Michael McNamara

technology, networking, virtualization and IP telephony

Working from home upgrades

by

I made some purchases over the past few months to help improve my work from home environment and thought I’d share my thoughts on those items. I purchased all the items below from from my local BestBuy using the BestBuy Android mobile app with curbside pickup. As someone who works in retail I was really impressed with how well the checkout and curbside pickup process works at BestBuy and how effortless it was, a real technology win in my honest opinion. Kudos to their team on an incredibly frictionless process and to all their store associates. The pricing for each item was in line with pricing from online resellers so I wasn’t really sacrificing anything by purchasing from a traditional brick-n-mortar business and I was happy to support my local store.

LG – 34WL500-B 34″ IPS LED UltraWide FHD FreeSync Monitor with HDR (HDMI) – Black

When you upgrade to an UltraWide display you won’t ever want to go back. I desperately needed the additional desktop space on my work laptop to help improve my general productivity. I usually have 15-30 windows open at any time and having to switch back and forth, or worse yet go hunting for individual windows can be an incredible productivity drain. This display only has a max resolution of 2560 x 1080 but that’s fine for my aging eyes and provides me all the desktop real estate I need to work efficiently. The included stand isn’t overly large and brightness levels from the display are great. This monitor is currently on-sale at BestBuy for $300, a great price for a 34″ wide monitor. The 29″ version LG 29WL500-B is an even better deal at BestBuy for $200. I would recommend either of these for a work from home environment. I don’t play any games on this display so I can’t comment about game performance.

Logitech – G PRO X Wireless DTS Headphone:X 2.0 Gaming Headset for Windows with Blue VO!CE Mic Filter Tech and LIGHTSPEED Wireless – Black

I’ve traditionally used relatively cheap Plantronics headsets on my home desktop but I decided it was time to cut the cord and go with a premium wireless headset that would allow me to move around on long conference and video calls. Having the ability to move it around between my personal desktop and my corporate laptop was also extremely beneficial. I’m not yet sold on the Blue VOICE feature, I didn’t particularly like how I sounded with that feature enabled so I need to-do some additional testing and validation. I’m still up in the air about this headset, I’ll need a little more time before I decide if it was a good purchase.

Bose – Companion 2 Series III Multimedia Speaker System (2-Piece) – Black

I’ve often opt for the cheap Insignia speakers but this time I wanted a quality set of speakers to use when I wasn’t using my wireless headset and so I chose the Bose Companion 2 Series III speakers. I’m not a high-fidelity guy but these sound incredibly better than any other computer speakers I’ve ever owned and easily rival the sound put out from the Onkyo receiver and speakers in my basement surround sound system. These speakers get a solid buy rating from me. There are likely better options available for the audiophiles out there but I couldn’t justify spending $200 or $300 on desktop speakers.

Have you made any purchases lately? Anything fun?

Cheers!

Point to Point Wireless Bridge – Savior or Destroyer

by

Hopefully you can see where I’m going with this… years and years ago… I setup an infrared point to point wireless bridge between two buildings across a public street that promised 100Mbps connectivity. Initially the solution delivered on its promise… we had 100Mbps of connectivity without any monthly telcom charges. It was seen by the purse holders as a huge success for it’s near $0 operating cost. That was until 7 months later when old man winter came calling… ice buildup on the infrared cameras and condensation inside the housing required some maintenance activities which ultimately led to alignment issues and it all went downhill from there. It was incredibly difficult and painful standing on the 6th floor of a hospital roof in 11F temperatures leaning out over a parapet wall trying to align a pointer with an object 500 ft away. Needless to say I was left somewhat scarred by the experience.

I had another opportunity to try my hand at a point to point wireless solution albeit somewhat reluctantly. In this case the distance that we needed to span was about 1,500 ft. The construction costs to pull fiber into this building was in excess of $50,000 so I reluctantly starting looking at wireless solutions. Ultimately I landed on the Ubiquiti NanoBeam AC Gen2 (NBE-5AC-GEN2-US) solution. It was relatively inexpensive and wouldn’t cost much to actually install and see if it would work. That was 18 months ago… and that sucker hasn’t dropped a packet since [knock knock].

In real world iPerf testing we get about 350 Mbps through the link which is pretty awesome considering the solution was essentially under $1000 with the surge arresters and installation.

I can’t say that everyone will have this level of success… but seeing how relatively inexpensive these devices are it seems well worth the gamble given that you might pay $1,500/monthly for a 500Mbps Ethernet circuit… that’s $18,000/yearly. If it works the solution will essentially pay for itself in the first month of operation.

Now don’t go all crazy… you’ll need line of site between the two locations and growing trees can present interesting problems. And if a new building or structure pops up between your wireless endpoints, well you’ll be out of luck.

You might be asking so what did I do to resolve the issues with the infrared cameras 10 years ago? We were able to contract with Sunesys, now Crown Castle to lease 4 fiber strands between the two buildings. The local electrical utility wanted $40,000 to replace two telephone polls when I tried to pull the fiber myself so we went with Sunesys who had the fiber installed and running in 2 weeks – no new telephone polls required.

Are you running any point to point wireless solutions?

Cheers!

Aruba Instant AP – Certificate Revocation

by

The past two weeks have been an interesting blur thanks to GeoTrust revoking the Aruba certificate securelogin.arubanetworks.com which is used in the captive portal for all Aruba APs, including Aruba ClearPass. The problem started when I received a notification from Aruba on September 9th with the subject line of “Aruba Support Advisory ARUBA-SA-20160908-01 :: ArubaOS Default Certification Revocation”. Unfortunately I didn’t get around to really reading the notification until September 12th. And wouldn’t you know I got my first call about a problem with guest wireless the next day on September 13th.

The Aruba notification cited the following two articles;

In summary, a third party named SEC Consult posted a large number of private keys to GitHub including the private key for securelogin.arubanetworks.com which they had extracted from an Alcatel-Lucent OmniAccess Wireless Access Point. It just happens that Aruba is the OEM for the Alcatel-Lucent OmniAccess product line. With the private key public, it’s fairly easy for anyone to perform a man-in-the-middle attack and eavesdrop on supposedly secure traffic. Shortly afterwards GeoTrust revoked the certificate which will now cause browsers to throw an error when using the certificate for guest registration or captive portal.

securelogin-arubanetworks-com_revoke

This will only happen for browsers which have recently updated their CRL list. If we check the CRL we’ll find the certificate with serial number 01DA52.

[root@centos ~]# wget http://gtssldv-crl.geotrust.com/crls/gtssldv.crl
--2016-09-28 20:15:01--  http://gtssldv-crl.geotrust.com/crls/gtssldv.crl
Resolving gtssldv-crl.geotrust.com... 2600:1400:a:18f::1abd, 2600:1400:a:18b::1abd, 23.50.69.163
Connecting to gtssldv-crl.geotrust.com|2600:1400:a:18f::1abd|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 5150 (5.0K) [application/pkix-crl]
Saving to: `gtssldv.crl'

100%[======================================>] 5,150       --.-K/s   in 0s

2016-09-28 20:15:01 (189 MB/s) - `gtssldv.crl' saved [5150/5150]

[root@centos ~]# openssl crl -inform DER -text -noout -in gtssldv.crl
Certificate Revocation List (CRL):
        Version 2 (0x1)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: /C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA
        Last Update: Sep 28 23:43:00 2016 GMT
        Next Update: Oct  8 23:43:00 2016 GMT
        CRL extensions:
            X509v3 Authority Key Identifier:
                keyid:8C:F4:D9:93:0A:47:BC:00:A0:4A:CE:4B:75:6E:A0:B6:B0:B2:7E:FC

            X509v3 CRL Number:
                164147
Revoked Certificates:
...
    Serial Number: 01DA52
        Revocation Date: Sep  7 17:04:44 2016 GMT
...
    Signature Algorithm: sha1WithRSAEncryption
         58:20:83:3f:5c:cf:31:0f:69:9b:e5:af:dd:ca:2f:b9:e1:42:
         b0:bb:68:f3:b8:e8:8c:e2:b1:17:0b:bf:5a:d0:a2:65:3c:1f:
         18:bf:93:3a:55:ea:25:c9:da:ba:3b:ed:b6:c7:67:ae:33:b2:
         34:40:27:b9:5c:76:8a:3a:8d:4e:8a:9c:d3:61:a7:ed:01:a0:
         94:fe:ab:7d:96:79:cb:4e:a5:bb:2e:fb:3c:96:52:3e:ae:e9:
         9a:d9:0b:59:3a:c0:f6:45:10:3e:f2:b4:d1:79:63:0b:41:ed:
         d4:70:d6:26:67:1d:ab:7a:6e:c8:8d:6a:0e:df:17:ff:b3:e6:
         a7:dd:6c:5f:fe:41:79:0c:09:51:cd:6d:7d:33:2a:0b:48:a2:
         5c:5c:5c:06:f3:6b:d6:b9:af:14:34:3d:7d:b9:85:36:32:38:
         c1:70:50:9d:13:01:ab:b1:de:78:0d:10:24:f2:56:3d:d2:77:
         93:d1:70:b8:47:78:a6:22:aa:6a:95:af:49:cb:bc:f6:1e:dd:
         1b:0e:bd:10:54:09:39:93:4a:10:a3:1f:76:99:12:47:35:0d:
         37:95:6e:fc:a1:b5:e1:f0:d4:f7:96:3e:52:44:e4:69:d9:64:
         37:ec:15:50:fd:e8:f3:06:3b:ee:c1:6a:ee:0a:01:fc:fc:e0:
         7e:92:d8:0c

We had to replace the certificate, but how do you replace the certificate on almost 600+ Aruba Instant AP Virtual Controllers? That’s where we looked at utilizing Airwave Management Platform (AMP), and the process appeared to be pretty straight forward although like almost everything with technology we quickly ran into problems. We started by getting a new public certificate and combined the certificate, intermediate certificate and root certificate all into a single file. We uploaded that file to AMP and then went through the multiple groups within Airwave to enable the new certificate.  And we quickly thought, that was too easy and it was.  While a number of groups worked and the VCs in those groups were getting the new certificate, a large number of groups were not working and those VCs were not getting the new certificate. We turned to Auba TAC should guided us through the following steps 1) upgrade of AMP from 8.0.9.2 to 8.0.10, 2) upgrade of the IAPs from 6.3.1.2-4.0.0.4  to 6.4.2.6-4.1.3.1, 3) second upgrade of AMP from 8.0.10 to 8.2.2. We finally discovered that the following was missing from the template; %captive_portal_cert_checksum%. Without this line in the configuration template AMP will not push down the certificate to the IAPs.

Cheers!

References:

ArubaOS Default Certificate Revocation FAQ – Instant

Image Credit: Eliseeva Ekaterina

Lenovo ThinkPad T460 Yoga with Intel AC 8260 Wireless Issues

by

I recently came across an issue where the Lenovo ThinkPad T460 Yoga with Intel AC 8260 wireless adapter was having all sorts of issues connecting to and passing traffic across a Cisco 5508 Wireless LAN Controller with 1262N and 3702E Access Points running 8.0.133.0 software, the most recent release at the time of the issue. The first thing we tried was upgrading the driver for the Intel Dual Band Wireless-AC 8260 to 19.1.0.4 (7/16/2016) which was the latest available at the time. Unfortunately that didn’t help any, we also tried applying an 8.0.135.5 software version to the Cisco WLC, again that didn’t help any.

The laptop would often connect to the SSID but the laptop would be unable to get a webpage to render with all IP traffic essentially stalling. ICMP ping times would jump from 1 ms to 3,900 ms with multiple dropped packets scattered all about the constant ping. Without any load you could occasionally get 1 ms response times for a couple of minutes at a time but the instant you opened a web page the traffic would stall and the ICMP pings would start timing out.

The Intel engineer that was assisting me provided the hint, letting me know that Cisco IT had actually stumbled across this very same issue the week earlier internally with their own employees. Cisco had intentionally disabled A-MPDU on their WLCs, the workaround was to enable A-MPDU for 802.11n on their WLCs. I went ahead and checked our WLCs and sure enough we also had A-MPDU disabled – not exactly sure who or why it was disabled.

802.11n Status: 
    A-MPDU Tx: 
        Priority 0............................... Disabled 
        Priority 1............................... Disabled 
        Priority 2............................... Disabled 
        Priority 3............................... Disabled 
        Priority 4............................... Disabled 
        Priority 5............................... Disabled 
        Priority 6............................... Disabled 
        Priority 7............................... Disabled 
        Aggregation scheduler.................... Enabled 
        Frame Burst.............................. Automatic 
            Realtime Timeout..................... 10 
    A-MSDU Tx: 
        Priority 0............................... Enabled 
        Priority 1............................... Enabled 
        Priority 2............................... Enabled 
        Priority 3............................... Enabled 
        Priority 4............................... Enabled 
        Priority 5............................... Enabled 
        Priority 6............................... Disabled 
        Priority 7............................... Disabled 
    Rifs Rx ..................................... Enabled 
    Guard Interval .............................. Any

I used the following CLI commands to enable A-MPDU; (note that I had to temporarily disable the 802.11a network to make the change – you’ll want to schedule this off-hours)

config 802.11a disable 
y 
config 802.11a 11nsupport a-mpdu tx priority 0 enable 
config 802.11a 11nsupport a-mpdu tx priority 1 enable 
config 802.11a 11nsupport a-mpdu tx priority 2 enable 
config 802.11a 11nsupport a-mpdu tx priority 3 enable 
config 802.11a 11nsupport a-mpdu tx priority 4 enable 
config 802.11a 11nsupport a-mpdu tx priority 5 enable 
config 802.11a enable

Why doesn’t the Intel AC 8260 wireless adapter negotiate using A-MSDU?

I hope to be able to bring you that answer from either Cisco or Intel.

I hope you enjoyed the article Tim.

Cheers!

Update: December 7, 2016

Intel has released a new driver for the AC 8260 that is designed to address the issue.
https://downloadcenter.intel.com/download/26465/Intel-PROSet-Wireless-Software-and-Drivers-for-Windows-10
https://downloadcenter.intel.com/download/26469/Intel-PROSet-Wireless-Software-and-Drivers-for-IT-Admins

I’m currently testing the driver but haven’t had enough time to comment yet.

New Cisco AP 2702i won’t join controller

by

As if I didn’t have enough wireless fun this past week… I recently stumbled across an issue trying to get a number of new Cisco 2702i APs to join a Cisco 5508 Wireless LAN Controller. I didn’t realize it at the time but the reseller had changed the part number on my order from AIR-CAP2702I-A-K9 to AIR-CAP2702I-B-K9. The significance is the new -B regulartory domain that requires minimum of 8.0.132.0 software on the Cisco WLC to recognize the new AP models. As luck would have it the WLC I had was only running 8.0.121.0 software hence the APs were unable to join controller.

If you are going to be adding new APs you had better make sure that you upgrade the software on your WLC first.

Cheers!

Update: Thursday September 8, 2016

It turned out we had to disconnect the APs for about 5 minutes to allow the DTLS cache on the controller to age out before the APs would join properly after upgrading the WLC.

Recent Posts

Categories

SUBSCRIBE BY EMAIL