I’ve scheduled both in the same morning, and I’ve finished it in less than 2 hours.

Now I have the updated version (current) for Fortinet Certified Network Secutiry Administrator FCNSA

and

Fortinet Certified Network Security Professional FCNSP

As usual, I had found more difficulties on the first level exam FCNSA (the simplier one) than on the second FCNSP.

Right now I’m planning to start study some Cisco manuals to start Cisco certification path.

Bye

Riccardo

Share and Enjoy

But after download the latest Skype beta for Linux from the skype website I’ve notice that something doesn’t work.

This is pretty similar situation as this post and this post.

So the following is two simple steps to install a working version of Skype.

• Download the latest beta from the Skype Website from here (http://www.skype.com/go/getskype-linux-beta-fc10)
• Install dependencies by running:

  yum install -y qt-x11.i686 libXScrnSaver.i686 alsa-plugins-pulseaudio.i686 libXv.i686

• Install Skype by running:

  yum install --nogpgcheck -y skype-2.2.0.25-fedora.i586.rpm

Enjoy it

Hope this help

Bye
Riccardo

Share and Enjoy

Be VERY careful on executing the following actions:

Go to the script editor in the Storage Manager gui. Choose script editor. Type in command like this:
set logicaldrive ["MyVolumeName"] addCapacity=100 GB;

Or even from the shell:
SMcli 10.11.12.13 -n our-nice-ibm-box -p secret-password -c 'set logicaldrive ["MyVolumeName"] addCapacity=100 GB;'

Do not forget the semi-comma at the end of the line.
This would add 50GB’s to the disk “FINKOPAS01-BOOT”.
Now choose run command from the menu. After the disk system has expanded your LUN you should see the extra capacity in the disk management console window.
For fun and to be sure before editing a production volume, I've searched through the online manuals, and finally found a small note at page 96 in “IBM System Storage DS Storage Manager 10, Installation and Support Guide” mentioning the command among best practices using the cli.
Thank you IBM !
Hope this help
Bye

Riccardo

Note: There is a print link embedded within this post, please visit this post to print it.

Share and Enjoy

If your distribution don’t include it, you can download it from here, extract it and make it, then copy the compiled executable wherever you want (in the following example I’ve copied it into /usr/bin).

I had to use it on a CentOS to balance some session directed to application servers, and there wasn’t the init script, so I wrote it because I really hate to execute script not registered with chkconfig on a production systems.

The following is the script :

#!/bin/sh
#
# Init Script to run HaProxy in daemon mode at boot time.
#
# Author: Riccardo Riva - RPM S.r.l.
# Revision 1.0  -  2011 November, 18</pre>

#====================================================================
# Run level information:
#
# chkconfig: 2345 85 15
# description: HA-Proxy is a TCP/HTTP reverse proxy which is particularly suited
#              for high availability environments.
# processname: haproxy
# config: /etc/haproxy.cfg
# pidfile: /var/run/haproxy.pid
#
# Run "/sbin/chkconfig --add haproxy" to add the Run levels.
# This will setup the symlinks and set the process to run at boot.
#====================================================================

# Source function library.
if [ -f /etc/init.d/functions ]; then
  . /etc/init.d/functions
elif [ -f /etc/rc.d/init.d/functions ] ; then
  . /etc/rc.d/init.d/functions
else
  exit 0
fi

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

[ -f /etc/haproxy.cfg ] || exit 1

RETVAL=0

start() {
  /usr/bin/haproxy -c -q -f /etc/haproxy.cfg
  if [ $? -ne 0 ]; then
    echo "Errors found in configuration file."
    return 1
  fi

  echo -n "Starting HAproxy: "
  daemon /usr/bin/haproxy -D -f /etc/haproxy.cfg -p /var/run/haproxy.pid
  RETVAL=$?
  echo
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/haproxy
  return $RETVAL
}

stop() {
  echo -n "Shutting down HAproxy: "
  killproc haproxy -USR1
  RETVAL=$?
  echo
  [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/haproxy
  [ $RETVAL -eq 0 ] && rm -f /var/run/haproxy.pid
  return $RETVAL
}

restart() {
  /usr/bin/haproxy -c -q -f /etc/haproxy.cfg
  if [ $? -ne 0 ]; then
    echo "Errors found in configuration file, check it with 'haproxy check'."
    return 1
  fi
  stop
  start
}

check() {
  /usr/bin/haproxy -c -q -V -f /etc/haproxy.cfg
}

rhstatus() {
  status haproxy
}

condrestart() {
  [ -e /var/lock/subsys/haproxy ] && restart || :
}

# See how we were called.
case "$1" in
  start)
    start
    ;;
  stop)
    stop
    ;;
  restart)
    restart
    ;;
  reload)
    restart
    ;;
  condrestart)
    condrestart
    ;;
  status)
    rhstatus
    ;;
  check)
    check
    ;;
  *)
    echo $"Usage: haproxy {start|stop|restart|reload|condrestart|status|check}"
    RETVAL=1
esac

exit $RETVAL

Hope this help

Bye
Riccardo

Share and Enjoy

I’ve passed it with 361 points (the minimum was 300).

I’m so much more relaxed right now.

Bye
Riccardo

Share and Enjoy

Fedora 16 “Verne” is coming, are you ready ?

Bye
Riccardo

Share and Enjoy

The product is called Intel Modular Server.

Intel Modular Server is a modular server (not a Blade) and have some very interesting feature :

- Fully redundant hot swap power supply.
- Fully redundant hot swap Gigabit ethernet switches with failover.
- Fully redundant hot swap storage controller, with multipathing and failover support.
- Up to six (6) compute module double socket (for Intel Xeon 5400 or 5500 CPU family).
- Up to 96GB of RAM each compute module.
- Up to 14 HDD SAS.
- Up to two redundant external SAS connection to storage expansion or SAS device connection (i.e. Tape Unit or Storage Devices).

But the more important things that lead me to write this post is that storage is shared between the compute module, but not as other Blade Server on the market right now, with Intel Modular Server you should create a Virtual Disk (similar to a SAN LUN) and share it between all compute module if you need it.

At this time only IBM Blade Center S should have the same possibility, but it’s a Blade server, not a modular server, and there is a big price difference.

I had the luck to test the Intel Modular Server for few days (a lot) and install a lot of others at customer sites, and I’ve installed the following :

- VMware ESXi 3.5
- VMware ESX 3.5
- VMware ESXi 4.x
- VMware ESX 4.x
- VMware ESXi 5
- Red Hat Enterprise Linux 5.x
- Microsoft Windows Server 2003 (also R2)
- Microsoft Windows Server 2008 (also R2)

I’ve created some fully function, and very performance VMware HA and DRS Cluster, and some Linux Cluster based on RHEL, and a large number of my previous post was written based on the installation above.

The standard server virtualization or clustering best practices require shared storage to use all benefits of the technology and this lead to buy SAN, Storage array (tipically Fibre Channel) who is very expensive, difficult to maintain and create a very complex infrastructure.

So you should know why I’m so excited about Intel Modular Server, because it’s a “single package” that contains all things you need for virtualization or clustering purpose : servers, storage and network a real datacenter all in one.

With the maximum configuration this machine should support up tp two hundred (200) Virtual Machine !! And his price will be very similar to two or three phisical server (as you are useful to see) and a shared storage, so you should understand that is a beautiful “piece of iron”.

I truly believe that modular server is sometimes under valuated, but in my opinion there is an enormous potential in it and it will be beautiful if this post lead some people to find out a solution, cheaper than other more famous one, using this piece of technology.

You should found more details about Intel Modular Server at the following websites.

http://www.intelmodularserver.com

or, obviously calling the company for which I work, http://www.rpmsrl.it

Feel free to ask, they will answer you !

Riccardo

Share and Enjoy

The test is quite simple if you have knowledge and experience on VOIP devices and SIP protocols, it also include TCP/IP Knowledge and SNOM devices.

Bye
Riccardo

Share and Enjoy

The following will be the steps you (and I, for future reference) had to follow for a working connection with the following :

- L2TP over IPSEC connection
- User Account authentication on the internal domain controller.

The following configuration will be entirely command line based because it’s easiest to port on other devices and because some steps works only on CLI.

Note: the following configuration is for a Fortigate device running v4.0 of the OS at a patch level of MR2.

So, here we go :

STEP 1:
Since L2TP requires a remote user to authenticate, we need to setup a new Group and User on the firewall for our VPN configuration.
For doing so, I want to use the Active Directory users, so :

config user ldap
edit "riccardoriva.local"
set server "192.168.1.12"
set cnid "cn"
set dn "OU=users,DC=riccardoriva,DC=local"
set type regular
set username "riccardoriva\Administrator"
set password ENC *******************************************
set filter ''
next
end

and the group:

config user group
edit "L2TP-GROUP"
set group-type firewall
set member "riccardoriva.local"
next
end

STEP 2:
Now that we’ve finished with the users configuration, let’s start to configure the VPN.
In order to configure L2TP, you’ll have to assign an IP range on the local network for the connected clients and also assign the user group.

config vpn L2TP
set sip 192.168.1.200
set eip 192.168.1.225
set status enable
set usrgrp "L2TP-GROUP"
end

STEP 3:
After this, it will be better to create a Firewall Address entry to simply assign it to a Firewall policy at the end of this tutorial :

config firewall address
edit "L2TP-Clients"
set type iprange
set start-ip 192.168.1.200
set end-ip 192.168.1.225
end

STEP 4:
Now you have to configure an IPSec tunnel for encryption. The most important thing to remember is that L2TP requires transparent mode instead of tunnel mode.

So let’s configure IPSEC PHASE 1:

config vpn ipsec phase1
edit "P1_L2TP"
set type dynamic
set interface wan1
set mode main
set psksecret ********
set proposal aes256-md5 3des-sha1 aes192-sha1
set dhgrp 2
set nattraversal enable
set dpd enable
end

And the related IPSEC PHASE 2:

config vpn ipsec phase2
edit "P2_L2TP"
set phase1name "P1_L2TP"
set proposal aes256-md5 3des-sha1 aes192-sha1
set replay enable
set pfs disable
set keylifeseconds 3600
set encapsulation transport-mode
end
config vpn ipsec phase2
edit "P2_L2TP"
set encapsulation transport-mode
end

STEP 5:
Now you have to configure the Firewall Policy to allow VPN traffic.
Here’s the configuration for the IPSec policy that establishes the VPN connection:

config firewall policy
edit 0
set srcintf internal
set dstintf wan1
set srcaddr all
set dstaddr all
set action ipsec
set schedule always
set service ANY
set inbound enable
set outbound enable
set vpntunnel "P1_L2TP"
end

UPDATE:
And you have to configure DHCP over IPSEC

config system dhcp server
edit "ipsec_dhcp_server"
set dns-server1 8.8.8.8
set end-ip 192.168.1.225
set interface "wan1"
set netmask 255.255.255.0
set server-type ipsec
set start-ip 192.168.1.200
next
end

And finally, the following is the policy that will allow the IP addresses assigned to the remote clients to connect to the rest of the network:

config firewall policy
edit 0
set srcintf wan1
set dstintf internal
set srcaddr "L2TP-Clients"
set dstaddr all
set action accept
set schedule always
set service ANY
end

That’s all, now you only have to configure your Android device to properly connect to it.

STEP 6:
The following are the steps to configure the Android phone/tablet VPN client:

Go to Settings -> Wireless & Networks -> VPN Settings
Tap Add VPN
Tap Add L2TP/IPSec PSK VPN
Set the VPN name to whatever you like
Set VPN Server to the hostname of your firewall (either via a static DNS name, or dynamic DNS, or IP ADDRESS)
Set IPSec pre-shared key to the key you set in the previous step (set psksecret ******** )
Tap the Menu Key, Tap Save

That’s all again.

When you tap on the VPN name on your Android device imput your Active Directory username and password, click OK and if all wors wait a couple of seconds and you’ll be connected on your network.

Hope this help

Bye
Riccardo

Share and Enjoy

Vmware Techical Sales Professional on vSphere 5 (VTSP5)

Thank you to Vmware to share such a great materials.

…. and  now let’s start to journey to earn the VCP5 as soon as possible.

Bye
Riccardo

Share and Enjoy