1)      ITKE* employees

2)      Contractors /Outsourced companies

3)      Visitor Engineers Access (Vendors)

1 ITKE* staff Access

It is given to people who have free access authority into the Data Center. ITKE* staff Access is granted to the ITKE* staff whose job responsibilities require that they have access to the area. These individuals also have the authority to grant temporary access to the Data Center and to enable others to enter and leave the Data Center. People with ITKE* staff Access are responsible for the security of the area, and for any individuals that they allow into the Data Center they MUST listed on Authorized Access List.  Individuals with ITKE* staff Access to the area may allow properly authorized and logged individuals (sign in and out) for contractors and visitor engineers when they Access to the Data Center.

2 Contractors/ Outsourced companies Access

It is closely monitored access given to people who have a business need for infrequent access to the Data Center. “Infrequent access” is generally defined as access required for pried of time (depend on the contract). A person given Contractors Access to the area MUST sign in and out under the direct supervision of a person with Controlling Access. A person with Contractors Access to the area MUST NOT allow any other person to enter or leave the area until have permission from ITKE* staff Access. Only those Representatives identified in writing by the Customer on the ITKE* Data Centre Access Authorization List Form may make request to enter the Data Centre. Each Customer MUST ensure that the Representatives and the accompanying persons do NOT take any actions that Customer is prohibited from taking under this Policy.

3 Visitor Engineers Access (Vendors)

It is granted to a person from vendors who have to do insulation or some work in the data center. A person given visitor engineers access to the area MUST sign in and out and submit report under the direct supervision of a person with Controlling Access. A person with visitor engineer’s access to the area MUST NOT allow any other person to enter or leave the area. Maximum of 3 persons, of whom at least one MUST be a Representative, may enter the Data Centre at the same time. For security reasons, all visitors (Representatives and accompanying persons) will be requested to show his/her STAFF ID or Passport for verification. He/she will be refused to enter the Data Centre if the required credentials CANNOT be shown.

In upcoming post let’s continue our journey with the policy and procedures related to Data Center access.

In this particular part of my article I will try to focus on the Data Center physical security policy and procedures.

1. Overview

Security for the Data Center is the responsibility of all departments that are sharing the data center space. ITKE* is responsible for the administration of this policy. The following are the general requirements and policies to access to this sensitive area. Failure to follow the guidelines set forth in this document is grounds for termination of agreements and potential legal action.

Customer MUST NOT, except as otherwise agreed by ITKE*,

1. 1. Place any computer hardware or other equipment in the Licensed Area
   2. Store any other combustible materials of any kind in the Licensed Area; and
   3. Bring any “Prohibited Materials” (as defined below) into the Data Centre. Prohibited Materials shall include, but NOTlimited to, the following and any similar items:
      1. 1. Food, drink, illegal drugs and other intoxicants
         2. Tobacco products
         3. Explosives and weapons
         4. Hazardous materials
         5. Electro-magnetic devices, which could unreasonably interfere with computer and telecommunications equipment
         6. Radioactive materials
         7. Photographic or recording equipment of any kind
         8. Any other items deemed inappropriate at ITKE*’s sole discretion.

2. Primary Guidelines

The “Data Center” is a restricted area requiring a much greater level of control than normal spaces. Only those individuals who are authorized to do so by the ITKE* may enter this area.  Access privileges will only be granted to individuals who have business need to be in the data center.

All departmental staff sharing the Data Center will familiarize themselves thoroughly with this document. Any questions regarding policies and procedures should be addressed to ITKE*.

The only exception allowed to the Data Center Security Policies and Practices is temporary suspension of these rules if it becomes necessary to provide emergency access.

In upcoming article I will try to focus on levels of access can be provided to the Data Centers.

*ITKE is used just as reference which can be replaced by your organization or department name.

Look at its popularity it was a right move by Cisco Systems to introduce the Cisco CCT Telepresence Certification, which focuses on the on the skills required for onsite support and maintenance of Cisco TelePresence Systems. Technicians in this area must be able to identify Cisco TelePresence models, accessories, cabling, and interfaces; understand the Cisco TelePresence operating modes and identify commonly found software; and be able to use the Cisco Command Line Interface (CLI) to connect and service products and make basic Cisco TelePresence system adjustments.

The only prerequisite for Cisco CCT Telepresence Certification is Cisco CCT Routing and Switching.

For further details do check the Cisco Learning Network Website

Personally I welcome the introduction of Cisco CCT Data Center certification, especially after Cisco announced their Nexus 7000, Nexus 5000, and Nexus 2000 Series Switches which are specially designed for Data Centers. Certainly this move by Cisco System empowers the Data Center operators or Technicians to demonstrate the knowledge and ability required for the onsite support and Maintenance of Cisco Data Center Products.

The Cisco CCT Data Center Certification ensures that the certified individual have knowledge of the Cisco Nexus 7000, Nexus 5000, Nexus 2000 and MSD 9000 (SAN Switches) product line along with the basic knowledge of the NX-OS and simple commands required to perform tasks such as password recovery.

In order to be  Cisco CCT Data Center Certified the only prerequisite is to have valid Cisco CCT Routing and Switching Certification.

For further details do check the Cisco Learning Network Website

Currently Cisco Systems are offering three Cisco Certified Technician (CCT) Certifications.

1)      Cisco CCT Routing & Switching certification

2)      Cisco CCT Data Center certification

3)      Cisco CCT TelePresence certification.

The Cisco CCT Routing & Switching certification which certifies that an onsite technician has the required skills and knowledge to work with Cisco Routers and Switches performing task such as troubleshooting, repairs, hot-swap of specific components, and create TAC tickets as required. The Cisco CCT Routing and Switching certification serves as a prerequisite for the Cisco CCT Data Center certification and the Cisco CCT TelePresence certification.

Exams & Recommended Training for Cisco CCT Routing & Switching certification are as follows

In my next post I will talk about Cisco CCT Data Center certification and the Cisco CCT TelePresence certification. It’s a good move from Cisco and for sure this certification is very handy and provides a solid foundation to all those technicians who are aim the sky (CCIE)

In my previous post I was discussing about Gateway Load Balancing Protocol (GLBP), now let’s see how Gateway Load Balancing Protocol (GLBP) does load balancing?  Basically there are three different types of Load balancing algorithms applied

Round Robin:

• This method is the default method used by Gateway Load Balancing Protocol (GLBP).
• In this method the when the client sends ARP requests to resolve the MAC- address of the default gateway , the reply contains the MAC address of the next possible router in round-robin fashion

 Weighted:

•  Gateway Load Balancing Protocol (GLBP) places a weight on each device to calculate the amount of load sharing that will occur through MAC assignment
• The routers participating in GLBP will advertise its weight and AVG will act based on that value
• For example if we have two routers named ITKE-Router A and ITKE-Router B. If the ITKE-Router A has double the bandwidth capacity then the ITKE-Router B. ITKE-Router A will be configured with the double weighting value of ITKE-Router B

Host-Dependent

• Each Client will always get the same Virtual MAC address.

• The Mac-address of the host is used to determine which AVF’s mac the host is directed towards.

• This method is used when the client needs a consistent gateway MAC -address.

• Host dependent GLBP is not recommended in situation where there are small number of hosts, for example, less than 20

In upcoming posts let’s see how to configure Gateway Load Balancing Protocol (GLBP) in Cisco devices.

GLBP better known as Gateway Load Balancing Protocol (GBLP) is a Cisco proprietary protocol especially designed overcome the limitations of Hot Standby Routing Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP). The added feature to Gateway Load Balancing Protocol (GLBP) is it can load balance between the gateways where as in HSRP and VRRP, the standby routers are configured for redundancy and act as standby only and become active only when the active router fails.

The Gateway Load Balancing Protocol (GLBP) provides load balancing over multiple routers (gateways) using a single virtual IP address and multiple virtual MAC addresses. The forwarding load is shared among all routers in a GLBP group rather than being handled by a single router while the other routers stand idle. Each host is configured with the same virtual IP address, and all routers in the virtual router group participate in forwarding packets. GLBP members communicate between each other through hello messages sent every 3 seconds to the multicast address 224.0.0.102, User Datagram Protocol (UDP) port 3222 (source and destination).

The Gateway Load Balancing Protocol (GLBP) elects one router as active virtual gateway (AVG) based on highest priority value or highest IP address in the group, if there is no highest priority.  The active virtual gateway (AVG) to respond to ARP requests sent to the virtual gateway IP address replying different virtual MAC addresses depends on which load-balancing algorithm is configured.

All routers participating in GLBP group gets the necessary virtual MAC addresses from the active virtual gateway (AVG). Up to four virtual MAC addresses can be used in any group. Each of these routers is referred to as an active virtual forwarder (AVF), forwarding traffic received on its virtual MAC address. Other routers in the group serve as backup or secondary virtual forwarders, in case the AVF fails. The AVG also assigns secondary roles.

The Gateway Load Balancing Protocol (GLBP) is part of CCNP 642-813 Exam curriculum and you must master this protocol as you can expect few questions.

In upcoming posts I will try to highlight on load balancing techniques used and how to configure Gateway Load Balancing Protocol (GLBP) in Cisco Routers and Cisco Catalyst Switches .When it comes to Catalyst Switches GLBP is currently available with Catalyst 6500 Supervisor 2 with IOS Release 12.2(14) SY4 or later and Supervisor 720 with IOS Release 12.2(17a) SX4 switch platforms.

Cisco’s TechWise TV is webcasting a  60 minute Episode on 29th of October 2009  with a title ‘”Routers Are Dead. Long Live the Router!” where you can learn the Cisco integrated services router will dramatically simplify your branch architecture and greatly reduce your network management workload.

 [kml_flashembed movie="http://www.youtube.com/v/BTebfzQkDhE" width="425" height="350" wmode="transparent" /]

By registering to this web cast you will get the chance to see the technological advances that will enable you to create a truly borderless network, while giving you the convenient, powerful network management features you crave in today’s resource-challenged IT environment.

The Agenda

• ISR G2: New Model New Story
• The ISR Autopsy
• New Modules
• Security Innovation in the ISR
• Collaboration Enablement
• The Service Ready Engine
• Universal IOS
• Long Live the Router

Register now

In the following example we will configure the interface fast Ethernet 0/9  to default configuration

Current Configuration for fast Ethernet 0/9  

ITKE-Cisco#sho running-config interface fastEthernet 0/9

Building configuration…

Current configuration : 85 bytes

!

interface FastEthernet0/9

 switchport access vlan 100

 switchport mode access

end

ITKE-Cisco

Now we will configure the fast Ethernet 0/9 to default configuration using the following command

“default interface fastEthernet 0/9” 

ITKE-Cisco#configure t

Enter configuration commands, one per line.  End with CNTL/Z.

ITKE-Cisco(config)#default interface fastEthernet 0/9

Interface FastEthernet0/6 set to default configuration

ITKE-Cisco(config)#

Running configuration for fast Ethernet 0/9 after configuring to default settings

ITKE-Cisco#sho running-config interface fastEthernet 0/9

Building configuration…

Current configuration : 68 bytes

!

interface FastEthernet0/9

 switchport mode dynamic desirable

end

ITKE-Cisco#

Pic Courtesy: Cisco

The ASR 9000 also includes new technologies for proactively managing notoriously challenging video signals. It makes corrections and ensures picture quality for ultra-clear high-definition TV and other video services, Cisco executives say.

For more details check the press release from Cisco.