Michael Ellerbeck

Finally killing the red triangles :) for MAPI encryption with a riverbed

mellerbeck — Mon, 16 Jan 2012 16:29:30 +0000

The trick was that after I followed everything in this guide

https://support.riverbed.com/download.htm?filename=doc/technotes/Windows_security_guide.pdf

I still needed to configure the ‘client’ steelheads to have matching encryption settings.

Setting up F5 BigIP with VPN on demand, SSO (Single sign on) for Qlikview

mellerbeck — Thu, 12 Jan 2012 23:27:43 +0000

So, initially we were using the PPTP to VPN with our iDevices

http://michaelellerbeck.com/2009/07/08/setting-up-a-vpn-for-an-iphone-using-server-2003-pptp-and-then-connecting-to-qlikview-server/

This worked OK, was kind of flaky though, and the biggest inconvenience was having to manually turn on the VPN. ( Too tricky for VP’s of course)

So our CIO happened on the magic term of VPN on demand. From the there the ball got rolling. Basically, when you go to a pre-defined domain it’s smart enough to fire off the VPN client for you!

I wasn’t involved completely in the install so there are some gaping holes in my knowledge, but I will try to lay out the setup as best as I can.

The F5 big-ip box is a hot rod! We are using only about 1% of its capabilities. It has a very nice visual design tool for configuring your Access Policies

Click to view the whole screen shot. Basically, it start with a ‘Start’ then runs a Client Cert Inspection. (I believe this is where it inspects the client to see that it has the SSL certificate that we setup (We obtained a trusted cert from somewhere). The next step is to check the UI mode of the Client. Then it checks what OS your are running. Then there is a Logon Page (If I remember correctly, this is where the F5 Edge Client grabs the NT username & password. After that it hits the AD Auth module. This module is configured to use a server that was setup name ‘ActiveDirector’ setup under the Access Policy, AAA Servers with an Active Directory Type, and domain controller and other creds specified. After it’s authenticated it then caches the credentials for single sign on!! Module is called SSO Credential Mapping, and I left the settings at default. This mapping uses the SSO setting set at the Access Profile, Properties selection. (This is really cool BTW, otherwise the CEO, VP’s etc… have to type in their password every time that connect to the qlikview server) This is configured under Access Policy, SSO Configurations. I named it SSO_IPHONE_POLICY, I used NTLMV1, I enabled Username Conversion and typed in the NTLM domain, left the rest of the settings at default. Next in the mapping is an AD Query, it once again uses the ‘ActiveDirector’ AD server, User Principal Name is Enabled, Under Branch Rules is a ‘MemberOf’ with an expression of

CN=VPN_Users,OU=Custom Groups,OU=My Groups,DC=mydomain,DC=local . This will check users attempting to connect are members of the VPN_Users AD group. Then finally if all the criteria matches it passes to a Resource Assign and then to an Allow.

There are of course a couple of other settings.

Originally when we set it up the VPN worked great, actually too great…. it would never disconnect. After contacting support this is how to fix it

We have determined why the session is not disconnecting after the Inactivity timeout expires. The edge client sends out 40 bytes of data every 30 seconds or so. For the Network Access object, the ‘Session Update Threshold’ is set to 0 by default. So the 40 bytes we send triggers and keeps the tunnel open and prevents the Inactivity Timeout from starting. With a value of 60 bytes, the tunnel on the iPhone closes after the timeout expires as expected.

Go into your GUI, Access Policy ›› Network Access : Network Access List and select the active one for your set up. Change the General Settings view to “Advanced”. You can update the “Session Update Threshold” to 50 or 60. Update and apply the policy and you should be good to go. If you need assistance with changing that value, let me know.

As mentioned above you need to set the SSO Configuration at the ‘properties tab’ of your Access Profile. Then you need to configure your network access to support SSO through a layered virtual server. This allows your users full network access to multiple web services without requiring them to enter their credential multiple times.

Manual Chapter: Introducing Single Sign-On

http://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm_config_10_2_0/apm_config_sso.html?sr=18213209

Open the document above and search for ’Using Single Sign-On for web application access over network access tunnel’

I was confused by the terminology of layered virtual server, but the way I understand it is that under Local Traffic, Virtual Servers you create a ‘virtual server’ (This is more like a virtual IP??)

I used a Host type, and did all ports. I did standard, and TCP, and http.

Under VLAN and Tunnel Traffic: Client_Access_cp (the correct connectivity profile)

SNAT is set to Auto Map, then make sure Address Translation and Port Translation are not enabled.

Then under the Virtual Address List for the ip of the above ‘virtual server’ uncheck the ARP

When cleared (disabled), specifies that the system does not accept ARP requests.

So, how does it work? Download the F5 Edge Client. The guy who set us up initially used the iPhone Configuration utility to create us a vpn.mobileconfig file. This is an easy way to email the certificate to the user and have them be able to add it.

Now we need to create our own config so open up the Edge Client, press Add Configuration, give it a name, type in the Server address, click Use Cerificates ON, then you choose the certificate that came in the email. Type your username and password, select Connect On Demand and then choose in the domain list your domain, and connect as needed.

Try a quick test connect, should say Contacting, Authenticating, Negotiating, and then Connected. You will notice the little VPN symbol in the top of your screen (In wanders from the left to the right, who knows why?)

So then, if you open up Safari and surf to your Qlikview server using the domain that was indicated in the connect as needed it should fire off the VPN, go to the Qlikview server, and pass your credentials…. Magic!

Qlikview, F5, VPN on Demand, iPhone, iPad and tigers.. oh my

mellerbeck — Wed, 11 Jan 2012 23:17:53 +0000

So one of our recent initiatives has been mobile BI.

Now that we actually got it working I wanted to document it a little, since there are some tricky things about it.

At a high level this is what happens.

Install the F5 Edge Client, configure the VPN on demand with a certificate, NT username and password. Setup the domain list for connect if needed to lets say mydomain.local

So open up Safari, type in myqlikview.mydomain.local

This will bring you to the Qlikview portal, choose your qlikview, after it opens up press the button to add it to your home screen.

So, I will break out the config for the F5 into this post:

http://t.co/0HpFZejp

And then some Qlikview designs and notes here:

If for what ever reason you want to import an EPS with Inkscape

mellerbeck — Wed, 11 Jan 2012 22:16:03 +0000

First you need to install GhostScript.

Then add a PATH environment variable to C:\Program Files\gs\gs8.64\bin and C:\Program Files\gs\gs8.64\lib (using your version of course)

And then copy the file gswin32c.exe from the directory :
C:\Program Files\gs\gs8.64\bin
to the directory :
C:\Program Files\gs\gs8.64\lib
so that it exists in both places?
The ‘lib’ directory is probably already in the path, but the ‘bin’ directory may not be in the path, and the file gswin32c.exe is essential for this procedure. (You’ll need to adjust the version number 8.64 as required)

From https://bugs.launchpad.net/inkscape/+bug/442243

Been a busy day, Native 2003 mode, Delegation and more fun, Riverbeds

mellerbeck — Wed, 11 Jan 2012 19:43:44 +0000

So as most things IT, there is usually a long chain of dependencies. So recently we started rolling Outlook 2010 to our remote locations.

Well this of course causes our Riverbed WAN optimizers not to be able to encrypt the MAPI traffic anymore. Red triangles bah…

So, I get the awesome guide from riverbed on how to set up the MAPI optimization.

https://support.riverbed.com/download.htm?filename=doc/technotes/Windows_security_guide.pdf

They write really good documentation!

So I get to step like 10 and then you have to right click on the created user and go to the delegation tab…. grr I don’t have a delegation tab. And why is that? Because we’re still running mixed mode. I know, I know that is so like last century. So after fixing a couple of schema ‘ghosts’ caught by the following commands to check AD

Run dcdiag, netdiag and repadmin in verbose mode.
-> DCDIAG /V /C /D /E /s:yourdcname > c:\dcdiag.log
-> netdiag.exe /v > c:\netdiag.log (On each dc)
-> repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt

We finally are in native 2003 mode.

So I can continue on trying to optimize the encrypted MAPI traffic.

I had to rename the riverbed because its name was longer than 15 characters… gah

Gah, unfortunately after all that I’m still getting the blasted red triangles!

EQL users, do you use the web GUI or CLI for firmware upgrades?

mellerbeck — Mon, 09 Jan 2012 17:17:58 +0000

I’m curious about all of those EQL users out there, do you use the web GUI for your firmware upgrades or do you use the CLI?

After reading the post below I think I’m leaning towards the CLI upgrade, you?

http://www.interweb.org.uk/2012/01/06/equallogic-kernel-panic-on-a-netbsd-processor/

During the upgrade I recieved a Kernel Panic and subsequent Panic Recovery, looks like the controller crashed during the update this resulted in the iSCSI targets being unavailable for a couple of minutes, the controllers did not fail over and I now have a Firmware mismatch.

Spoke to EqualLogic support, according to them there is a rare issue with FW Versions 5.1.x that in when you process a firmware update using the Java based Group Manager GUI, there are instances when the firmware file becomes corrupted. Support siad that this is a very rare issue and that it will be addressed in further updates.

VSS asynchronous operation is not completed. Operation

mellerbeck — Fri, 06 Jan 2012 21:45:07 +0000

To Fix: Free up some space on the harddrive of the virtual machine.

From here http://kb.hyve.com/wiki/Veeam%20backup%20fails%20due%20to%20bad%20vss%20writer

Excel 2010 only prints to the default printer

mellerbeck — Fri, 06 Jan 2012 21:39:10 +0000

To fix: ”I had installed the add-in “Microsoft Office Labs Search Command”. As soon as I “deselected” it from the active add-ins it went back to working.

From http://answers.microsoft.com/en-us/office/forum/office_2010-excel/excel-2010-only-prints-to-the-default-printer/5b6beddd-f85d-4fda-ab2b-56c750f2028c?msgId=860b990d-a5ab-4078-aa65-63c659c3a01c

This looks cool, but doesn’t work for me :(

mellerbeck — Thu, 15 Dec 2011 17:36:19 +0000

http://ssmsallocation.codeplex.com/

Any alternatives out there

Strangest network storm today, something to do with the ESX host

mellerbeck — Wed, 14 Dec 2011 19:30:34 +0000

So I was doing a P2V and all of the sudden our network started going crazy. After a lot of poking around we seemed to isolate it to the P2V process. After looking at our ESX hosts one of them wasn’t pulling up anything on the display through our KVM which was strange. This appeared to be the host that the P2V was going against. After a hard power off/power of the ESX host, the P2V was able to proceed smoothly.

Strange