5 recession-proof IT skills

The enterprise data center has become the corporate center of attention. If you want in, here are the skills you need to have:

1. Virtualization.
A foundational technology for state-of-the-art IT infrastructures, virtualization skills almost go without saying.

Rick King, CTO at Thomson Reuters, Legal, in Eagan, Minn., puts it this way: “Today people who have spent a lot of time with virtualization technologies can pretty much work any place they want — and that will be true for some period of time, until almost all data centers are running almost everything in a virtual environment.”

2. Services management.
As enterprises shift into the use of public or private cloud service providers, data center personnel need to ratchet up their service management skills, says John Ryan, the global portfolio executive responsible for platform and end user services at technology consulting firm CSC.

“It’s no longer enough to know how to manage the hypervisor and workloads moving across the infrastructure. People have to shift their thinking into an environment where capacity and demand management come together. They have to be skilled in services management,” he explains.

Joanne Kossuth, vice president of operations and CIO for Franklin W. Olin College of Engineering in Needham, Mass., agrees. “Things like software and infrastructure as a service already exist, and some are more highly adopted than others. But five years down the line, it really will be about a combination of these things and data center folks are going to manage all that.”

3. Unified computing.
“The trend today, as it will for the next three to five years, will be unified computing – look at Cisco with its Unified Computing System, HP with BladeSystem Matrix and IBM with its cloud computing strategy,” says Rockwell Bonecutter, data center technology and operations lead for North America at Accenture, a technology services consulting company. “The natural assumption you can derive from that is that this will be the hot button for new skills.”

As such, data center personnel of every ilk must get up to speed on unified compute concepts, principles and architecture, he says. As a result, we’ll have data centers staffed by people who understand how to deliver business value and services rather than only knowing how to add more processing power or storage, for example.

4. Green IT.
Going green is a corporate mandate the world over, and that leaves many IT organizations deciding whether they need a point person for green efforts across the data center, King says. “This professional would focus on deploying green technologies — as well as steering away from deployment of non-green technologies. Because green technologies often improve operational efficiencies, such people would actually pay for themselves over and over again,” he adds.

5. Resource management.
Along the same lines, the ability to finesse conversations between IT and facilities is becoming a critical skill in the data center, says David Cappuccio, managing vice president and chief of research for the infrastructure teams at Gartner. “Building a capacity plan when you don’t take into account energy consumption and heat dissipation is a plan in a vacuum,” he adds. “You need somebody on staff who can actually track these things, talk a facilities language and translate it back to IT.” These skills are sometimes packaged in a position called resource manager or facilities liaison, Cappuccio says.

At Citigroup, they’re wrapped up into a position called data center planning and critical systems engineer, says Jim Carney, executive vice president of data center planning for the New York-based global financial services firm.

In fact, Carney says, “No data center manager I would ever hire could be blind to the facilities side of the business because it’s so integral to their uptime.”

High-Tech Computer Rental for Business Promotion

In current development of technology, everyday comes with some enhancements in latest technology. To grow business and to compete with competitors, high tech equipments are required for office use and to organize conferences, trade show & seminars. Rather than going to shop and purchasing these equipments, we can take all the required computer equipments from computer rental services. It helps us to perform our tasks nicely and also aware us to the latest technology.

Whether you are holding a tradeshow, hotel convention, or any type of business meeting, you can always count on Professional Computer Equipment Rental Services. By combining premium AV rental equipment, top-quality computer rentals, reasonable rates, and unsurpassed staff, your experience with these services will make you comfortable to organize any Business conference and other Business meetings as well as you can fulfill your office needs without investing a lot of money on these High Tech Equipments by approaching business technology rental centers.

Equipment dependability at your tradeshow or convention means knowing that the proper equipment will be delivered, set up, and operating when you need it and where you need it. Dependability is the reason why convention and tradeshow producers, as well as exhibitors, have been looking to Computer Rental Services to handle their audiovisual needs.

When you call for Computer Rental Services, you can depend on their trained experts to combine their extensive tradeshow and convention experience with broad selection of top audiovisual and computer rental inventory. The result is an impressive well-managed event.

These Services are providing audiovisual rental selection includes plasma screens, high-resolution LCD monitors, and high-lumen LCD projectors – all of which draw attention and visitors to your individual exhibit or tradeshow production. Their trained technicians can design a standard or wireless sound system for any size audience or any type room configuration. If computer rentals, laptops or desktops, servers, and printers are needed, they are carefully selected for your exact requirements, be it for a computer-enhanced display, sophisticated Internet cafe, or for a busy registration area.

Simply choose your audiovisual or computer rental equipment and let Agency deliver, set up, and provide support for everything from registration desks to full-service press rooms and breakout rooms.

Once selected, your equipment will be handled by their team of experts, who will deliver, set up, test, and provide the vital technical support necessary to ensure seamless, smooth performance for your convention or tradeshow.

Find the best Cisco router for your needs

For those of us who have been working with Cisco routers for some time, some of the most well-known routers are missing from the current lineup. Cisco discontinued the 2600 and 3600 Series routers some time ago. For the remote branch office and SMB market, these routers were always the workhorse of the Cisco router lineup.

In my opinion, it wasn’t their capabilities that made them obsolete. They could do just about anything that the latest routers could do. For that reason, many shops are still using them.

What made these series of routers depreciate was the limitation of their CPU processing, Flash, and RAM storage. The Cisco IOS grew to be larger than what those routers could handle efficiently with the maximum amount of RAM.

In addition, the packet load of the typical network grew so much that Gig-Ethernet became common on networks. These routers just didn’t have the processing to handle that throughput with the CPU that they had.

Which router do I need?People often ask me which router they should use for a specific situation. To begin, I think Figure A does a decent job of illustrating Cisco’s available routers and the load they can take (as illustrated by the light blue column in the graphic).

Of course, there’s no hard and fast rule telling us which router to use for which situation. However, here are some general guidelines that I suggest using.

Home office or small branch office
Let’s say you have a home office worker who needs more than just a periodic VPN connection. The employee will be working a full 40-hour workweek over a site-to-site VPN, and you want him or her to have the most reliable and best performing connection possible.

Cisco 800 Series routers are ideal in this situation. They’re great performing routers for a single person or even a small office of up to 10 people. They have the full Cisco IOS, including the latest IOS 12.4 including features such as Firewall, IPS, VPN, VLAN, QoS, NAC, and even high availability features. There are different models for different applications, including ISDN, DSL, and routers with integrated wireless.

I use a Cisco 871W router at my house. In addition to it being a great router to connect to the Internet, it’s an excellent router for testing Cisco IOS commands. I also recommend the 800 Series routers to CCNA and CCNP candidates as the best option for studying IOS commands.

Remote office of 25 workers
For remote offices that have 25 or so workers, Cisco 1800 Series routers are an excellent choice. This router is perfect if all you need is a router to connect your office to the Internet, VPN, firewall, and wireless.

Remote office of 50 workers
If you’re looking for the same basic functionality of the 1800 Series but need a lot more performance and expandability, Cisco 2800 Series routers are what you need. With the 2800 series lineup, you can get everything that’s in the 1800 Series plus redundant power supply options, Gig-Ethernet ports, Network Module (NM) expansion slots, VoIP Call Manager Express (CME) with SRST, and much more performance.

Having the NM card slot lets you add things such as a 36-port switch with PoE, a DS3 ATM, a 24-port VoIP module, an intrusion detection module, a network analysis module, or a Cisco Unity Express voice mail module. In my opinion, the Network Module slot on the 2800 Series is where the Cisco router lineup really starts to get exciting.

Remote or HQ office of 100 workers
Cisco 3800 Series routers are similar to the 2800 Series in that there are a lot of HWIC and NM options for them. But what sets them apart from the 2800 Series is the sheer performance of the hardware and the number of HWIC and NM card that you can put into them.

Campus or large HQ office
For very large campus or service providers, the Catalyst 6500 and 7200/7300 Series platforms are for you. Cisco calls these “service aggregation platforms.” These are very high-performance networking platforms with a huge capacity for expansion.

A quick disclaimer: Always read the specifications for the router you’re considering, and consult with your local SE or experienced Cisco reseller to make sure you get the best router for the job.

Cisco 2800 ISR configuration for SIP voice with NAT and Firewall

I had the enjoyable opportunity over the last few weeks to jump in and do a basic Cisco voice install. It was about 110 phones, with the Cisco Unified Communications Manager Business Edition. This is a single box that includes Call Manager 6.1.3, and Unity Connection 2.1. It had to be done fast, and it had to be done right, so I stuck to mostly tried and true configurations.

Since this was a price sensitive design, we used the 2800 router to its maximum potential. The 2800 is an amazingly flexible piece of equipment; it can be configured to do large variety of things. Sometimes known as the Integrated Services Router, or ISR, it can be set up as a router, firewall, VPN, Voice Gateway, SIP session border controller, transoder, conference bridge, and survivable remote gateway, all at the same time, on the same box!

The call manager and unity connection install was straightforward, like punching out license plates. Set up media, device pools, partitions, calling search spaces, translation patterns, gateways, route filters, route patterns, etc. Scan then batch add the phones, set up voicemail and autoattendant call handlers, create expections, deal with the special people, and that’s it. Enough said about that.

The Cisco 2800 Integrated Services Router is used in this example to terminate a Multilink PPP bundle of four Internet T1’s, act as a firewall, provide media services to the Cisco call manager, act as an MGCP controlled analog gateway, and use Cisco Survivable Remote Site Telephony (SRST) to be the backup call processor to the main Cisco Call Manager.

SIP is ok with Network Address Translation as long as the firewall is capable of doing deep packet inspection and NAT’s all references to IP addresses. When I tried to NAT the inside interface of the firewall…it did not work so well. The remote SIP service provider was seeing private IP addresses in the SIP text, which does not make for good two way communications.

The Quality of Service setup on this example is fairly straightforward. Outbound is the standard Cisco MQS low-latency queuing setup, with a priority queue for voice and class based weighted fair queuing for the rest. Even though the service provider has said they prioritize inbound voice, I still set up inbound policing. Non-voice is limited to 4 Mbps, and anything greater than that will be dropped. Voice can use all of the bandwidth, so essentially there is 2 Mbps reserved for inbound voice. This is based on a calculation of 80 kbps for one G.711 call, so 2000 kbps gives us 25 concurrent voice calls, which should be plenty for 110 phones.

Object groups are used, which is new to IOS version 12.4.20T. As a side note, I recommend strongly against using 12.4.22T1 for NAT or SCCP media like MTP’s, since those feature are broken in that version.

version 12.4

no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname PriorityQueueRouter
!
boot-start-marker
warm-reboot
boot-end-marker
!
card type t1 0 0
card type t1 0 1
security authentication failure rate 3 log
security passwords min-length 6
logging message-counter syslog
logging buffered 100000 warnings
no logging console
enable secret 5 0000000000000000000
!
aaa new-model
!
aaa authentication login default local
aaa authorization console
aaa authorization exec default local
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
network-clock-participate wic 0
network-clock-participate wic 1
network-clock-select 1 T1 0/0/0
network-clock-select 2 T1 0/0/1
network-clock-select 3 T1 0/1/0
network-clock-select 4 T1 0/1/1
!
dot11 syslog
no ip source-route
!
!
ip cef
!
!
no ip domain lookup
ip domain name MAINSITE.local

ip inspect max-incomplete high 5000
ip inspect max-incomplete low 4500
ip inspect one-minute high 5000
ip inspect one-minute low 4500
ip inspect tcp idle-time 300
ip inspect tcp finwait-time 10
ip inspect tcp max-incomplete host 1000 block-time 0
ip inspect tcp reassembly queue length 1024
ip inspect tcp reassembly timeout 60
ip inspect tcp reassembly memory limit 256000
ip inspect name EXT_FW ssh
ip inspect name EXT_FW https
ip inspect name EXT_FW ntp
ip inspect name EXT_FW tcp
ip inspect name EXT_FW dns
ip inspect name EXT_FW smtp
ip inspect name EXT_FW udp
ip inspect name EXT_FW icmp
ip inspect name EXT_FW ftp timeout 1200
ip inspect name EXT_FW http
ip inspect name EXT_FW sip
ip inspect name EXT_FW appleqtc
ip inspect name EXT_FW l2tp
ip inspect name EXT_FW pptp
no ipv6 cef
!
multilink bundle-name authenticated
!
!
trunk group FXOPORTS
hunt-scheme sequential both up
!
!
voice service voip
address-hiding
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
no supplementary-service sip moved-temporarily
no supplementary-service sip refer
redirect ip2ip
fax protocol pass-through g711ulaw
modem passthrough nse codec g711ulaw
sip
bind control source-interface Loopback0
bind media source-interface Loopback0
header-passing
registrar server expires max 3600 min 3600
no update-callerid
early-offer forced
!
!
voice class media 1
media flow-through
!
!
voice class codec 1
codec preference 1 g711ulaw
codec preference 2 g729r8
!
!
voice translation-rule 1
rule 1 /^\(2…\)/ /770555\1/
!
voice translation-rule 2
rule 1 /^9/ //
!
!
voice translation-profile OUTBOUND
translate calling 1
translate called 2
!
!
voice-card 0
no dspfarm
dsp services dspfarm
!
!
object-group network EXTERNAL_SIP_SERVERS
host 247.10.98.2
!
object-group network INSIDE_NETWORKS
10.108.0.0 255.255.0.0
!
object-group network INTERNAL_SIP_SERVERS
host 251.222.32.206
host 251.222.32.205

object-group network OUTSIDE_INTERFACE
host 250.1.26.7
!
object-group service PING_SERVICE
icmp echo-reply
icmp unreachable
icmp redirect
icmp echo
udp eq ntp
udp eq domain
!
object-group network PRIVATE_NAT_SERVERS
host 10.108.80.5
host 10.108.60.6
host 10.108.60.7
host 10.108.60.10
host 10.108.60.12
!
object-group network PUBLIC_NAT_SERVERS
host 251.222.32.205
host 251.222.32.195
host 251.222.32.197
host 251.222.32.199
host 251.222.32.201
!
object-group network SERVER_NETWORKS
10.108.60.0 255.255.255.0
10.108.80.0 255.255.255.0
!
object-group network SIP_NETWORKS
host 251.222.32.206
host 251.222.32.205
!
object-group service SIP_SERVICE
udp eq 5060
tcp eq 5060
!
!
controller T1 0/0/0
framing esf
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/0/1
framing esf
linecode b8zs
cablelength long 0db
channel-group 1 timeslots 1-24
!
controller T1 0/1/0
framing esf
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/1/1
framing esf
linecode b8zs
cablelength long 0db
channel-group 1 timeslots 1-24
!
ip tcp synwait-time 60
ip tcp path-mtu-discovery
ip ssh time-out 60
ip ssh version 2
!
class-map match-any VOICE_CLASS
match ip dscp ef
match access-group name VOICEPACKETS_ACL
class-map match-any CALLCONTROL_CLASS
match ip dscp af31
match ip dscp cs3
match ip dscp af21
class-map match-any CONTROL_CLASS
match access-group name NETWORKCONTROL_ACL
match ip dscp af11
class-map match-any FROM_ISP_CLASS
match access-group name FROM_ISP_ACL
!
!
policy-map DROP_NON_VOICE_POLICY
class FROM_ISP_CLASS
police rate 2000000
conform-action set-dscp-transmit ef
exceed-action set-dscp-transmit ef
violate-action set-dscp-transmit ef
class class-default
police rate 4000000
conform-action transmit
exceed-action drop
violate-action drop
policy-map VOICEFIRST_POLICY
class CALLCONTROL_CLASS
bandwidth percent 5
set dscp af21
class CONTROL_CLASS
bandwidth percent 5
set dscp af11
class VOICE_CLASS
priority percent 65 200000
set dscp ef
class class-default
fair-queue
random-detect
!
!
interface Loopback0
ip address 251.222.32.206 255.255.255.255
!
interface Multilink1
ip address 250.1.26.7 255.255.255.252
ip access-group OUTSIDE_IN in
ip verify unicast reverse-path
ip flow ingress
ip nat outside
ip inspect EXT_FW out
ip virtual-reassembly
snmp trap ip verify drop-rate
no cdp enable
ppp multilink
ppp multilink group 1
ppp multilink fragment disable
service-policy input DROP_NON_VOICE_POLICY
service-policy output VOICEFIRST_POLICY

!
interface GigabitEthernet0/0
ip address 10.108.100.254 255.255.255.0
ip flow ingress
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/0/1:1
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1/1:1
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
ip local pool VPNPOOL 192.168.50.200 192.168.50.250
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Multilink1
ip route 10.108.0.0 255.255.0.0 10.108.100.1
no ip http server
ip http authentication aaa
ip http secure-server
!
!
ip nat inside source route-map DYNAMIC_RMAP interface Multilink1 overload
ip nat inside source static 10.108.60.6 64.206.208.195 route-map STATIC_RMAP
ip nat inside source static 10.108.60.8 64.206.208.197 route-map STATIC_RMAP
ip nat inside source static 10.108.60.10 64.206.208.199 route-map STATIC_RMAP
ip nat inside source static 10.108.60.12 64.206.208.201 route-map STATIC_RMAP
ip nat inside source static 10.108.80.5 64.206.208.205 route-map STATIC_RMAP
!
ip access-list extended DYNAMIC_NAT_ACL
deny ip object-group PRIVATE_NAT_SERVERS any
permit ip 10.108.0.0 0.0.255.255 any
!
ip access-list extended FROM_ISP_ACL
permit ip object-group EXTERNAL_SIP_SERVERS object-group INTERNAL_SIP_SERVERS
!
ip access-list extended OUTSIDE_IN
permit object-group PING_SERVICE any object-group OUTSIDE_INTERFACE
permit object-group PING_SERVICE any object-group INTERNAL_SIP_SERVERS
permit object-group PING_SERVICE any object-group PUBLIC_NAT_SERVERS
permit object-group SIP_SERVICE object-group EXTERNAL_SIP_SERVERS object-group INTERNAL_SIP_SERVERS
permit object-group MGMT_SERVICE object-group MGMT_NETWORKS object-group OUTSIDE_INTERFACE
!
ip access-list extended STATIC_NAT_ACL
permit ip 10.108.0.0 0.0.255.255 any
!
!
route-map DYNAMIC_RMAP permit 1
match ip address DYNAMIC_NAT_ACL
!
route-map STATIC_RMAP permit 1
match ip address STATIC_NAT_ACL
!

control-plane
!
voice-port 2/0/0
!
voice-port 2/0/1
!
voice-port 2/0/2
!
voice-port 2/0/3
!
voice-port 2/0/4
!
voice-port 2/0/5
!
voice-port 2/0/6
!
voice-port 2/0/7
!
voice-port 2/0/8
trunk-group FXOPORTS 6
timing hookflash-out 50
connection plar 2700
!
voice-port 2/0/9
trunk-group FXOPORTS 5
timing hookflash-out 50
connection plar 2700
!
voice-port 2/0/10
connection plar 2700
!
voice-port 2/0/11
connection plar 2700
!
voice-port 2/0/12
connection plar 2700
!
voice-port 2/0/13
connection plar 2700
!
ccm-manager fallback-mgcp
ccm-manager mgcp
ccm-manager music-on-hold
ccm-manager config server 10.108.80.5
ccm-manager config
!
mgcp
mgcp call-agent ucserver 2427 service-type mgcp version 0.1
mgcp dtmf-relay voip codec all mode out-of-band
mgcp rtp unreachable timeout 1000 action notify
mgcp modem passthrough voip mode nse
mgcp package-capability rtp-package
mgcp package-capability sst-package
mgcp package-capability pre-package
no mgcp package-capability res-package
no mgcp package-capability fxr-package
no mgcp timer receive-rtcp
mgcp sdp simple
mgcp fax t38 inhibit
mgcp rtp payload-type g726r16 static
mgcp bind control source-interface GigabitEthernet0/0
mgcp bind media source-interface GigabitEthernet0/0
!
mgcp profile default
!
sccp local Loopback0
sccp ccm 10.108.80.5 identifier 1 priority 1 version 6.0
sccp
!
sccp ccm group 1
associate ccm 1 priority 1
associate profile 4 register MTP2851-729
associate profile 3 register MTP2851
associate profile 2 register CFB2851
associate profile 1 register XCD2851
!
dspfarm profile 1 transcode
codec g711ulaw
codec g729r8
maximum sessions 2
associate application SCCP
!
dspfarm profile 2 conference
codec g711ulaw
codec g729r8
maximum sessions 2
associate application SCCP
!
dspfarm profile 3 mtp
codec g711ulaw
maximum sessions software 50
associate application SCCP
!
dspfarm profile 4 mtp
codec g729r8
maximum sessions software 50
associate application SCCP
shutdown
!
!
dial-peer voice 999200 pots
service mgcpapp
port 2/0/0
!
dial-peer voice 999208 pots
service mgcpapp
port 2/0/8
!
dial-peer voice 1 pots
description Incoming called numbers from FXO or FXS or ccm
incoming called-number .
direct-inward-dial
!
dial-peer voice 59111 pots
trunkgroup FXOPORTS
description 911 service with a leading 9
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9[49]11
!
dial-peer voice 59112 pots
trunkgroup FXOPORTS
description 911 service without a leading 9
preference 5
destination-pattern [49]11
!
dial-peer voice 5202 pots
trunkgroup FXOPORTS
description International calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9011T
!
dial-peer voice 19111 voip
description 911 service with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 6
destination-pattern 9[49]11
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
!
dial-peer voice 1200 voip
description local with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 9[2-9]..[2-9]……
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 1201 voip
description long distance with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 91[2-9]..[2-9]……
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 1202 voip
description international with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 9011T
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 999209 pots
service mgcpapp
port 2/0/9
!
dial-peer voice 5200 pots
trunkgroup FXOPORTS
description Local calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9[2-9]..[2-9]……
!
dial-peer voice 5201 pots
trunkgroup FXOPORTS
description Long distance calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 91[2-9]..[2-9]……
!
dial-peer voice 1100 voip
description ** Incoming call from SIP trunk **
translation-profile incoming INBOUND
voice-class codec 1
voice-class sip dtmf-relay force rtp-nte
session protocol sipv2
session transport udp
incoming called-number 770…….
dtmf-relay rtp-nte
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
!
sip-ua
nat symmetric role active
retry invite 3
retry response 3
retry bye 3
retry cancel 3
retry rel1xx 3
timers connect 100
timers connection aging 30
!
!
!
call-manager-fallback
secondary-dialtone 9
max-conferences 8 gain -6
transfer-system full-consult
limit-dn 7961 6
timeouts interdigit 5
ip source-address 10.108.100.254 port 2000
max-ephones 110
max-dn 200 dual-line
dialplan-pattern 1 770555 extension-length 4
transfer-pattern 9……….
keepalive 10
default-destination 2700
no huntstop
time-zone 13
!
banner login ^CC
*******************************************************************************
Unauthorized access and improper use are prohibited. Any activity on the system
is subject to monitoring by the company at any time. Anyone who uses the system
consents to such monitoring and agrees that the company may use the results of
such monitoring without limitation.
*******************************************************************************
^C
!
line con 0
exec-timeout 60 0
logging synchronous
line aux 0
line vty 0 4
exec-timeout 60 0
logging synchronous
line vty 5 15
exec-timeout 60 0
logging synchronous
!
scheduler allocate 20000 1000
ntp server 131.144.4.9
ntp server 198.72.72.10
end

Using NAC for smartphone security on wireless LAN

As unmanaged, Wi-Fi-enabled smartphones proliferate on corporate networks, network managers should use wireless network access control (NAC) to give them an idea of what’s on the network and how they can secure those devices.

“I talked to a hospital recently that had some sense that they had a lot of smartphones on their network, but they weren’t really sure,” said Jeff Wilson, principal analyst for Infonetics Research. “They thought they had about 8,000 total devices on their network, but when they dropped in [a network access control appliance from] ForeScout, they found that they had 12,000 devices. Most of the devices they hadn’t accounted for were smartphones of all flavors.”

Once network managers understand what devices they have on the network, they need look at their smartphone population as two main groups: company-owned assets that IT has access to, and user-owned devices that employees are using to access email and work with sensitive corporate information.

“You have to look at the world in terms of what are the devices I know about and control and what are the devices I don’t know about and can’t control,” Wilson said. “Then you come up with one strategy that works for devices you know about and one for unknown devices. Whether that will be a way to block all access to those devices or to allow access but find some way to limit and control [access] is up to you.”

Grasping control of the managed smartphones on the network is a matter of collaborating with the mobile device manager in the IT organization. The unmanaged devices will be a bigger challenge, Wilson said, “because you’re not going to physically touch all of them.”

Enterprises can use NAC to discover not only what kinds of devices are out there but which software and which security clients, if any, are running on them, he said. This information can help network managers determine what sort of security policies to implement for unmanaged smartphones.

Bill Perry, the IT services manager for Richard Huish College in Taunton, England, recently installed a NAC product from ForeScout specifically to gain visibility into the number of iPhones and USB devices he had on the network.

“There are many courses here where [professors] teach totally from the network,” Perry said. “If it goes down, they stop teaching. I think the iPhone could come on and bring in something that could affect the operations of the network.”

Perry’s ForeScout appliance is currently in monitoring mode to see what is happening on the network. This month he will start implementing rules and policies to gain control over which devices can access his Cisco wireless LAN and his wired network.

Wireless network access control: What are devices doing?

After taking inventory of the smartphones on the network, network managers need to know how devices are being used.

“An important part is understanding how they are getting used on your network,” Wilson said. “What is it [that] users do with the devices when they’re connected, and what kind of threat does that present? That’s something that using some sort of NAC or application control or discovery product can help you understand.”

“Secondarily, think about the data at rest problem,” he said. “Do we have a policy for what to do if someone’s phone is lost? How do we decide whether I care from an IT perspective if that device is lost? And what is it we can do if we can never see, touch or do anything to handle these devices? How can we protect ourselves assuming we are never going to have access to these devices?”

Turning a blind eye to unmanaged smartphones is a gamble. “We haven’t seen a lot of mobile device-specific exploits yet, but I believe that they are coming. Also, companies that invest specifically in security for smartphones right now [are doing it] because they know there are sensitive data that they would worry about if it’s lost or stolen.”

Out-of-band wireless NAC solutions

Not every NAC solution will afford the same amount of control and visibility into unmanaged smartphones, Wilson said. For instance, NAC products from endpoint protection vendors like McAfee and Symantec may not do much good, given that they rely on client software that the smartphones probably won’t have installed. Microsoft NAP might do a good job of managing Windows Mobile smartphones, but it will have trouble tracking other smartphone platforms. NAC products that track only devices that have 802.1x supplicants will have trouble seeing devices that don’t have this software, particularly smartphones.

“So you’re looking at out-of-band solutions that aren’t limited to 802.1x and use other methods, such as capturing MAC addresses and machine IDs,” Wilson said.

Going beyond smartphone security

NAC has also helped Perry deal with other issues relating to both managed and unmanaged laptops on the network. For instance he’s detected a couple of unmanaged PCs that are scanning his network, particularly password scanning, so he’s trying to track the machines down with ForeScout. He’s not convinced that someone is trying to hack the network, but he’ll know more once he finds the machine.

The technology also helped him find a school-owned loaner laptop that had gone missing.

“We went through the records and could see the last time it was on a network, the person who was using it and the port it was accessed through,” Perry said. “So you can track it down, then go find it. That one was being used by the finance department, and then it was locked away in a cupboard for a month and a half.”