Fortinet Certified Sales Associate (FCSA)

Achieved the Fortinet Certified Sales Associate (FCSA) certification today.

Polycom infrastructure

Wandering into the depth of videoconferencing was, for me atleast, the natural step beyond traditional VoIP and IP telephony, in which area I have many years of experience from, among others, Cisco, Alcatel and Grandstream.

Lately I´ve been studying hard and achieved a whole of four technical certifications on Polycom infrastructure and video solutions/environments.

As of now I´m pushing myself harder into both Polycom, but also 3CX Phone System in order to widen my knowledge of other vendors and techniques as a complement to what I already have in my baggage.

Evaluating Fortigate-One

Recently I got my hands on a Procurve-One module (J9289A) for the Procurve ZL fabric switches. This module can be loaded with different products, however since we are partners with both Procurve and Fortinet I decided to load the module with Fortinet Fortigate product tailored for the Procurve-One module.

This is one sweet and welldesigned product which offers same capabilities as the Fortigate appliance boxes and enjoys the same benefits, but it lacks the drawbacks that Fortinet appliances have, such as they need a separate PSU (which is quite cheaply built switched PSU), most of the Fortigate appliances are not 19″ which makes them more or less troublesome to mount in a 19″ environment.

The Procurve-One module loaded with the Fortigate-One product integrates seamlessly into the switch fabric and provides, among other things, two 10 GbE interfaces directly into the switch fabric. The management of Fortigate-One is ofcourse the same as before. One of the strengths that Fortinet has is that they always use the same webinterface regardless of firewall size or capabilities.

The Procurve-One ZL module is a nice piece of hardware:

• Intel T7500 Core 2 Duo @ 2200 MHz
• 4 GB DDR2 SDRAM
• 4 GB compact flash
• 250 GB SATA II 7200 rpm hard disk drive

The pricetag however is not for the fainthearted, the Procurve-One ZL module and the Fortigate-One product is about 120.000:- swedish crowns, but considering the function, performance and seamless integration I believe that this might be a considerable option if you already got the fabric in place.

VTSP claimed….

Today I claimed certification for VTSP, VMware Technical Sales Professional.

Certified VMware Sales Professional, VSP

Recently I achieved status as an certified VSP, VMware Sales Professional.

I chose this track since I´m quite involved in planning, designing, implementing and maintaining converged infrastructures often involving VMware solutions. This complements well to my infrastructural security track.

Next step is certified VTSP.

Procurve Platform Specialist - 2008

Scored HP2-Z02 with 76% qualifying me for Procurve Accredited Platform Specialist 2008

Procurve Sales Professional - 2008

I have now finished Procurve Sales Professional - 2008 recertification in line with HP Continous Learning. Scored 92,5%

Fortigate TFTP configuration script

How many times have you not wished for a function to grab your valuable configurationfiles automatically for safety reasons if your Fortigate should die ?

This simple script in Linuxenvironment will contact your Fortigate and tell it to send it´s configurationfile to your TFTP server. The script requires that you have the expect function installed on your server from where you´ll execute the script.

#!/usr/bin/expect -f
set timeout 60
spawn ssh admin@fgt-ipaddress
expect “password: $”
set send_slow {1 0.05}
send -s “password\r”
send_user “password\r”
send -s ” config global\n”
send -s “execute backup full-config tftp filename.txt tftp-ipaddress\n”
send -s “exit\n”
interact

Where the bold information for you to enter. The italic row is ONLY used if you´re running VDOM´s.

Use chmod 700 scriptfilename to make this scriptfile executable and then configure your crontab for whatever schedule you wish.

ESX Server beaconing causing network failures

ESX Server issues beacon packets from one adapter addressed to other adapters assigned to a virtual switch. By monitoring beacon reception, the server can detect distributed connection failures. These packets are, in some cases, interpreted by switches as BPDU packets. For some strange reason these beaconing packets seems to be behaving like BPDU packets from a switch point of view.

This can, in conjuction with Spanning Tree, cause major problems in a network triggering constant topology changes, hence triggers elections of rootbridges. The effect from this, except flooding your syslog server and SNMP services, render your network more or less useless.

This unwanted behaviour can be prevented by issuing some simple commands on your switchport where the ESX is located.
This is called BPDU filtering and should only be implemented on the specific switchports, not all the switchports since that will result in that the switch no longer can participate in the Spanning Tree configuration of the network.

The syntax for enabling BPDU filtering on a specific switchport is like this (Procurve):

[no] spanning-tree <port-list | all> bpdu-filter

Example: ProCurve(config)# spanning-tree a9 bpdu-filter

In the example above the ESX Server is connected to switchport a9. This will result in that the switchport won´t accept either transmission or reception of BPDU packets, but the switch as a whole still participate in the Spanning Tree configuration of the network.

Last cert in the Procurve sales track

I have now finished the Procurve salestrack by passing the last certification:

HP Accredited Sales Consultant (ASC) - Procurve Networking (Scored HP2-039 with 81,2%)