PFE Ireland : Commentary

Network Access Protection (NAP) and my switches

gmcshera — Fri, 30 May 2008 01:47:02 GMT

I recently gave an overview of NAP at a Windows Server 2008 event. For the purposes of the event I focused and demo’d DHCP enforcement. From some customers DHCP enforcement was not enough. What about 802.1x enforcement ? Our pals on the NAP team have already blogged this (quite sometime back) as an introduction to what the real world options are. Check it out : NAP 802.1x enforcement. I’d also point you in the direction of the Step by Step lab guide.

For a real world view of NAP in action with Cisco switches check out Michael Kleefs blog here. When I asked about real world implementations Michael's demos where recommended.

While on the topic of NAP…. I was also asked about how much traffic does it generate. Yet again Michael Kleef had the answers.

Update: No sooner had I posted this (7 minutes after to be exact) Jeff Sigman (NAP guru) commented that he setup a rack with 10+ switches. Check out his posting http://blogs.technet.com/nap/archive/2008/04/15/video-nap-world-tour-rsa-2008-san-francisco.aspx. How is that for fast information update! :)

Vista UAC can protect against Root Kits

gmcshera — Wed, 28 May 2008 14:49:24 GMT

Since Vista RTM’d people have complained to me about UAC (User Account Control) and how often they get warnings and popup’s. They just never seemed to get the point of it. I leave it on for all my Vista machines, even the VMs and even during demos to customers. Why? Easy. It protects my system from drive by style installations or modifications to my Vista machines. Its never really proven to be a hindrance to me, even during demos.

A colleague of mine tipped me off to the following articles.

PCWorld

NeoWin.net

Reading them was quite interesting. Tests showed that with UAC on, root kits couldn’t install themselves on Vista without alerting the user. No silently slipping onto the OS. However, its the comments at the end of each article that really intrigue me. Some people think Microsoft use UAC as a way of avoiding responsibility. Others, and rightly so in my mind, point out that the best you can do is warn/alert a user that something is attempting to modify their system … but if they don’t take the time to even read what’s on screen malware will always find its way onto a system. Software will always have its flaws.

UAC isn’t just about stopping malware … its about protecting users from themselves. It would appear that you can lead a horse to water but you cant’ stop it clicking continue, ok, yes I’m sure, no problem and diving right in.

MSDN and TechNet now run on Hyper-V

gmcshera — Tue, 27 May 2008 17:22:00 GMT

I’ve had a lot of interest in Hyper-V from customers and quite a few questions too. One of the most common being, “Who is using it in a production environment?”. Up until now I didn't have an answer. … but now I do.

Microsoft are now running the MSDN and TechNet sites on Hyper-V. So, putting that in context, that’s over 4 million hits a day (1 million for TechNet and 3 million for MSDN). This implementation also puts in context what sort of work loads Hyper-V can support. Granted there was a performance overhead for running in a virtual environment when compared with the loads the physical boxes could handle but that’s part of parcel of virtualisation.

More info can be found on Virtualization.info or indeed on our Virtualisation blog here.

Hyper-V: Where do I start?

gmcshera — Thu, 15 May 2008 18:49:11 GMT

There are plenty of docs and blogs out there digging deep into Hyper-V. However, a few customers have asked a simple question: “What do I need to think about before I start testing Hyper-V?"

Well, first things first. The product still hasn’t RTM’d so DONT use it for production environments … not even a little one!
Hyper-V only runs on x64 processors with INTEL-VT or AMD-V.
Pick your hardware: While it has not been RTM’d the Certified hardware list is available. Check out Windows Server Catalog site BEFORE you make the decision to purchase hardware. Keep an eye open for the logo below:
Think carefully about your storage options. Badly designed or configured storage can impact the overall performance of your virtual environment.
Understand the licensing model for Virtual operating systems. More information can be found Virtual Machine Technology FAQ. Its important to note that regardless of what vitalization product you decide to run the licensing model is still the same.
Think carefully about disaster recovery. Don’t wait until the last minute to figure out how you will manage and recover your virtual machines. The smallest hardware failure can take down the biggest virtual environment. Plan accordingly.

These are all very high level points so I will flesh them out over time. Any questions, feel free to comment.

Expensive Hypervisors - a bad idea even if you can afford them

gmcshera — Thu, 08 May 2008 17:40:04 GMT

Here is a great post from James O'Neill.

http://blogs.technet.com/jamesone/archive/2008/03/13/expensive-hypervisors-a-bad-idea-even-if-you-can-afford-them.asp

As Microsoft get ready with Hyper-V, VMware are beginingg their marketing blitz in an attempt to justify their pricing. As James points out in his post you can manipulate figures to come to any conclusion you want ... even if its way off base. Microsofts Hyper-V will cost a fraction, per socket, when compared to VMWare. While the VMWare products are slightly more mature Hyper-V is only a small part of the Virtualisation offering from Microsoft. Windows Server 2008 really brings Mircosoft virtual offerings to the forefront as an end-to-end solution. Check out http://www.microsoft.com/virtualization/default.mspx for more details.