliburton, duPont, Eli Lily, Merck, Prudential, MIT, and others who each received /8 allocations in the early-to-mid 90s. There's *NO FUCKING WAY* any of these guys are using all of that space).

While consumers aren't going to start feeling the pinch for a few years yet, network operators (especially service providers and large enterprises) are just waiting for the epic trainwreck to start.
 

sryan2k1

Ars Legatus Legionis
46,568
Subscriptor++
Uhlek":933190ll said:
Is all the current talk about IPv6 because of the governments recent actions?
No, it's the fact that, for all intents and purposes, IANA is out of /8s to allocate. From what I've picked up from reading NANOG, APNIC is virtually guaranteed the next two allocations. When those are gone, the gig is up. The final five are immediately given to each of the five RIRs and the pool is officially exhausted. The RIRs will get stingier and stingier and it will become more and more difficult to get new allocations. We're also probably going to start seeing pressure exerted on legacy space owners to relinquish unused portions back to ARIN and other RIRs (e.g., entities like Apple, Halliburton, duPont, Eli Lily, Merck, Prudential, MIT, and others who each received /8 allocations in the early-to-mid 90s. There's *NO FUCKING WAY* any of these guys are using all of that space).

While consumers aren't going to start feeling the pinch for a few years yet, network operators (especially service providers and large enterprises) are just waiting for the epic trainwreck to start.



If the DoD gave back all the /8s they collectively possess we would be okay :D


It scares me how close we are to running out of v4 addresses and how little everyone is doing with v6.

I spent 4 hours one night trying to get v6 working with DD-WRT and Comcast, Comcast even had a page about it. Nope, didn't work.
 

Xavin

Ars Legatus Legionis
30,685
Subscriptor++
(e.g., entities like Apple, Halliburton, duPont, Eli Lily, Merck, Prudential, MIT, and others who each received /8 allocations in the early-to-mid 90s. There's *NO FUCKING WAY* any of these guys are using all of that space
True, but it's also extremely unlikely that they just started at the beginning of their range and used them as needed. It's way more likely the ranges are spread out all over the organization in many different groups and locations. They won't be able to just hand back a huge chunk of unused addresses, they will need to massively restructure internally to consolidate, which I think has an extremely small chance of actually happening. Allocated addresses are gone for all reasonable purposes. We may see a few of those given up, but it won't be enough to make any kind of difference. The transition is going to happen soon, and it's going to be messy.
 

Uhlek

Ars Tribunus Angusticlavius
6,650
Subscriptor
We may see a few of those given up, but it won't be enough to make any kind of difference.
I'm not expecting it to happen, I'm just expecting to see ARIN and other RIRs (and potentially even the government) attempt to pressure those organizations to give up some of their space once the RIR allocations start to dry up. Maybe even an offer of things like tax credits in exchange for every /16 returned.
 
Status
Not open for further replies.