Network Jones

ListWire Training

2011-05-19T14:49:00.000-04:00

ListWire, the free mail list software I now use, has new training (for Free!)

Mail List Software Revisited

2011-05-19T14:07:00.000-04:00

The past few months, I have tested AWeber, ListWire, and phpList for my mailing list services. Now, I'm ready to document why I made the switch.

phpList Mailing List Software

phpList is a free, open source mailing list software you install on your own server. ( see phpList postings for more info) phpList is great for tech savvy users and has the advantage that you are in full control. You can import users and not have to force them to confirm their subscription, which is great if they confirmed elsewhere. Unfortunately, phpList is missing an important feature for Internet Marketers, auto-responders. You can't set up a series of email to be sent to each new subscriber. phpList is also missing support and isn't seeing much new development.

I used phpList as my mail list server for a year, but decided because of the lack of auto-responders and new development, I need to look at other mail-list services.

AWeber Mailing

As part of a training class I was doing this spring, I subscribed to AWeber's mailing list service. Aweber is very easy to use, well supported and has the auto-responder feature. AWeber integrates into Wordpress very well with their subscription forms plugin. AWeber has extensive training that follows you thought the process of setting up your subscribers and mailings. However, importing is difficult with Aweber. To import a list you have to submit the list, give a explanation of where you got the list, wait for a Aweber employee to review the list and then go through the confirmation process. Aweber also costs money, $20 a month.

ListWire Mail Server

Another mail list service I tried this spring is ListWire. ListWire is a full featured mailing list service with subscription forms, Wordpress integration and auto-responders. ListWire training is thin, but has a strong user community that provides good support. (including a great user manual and new video training). ListWire does not support subscription list imports. You need to send your old mail list a subscription request email from your normal email account. But the major plus, ListWire is free. The downside to free, is that your subscriber will see a "offer" from the site a the end the confirmation process.

Recommendation??

So after testing these mail list services, I have decided to go with ListWire. I don't have a large mailing list and mailing list are not a large part on my Internet Marketing strategy, so free is better and I don't mind the presentation of a offer during the confirmation process.

However, if mailing lists are an important piece of your strategy and having a very positive online image is important, I would suggest going with AWeber.

As for phpList? Only if you love to tinker and don't need a auto-responder feature.

Wordpress SEO plugin free training

2011-05-11T21:49:00.000-04:00

If you are using the Wordpress SEO plugin from Yoast, as I recommended a few months ago, you may have seen that the latest version added a new page analysis feature - Linkdex. Linkdex is a tool Yoast uses for SEO and has come to love,

This friday, Matt Roberts of Linkdex and Yoast will do a free webinar on how to use the new functionality in the WordPress SEO plugin and answer all your questions .

When: Friday May 13, at 11:00 AM, PDT

Cost: Free

Registration: Required (limited space available)

Register now through this link:

https://www2.gotomeeting.com/register/931773099

Hope you can join me on Friday!

XP Mode Audio Issues - Solved

2011-05-09T18:53:00.000-04:00

Windows 7's XP Mode or Virtual PC can have issues with video and sound playback.

I recently got a new laptop for work running Windows 7. I like to run virtual machines on my laptop so that I can install software that's required for my projects without messing up my main windows installation. Those vm images are also easy to back up and move around.

VMware Player worked well, but would not see my USB camera and microphones. It also used fixed disk sizes. So, I tried Win 7's XP Mode vm and found it easier to use.

XP Mode allows auto disk sizing and supports all the USB devices I could throw at it. However, I noticed videos would have the sound delayed or echoed. After a some research and some experiments, I found the trick to making videos play correctly.

Turn off Audio Integration.

Yep, turn it off. If you were like me, you assumed you need Audio Integration to get the sound from the virtual machine. Not true, Audio Integration created a 'soft' or virtual version of your sound device instead of using your full sound card. Turning it off allows XP Mode to talk directly with your sound card.

From the Windows Virtual Mode help file:

Audio. This setting controls whether audio input and output for the virtual machine is redirected to audio devices in the host, or is managed by an emulated audio device. To improve audio performance, clear the check box for a virtual machine running Windows XP, and select the check box for a virtual machine running Windows Vista or Windows 7.

See that? Uncheck the box for audio to improve performance on XP virtual machines. I now can play videos inside my virtual machines. I still see some lag issues if my main PC is doing some work, but otherwise works great.

[caption id="attachment_251" align="aligncenter" width="300" caption="Integration Settings"][/caption]

Note: XP Mode is part of Windows 7 Enterprise or Ultimate versions, Virtual PC 2007 is available for other versions of windows. http://www.microsoft.com/windows/virtual-pc/support/virtual-pc-2007.aspx

phpList - Friend or Foe?

2011-02-15T06:29:00.000-05:00

I love using phpList. It works well and it's free. But the more I use it, the more issues I discover.
The main issue for Internet Marketers is that phpList does not support auto-responder emails. Automated emails timed to send out X number of days after a new subscription.

And if you saw my email yesterday, you saw the result of a new complaint. If you forget to save your message edits, phpList prompts you with a reminder to save. The default is to lose the changes and not save. Very easy to lose your last edits. So instead of sending the last version of my email, it sent the first saved version. One with typos. Very embarrassing.

I have already started evaluating replacements for phpList. I'm testing Adweber and Listwire. I'll post my findings later once I finish the tests.

But meanwhile... What email list software are you using?

Broken Wordpress "Incoming Links" not showing backlinks

2011-02-14T16:49:00.000-05:00

I received a email yesterday asking why the "Incoming Links" section of the WordPress dashboard is empty even after creating several back-links to his site. After some quick research I found the sad truth.

The Wordpress "Incoming Links" area is broken and has been for about a year. It was supposed to go out to Google and search for your back links. I can go to Google and do the same search and get results, but the code inside WordPress just doesn't work. I saw some comments that this as been broken since version 2.7, but the developer team just hasn't addressed it. My recommendation? Use Screen Options in the upper right corner to turn it off.

You can find your backlinks by using site:yourwebaddress.com on Google. For example, to find links pointing to my main site dcj21.net, I would use site:dcj21.net. I see 769 listings for dcj21.net that way.

In Market Samurai, the Rank Tracker filters the back links to show only links for that specific URL. This section also uses Yahoo's Site Explorer instead of Google. Inside Market Samurai, click on Show Domain Details to see back link counts from Google, Yahoo, and Bing.

Google's Webmaster Tools also shows your links. But I get a different count here (245) than in Google's main search engine.

So, we have lots of tools to show out back links and they are all showing different data. So what would the trust? Most SEO experts recommend Yahoo Site Explorer. But the key is to pick one and watch how it grows over time.

But the real question is how to do better in Google's index. Backlinks help, but make sure your pages are optimized for SEO. I''m now using the Yoast WordPress SEO plugin to do this easily for me. Read his great article on The Definitive Guide To Higher Rankings For Your Blog

Multipress Lite fOpen Error

2010-12-29T14:59:00.000-05:00

The guys over at TwoEnough have a autobloging tool called Mutlipress. It creates and manages a mutli-site wordpress blog with auto content generation. Great tool - I've used it on one of my sites. Right now, it's on sale for 70% off - Visit thier site and enter the code JHH7KL644GHLFSS for the discount.

But - they have a free version of the content tool that will automaticaly populate your wordpress blog - Mutlipress Lite

However, the current free version has two issues in the install.

You have to manualy install the plugin with FTP (can't upload in the New Plugins)

Once activated, you get an fOpen file not found error.

To fix both these issues, do the following:

Get the free plugin - Mutlipress Lite

Rename the download to m-p.zip

Unzip the file to your computer

Go into m-p folder then into the mutlipress-content folder

Rename multipress-content.php to multipress-content-full.php

Go up one folder level

Zip the mutlipress-content folder (not the m-p folder.)

Go to your Wordpress Plugins and Add New

Use Upload and select the mutlipress-content.zip file

Activate and configure.

If this gives you heartache, let me know and I'll email you a fixed zip file for version 1.2.8

And to help others searching for the error message find this solution, here's the error message you will see if you don't rename the one php file:

Warning: fopen(/*****/*****/*****/****/wp-content/plugins/multipress-content/core/../multipress-content-full.php) [function.fopen]: failed to open stream: No such file or directory in /****/****/****/*****/wp-includes/functions.php on line 4165

Enjoy!

Lesson Learned

2010-12-28T15:43:00.000-05:00

Thanks to a little Internet Angel, I discovered that in all my testing of phpList on my production server had caused my "Subscribe" box on the left to break.

First - anyone that subscribed and did not get a confirmation email, please resubscribe.

Second - lesson learned - don't play with your production server and if you do, reverify EVERYTHING. :-(

phpList - Templates and Messages

2010-12-28T11:32:00.000-05:00

Just in time for the New Year!

I've completed the phpList videos with creating templates and sending messages. That's why you created a phpList server - to send messages!

Part one covers creating a HTML template for your messages and adding user tracking to see how many of your emails are read.

[youtube]4AxvhbE4lNE[/youtube]

Part two covers creating messages using your template and scheduling messages for delayed sending.

[youtube]fhiGxdP-ahs[/youtube]

This completes the planned phpList video, unless you have a topic you want me to cover. Leave a comment or send me an email and I'll help you solve your Internet questions.

Adding Yoast WordPress SEO to Atahualpa 3.5

2010-12-27T08:15:00.000-05:00

Internet guru Yoast has created a new SEO plugin for Wordpress - WordPress SEO.

Wordpress SEO

It's a great plugin and I use it on my sites. However, since I use one of the more flexible themes, Atahualpa, the configuration of Wordpress SEO is a little more complex.

So if you are using the Atahualpa theme, here's my notes on adding Yoast's Wordpress SEO.

First Steps

Wordpres SEO is still beta, so BACK UP. (you have a backup don't you?) Install Wordpress SEO plugin and activate it. Now on the bottom left, expand the SEO section and go to Import and Export. Import your settings from other SEO tools and then deactivate the other plugins.

Fixing the Title

To format the <title> code the way Yoast wants, go to Appreance, Editor and edit the file bfa_meta_tags.php.

Change

<title><?php wp_title('&laquo;', true, 'right'); ?><?php bloginfo('name'); ?></title>

<title><?php wp_title(''); ?></title>

Then update the file.

Adding the Breadcrumbs

To add the Breadcrumb feature, go to Atahualpa Theme Options, Style and Edit center column. In the Content ABOVE the LOOP section add this code to the bottom to the code:

<?php if ( function_exists('yoast_breadcrumb') ) {
	yoast_breadcrumb('<p id="breadcrumbs">','</p>');
} ?>

Then save changes.

Updates to your Theme

If you update or change your theme, you will need to re-do the code changes to the theme. Your Wordpress SEO setting are not affected by theme changes.

Configuring Wordpress SEO

Now you are ready to configure Wordpress SEO. I used a great tutorial over at wpBeginner - How to Install and Setup WordPress SEO Plugin by Yoast. Once you have it configured, export your settings to save them to your computer. And you can use the saved configuration as a import on your next install to save time.

If you have any questions or comments, please let me know in the comments section. Enjoy!

Using Spinner Chief to Submit Articles

2010-12-10T01:15:00.000-05:00

I've seen a few folks wanted to know how to use the Submission feature in Spinner Chief. The submission screen lets you queue up several spun articles to be uploaded to blog sites and article directories. You just tell Spinner Chief what goes where and it does the rest (mostly).

[youtube]sUP74czuduU[/youtube]

This method is mot 100% though, recent changes to the remote sites is giving Spinner Chief trouble. Fourtunatly, the guys atSpinner Chief are working on it.

[youtube]wwnWjz86lS0[/youtube]

PS - I also touch on the really useful Batch Spinning feature.

If you need a copy of Spinner Chief, it's free! So download your copy today.

Hidden Menu on Market Samurai

2010-12-03T19:37:00.000-05:00

I was watching the Market Samurai training videos today and came across a cool, hidden menu. I almost called it a secret tip, but, it is in the training videos...

This menu is in the SEC Competition Module. Click on the triangle and a new hidden menu pops up for that domain. This menu gives you several options on looking at how that web page became ranked. Market Samurai calls this "Link Competition Analysis" It's analyzing their backlink network, search keywords, and demographics.

These tools pull data about the backlink network of the listed web site so you can see what web site your competition uses to build their backlink network -- cool.

I'm not going to go into detail here, but ask you to watch the Market Samurai training videos about this section.

Episode 12 - How To Gain a Competitive Advantage

Episode 13 - How To Unmask Your Google Competition

Once you understand how your competition is doing backlinks, you can emulate them and improve. Moving ahead of them in the rankings!

If you don't have market Samuri, you can use my affiliate link to get a 12 day trial and a savings of over 30% ($149 down to $97) One time purchase.

Importing email lists into your phpList server

2010-11-30T20:31:00.000-05:00

Part 3 of my Installing phpList on your Wordpress Blog covers importing users.

Now that our phpList server is running and we have out lists, it's time to import our email list that we got from some other source. phpList allows us to import and not have to re-confirm eamils that we have confirmed elsewhere. But if you have a list that has not been confirmed to your mail list, you can send a confirmation email.

Watch Installing phpList on Wordpress - Part 3 Importing Mail Lists

[youtube]_rXDj9jo2rI[/youtube]

I'm using the free opensource CamStudio to record now. Lots of cool features.
CamStudio - Free Streaming Video Desktop Recording Software

Using phpList for your mail list

2010-11-25T14:55:00.000-05:00

I've started using mail lists for my websites and was looking for a great and cheep solution. I found one with phpList.

phpList is a open source (as in free) mail list server you can isntall on the same service that you host your web sites with. The BIG advantage is with phpList, you control if users must confirm subscriptions WHEN YOU IMPORT THEM!

I have a list of subscribers that have already confirmed. I dont want to force them to confirm again. With phpList I don't have too.

Watch my first How TO videos

Part One - Install the phpList server software
[youtube]VU98MBIv--Q[/youtube]

Part Two - Install the mail list to your Wordpress Blog (Widget based!)

[youtube]lt6UAQlnK50[/youtube]

Big sale at Hostgator

2010-11-25T06:50:00.000-05:00

If you've been looking for a coupon or sale for your internet hosting, I have a deal for you! Hostgator's big Black Friday sale will carry over to Cyber Monday!

Cyber Monday Sale at Hostgator!

This great sale starts at 12:00 AM Monday November 29^th CST (-6 GMT) and will run until 11:59PM CST (-6 GMT) 11/26/2010.

50% OFF EVERYTHING

This applies to ALL Accounts and ALL Term Lengths.

To get this deal, Click here and use coupon code CYBERMONDAY2010

Includes Shared Hosting, Reseller Hosting, VPS Hosting AND even Dedicated Servers! Never before has Hostgator allowed the promotion on EVERYTHING including reseller, vps and dedicated servers AND ALL Term Lengths.

New Customers Only

Ed Dale Influences the Simpsons!

2010-11-19T19:03:00.000-05:00

I was watching the latest Simpsons tonight and saw that Ed Dale of The Challenge has influenced Bart to take up Ed's latest niche, Kite Surfing. Way to go Ed!

[caption id="attachment_58" align="aligncenter" width="437" caption="Bart takes up Kite Surfing"][/caption]

Webmaster Sites

2010-11-11T09:57:00.000-05:00

Google, Yahoo and Bing (MSN) all have nice Webmaster tools.

Many suggest using a Webmaster plugin for Wordpress to help verify ownership with these sites, but not me.

I don't like adding code to a site that is only used once, So here's how I add the Webmaster verify codes. Add the META tag to the "Additional Home Headers" field in All in One SEO plugin and update. That's it. You can remove the code after you're verified.

Major Site Webmaster Tools

Google Webmaster Central

Bing Webmaster Center

Yahoo Site Explorer

Alexa Rank Site

Don't forget to setup your Webmaster accounts fully. Add your sitemaps, your feeds and home urls to each service.

Recommended WordPress Theme and Tools

2010-11-10T11:18:00.000-05:00

Word press is the best content platform for bloging and general web pages, it's easy to use and very configurable. However the configurablility can make it had to select what options to use.

After working with a few sites and trying out many themes and plugin, here's my current list of recommended WordPress plugins:

Atahualpa - This is a very customizable theme, you can use menus to configure all the options that you would have to edit style sheets or php code on other themes. It's well supported and best of all free.

AddThis - Social Bookmarking Widget / Button to let readers share your posts.

Advertising Manager - display and manage Ad Sense and other ads.

All in One SEO Pack - configures all the SEO items for your site and posts.

Easy Privacy Policy - configures and managed a privacy policy page for your site, as required by Google Ad Sense.

Google Analyticator - configures and reports on your traffic using Google Analytics.

Google XML Sitemaps - generates your site map and automatically submits it to Google, Yahoo, Bing, & Ask.

WPtouch - converts your site to a smartphone compatible theme automatically.

I developed this list based on my experience with Ed Dale's The Challenge and Pat Flynn's Smart Passive Income site. I welcome your comments and suggestions.

For more Recommended tools, see my Recommended Tools page

Blown Fiber

2010-10-21T10:59:00.000-04:00

I took a class a few weeks ago to learn how to install blown fiber. Until Itook this class, I never know how cool this ideawas.

Blown fiber is a way to install fiber cable using small tubes installed inside your conduits , table trays orother pathways. The fiber cable is blown into the tube insteadof the usual pulling of cables. Most fiber cables only support a 25 pound pulltension, so it's easy to put too much force and risk damaging the cable. Thatrisk does not exist with blown fiber.

The BEST feature is the growth capabilities.The "pulled" way of installing fiber usual entails us designers specifying more fiber than we need. I used to alwayspull some single mode fiber, some multimode and double the amount needed. Very wasteful, but, it'sbetter to do it now because later we can't pull more in easily if at all.

With the blown fiber solution you install a multitube assembly and onlyblow in what is needed today. In the future, it'seasy to blow in more fiber into another tube.

I took the Sumitomo FutureFlex training. They have tube assemblies that have2, 4, 7, or 19 tubes in each. A 24 strand fiber cable can fit in eachtube. So today I can install a 7 tube assembly,blow in 24 strands of multimode and easily comeback at some point in the future and blow in another cable without worrying about pull-past issues or tearing up thepathway or disrupting the customer.

Sweet deal!

Sumitomo's Futureflex product website

New Home!

2010-09-30T23:59:00.000-04:00

Network Jones has moved to a new home. Please visit NetworkJones.us

Industrial Networks

2010-01-01T23:33:00.004-05:00

Well, I passed my RCDD - Registered Communications Distribution Designer. It's a certification concerned with Layer One networking issues - wires, conduits. telcom room layout, etc.. It's by a group called BISCI.

This is the second time I passed the exam. I had it in 1999 and let it expire -- I wont this time.

But the big thing I noticed this time was the lack of concern for industrial facilities. BICSI recommendations focus on commercial office space. You need a telcom closet on each floor, plan for 3 outlets for each 100 sq. ft. These don't apply in a factory or other industrial buildings. Most floor only need 5 drops total and don't need a closet.

I have spent the past 15 years building networks for industrial facilities for Honeywell, Georgia-Pacific and now for Computer Science Corp (CSC). I plan to spend this year working on making a white paper and presentation for Building Industrial Networks that could become a chapter for the next BICSI manual.

Industrial Networks

2010-01-01T18:33:00.000-05:00

LogMeIn Remote Access

2009-04-10T02:35:00.003-04:00

If you are an IT professional like me, you've gotten the call...

"Honey, the computer's acting up" No problem, right? Not in my world. I'm on one coast and the wife's computer is on the other.

I finally found a great product that allows remote access to my wife's computer (and my Mom's) when I'm away from home. LogMeIn.com

They have a full suite of products for every need, from IT professionals supporting hundreds of computers , to small consultants with a few clients spread out all over, to me -- an IT guy needing to provide free support to my loved ones.

That's why I use LogMeIn.com, they have a striped down free version that's not a trial version - it doesn't go away. The free version only does KVM, but that's all I need to fix most of the things I need to do.

No need to 'GoTo' any other solution.

On to my next project

2009-03-23T13:54:00.002-04:00

I finished up the build out project and am now on a more consultative and management project. So I won't have may new technical challenges, but I'll dig up some stuff I've done before and post here.

Plus - I'm working on my CCNA - again. I messed up a few years ago and let my CCNP expire. Time to start over. :-(

SSH key sharing between ESX and NetApp

2009-02-18T00:46:00.003-05:00

Setup SSH between ESX and NetApp to not use passwords.
VMWare recommends setting up shared keys between your ESX servers and your Network Appliance Filer to facilitate configuration, status checks and troubleshooting. I recently set this up so that the PowerChute Network Shutdown on my VMware ESX server could execute a script to shutdown all the VMWare servers and then shutdown the NetApp before losing power.
Using shared keys is great for trusted machines. As a consultant, I was concerned that later administrators would change the root password and not update the shutdown script to use the new password. That would cause the shutdown to fail and possibility corrupts the NetApp. I wanted to use SSH as it is more secure than rsh and hosts.equiv.

On the NetApp, we need to create an authorized_keys file. However, NetApp’s console limits access to the operating structure and does not have standard UNIX mkdir or file editing tools. To edit the file structure, we must access the root volume from another machine using FTP, Windows File mounts (CIFS) or NFS. Since my server was only using FCP (Fiber), I opted for using the FTP server on NetApp.

Create a root account and enable the FTP server on the NetApp
The FTP server does not use the normal root login. It uses the /etc/password file which is not synchronized with any outher authentication scheme. First we need to create an encrypted password. NetApp has a tool in CIFS to create the encrytpted string. You may need to enable CIFS first before executing this command and you don’t need to do this on each NetApp you are conifuring. Once you have the string, you copy/paste it on to other NetApps (I had two to configure). Log into the NetApp and execute cifs passwd followed by your desired password. The NetApp will respond with the encrypted string. Make sure you copy the entire string. Watch for punctuation at the beginning or end.

Next, edit the /etc/password file. Since NetApp does not have an edit function, we need to read the file then write a new one. Execute rdfile /etc/passwd Look at the existing file to see if there are additional entries. Other file sharing systems can use the UNIX authentication method – aka /etc/passwd.

Now we need to create the new /etc/passwd file. Execute wrfile /etc/passwd and create the root entry by typing in root: followed by the new encrypted password. Then finish the line with :0:1::/: and press return. Then paste the rest of the old /etc/password into the new file. You may want to create the new file in Notepad then copy the entire file at once. Press control-c to exit (Control-d is the preferred method but it also closes the SSH session). Execute rdfile /etc/passwd to verify your new file. (Note your password will be different).
root:_SwdOnr(sw.:0:1::/:
pcuser::65534:65534::/:
nobody::65535:65535::/:
ftp::65533:65533:FTP Anonymous:/home/ftp:

Now we can enable the FTP server on the NetApp. Execute options ftpd.enable on

Create the key file on the ESX server
Now we need to create the key file on the ESX server. Login as root on the ESX server and execute ssh-keygen -t des Accept the default directory and leave the password empty.
Enable ftp client on the ESX server by executing esxcfg-firewall -e ftpClient
FTP to the NetApp from the ESX server by executing ftp NetApp_IP_ADDR Login using root and your new password (the UNencrytped version). Create the root user SSH directory by executing mkdir /etc/sshd/root/.ssh/
Display the DSA key so you can copy the contents: cat /root/.ssh/id_dsa.pub

Create the Authorized_keys file on the NetApp
Back on the NetApp, create the trusted key file by executing wrfile /etc/sshd/root/.ssh/authorized_keys Paste the contents of ESX id_dsa.pub into the file. Control-c to exit wrfile.
Now that we are done with FTP, turn it off by executing options ftpd.enable off
Logout by pressing Control-D ( NetApp only allows 1 ssh connection at a time, so logout before testing)

Test the configuration
From the ESX server, execute the following to test:
ssh -c 3des-cbc root@NetApp_IP_ADDR help
This may ask you to allow the key to be trusted, answer yes. You then should see the NetApp help text without being asked for the password. We must tell ESX which encryption method to use since the ESX server and NetApps default to RSA and DES respectively.

Why Network Jones?

2008-10-24T00:19:00.002-04:00

So now I have time to sit down and explain why they call me Network Jones.

Back in the mid-nineties, Novell had a ad campaign where the borrowed Indiana Jones and relabeled him "Network Jones" The ads were print. I don't recall any TV spots.

As a young Novell NetWare engineer, with a last name of Jones, I picked up the nickname Network Jones. I also had a co-worker call me Dr. Jones, a reference to Indy.

The lab at my old employer has a rare print out of Novell's Network Jones. I've searched the Internet and can't find any references to Novell's Network Jones, so I'll have to see if I can find someone on the inside to scan that picture for me. I'll post it when I get it.

Now you know the rest of the story.
-NJ

Juniper SSG VPN with FIPS

2008-10-19T22:08:00.004-04:00

Time for my tale of configuring a pair of Juniper SSG routers to use FIPS mode and create a point to point VPN. (see my other post for the background for this)

First, I found a good resource and you should get it also:

Concepts & Examples ScreenOS Reference Guide
Volume 5: Virtual Private Networks
Release 6.1.0, Rev. 01
Chapter 4: Site-to-Site Virtual Private Networks
“Route-Based Site-to-Site VPN, AutoKey IKE” on page 96

NOTE ScreenOS 5.4.0r4 is the only version FIPS certified. ScreenOS 6.1 supports FIPS mode, but has not been tested by NIST.

You must use a console cable to configure the routers. FIBS mode disables Telnet and HTTP management.

To keep this post short and readable, I'll have to ask you to refer the the “Route-Based Site-to-Site VPN, AutoKey IKE” on page 96 of the resource I listed above.

The first order of business is to upgrade or downgrade the ScreenOS if desired. Use a tftp server to load the ScreenOS.

Next, the FIPS mode must do a checksum on the ScreenOS on boot up, so you must install the Authentication Certificate from http://www.juniper.net/techpubs/software/screenos/mibs.html to the router using a tftp server.
save image-key tftp tftp_srv_ip_addr imagekey.cer from bgroup0

Then enable FIPS mode
set FIPS-mode enable

The device will reboot and erase the configuration.

Configure the basic administration and interface information. Change the admin account's name and password. The FIPS password must have Upper, Lower, Number and Punctuation.

The most important part is configuring VPN with a Preshared Key.
First, we have to define our own phase 1 group because FIPS-mode deleted them (it requires a more stringent phase 1) Use Group5 , ESP, Tripple DES, and SHA-1
set ike p1-proposal pre-g5-esp-3des-sha-1 group5 esp 3des sha-1

Assign the Phase One to the remote gateway. Put in your remote gateway's IP address. h1p8A24nG5 is my preshared key. This is a long command.
set ike gateway To_Remote address remote_ip_addr main outgoing-interface ethernet0/0 preshare h1p8A24nG5 proposal pre-g5-esp-3des-sha-1

Next, the phase 2 group
set ike p2-proposal g5-esp-3des-sha-1 group5 esp 3des sha-1

Set the VPN tunnel with our phase two and bind
set vpn New_Tunnel gateway To_Remote proposal g5-esp-3des-sha-1 set vpn New_Tunnel bind interface tunnel.1

Define the IP address at the end of the tunnel (1.0 is local, 2.0 is remote)
set vpn New_Tunnel proxy-id local-ip 192.168.1.0/24 remote-ip 192.168.2.0/24 any

Setup a route to the other network
set vrouter trust-vr route 192.168.2.0/24 interface tunnel.1

Define names for your LANs
set address "Trust" Local_LAN 192.168.1.0/24
set address "Untrust" Remote_Office 192.168.2.0/24

And then setup policies to allow the traffic. (these are 2 lines)
set policy top name "To Remote" from "Trust" to "Untrust" Local_LAN Remote_Office any permit
set policy top name "From Remote" from "Untrust" to "Trust" Remote_Office Local_LAN any permit

save

This should help you get a VPN tunnel setup on your FIPS mode Juniper. If you have any questions, leave a comment, and I'll get back with you.

Happy networking!

SAN Switch Configuration Made Easy

2008-10-16T23:26:00.003-04:00

Well, I'm still on the same project cutting though the jungle of new and mysterious technologies. Today, I find myself face to face with a HP StorageWorks 4/16 Brocade SAN switch. This switch is a Storage Area Network switch with 16 4Gb fibre channel ports.

I've not worked with SAN switches before, so when I set this up the first time, I used the defaults from the "Easy" Set-up. Little did I know it wasn't easy.

But first some background on SAN switches. They work like Ethernet switches directing data, but use different terms for familiar concepts. The switches have a WWN - World Wide Number, A MAC address for the switch. (In fact the last digits of the WWN was the same as the MAC for the Ethernet management port). The server's fibre ports have a WWPN - World Wide Port Number. It's like a MAC address for the fibre channel port. The SAN uses Zones, which are just like VLANs in that they isolate segments of traffic and devices must be in the same Zone to communicate.

Thus my problem. I configured the default, 'typical' settings and the switch set each port in it's own zone. Therefore, the servers could not see the storage array (NetApp Filer). After the client's expert looked at the Filer, Servers and Switch configurations and couldn't figure out why it was not working , I started doing research and found out about the zone issue. I guess they default to the most secure configuration when you don't know to change things. :-(

To correct the 'every port a zone' issue is easy, once you know the why and how. First bring up the web interface for the switch and go to Zone Admin. Near the top of that page is a button to "Clear Config". Click it and clear the Zone configuration. Then click the tab for Zones and create a new zone. At this point the window on the right shows all of your Ports and WWPNs and the left is empty. Select all of your ports and WWPNs and click "Add >>". Now all of your ports and devices are in the same zone and they can all share data. If you need to segment your SAN network, then create multiple zones and 'Add' accordingly.

Once you're done adding the ports and devices, click Save Config to save your configuration.

Ta Da! You now have a working SAN Switch!

I had 3 techs waiting for this to be fixed, so I was a hero. Network Jones saves the day!

-=-=-=-=-=-

BTW - I'm still working on the Juniper config posting. I hope to have it up this weekend.

Welcome

2008-09-25T01:29:00.001-04:00

I'm a IT consultant and network engineer and I often have to figure out what should be a standard network setup or design, but I can't find anything when I Google it.

For example, I just setup a Juniper SSG with Site to Site VPN using preshared keys. Simple? Yep, I found an example in Juniper's documentation and modeled my configurations after that. Worked great!

But....

The client wanted FIPS mode turned on. FIPS is a government standard for security and really locks down the box. When I turned FIPS mode on, the VPN tunnel would not work and I could not find any reference to FIPS VPN tunnels, so I had to figure it out, piece by piece.

So...

To save others from this heartache, I will start to post things I figure out in my job.

Welcome to Network Jones.

PS - my next few posts will be about the Juniper and why Network Jones.