ABS Engineer Paul Ingram Achieves Cisco Voice Designated TSS

Paul Ingram, a Senior Network Engineer at ABS Technology Architects, was officially designated as a Technology Solution Specialist (TSS) for Cisco Voice Advanced Technology products yesterday by a review board of Cisco employees. Paul is one of only two Cisco Voice TSS' in the Virginia Mid-Atlantic Region. His achievement highlights ABS as a frontrunner in the industry, and the only Cisco Partner in Virginia with two TSS designated engineers: Paul Ingram (Voice) and Timur Snoke (Security).

A Technology Solution Specialist is a qualification given to a Cisco Partner Engineers who can expertly explain, demonstrate, & design a technical solution within a particular technology, as well as escalate and facilitate post-sales issues during the implementation phase. A TSS must continue to participate and stay current in their chosen technology to maintain their designation. Cisco created the TSS Program to create awareness within Cisco for the best partner pre-sales engineers, create demand in the customer base for the best partner pre-sales engineers, and recognize partner pre-sales excellence.

Paul Ingram has been with ABS since 2005, and is certified CCNA, CCDA, GSEC Gold, LPIC-1 and A+. He has designed, developed and deployed a variety of Cisco based solutions for customers across industries, including education, finance, and commercial corporations. In 2006, Paul was awarded the Cisco Systems Partner SE Award. He lives with his wife, Emily, and daughter, Zoe, in Chesapeake, Virginia.

President Walker Dorroh Selected for 2008 Hampton Roads "Top Forty Under 40"

Walker Dorroh, President and Co-owner of ABS Technology Architects, headquartered in Virginia Beach, has been selected by Inside Business as a 2008 "Top Forty Under 40" honoree. This prestigious award program was established in 1999 and each year, its aim is to recognize forty local businesspeople under the age of 40 for leadership, innovation and achievement in their careers, and for their dedication to the community.

Dorroh and the other recipients of the tenth annual awards were honored at a special banquet celebration held at the Norfolk Waterside Marriot on Monday, October 13th, 2008.
As the President and co-owner of ABS Technology Architects, Walker Dorroh is responsible for tailoring strategic company solutions and services to the needs of customers in Government, Education, Banking & Finance, and Retail markets, where technology-driven innovation is a key differentiator. Dorroh develops and executes strategies to drive growth, market leadership, profitability, and customer satisfaction for ABS.

Dorroh's community volunteer activities include theCommotion in the Ocean at the Virginia Aquarium, the Children’s Hospital of The King’s Daughters Health and Surgery Center Advisory Board member, and being a Virginia Tech Alumni Association and CareerLink Member.
To read more about Walker Dorroh and the other 2008 Top Forty Under 40 Honorees, please click here.

Tech Tip for ASA packet Captures

Thanks again to Paul Ingram, Sr. Network Engineer, for this Tech Tip:


How to Automate Getting Packet Captures off of an ASA
For weeks I have been trying to figure out how to get packet captures off an an ASA before the buffer is full or overwritten. It always seems like I was too late go get the capture I wanted manually, so here is what I came up with. I have found this to be a life saver for intermittent and unpredictable network events.

Using a circular-buffer and the Linux wget and crontab commands you can automate the download of your capture file off of your ASA and store as many captures as you have disk space. There might be some overlap between captures but at least you are going to have the packet captures you need. I am using Debian Etch but the commands are very generic and should work with any Linux distribution or Cygwin if you are stuck with Windows. My ASA software is version 7.2(3)12.

First, create an access-list for the captures you want on your ASA. Let's say between two devices:

access-list cap extended permit ip host 10.10.150.1 host 192.168.0.1 access-list cap extended permit ip host 192.168.0.1 host 10.10.150.1

Second, start your capture.

capture capout access-list cap interface outside buffer 1000000 circular-buffer
I am increasing the size of the buffer so I don't have to pull the captures off of the ASA so often. And, I am setting the circular-buffer command so the capture buffer starts overwriting old packet captures when it gets full. If you don't set this the capture just stops when the buffer is full.

Third, create an executable file on your Linux box and enter all on one line:

wget -P /home/directory 'https: //username:'password'@ASA/capture/capout/pcap' -–no-check-certificate

wget is a very powerful program from the Linux/Unix world. It is great for pulling content off of a website without going through a browser. This command will place your capture files in the /home/directory. Unfortunately this is not very secure because the password to your ASA is in this file for anyone who has privileges to read. So be careful where you put it and who can see it.

Fourth, create your crontab. We will set the crontab to download the capture every half hour.
At the command prompt enter:

crontab -e

Then add a line like this:

30 * * * * /directory/of/your/executable_in_step_three

Make sure the permissions on the file allow it be executed.

Now, what will happen is every half hour the crontab will download the pcap file to the directory you specified. The first file will be named pcap, the second pcap.1, third pcap.2 and so on. You need to be careful to make sure your crontab is downloading the pcap file before the new packet captures get overwritten. You can adjust either your crontab time or the buffer size on your ASA to accomplish this.

Cisco WAAS keeps Olympic net humming

Paul Ingram, Senior Network Engineer at ABS, found this article on Cisco at the 2008 Beijing Olympics from Ann Bednarz at Network World:

Cisco's Cisco IP video technology and WAN acceleration gear is playing a behind-the-scenes role in one of the most watched events worldwide: the 2008 Beijing Olympic Games.

NBC is using Cisco’s IP video infrastructure and video-encoding technology to transfer multi-gigabyte files in near real-time so that NBC staff working in New York and Los Angeles can edit video after it’s captured in Beijing and ready it for delivery to TV, PC and smartphone screens.

Don't Miss!Read the latest WhitePaper - Best Practices for WAN Optimization with Data Replication

NBC expects to present more than 3,600 hours of broadcast coverage during the 17-day Olympic Games, which wrap up on Aug. 24. Online viewers will have access to 2,200 hours of video that they can play back on demand, as well as 3,000 hours of highlights and scoring results. Smartphone users will be able to watch video and view event results as well.

In previous Olympics, NBC staff worked from videotapes to add graphics and captions to event shots. But with so many thousands of hours of coverage planned, working from tapes and duplicating video copies for use at eight different affiliate networks would have been impossible, according to Cisco. Instead, NBC is using a file-based workflow to select shots and distribute them to affiliates -- even before an event is finished. To cut back on WAN bandwidth consumption, Cisco’s video encoding technology converts high-definition video into low-resolution MPEG-4 files for editors and shot selectors in North America to review. Once their selections are made, NBC determines which high-definition video files need to be transferred to affiliates.

"With the Cisco network solution, we've achieved the Holy Grail of digital video, which is the ability to perform shot selections on low-resolution files and extract high-resolution material from those files even as they are being recorded. That is a huge accomplishment," said Craig Lau, vice president for IT at NBC Olympics, in a statement.
In a blog posting, Cisco’s Douglas Gourlay highlights the role that Wide Area Application Services (WAAS) technology plays.

Cisco WAAS effectively optimizes 35Mbps links into 140Mbps links so that editors and shot selectors in New York and Los Angeles can “access gigabyte-sized video files over the WAN with the same performance as if they were stored locally,” writes Gourlay, who is senior director of marketing and product management for Cisco’s data center business unit.

Instead of sending 400 video shot selectors and editors to Beijing, NBC deployed three 155Mbps OC-3 pipes between Beijing and New York to transmit video to its studios. A Cisco 12004/4 Router collapses all three into one virtual pipe using equal cost load balancing, Gourlay writes. “Cisco WAAS leverages rather than overwrites router QoS, giving NBC the confidence to dedicate 400Mbps to video, unlike tunnel-based architectures.”

ABS Continues Cisco Channel Customer Satisfaction Excellence

ABS Technology Architects is pleased to announce that Cisco Systems has recognized us for achieving Cisco Channel Customer Satisfaction Excellence. ABS as achieved this customer satisfaction rating for six consecutive years, from 2002 - 2008.

Customer Satisfaction Excellence is the highest distinction a partner can achieve within the Cisco Channel Partner Program. ABS will be recognized for Customer Satisfaction Excellence in the Cisco Partner Locator (www.cisco.com/go/partnerlocator) with a special star indicator representing its achievement. Customers, Cisco personnel and partners will be able to identify us as having achieved outstanding customer satisfaction as part of Cisco's worldwide assessment process.

Channel Customer Satisfaction Excellence assessment is based upon the customer satisfaction results captured in the Cisco Partner Access Online tool (www.cisco.com/go/pal). Each quarter, Cisco will acknowledge Certified Partners that have the highest customer satisfaction distinction within each geographic region.

Customer Satisfaction Excellence is a core value that Cisco and ABS share, and a key driver of our current and future success.

For more information on Cisco Channel Customer Satisfaction Excellence, please visit: www.cisco.com/go/pal.

ABS Hosts 4 Network on Wheels Events Across the Commonwealth

ABS Technology Architects and Cisco Systems hosted the Network on Wheels (NOW) Van—with New Unified Communications and Security Demos—in three locations across Virgina so far this summer. On June 19 and 20, the van visited southwestern Virginia at the ABS office in Roanoke, and Emory & Henry College in Emory, Virginia. On July 10, TowneBank hosted the van at their Member Service Center in Suffolk, near ABS headquarters in Virginia Beach.

Visitors experienced the very best in real-world, small and medium-sized business solutions from Cisco in a mobile showcase that’s both educational and entertaining. The recently updated 25 foot van boasts the most advanced Unified Communications and Security solutions available today. It is equipped with the latest Cisco networking technologies. This unique showcase provides hands-on demonstrations of proven integrated networking solutions that are customizable to your business size and needs.

If you weren't able to visit the NOW Van in June or July, your next chance will be September 18 in Lynchburg, Virginia. For more information or to register for the event, please contact Julia Gardner at sales@absnt.com. Once onboard, you’ll take part in interactive demonstrations of technology solutions that can sharpen your competitive edge, maximize productivity, reduce operating costs, and increase user satisfaction—just what you need to increase the growth of your business.

Brian Meade Wins National Award in Internetworking

Kansas City, MO, June 27, 2008, 6:00 p.m.

Brian Meade, a student at Virginia Beach Public School’s Advanced Technology Center and Tallwood High School, was awarded the 2nd place in Internetworking at the annual National Leadership and Skills Conference and SkillsUSA Championships. The competition was held at H. Roe Bartle Hall, Municipal Auditorium and American Royal in Kansas City, Missouri, on June 24-26.

The SkillsUSA Championships is considered the largest single day of corporate volunteerism in America and valued at $33 million in industry support of donated time, equipment, cash and material. All contests are run by and judged by industry using industry standards for employment. Over 500 industry judges participated this year.

All winners receive medallions and frequently receive tools of their trade and/or scholarships to further their careers and education. The SkillsUSA Championships is for high school and college-level students who are members of SkillsUSA. More than 5,000 students from every state and three territories competed in 91 contests in technical, skilled, and service occupations, including health occupations this year. In order to qualify for the national competition, the students competed in local and state contests. The state gold winners advanced to the national SkillsUSA Championships. Brian Meade was one of only five contestants from Virginia to place in the SkillsUSA Championships in Kansas City, Missouri. He is currently employed as a Junior Network Engineer for ABS Technology Architects in Virginia Beach.

A complete list of winners is available. Go to http://www.skillsusa.org/compete/results.shtml. In addition, trade releases specific to each contest area are located at http://www.skillsusa.org/about/mediakit.shtml.

About ABS Technology Architects

ABS Technology Architects (www.absnt.com) is a Cisco Gold Direct Value Added Reseller (DVAR) headquartered in Virginia Beach, Virginia that provides both regional and national advanced technology solutions for corporate, educational, and governmental organizations. Founded in 1972, ABS has long been considered one of the top solution partners in the United States with an emphasis on Cisco based advanced technologies including IP Unified Communications, Contact Center, MESH Wireless, and Advanced Security Solutions. In 2004 ABS was named one of Cisco’s U.S. National Partners of the Year at the Global Partner Summit in Vancouver, Canada.

ABS Engineer Travis Wilson Achieves CCVP Certification

Congratulations to ABS Engineer Travis Wilson for earning his Cisco Systems CCVP certification!

The CCVP certification recognizes the increased importance placed on IT professionals of today who are responsible for integrating voice technology into underlying network architectures. Individuals who earn a CCVP certification can help create a telephony solution that is transparent, scalable, and manageable. Earning a CCVP certification validates a robust set of skills in implementing, operating, configuring, and troubleshooting a converged IP network. The certification content focuses on Cisco Unified Communications Manager (formerly Unified CallManager), quality of service (QoS), gateways, gatekeepers, IP phones, voice applications, and utilities on Cisco routers and Cisco Catalyst switches.

Travis successfully completed all five required tests for this certification in just under one year of employment with ABS. Prior to his tenure here, Travis had no experience working with Cisco Voice.

ABS Engineer Timur Snoke Achieves Cisco Security TSS

Timur Snoke, a Senior Technology Architect at ABS Technology Architects was officially designated as a Technology Solution Specialist (TSS) for Cisco Security Advanced Technology products yesterday by a review board of Cisco employees. Timur is the only Security TSS in the Virginia Mid-Atlantic Region.

A Technology Solution Specialist is a qualification given to a Cisco Partner Engineers who can expertly explain, demonstrate, & design a technical solution within a particular technology, as well as escalate and facilitate post-sales issues during the implementation phase. A TSS must continue to participate and stay current in their chosen technology to maintain their designation. Cisco created the TSS Program to create awareness within Cisco for the best partner pre-sales engineers, create demand in the customer base for the best partner pre-sales engineers, and recognize partner pre-sales excellence.

Timur Snoke has been with ABS since 2005. He has designed, developed and deployed a variety of Cisco based solutions for customers across industries, including secondary education, higher education, utilities, and corporations. Timur received a Masters degree in Information Security from James Madison University, in conjunction with two NSA approved certificates: Information Systems Security Professionals and Information Systems Security Officers. He and his wife celebrated the birth of their daughter in November 2006, and they live in Roanoke, Virginia.

Congratulations Brian Meade!

Congratulations to ABS Junior Network Engineer Brian Meade for taking First Place at the SkillsUSA Internetworking State Competition on April 26, 2008. The competition included a router simulation, written test, and cable making portion. ABS would also like to wish Brian good luck when he goes to the National Competition in Kansas City, Kansas on June 26, 2008.

Here is Brian posing with his medal.:

ABS Sponsors College Student Viral Video Contest “Emory Has Connections”

ABS is sponsoring a viral video contest for the students of Emory & Henry College. The topic of the videos is how students’ lives are affected by the new wireless network that ABS installed in 2007. Please take a minute to watch the videos and appreciate the students' creativity and hard work. Many of the students are receiving extra credit in class for their videos, and the winner will be receiving a cash prize from ABS. Half of the contest depends on how many hits each video receives, so if you really like one, be sure to pass it on to your friends/family/etc.

You can view the videos here:

http://www.youtube.com/group/ABSVideoContest

Cisco and IronPort: Filters Are Not Enough

(From ISP-Planet)
by Alex Goldman ISP-Planet Managing Editor.

A recent report from IronPort and its parent company Cisco says that threats are not only growing, they are changing in ways that will force ISPs to adopt new anti-malware technologies.

"ISPs know that spam is out of control," says Rand Wacker, senior group product manager at an anti-malware subsidiary of Cisco, San Bruno, Calif.-based IronPort. "We saw a 100 percent increase in spam this year, and a 100 percent increase last year. It's an arms race, and in order to maintain a consistent absolute number of messages arriving in each inbox, spammers are increasing the number of messages sent. We're seeing the equivalent of 20 spam messages per day for every man, woman, and child on the planet."

Attacks are changing. "The really scary part," says Wacker, "is the viruses that infect systems through vulnerabilities, such as in IE, that are not detected by traditional anti-virus software."
Whereas in the past, a virus would have been contained in an attachment, today the malware can be in a remote website, and the spam need simply contain a URL directing the recipient to an infected website. All of it is detailed in a new report from IronPort and Cisco called, "Internet Security Trends for 2007: A Report on Spam, Viruses, and Spyware."

Converged threatsAnti-malware vendors now have to protect against all threats. It's increasingly difficult to distinguish between viruses and spam, but end users know they don't want either of them. "We're seeing this change," says Jon Orbeton, IronPort product manager. "Anti-virus vendors initially did not offer protection against spyware, and now many do. We're seeing a merge between anti-virus and anti-spyware. Our own devices have both Webroot and anti-virus scanning on board."

IronPort is touting Senderbase, a system we first wrote about in detail two years ago (see The Future of Messaging). As you can see from the title of our 2005 article, we were impressed with Senderbase from its inception. Many anti-malware operations have a threat operations center (TOC) and track trends in bad stuff in real time. But none that we know of track 110 variables in real time (although MessageLabs might be doing this).

The reason it's necessary, according to IronPort, is a new type of malware.

A new malplatformTake the Storm "virus" as an example. The report notes that Storm is so new that it did not fit into the malware categories we are accustomed to. Storm, the report says, has been called a trojan, a botnet, a worm, a spam engine, and a DDoS network. "The many names are an indication of the number of features Storm provides and the fact that it is a new class of malware—the reusable attack platform."

Orbeton explains that while in the past, viruses were written with specific instructions, attacking one vulnerability and delivering one payload, Storm can receive updates. For example, the botnet component is designed to keep track of which machines remain infected and which have been cleaned. It is even designed to track the behavior of researchers and launch DDoS attacks at any machine deemed to be studying the Storm system.

"At first we wondered why it was launching automated attacks against investigators," says Orbeton. "Then we realized it was because Storm's creators has spent so much time designing it and intend to reuse it."

Further malware innovations loom. Wacker warns that legitimate sites have been infected and used to spread trojans. "We no longer see website defacements by teenagers," he says. "These are professionals and they want their malware to be stealthy."

IronPort is warning that there's a problem and it offers its own products as part of the solution. Whether or not you choose IronPort for your own operation, at the very least make sure that you can protect your customers from web-based threats. IronPort's products, especially Senderbase, are well worth looking at.

We'll have more on Unified Threat Management (UTM) later this month when we publish a report from our security expert, Lisa Phifer.
—End

Cisco Security Advisory: SQL injection in Cisco Unified Communications Manager

Summary: Cisco Unified Communications Manager is vulnerable to a SQL Injection attack in the parameter key of the admin and user interface pages. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database.

Cisco has released free software updates that address this vulnerability.

Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0026 has been assigned to this vulnerability.

URL:
http://www.cisco.com/en/US/customer/products/products_security_advisory09186a0080949c7c.shtml (available to registered users)

http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7c.shtml
(available to non-registered users)

Education & Technology: An Extraordinary Opportunity Exists Today

Only occasionally in the world of technology does a confluence of events occur that creates truly a “game changing” opportunity for an entire market. It is ABS’ opinion that we are seeing such a confluence of events in the education space with the advent of high quality, affordable and soon to be ubiquitous handheld 802.11 devices, the development of Web 2.0 applications, and the emergence of high speed wireless mesh networks. The combination of these three technologies has the potential to dramatically change the education space as we know it today. However, the challenge for all of us is to plan, manage, and leverage this education revolution. Failure to recognize and plan for this intersection of technology and educational opportunity will, at best, result in a missed opportunity and, at worst, devolve into educational confusion.

We can try to deny it, but the day of the 802.11 capable PDA’s, telephones, iPods, and the next-cool-thing is here. It may not happen this year, but by the end of 2008, it is not only possible, but very likely that most students in middle school and higher will show up at school or on campus with some flavor of hand held 802.11 device. This can either be an educational godsend or an educational nemesis depending on your plans to make these devices a leverage point in the school curriculum.

If you have not seen Karl Fisch’s YouTube video Did You Know 2.0, ABS recommends that you view it. While there are some quibbles about the accuracy of some of his statistics, the macro-level message is clear. Rapidly advancing cultural, demographic, and technological change is creating an educational whirlwind that we need to embrace, or we could face dire consequences. The clear and undeniable expectation for students today is to be connected; to be “on,” to be reachable every minute of every day. The expectation is that they are connected to almost limitless resources through the internet, and that communication over what we see as a traditional telephone call with a wired phone, is essentially a marginal technology of limited use.

Not convinced of the coming tidal wave of the 802.11 PDA? Consider that it took Apple over 18 months to sell the first one million iPods. That is almost 600 days. Apple sold one million iPhones in just 74 days. The iPhone has brought 802.11 access into the mobile, handheld mainstream. This cat is out of the bag and is not going back in. The ramifications for education are enormous as applications that leverage that capability of the iPhone and other knockoff devices grows rapidly.

ABS also strongly believes in the rapid development and rapid use of Web 2.0 applications… software as a service…ad hoc, high quality, interactive collaboration tools. It is our opinion that the day of canned, information “push” material in both the business and educational world is beginning its decline. Static content, non-interactive web experiences are going to become less relevant in our daily business lives, and will be boring and ineffective as an educational tool. It is ABS’ view that dynamic educational content, accessed anytime, anywhere across a school division is going to become part of the educational Web 2.0 experience.

Collaborative JIT (Just In Time) cram sessions between students at opposite ends of a campus using handheld 802.11 devices, quizzing each other interactively and posing questions is easy to envision. These students could then easily reach a teacher or teacher’s aid using their own 802.11 device, and, using WebEx or some variant of WebEx, set up an ad hoc, interactive review session…where no one is constrained by physical space, location, or network jacks. It is easy to envision a high school student working outside or sitting in a study hall, listening to a lecture from a Stanford professor on An Evening with Jefferson, on iTunesU as they prepare for a project on Colonial America.

In the Web 2.0 world, content is fluid throughout an entire school division and even between school divisions. Collaboration is a part of everyday life, and external research content accessed anywhere, anytime is an expectation versus a luxury. Teacher and classroom blogs are the standard for students in a Web 2.0 environment and Wiki’s are a part of the educational process. Each of these tools is expected to be accessible from anywhere in the school division and shared between students, teachers, and parents. All of these tools are here today. The expectation from students is that they will be part of their educational and business lives. The hand held 802.11 device is going to make access better, and educational possibilities limitless. However, it is imperative that we have planned to make these tools a cornerstone of the educational process.

The foundational technology that makes hand held 802.11 devices and Web 2.0 applications relevant is high speed wireless technology. Specifically: indoor and outdoor wireless mesh. It is that simple (or daunting depending on your role). When ABS discusses wireless capability with our clients, we are talking about wireless access literally everywhere in a school division or college campus: Academic buildings, administration buildings, dining halls, maintenance facilities, center field, twenty-five yard line, everywhere.

The development of wireless technology is the third leg of the stool that is creating this academic revolution. Hand held devices and collaboration applications are great, but if there is not high quality, high speed, reliable access, they become an annoyance instead of an educational asset. Wireless mesh technology is the glue that holds everything together. There are not many “foundation” technologies that we see across a specific market, but this is truly one for education.
It is ABS’ opinion that high speed access everywhere is going to be a “must have” for both K-12 and higher education. It is our experience and strongly held opinion that despite what vendors may have said, this technology has not been a practical reality for our clients for more than 24 months. What is new about wireless mesh is that:
- Now it is a routed technology using AWPP.
- It is a technology that continues to get faster.
- Indoor/outdoor wireless mesh can now be deployed, accessed, managed, and secured across an entire multi-site school division or college campus as a singe network.

We believe that these three developments in wireless technology make it a viable and necessary technology for all of our education clients. When combined with the viability of handheld 802.11 devices and Web 2.0 applications and content, indoor/outdoor wireless mesh becomes a requirement for education moving forward. Finally, while we always expect to see a lag between the Quality of Service capabilities of the wired versus the wireless network, the advances made in wireless QoS enable us to confidently deploy advanced applications across a wireless infrastructure.

ABS is excited about what we see on the horizon for the education space. The opportunity for educational advancement before us is immense. It will not only be possible, but practical, to engage students fully in the educational process in ways that make sense to them, and leverage the tools they use in everyday life. The risk we run is that our educational messages are lost not because they are ineffective or irrelevant, but because they are not packaged and presented in ways that are meaningful to the target audience. The opportunity is at hand; the technology not only exists today, but is mainstream and cost effective. It is our job to help our clients deploy the foundational technology they will need to serve their students today and tomorrow.

-David Rayner, Vice President of Sales

ABS Engineer Update - Bill Waldron on Emory & Henry College Wireless Deployment

During the summer of 2007, ABS was selected by Emory & Henry College, near Abingdon VA, to design and implement a totally new switching infrastructure, a new campus-wide wireless network, and network access control for students and staff. A Cisco Catalyst 6513 core switch was purchased and installed, along with approximately 30 additional Cisco 3560 PoE and non-PoE distribution switches to supplement the existing Cisco switches. Emory & Henry had the advantage of having a fiber backbone from their MDF to nearly every building on the campus. What they did not have was a Layer 3 network. With Layer 3 IDF switches not in the current budget, we went to work designing a segmented Layer 2 network, utilizing the newly purchased 6513 core switch to do the Layer 3 routing. The entire campus was logically subdivided into more than 180 VLANs, segmenting traffic throughout the campus.

With the desire to provide wireless coverage for the entire campus, indoors and outdoors, ABS and Emory & Henry chose the Cisco Unified Wireless solution. Within the 6513 core switch, two Wireless Integrated Service Modules, or WISMs, were implemented for redundant wireless management. Each WISM contains 2 Wireless LAN Controllers and each WLC is capable of managing 150 APs. For outdoor wireless coverage, Cisco 1510 LWAPP MESH APs were strategically placed throughout the campus to provide 802.11g coverage for clients in 100% of the populated areas. For indoor coverage, Cisco 1242AG LWAPP APs were used to provide wireless access in each of the approximately 48 buildings on campus. The result was an all-encompassing WLAN that provides wireless network access for all students, faculty, and staff, regardless of where they are located on this historic campus. Emory & Henry College became the first College in the state of Virginia to attain Unified Wireless coverage on 100% of their campus.

Emory & Henry also had several buildings located just outside of the campus boundaries that had no wired infrastructure to support students or staff. To spread the campus network to these outlying areas, MESH wireless links were designed, utilizing the 802.11a backbone of the Cisco 1510 APs, as well as several Cisco 1030 APs. The solution worked perfectly; it even created one bridge link to a guest residence located more than a quarter of a mile across the campus golf course. Users can now roam across the entire campus, maintaining a reliable wireless link to the EHC Wireless Network.

In order to control access to the newly wired and wireless networks, ABS and college IT staff chose Cisco Network Access Control, or NAC, and Cisco Clean Access to provide approved access to network resources and assurance that minimum requirements were met by all clients accessing those resources. Using a combination of “In-band” and “Out-of-band” configurations allowed the same redundant NAC cluster to manage wired and wireless clients throughout the campus network.

This project was started in mid-June 2007, after students vacated a large portion of the buildings. The wiring of all data drops to support the more than 200 APs was subcontracted to Teleconnect Inc., out of Johnson City, TN. The team at Teleconnect pulled off nothing short of several small miracles in wiring each of the more than 40 historic buildings on the campus, and did it on schedule. Our promise to Emory & Henry was to complete the project by the time students returned to school in August, providing them with a fully functional wireless environment. We achieved this, with time to spare, due to the hard work and dedication of the ABS Engineers.

Emory & Henry College now plans to add WCS, or Wireless Control System, to the solution. This will give them central management, reporting, and monitoring of the 4 Wireless LAN Controllers and all 200+ APs throughout the campus. This type of centralized management is very important when a school has to control large quantities of technology with a small IT staff.

Map of E&H Campus:


~Bill

Bill Waldron
CCNA, CAWFS, MCSE, MCSA
Senior Technology Architect
ABS Technology Architects

ABS Response to Cisco Security Advisory: Cisco Unified Communications Manager CTL Provider Heap Over

ABS would like to make our customers aware of the CTL service being exploited in the CUCM/CCM server via a DoS attack. That service is only usually used if there is some kind of security/encryption being used on the CCM servers beyond the standard features.

This is an exploit that Cisco Unified Communications customers need to know about, and they should be aware that it allows a Denial of Service (DoS) attack. Customers should also be aware that it may not be a service they need to have enabled, depending on the deployment.

For a service fee of $150.00, ABS will provide an engineer to remotely connect to the CCM cluster and confirm that the service is or is not running, and then disable the service (if it is not required) in alignment with the workarounds provided. While doing this, ABS will also have the engineer confirm the current OS and CCM version and patches, as well as verifying the last time a successful backup was run on the server.

Please contact your ABS Account Manager, or Julia Gardner at sales@absnt.com for more information.

Cisco Unified Communications Manager CTL Provider Heap Overflow Summary:

Cisco Unified Communications Manager (CUCM), formerly CallManager, contains a heap overflow vulnerability in the Certificate Trust List (CTL) Provider service that could allow a remote, unauthenticated user to cause a denial of service (DoS) condition or execute arbitrary code. There is a workaround for this vulnerability.

Cisco has made free software available to address these vulnerabilities for affected customers.

Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0027 has been assigned to this vulnerability.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080116-cucmctl.shtml

Malware Outbreak Report: "Storm Love"

As a follow-up to the last post on the 2008 security outlook, here is some more information about the Storm Network. This is more of their handiwork, multiphase, blended attacks:


Malware Outbreak Report: "Storm Love"

On January 15th, IronPort analysis labs detected a Valentines Day-themed attack that the Storm attack network is launching in advance of February 14th. This campaign uses a blended attack that combines both Email Spamming and malicious HTTP landing pages.

Over the past year, the Storm malware has continued to mutate and proliferate. January marks the one-year anniversary since the initial release of Storm. Storm continues to use events within popular culture to social engineer users into viewing the email and subsequently opening the malicious HTTP link.

IronPort stopped this most recent Storm attack within minutes through the combination of several technologies:

IronPort Reputation Filters: IronPort uses its SenderBase Network to assign reputation scores to Internet IP addresses based on their likelihood to send spam or host malicious websites.
The Email Reputation system blocks 80% of spam at the gateway – including Storm Spam.

The IronPort Web Reputation blocks protected networks from connecting to the Storm HTTP landing pages and the DVS scan engine will block the download of an infected executable. This Storm version may also contain a Phishing component – and despite not being currently active, the Phishing URLs have been preemptively blocked to ensure ongoing customer protection.

SenderBase is aware of the majority of Storm infected PCs and blocked these suspicious senders from sending Storm Spam proactively. For more detailed information about Storm please see IronPort's 2008 Internet Security Trends: http://www.ironport.com/securitytrends/

2008 Internet Security Trends

The objective of the ABS website is to be an information portal for our clients and prospects. While we prefer to present original content to our clients and prospects, in our research, we sometimes come across what we consider to be best-of-breed material and want to make that available to our clients and prospects in its entirety.

We believe the following report, published by IronPort and Cisco, on the state of the spam/virus/malware industry for 2008 is a “must read” for anyone with a network…or connected to the internet. In writing this introduction, we chose our words carefully. The virus/spam/malware authors out there have literally created an industry. They are monitoring and tracking their successes and modifying code to meet their objectives. They are investing in R&D to meet their objective, which is to penetrate your defenses and insert themselves into your operating environments. They have ROI metrics on their “products” and they are working to wreak havoc on your network, your productivity, and your organization.

ABS sees this as a chess game that will run into perpetuity. There is no checkmate for those of us on the defending end of the network security game, there is only the daily battle fought to keep networks running, servers intact, and data uncompromised. The more we know about the trends in the malware industry the better prepared we will be to defend ourselves against the latest intrusion strategy. We highly recommend the following report and would be glad to discuss these ideas with you and your organization.

http://www.absnt.com/files/For-Blog/2008-Internet-Security-Trends.pdf

ABS Engineer Update - Larry Woods on VBCPS Wireless Deployment

As of January 9th, 2008, and over the last year, ABS has worked directly with Virginia Beach City Public Schools to design and install a district wireless coverage implementation project. We have currently completely finished 24 of 86 schools. To date, we have three more High Schools to go and have completed all but two Middle Schools. The end result will be a completely mobile, flexible wireless environment to allow teachers/students the ability to do research and testing through wireless laptop computers wherever the school has the space.

This deployment is currently one of the largest installations ever in Virginia and even along the east coast. It involves 18 Cisco Wireless Integrated Service Modules (also known as WiSMs) that accounts for 36 Cisco Wireless Controllers over seven Cisco 7613 Routers, three Cisco Wireless Control Systems (to allow for management of all Controllers and Access Points), and up to 4,500 Cisco Wireless Access Points. Next week, we will be installing three Cisco Location Appliances that will use the Wireless Infrastructure to triangulate the locations of Wireless clients on floor plan maps of schools imported into the system. We will also be upgrading the entire system from version 4.0.217.0 version of code to 4.2.62.0 permitting the ability to do many more added on features.

We are in the process of installing approximately 160 Cisco 3750 Layer 3 Switches (two per site) and close to 400 Cisco 3560 PoE switches. With this equipment, the network will provide PoE capabilities to all Wireless Access Points and set the Virginia Beach City Public Schools current fiber ring to hand off a 1 Gbps connection to all schools/sites.

Redundancy has been added with multiple connections to the fiber ring and to the equipment at each wiring closet. Redundancy is a big factor in the design of the Cisco Wireless LAN Controllers as well. This system has been designed with the N+1 factor in mind where there is a full redundancy if an entire Cisco 7613 Router chassis goes offline for up to three WiSM modules (six Wireless Controllers). Bottom line, if something happens to a Wireless LAN Controller, the Wireless Access Points that were registered to that Controller will rather seamlessly roam to a backup controller with no problems and barely affecting client wireless usage.

Our plan from this point is to complete the installations of all 86 schools with wireless coverage. After that, there are plans in mind to set Wireless Laptop Carts with Printers installed on top to connect wireless over the network to minimize cables and user confusion also allowing the ability to track laptop carts in buildings. We have also designed and are on the verge of creating a Wireless Guest User access privilege for guests coming in and using the school’s internet connection. This new Wireless infrastructure will also allow for Voice over IP phones to be utilized at each site potentially if this is the direction the school system goes with.

Essentially, we have a very strong plan of attack and have executed this plan almost flawlessly. We have a great team of engineers working hard and diligently through the late hours of the night with the same goal in mind – a perfect installation – for each and every school. This has been very exciting for us and we look forward to continue our efforts even after this project is completed.

~Larry

Larry W. Woods
CAWLFS, CAWLDS, CCNA, CCDA,
CISS, PCWE, PCBA, PCBE
Senior Wireless Architect & Systems Engineer
ABS Technology Architects

Welcome to The Digital Blueprint

Welcome to The Digital Blueprint, the ABS Blog. We are excited to kickoff this blog for our clients, our prospects, our internal team, and anyone who is interested in leading-edge network technology. It is our intent for this to be an open forum to discuss ideas, share content, debate positions, and generally conduct civil and professional discussions about a wide variety of topics. ABS will kickoff discussion topics on a regular basis each month. These topics will range from updates on leading edge projects we ware working to debating the merits of new protocol standards or implementation strategies for a particular technology. We do not see this as a “help desk” site for specific, real time network issues (please click to chat with us for those questions and issues) but we hope that the content from The Digital Blueprint is helpful and interesting. ABS will not be in the business of editing or censoring the opinions or positions of posters, but we will make sure that the posts are respectful and professional and will remove posts that do not meet that standard. We are looking forward to lively interaction with those who find the technology we deploy and facilitate as fascinating as we do. We are excited about what we see on the horizon and we are interested in your ideas and opinions. Thank you for visiting The Digital Blueprint, we are glad to have you join us!