http://www.alltechtools.com/forums/blog.php This is a discussion forum powered by vBulletin. To find out about vBulletin, go to http://www.vbulletin.com/ . en Thu, 04 Dec 2008 22:06:08 GMT vBulletin 60 http://www.alltechtools.com/forums/images/misc/rss.jpg http://www.alltechtools.com/forums/blog.php http://www.alltechtools.com/forums/blogs/bob_mcmillen/51-trunks-vlans-firewalls-oh-my-part-4.html Fri, 08 Aug 2008 04:53:27 GMT Sunday and Monday mornings found us up on lifts with our heads stuck in boxes while swaying back and forth fearing for our lives.
We found out the hard way that these devices were configured as layer 2 switches, and there is no command line interface. It's all web GUI, and the GUI is barely configurable for what we wanted to do.
We found that we could click on each port and tell it what kind of device is attached to each port. By telling each port that a desktop and phone was connected to each one, wireless access points and phones started to come up.
We had to configure the fiber ports as routers by clicking a picture of a router and applying it to the port. How silly.
Later on we discovered that there was a routing loop because not only were the fiber ports connected to each other they were also connected by CAT 5 cables. We had to wait until each port reported an error to figure out what was happening.
I then came up with the idea of hanging a 25' cable down each pole so we didn't have to climb to the top of each 500 switch when we needed to connect to them or reboot them.
The only problem was every time we tried to connect to the management port it strangely brought an entire group of computers off the network for no apparent reason. In order to troubleshoot it though we would have to bring it down over and over until we found the problem. We decided to just not connect to them since everything was working anyway, and that was that.
When I got home after four days of non stop work I had found I lost several pounds because we rarely took time to eat. I was also glad to get a full nights sleep and the bruises I received from being contorted while on a lift were starting to subside.
I got an email after getting home on Monday that the client VPN was down. I remoted into the firewall and found the DNS and the authenticating servers were still pointed to the old IP address. I then fixed that and remoted into the authenticating server. In IAS on Windows servers you can change what authenticating IP address you want to take orders from and there has to be a matching password. After adjusting this the VPN started to work.
There is no real good way of preparing for a job like this unless you are intimately familiar with it. Since no single person knew all of it there were lots of difficulties in completing the project.
I still wake up in a cold sweat thinking that stupid layer 2 switch that brought the network down did it again. I hope that changes soon! ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/51-trunks-vlans-firewalls-oh-my-part-4.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/50-trunks-vlans-firewalls-oh-my-part-3.html Fri, 08 Aug 2008 04:26:37 GMT Now that VLANs and phone commands are set up and the trunking commands are ready to tie the switches together, we are ready to make this work.
I first started with the core switches which were Cisco 3750's in a cluster of three. After inputting the commands the workstations started to come on line along with the phones.
But there was an entire section of servers we couldn't get to come online. We found out that those servers were hanging off a layer 2 switch. Now that complicates things. You can't trunk the two together because thats a layer 3 command. Layer two switches only memorize the MAC (or hardware) address of a network card. It doesn't route like layer 3 devices.
In order to fix this we decided to remove the portfast command which can cause a routing loop when connected to a switch. Now the servers started working great. They worked all night and into the next morning until the layer 2 switch crashed after a reboot of the core switches. It took out almost all of my configurations. The first night's work for us lasted until midnight. On day two we were on our way to another long day.
We showed up around 8 AM on a Saturday and got to work. I had to re input all the commands on the switches and we replaced the layer 2 switch with another 3750 layer 3 switch.
Now we had to connect the switches in the very large warehouse. The company keeps track of their stock by using wireless scanners. The WAPs are connected to switches in the warehouse on power poles rough 25 feet in the air. A scissor lift raises us up to these switches where we had to reboot all of them. They worked on the reboot but we could only get the workstations to come up. These were Cisco 500 switches and we couldn't tell how they were configured. So we had to get back up on the scissor lift and connect a hyperterminal cable each one to see how they are setup so can fix them properly. One problem though: The scissor lift ran out of battery power and they only had one.
On to tomorrow and the next segment of our story. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/50-trunks-vlans-firewalls-oh-my-part-3.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/49-trunks-vlans-firewalls-oh-my-part-2.html Fri, 08 Aug 2008 04:04:54 GMT In the last segment I wrote about VLANs and using them to segment network traffic. Rather than do this the traditional way we were going to use VLANs to segment traffic from particular devices.
When you first turn on any Cisco router or switch it automatically communicates on VLAN 1. If you want to add VLANs you have to choose a different subnet. For instance VLAN 1 can be 192.168.0.0/24 and the VLAN 2 could be 192.168.1.0/24. The /24 means the last octet is used for host addresses on the computer devices. In this case you would get 254 computers on each of those two networks. We would then assign port 1 to VLAN 1 and Port 2 to VLAN 2. You could also have many of these ports using one VLAN or the other.
Now if you want to connect one switch our router to another you need to create a Trunk. A Trunk is like a virtual tether between two devices. In the statement you also need to allow traffic for all the VLANs you create on the ports connected between devices.
In our case most of the switches were connected to each other by using the fiber port, so the trunking command would go on both switches fiber ports. If a workstation was plugged into Port 10 then we would do a switchport mode access and switchport access VLAN 3 command on Port 10. The trunking commands would be switchport mode trunk and a DOT 1q command to allow the passing of the traffic between switches.
Our first problem came with the fact that phones and workstations needed to be on the same port. IF the phones were Cisco phones then there is a command for both data and voice to pass on one port, but because we had Shoretel phones this wasn't an option because Shoretel doesn't use the same protocol. So we had to put both a trunking protocol and a VLAN command to make it work. This was a completely undocumented command combination but fortuantely we had a Shoretel person to help us since Cisco wasn't going to be of much help.
Now that the first phase is done go one to the next part to read on. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/49-trunks-vlans-firewalls-oh-my-part-2.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/48-trunks-vlans-firewalls-oh-my-part-1.html Fri, 08 Aug 2008 03:44:55 GMT This week I had the hardest project so far this year. Our project was to re subnet a company in preparation for a merger. Since both companies had some crossover subnets we had to change one side so both sides can communicate. Changing a subnet is basically changing the IP addresses that the network communicates on to go to a new set of addresses. Since no two IP addresses can exist on a network you have to be careful when you have multiple offices with hundreds or thousands of devices. If you have a street where there are two houses with the same address the postman will go ...postal on one of you. That means one of you will not get mail and the other will get twice as much. In this case we were to not only change the subnet but also add VLANS so we could have several subnets running simultaneously. The theory was to be able to differentiate the traffic from servers to wireless to workstations. This is a bit more complicated than the previous scenario. Instead of everyone having a different address on the same long and winding street, you have each house in their own zip code. It will work but it will also cause the postman to take more time delivering the mail. We decided the network devices like switches, routers and firewalls would run on VLAN 1, which is the default on every one of those types of devices anyway. The second VLAN will be for servers. The third will be for workstations and wireless, and the last will be for VOIP phones. These types of phones operate solely by the same addressing and protocol that computers run on which is TCP/IP. See the next segment to read about the good and the bad of what happened next. This week I had the hardest project so far this year. Our project was to re subnet a company in preparation for a merger. Since both companies had some crossover subnets we had to change one side so both sides can communicate.
Changing a subnet is basically changing the IP addresses that the network communicates on to go to a new set of addresses. Since no two IP addresses can exist on a network you have to be careful when you have multiple offices with hundreds or thousands of devices. If you have a street where there are two houses with the same address the postman will go ...postal on one of you. That means one of you will not get mail and the other will get twice as much.
In this case we were to not only change the subnet but also add VLANS so we could have several subnets running simultaneously. The theory was to be able to differentiate the traffic from servers to wireless to workstations.
This is a bit more complicated than the previous scenario. Instead of everyone having a different address on the same long and winding street, you have each house in their own zip code. It will work but it will also cause the postman to take more time delivering the mail.
We decided the network devices like switches, routers and firewalls would run on VLAN 1, which is the default on every one of those types of devices anyway.
The second VLAN will be for servers. The third will be for workstations and wireless, and the last will be for VOIP phones. These types of phones operate solely by the same addressing and protocol that computers run on which is TCP/IP.
See the next segment to read about the good and the bad of what happened next. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/48-trunks-vlans-firewalls-oh-my-part-1.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/47-video-problems-vista-beta.html Wed, 18 Jun 2008 20:47:53 GMT A couple of months ago I installed the Vista SP1 Beta before the final release came out. What a mistake that was. After rebooting several times and taking over an hour to install I was presented with wallpaper that said "Vista Demo".

By istelf that's no big deal, but every time I did a rmeote session into my work computer from another location I would be presented with a simple white cursor and a black screen.
I would then have to do a hard restart.

I thought that it couldn't be the Beta. It must be a memory leak so I added the max four GB of RAM that a 32 bit Windows OS can handle but still had the same problem. I decided to risk it and uninstall the Beta and install the final service pack. Many people have nuked their systems by doing this but I was just so frustrated I decided to do it. You can't just install SP1. You have to uninstall the beta first.

I did so, and after taking an hour to uninstall, I started the install of the final product and went home. The next morning it was like a miracle. everything worked as it did before and better.

It made me so happy I cried and forgot the motherboard cover was still open. I fried the board, the RAM, and the video card, but that's another story. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/47-video-problems-vista-beta.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/46-demotion.html Wed, 28 May 2008 02:52:40 GMT This morning I was scheduled to demote a domain controller that I replaced last week. Sounds easy enough. I've done it hundreds of times.

All you need to do is go to a run command and type "dcpromo". Isn't it funny you always have to start something to shut it down? Why not type "DCdemote"?
After typing in the command I clicked for all the prompts to finish.

While it was going through its demotion I thought I would catch up on a little reading. When suddenly I heard a beep. The message said the RPC service is unavailable. I checked out all the event logs and found that my server, which I’m trying to demote, no longer thinks it’s a domain controller.

How can I demote a domain controller that no longer thinks it’s a domain controller ?
I then pulled up a list of all the shares and noticed the netlogon and syslog file share were missing. These are required in order for a domain controller to act appropriately. I have seen this problem several times but never as I was about to demote a server.

The fix for this is to go into the registry and reset the burflags. This allows active directory to rebuild the shares that may have been truncated by a previous update or other corruption. Since I had already transferred the master roles to the new server all I had to do was set the registry to a non authoritative restore.


After running this command the shares returned as I had hoped. I then ran the DC promo command once again. Unfortunately, I got the same error as the sysvol share once again deleted itself. After resetting the burflags two more times I decided to look for another solution.

I ran the replication monitor and it said there were problems replicating. I then ran DCDIAG and it showed me the IP address of the server was different than it actually was. Now this was looking like a dns problem so I opened up the dns manager. I looked for this incorrect IP address that DCDIAG was telling me, but I couldn’t find it. Then it dawned on me that someone had probably created a hosts file that pointed to the incorrect address.

A hosts file always trumps a DNS server entry.
I was correct. After deleting this address and running a flush dns command I was able to get farther during the demotion.

Then I received a new error. This one said that I did not have enough privileges to run the demotion when I was logged on as the administrator. Someone had removed rights to the administrator and gave them to their own account. Rather than search through what rights were missing I was able to type in his username and password and complete the demotion. Now I have a lot of time to find out how the administrator account was changed.

What which should have only taken 10 minutes ended up taking close to 4 hours. Wil the challenges never end? I met someone who used to be in IT during the DOT COM, and now sells lemonade on the street. They look much happier. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/46-demotion.html http://www.alltechtools.com/forums/blogs/andrew/45-pop3-imap-logging.html Tue, 27 May 2008 18:46:14 GMT Need to troubleshoot POP3 and IMAP connections? Not sure why that app that is connecting via POP3 isn't working? Turn on logging!!

Unfortunately logging requires registry editing. For full details see this article from Microsoft: http://support.microsoft.com/default.aspx?kbid=299778

Now before you do this I must insert the standard blah blah blah blah about registry editing. If you have never messed around in the registry before just stick to what the article says and you will be fine. Change anything else and you are on your own buster!!!!

For quick reference the key you need to change for IMAP is: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Imap4svc\Parameters\IMAP Protocol Logging Level (change the DWORD value to 5)

For POP3 the key is: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Pop3svc\Parameters\POP3 Protocol Logging Level (once again change the DWORD value to 5)

Hope this helps! ]]> Andrew http://www.alltechtools.com/forums/blogs/andrew/45-pop3-imap-logging.html http://www.alltechtools.com/forums/blogs/andrew/44-beginning-things.html Tue, 27 May 2008 18:35:06 GMT Hello to anyone that reads this!! I am going to start posting all the tips and tricks and thing that I spend more than 5 minutes looking for the answer to here. Let me know if you have any quesitons or if there are any tips and tricks you would like to add. Hello to anyone that reads this!!

I am going to start posting all the tips and tricks and thing that I spend more than 5 minutes looking for the answer to here. Let me know if you have any quesitons or if there are any tips and tricks you would like to add. ]]> Andrew http://www.alltechtools.com/forums/blogs/andrew/44-beginning-things.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/43-were-trying-something-new.html Sun, 04 May 2008 06:14:05 GMT A month ago I asked our Scott, our service manager, if he would purchase a video editing system.

We record all our radio shows in our studio, which is located in our office, but I wanted to add video to our show.

We started recording our radio show using a mini DV camcorder made by Sony a few months ago. It worked out pretty well but after posting it online it seemed kind of boring just watching two guys talk for an hour while sitting at a table (despite our witty banter).


So now, to try something new, I decided to add shorter videos with specific topics we could post on multiple video sharing websites. The video needs to be under 10 minutes to comply with for their rules.

I thought it would be fun to teach basic hacking skills as well as repair skills that could be done in just a few minutes.

The hacking skills would not be teaching any new secrets, but it would present them in a fun way for people to see. Rather than creating a whole new generation of hackers I think it would more likely scare small business owners and people who own Wireless Networks in their home to begin to secure their networks against real hackers. It's really not that difficult to keep people out, but it does take an effort.

I have also seen and heard many stories of PC repair that have given a black eye to our industry. I thought it would be a good idea to show some of those traps that people get caught up in when trying to get their computer repaired by unscrupulous repair companies. In order to do this I needed to not only video myself speaking about these issues, but I also needed to show people what was on my computer.

This is where the video editor comes in. The editor will allow my producer to switch back and forth between me speaking on video and what my computer is actually doing. The only problem is most computers and laptops were unable to synchronize the video when we tried this. Finally we successfully used my Acer laptop wth S video output. It utilizes Windows XP professional and was made for multimedia.

None of the vista computers worked, and only this one Windows XP Computer worked out of four we tried. It was quite surprising.

I will report back once we start posting the videos next week. It should be a lot of fun. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/43-were-trying-something-new.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/42-speaking-my-blog.html Mon, 28 Apr 2008 05:13:51 GMT For the first time ever, I have decided to attempt to use speaking instead of typing to get my work done.

I purchased a Logitech USB headphone and microphone combination. I then used Windows Vista to setup the computer to use my voice for writing this blog.

Although there've been typos, for the most part it's doing a great job. I even set it up to run windows commands, such as starting and closing programs. It's a little clumsy, but I think he will be a big time saver if I customize it.

The following is an example of using the voice command without editing:

This is my block and I am using a lodge attack USB microphone to write it.

See what I mean?


Tomorrow I will attempt to train vista to create macros for multiple commands with one voice command. I will also try to figure out how to fix the voice input when things go wrong.


So far it looks like a lot of fun, but it's driving me a little bit crazy. I'm having trouble with formatting because I don't know all the commands yet, but the good thing is if there is no command I can make one up. :-) ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/42-speaking-my-blog.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/41-building-bridges.html Tue, 22 Apr 2008 04:40:18 GMT You know when someone really upsets you (this sounds like Andy Rooney) that you feel like lashing out against them? But when you do lash out in anger you sometimes burn a bridge that cannot be fixed.
That happened to me over the weekend.
Rather than give specific details someone said something that made it look like I was being betrayed by what I thought was a friend.
When I actually confronted him I had some time to cool down and give him the benefit of the doubt. It turned out to not be what I was originally told after all.
When I did talk to him I noticed that for once I did the right thing.
I can't remember how many bridges I burned by not doing that.
Either my business partner is rubbing off on me or maybe wisdom is finally coming with age.
I also met a new guy, who like me, started a technology company on a shoe string one day and is now successful.
I not only saved a bridge but I built a new one. Its a very proud day. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/41-building-bridges.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/40-innotech-show.html Mon, 21 Apr 2008 05:12:14 GMT We had a hugely successful show at the Portland Convention center. It was the annual Innotech Show and this was our first year.
We recorded our show onsite and did some great interviews. To hear the show we recorded just go to alltechradio.com and click on the latest show to listen online.
We had so many people who wanted to be on the show we are going to have to split it into two weeks.
We also did an IBM demo of the Blade Center S Class and the ISCSI storage device.
Everyone wanted to play with it so all day long we kept pulling out the blade and opening it up.
IBM and Techdata gave us some great giveaways for people and we had a "guess the aliens" contest. People had to guess how many alien characters were in our glass bowl.
Our theme was "The Men in Blue" since we were all dressed up for IBM blue.
It was pretty fun. I look forward to doing it again next year! ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/40-innotech-show.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/39-i-still-dont-understand-blackberry.html Fri, 11 Apr 2008 05:02:26 GMT I just completed another server installation for Blackberry Enterprise on one of our client's servers.
I am convinced it s a status thing like Apple, and not the best thing out there.
Windows Mobile is free, and does everything that Blackberry does, but without the cost or other issues.

What other issues are there?
1. Its not as secure. You have to lower the security of the server to get it to send emails. Although Microsoft admittedly was the one who forced this.
2. Its an added expense. Why pay for it when Microsoft's version is free?
3. Its controlled by a centralized server system that breaks sometimes. There have been two major outages. Windows Mobile has no centralization, so if one server breaks everyone else's just keep going.
4. It adds an additional software program to your server that eats up memory and could cause program interaction problems. I had that happen today as it did not play well with another app that used SQL 2005. I got it to work but it took extra time.

Tell me why I'm wrong so I can understand. It seems insane to me to use Blackberry over Mobile. I'm open to changing my mind but so far no one has given me reason to. ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/39-i-still-dont-understand-blackberry.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/38-i-stumbled-upon.html Wed, 09 Apr 2008 04:32:55 GMT No one will admit it, but on my desk this week someone had placed a magazine article on my desk. It was for a website called stumbleupon.com.
I had heard of this site for several months but have ignored it as one of the many overblown websites that's more hype than help.

Today I finished my list of customer tasks early and had the show ready to be recorded, so I came across the article one more time. I started to throw it out but was distracted every time I picked it up and started for the recycle bin.
Someone had some new server problem or other issue that made me keep setting the article down. Finally on the start of my fourth trip to the bin I decided what the heck? I have become so complacent in my web surfing habits anyway. I go to the same news sites every day, and even though I get bored with them I just didn't feel like searching for new interesting sites.

This was what stumbleupon was designed for: Bored surfers like me who just use the internet for information and work, and forget about the fun.
I was surprised to see the website is really about a toolbar, but not your ordinary search tool bar. First I installed the toolbar with high hopes but low expectations. Sort of like asking the prom queen to the dance.
But believe it or not, (put on that cumberbun)dreams do come true. This new toolbar is awesome!
All I do is tell the toolbar what interests me from one of the many different cateogories during installation.
Then I have the choice of several buttons to click, like websites, pictures, or videos. It then takes me to a random yet interesting site immediately upon hitting the button. Within no time I was looking at art work sites and setting new desktop backgrounds. Then I read interesting blogs from people in other countries.
I clicked on the video button and saw hilarious creative cartoons and videos.
While the rest of the office continued working and talking to customers I had to remind myself not to feel guilty because I was doing research after all.
Soon the day was done and it was time to go home. But that was OK because after the kids go sleep I knew more research needed to be done.
This is one cool site! ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/38-i-stumbled-upon.html http://www.alltechtools.com/forums/blogs/bob_mcmillen/37-amsterdam-new-spam-king.html Mon, 07 Apr 2008 21:31:37 GMT We have been seeing a ton of spam from Amsterdam for the past few months. We have systematically blocked most of Asia, Africa, South America, and others from being able to email us. We've only had a couple of complaints from customers we are hosting SPAM filtering for.

For those companies we just opened up an exception.

What really surprised us though was Amsterdam sending us SPAM and now NDR (Non Delivery Report) attacks.

These are emails that are spoofed by pretending to be sent from legitimate addresses, and then when they get rejected they get sent to the legitimate ones.

Amsterdam runs the risk of losing the ability to email anyone in the states if all of us block their email. That would cripple their internet capabilities, and their sales of little glass bottles with holes in them.

I thought those people were too interested in smoking and getting high on er um.. life to be doing such things? I wonder if the Chinese are somehow involved? ]]> Bob_McMillen http://www.alltechtools.com/forums/blogs/bob_mcmillen/37-amsterdam-new-spam-king.html