Microsoft Clustering and Ping

We often take the venerable ping utility for granted.  Simply tell it what to ping and it does it.  When you're in a Microsoft cluster environment though you might not get what you really wanted.

Let's say that you're testing a firewall rule for a particular cluster IP address.  If you start to ping from any of the cluster nodes, you will actually ping from that node's IP address.  This obviously won't test the firewall rule correctly.  Instead you want to ping from the cluster's IP address.  To do this you just need to look at the command line options for ping.

C:\Users\storyb.000>ping -?
Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
            [-r count] [-s count] [[-j host-list] | [-k host-list]]
            [-w timeout] [-R] [-S srcaddr] [-4] [-6] target_name
Options:
    -t             Ping the specified host until stopped.
                   To see statistics and continue - type Control-Break;
                   To stop - type Control-C.
    -a             Resolve addresses to hostnames.
    -n count       Number of echo requests to send.
    -l size        Send buffer size.
    -f             Set Don't Fragment flag in packet (IPv4-only).
    -i TTL         Time To Live.
    -v TOS         Type Of Service (IPv4-only. This setting has been deprecated
                   and has no effect on the type of service field in the IP Head
er).
    -r count       Record route for count hops (IPv4-only).
    -s count       Timestamp for count hops (IPv4-only).
    -j host-list   Loose source route along host-list (IPv4-only).
    -k host-list   Strict source route along host-list (IPv4-only).
    -w timeout     Timeout in milliseconds to wait for each reply.
    -R             Use routing header to test reverse route also (IPv6-only).
    -S srcaddr     Source address to use.
    -4             Force using IPv4.
    -6             Force using IPv6.

So from looking over this list it looks like -S will save the day which it will.  By using ping -S <sourceIP> <dstIP> you can ping any host from the cluster's virtual IP.

Petition Cisco for Educational IOS

Greg over at Ethereal Mind has reposted his petition to Cisco to have them add educational versions of IOS.  The idea is to have something that is full featured, but performance crippled so that people can learn IOS without a large outlay in cash or having to use less than legal means to acquire IOS images.  Please take a look and sign the petition.

Internet Explorer 6 -- Ere he says he's not dead yet.

Contrary to reports that say IE 6 is dead, unfortunately it is not.  Today I got an urgent call to come help an outside technician that was installing a new remote support tool on some equipment.  He was having problems because he couldn't get past our IronPort WSA web filter.  I trotted up expecting to just add a few device IPs temporarily to the proxy bypass list until he was done downloading things.  Unfortunately the application needed web access all of the time and used the installed version of IE which of course was IE 6.  This is where it gets hairy.

Ironport WSA is configured to use passthrough NTLM authentication to authenticate users for Internet access.  This works great for IE 7+, Firefox and Chrome.  Unfortunately IE6 is braindead when it comes to NTLM authentication and only works with some NTLM proxies.  This means that I have to hard code any IE6 clients to use our proxy explicitly.

Moral of the story, vendors please update your "appliances" to modern software versions.

Uncompressing Image @@@@@@@@@@@@@@@@@@

I have done blogs before for my social life (yeah that one sucked) and for my religious interests, but now I've decided that it is time to blog about what I do most of the week... Cisco networking.

I am currently the network engineer for a 100 bed hospital in West Central Illinois doing both data and voice networking.  My data network is based on the Cisco 6509 VSS and Cisco 3750 switches along with WiSM controllers for my 1142n wireless access points.  One the voice side I am maintaining a 1996 vintage Rolm/Siemens 9751 MOD 80 (aka Siemens HiCOM 300) until money becomes available to modernize it.