Voodoo Networks

Took a bit of time yesterday to run up to Long Beach and walk around the Energy Management Conference exhibit hall. I would have liked to attend the conference sessions, or perhaps speak at the conference, but I didn’t realize that I’d be around for it. Oh well, maybe next year.

Anyway, there were quite a few interesting concepts and ideas out there for not only monitoring power usage, but also for reducing power usage and power spending. Daylight tracking sunlights, ice based cooling systems (makes ice during the night with lower cost power, then uses the ice during the day instead of running A/C compressors), that sort of thing.

Also in attendance at the show where a few consultants who do power profiling of your business and buildings. I like the idea of that, and truthfully never really thought of doing it as a business (at least until yesterday) but being in the IT field, with a solid background in building systems, I think that Voodoo may start offering a service along those lines. Though I’d rather just do the work to fix the problems that other auditors find. And help people make better choices from the early stages of a project.

As usual though, the exhibitors that interested me the most where the control systems guys. Slowly but surely they are moving away from weird proprietary control schemes to straight IP based controls. I can’t wait until they all get to the point where IP is the control scheme, and you don’t need proprietary software to control the systems. They are so close to that now (at least some of them) that I’m excited for what I will see coming in the next year. I think that someone will finally get there. And as soon as they do I’m ready to start deploying it.

Though that does bring up the issue of security on converged networks. Something that we’ll get to shortly.

Inspired by working onsite at a contract in Los Angeles this week.

I’ve worked on a lot of other peoples networks. And while it can be entertaining, it’s rarely fun. Usually you are expected to jump in and fix the random problem that they are having within minutes, which is never a reality (except in the case of very obvious things like the power cord being unplugged).

Thankfully I’m not dealing with that this week, though I am having some fun with trying to figure out why certain things have been done, and more importantly, why things haven’t been done.

For example, the company that I’m onsite at have 2 large internet connections, one each to different carriers. What you normally would do with that – and I’m sure that was the intention here – is apply for an Autonomous System (AS) number, apply for a bank of IP addresses from ARIN, then setup those two connections to be redundant to each other, both inbound and outbound, by advertising your AS number and IP address range over the Internet.

Simple, right?

Well, actually it’s not all that simple, but it’s a pretty straightforward thing to do. In fact it’s pretty much the default configuration for large networks connected to two or more ISP’s.

Well, things aren’t quite setup like that here. They have the big Internet connections. They have an AS number. And they qualified for and got a class C bank of IP addresses from ARIN. But then things sort of fell apart. They attempted to setup the dual homing, and their internet went down. So they rolled back off of that to having two separate internet connections with all of their inbound traffic coming in one, and all of their outbound traffic going out the other. There is some failover, but only for web browsing – if the connection goes down that their external servers are on, then they will have no ability for their customers to reach them over their secondary line.

So now I’ve mentioned this and been asked to fix it.

Which is where the fun really starts.

It’s really not that bad to make a change like this, just time consuming. You have to make a lot of phone calls, make some changes to the way that your routers are configured, add some translations into your firealls and then wait around until all that propagates across the Internet. Once your new IP addresses are available across the Internet, you now have to update the DNS entries for your servers. Then when that information propagates, you can go back and fix the translations on your firewall. And then stop using the ISP supplied IP addresses that you have been using up to this point.

That is a bit simplified, but it covers the basics. Like I said, it’s not complicated, just time consuming. But if something does go wrong it can be even more time consuming to fix.

I’m in the process of writing up the detailed plan of how I’m going to make the changes to get this running correctly. Hopefully all goes smoothly.

And hopefully when their normal network admin gets back from vacation he’s not too confused by what I’ve done……

There are lots of things that scare people about the Internet. Nigerian scammers, hackers, LOLCats. You know, the usual stuff.

While there is no perfect defense from any of those, especially the lolcats, implementing a firewall on your internet connection is a big step in the right direction.

A firewall is, in it’s most basic form, something that prevents network traffic from going to certain places. Think of it as a combination filtering and direction control system. Firewalls are available as software for a single computer, or as a combination hardware and software device for networks.

The most common firewall, at least for smaller companies, is a hardware based firewall that is built into your Internet router. It is generally setup to allow all traffic from the internal network (inside your company) out to the Internet, and block all traffic from the Internet that is trying to get into your companies network. It does this by watching where network traffic originates, makes a decision if it will allow that traffic to pass, and either lets it through or drops it. The firewall also keeps track of the traffic that it allows out, so that the return information can get back to the computer on the inside that requested it.

These firewalls also give you the ability to allow traffic from the Internet to come in to your network. Why would you want to do that? Well, if your email server is in your office, or you webserver is, then you’d need to tell the firewall to allow appropriate traffic from the Internet in to those servers. If you aren’t sure if you need to do that, or are sure you do, but don’t feel comfortable doing so, please contact a professional to do the work for you. It’s pretty straightforward, and shouldn’t take long at all in a small office setting.

Firewalls are also available as software for your computer. Both Windows and OS X have built in firewalls that can be used to allow traffic from your network to get to your computer, or can be used to stop your computer from communicating with the network.

There are also 3rd Party software packages from companies like McAffee or Symantec that you can install on your computer. Be aware of the issues that can come up if install one of these pacakages on your computer and it’s also running the native Windows firewall – lots of very weird issues can come from having both of them active at the same time.

A firewall won’t protect you from bad decisions made online, like sending your bank account info to Nigeria, or browsing LOL Cats, but it will definitely help to prevent unauthorized access into your network from the Internet. And given how secure even very small, low cost firewalls can be, there is no reason that you shouldn’t have one between your systems and the Internet.