One of my predecessors may not have realised that he misconfigured our internal address scheme by using a public IP address range that happens to be used by a very large publicly traded company. He started it with 192, but not 192.168.xxx.xxx. I knew we'd run into potential problems down the road, and we were able to avoid one this past year, but we really need to get this corrected.   This is the year we do so, which will require a host of changes from DNS to DHCP to routing, switching, you know the drill, across all locations.   Funny thing, no one here and none of our sub contractors can remember who did this or when it was done.   Thanks, dude. ... View more

I have a new avatar! ... View more

In '97, I started working for a law firm. I told them that I didn't see working there as a career move. Coming out of consulting, I figured I'd get them straightened out in a year and be scratching around to look somewhere else. To give you an idea of where they were, they'd call in a VAR to move a computer from one attorney's office to another when someone left and they wanted to shuffle offices.   Apart from also bringing on board an entire real estate department from another firm (about 20 people) the day I arrived, and finding a Netware server that abended literally every night, I found that they'd tolerated emails taking 8 hour round trips. They'd send an email out and get an answer 8 hours later. I couldn't believe they'd tolerated that.   As I looked into the reason behind the 8 hour round trip, I discovered that the Netopia router they were using connected to the Internet every four hours for just a few minutes via DSL. So email would queue up for four hours, go out, and then the router would open up and let emails come in and send new emails out again before it shut down the connection. No, they weren't using the Internet yet for anything but sending and receiving emails!   I ended up at that firm through 2001 when it was bought by another national firm and then became IT Director of that firm until 2005 when I finally went back out to consulting. As of 2009, I'm back in law firm IT and expect to retire here. When I got to my current firm, I found their internal addresses were set using another very big company's Internet routable IP address range. The fun never stops! ... View more

I would build a graphical representation of what's going over the wire at a given moment for the MX devices. Sure, I can look at the packet data, but I'd like to know, at a glance, who's using bandwidth and what sites and or applications are consuming that bandwidth per host in real time or near real time, not just for the last two hours. ... View more

I have a new avatar! ... View more

You may know that a Local Area Network (LAN) segment can address up to 254 end points or devices. You may have seen this noted in various ways such as:   192.1.1.1-254 192.1.1.0/24 192.1.1.1 - 192.9.1.1.254 or by the subnet mask 255.255.255.0   This limits communication between devices to 254 devices or fewer if we discount network devices that may be employed such as a firewall, a managed switch, and or a router. 254 devices sounds great for a small business which may have just a few phones, a smattering or laptops and desktops, some tablets and cellular phones, and perhaps some Internet of Things (IoT) devices such as cameras and thermostats.   But what if you have 100 employees in one building? Salespeople may have a desktop and a laptop in addition to their mobile devices which may also connect to Wi-Fi when in the office. If we have an IP phone on each desk and one in the breakroom, another in the kitchen, and one in each copy room, well, you may see how we quickly run out of addresses for our end-points!   We have a couple of ways to improve density. One would be to employ more network equipment to segment all those devices. We could use a router and more Wi-Fi access points to separate all those mobile devices into their own segment, for example. But as we do this, we add complexity to the physical network and cost, both in terms of initial cost as well as maintenance and support.   Another way to segment the network would be to use a Virtual LAN, or vLAN. A vLAN allows us to use the equipment we have in place and segment the network by using another address scheme "on top of" the same network cabling and equipment. In Meraki's MX80, for example, we can define a vLAN by telling the equipment that we'd like to use the address scheme of 10.10.10.0/24 (254 more addresses!) for all of the IP phones. Assuming there were, oh say, 110 phones on our network, we've just freed up 110 more addresses to use on our 192.1.1.0/24 network (YAY, Notebooks for everyone!).   But how does this work? Each vLAN is assigned a number. We can assign the number 23 to our IP phone vLAN. When we configure the addresses on our IP phones, we tell them to use vLAN 23. Assuming we've correctly set up our network devices (switches, firewall, etc.) for vLAN 23 to handle the traffic for our phones, all of that traffic will run over the same wires and equipment we've already got!   Segmenting networks also has a security bonus. vLAN 14 can (and probably should) be set up to never communicate with vLAN 27. Thus, you can have departments (IT, Accounting, C-level) separated form one another even though they are on the same physical network. A person working on a computer on the shop floor on vLAN 14 would never be able to glean accounting data from a computer on vLAN 27. Placing all IoT devices on a separate vLAN both frees up address space for computers and makes it harder for a would-be attacker to snag information from a database by gaining access through a device such as a thermostat, camera, or fish tank.   If you're a very small business with few visitors in your office, a vLAN may not be for you. It does add a bit of complexity to your setup. As your business, and your network, grows, segmenting your network via a vLAN may be a more secure, low-cost alternative to more equipment. ... View more

Looking forward to better and more secure access across devices when we have larger numbers of people in a conference room for depositions and better hand-offs when they break for side-meetings during bargaining or mediation. ... View more