4400 Controllers - Best Practise for connecting to wired network

At one time the best practise recommendation for wireless was to treat the traffic as untrusted and separate it from the wired network by firewalls and intrusion detection. A lot of the reason for this was the weakness of WEP. Now with strong authentication and encryption (e.g., WPA2 and EAP-TLS) in use, and the use of wireless controllers, I'm wondering what the industry is recommending (and doing in case the actions aren't the same as the recommendations).
Are organizations connecting the wireless controllers directly to the internal network or are they separating them with a firewall and IDS infrastructure? If the latter, what does the architecture look like? Are there documents on the Cisco site or on the Internet that show how the controllers could be firewalled? Everthing I've seen shows connections directly to the internal network. Is firewalling the controller an overreaction to the historical paranoia from the WEP days?

The argument would be that regardless of what security you put on the wireless, you still don't have the physical security - i.e. someone doesn't need to walk into your building to use your network.
Beyond that if you're using strong auth/enc you can currently be considered safe, we have customers using that direct into their LANs (but then, we also have customers with WEP direct into their LANs!)...
If you are concerned or really need belt 'n' braces security, then go down the firewall/IDS route - there's no harm in it if you have the money. It really depends how much functionality and ease of use you need to balance against it.
Aaron
Please rate helpful posts

Similar Messages

Best Practise for connecting to Ethernet based device

Hi,
I have inherited a system where we have a cDAQ-9181 controlling an vehicle access barrier, with a LabView application on a PC talking to it via Ethernet.
(The application is very simple - press a button > send a value to the 9181 unit > opens the barrier )
All works fine most of the time.
( We occasionally get network related errors. The LabView application sometimes thinks another PC has reserved the unit, or gives “error 89130 - device not available for routing” )
The users would now like to be able to easily run the application from a second PC ( not at the same time ), but this seems to be a problem. If I exit the application on PC “A” and run it on PC “B” it struggles to reserve the chassis, and throws the “89130” error and I have to restart the unit via MAC.
While I’m a “veteran” control programmer, I’m new to LabView, and would be very grateful for any pointers on “best practise” for talking to devices via Ethernet, or any specific suggestions for handling multiple PCs talking to a single device.
Thank You.
Tim.

Hi Tim,
Thank you for your post and welcome to the NI forums.
There are lots of knowledgebase articles on our website and you should be able to find documentation for most of our hardware.
There is a good troubleshooting guide for cDAQ Ethernet here (http://ae.natinst.com/public.nsf/web/searchinternal/e67b4e4749f378ff862577270059bd4b?OpenDocument) - it outlines the steps to take to ensure you have a stable a connection as possible. You may have already seen it, but the quick-start guide for your specific device may also be worth consulting for best practices. Are these helpful?
As for using more than one PC - this shouldn't be too much of an issue. I would expect that the resource isn't being closed correctly - when you exit the App on PC 'A', how are you closing off the resource?
Best regards,
Eden S
Applications Engineer
National Instruments UK & Ireland

Best Practise for rebooting ISE Nodes?

Hello Community,
I administer an ISE installation with two nodes (I am not an ISE Specialist, my job is just to manage the user/mac-adresses... but now I have to move my ISE Nodes from one VMWare Cluster to another VMWare Cluster.
(Both VMWare environments are connected to our enterprise network, but are different environments. vMotion not possible)
I would shutdown ISE02, move it to our new VMWare environment and start it again.
Than I would do this with our ISE01 Node...
Are there any best practises for doing this? (Shutdown application first, stopl replikation etc)?
Can I really simply reboot an ISE Node - or have I consider something bevor I doing this? After I doing this?
Any tasks after reboot?
Thank you for any answer!
ISE01
Administration, Monitoring, Policy Service
PRI(A), SEC(M)
ISE02
Administration, Monitoring, Policy Service
SEC(A), PRI(M)

There is a lot to consider here. If changing environments means changing IP Address and IP Scopes, then your policies, profiles, and dACLs would also have to change among other things. If this is the case, create a new ISE VM in the new environment using the built in evaluation license and recreate the deployment from the old environment using the addressing scheme of the new environment. Then spin-up a new Secondary node and register it on the Primary. Once this is done, you can re-host the license from your old environment onto your new environment. You can use this tool to re-host:
https://tools.cisco.com/SWIFT/LicensingUI/loadDemoLicensee?FormId=3999
If IP Addressing is to remain the same, it gets simpler.
First, and always, perform a configuration and operational backup.
If downtime is not an issue, or if you have a maintenance window of an hour or so: Simply shut down both nodes. Transfer them to the New Environment and turn them on, Primary Node first, of course.
If downtime is an issue, shut down the Secondary Node and transfer it to the New Environment. Start the Secondary Node and when it is up, shut down the Primary Node. Once services on the primary node have stopped, promote the Secondary Node to Primary Node.
Transfer the OLD Primary Node to the New Environment and turn it on. It should assume the role of Secondary Node. If it does not, assign that role through the GUI.
Remember, the correct way to shut down an ISE node is:
application stop ise
halt
By using these commands, the risk of database corruption decreases by about 90% (Remember to always backup).
Please Rate Helpful posts and mark this question as answered if, in fact, this does answer your question. Otherwise, feel free to post follow-up questions.
Charles Moreton

What is the best practise for setting dirty flag of a page/view?

For a page/view, normaylly there are 2 things to do for diry data:
1. when it's clean, Save button is disabled, when it's dirty, save button is enabled.
2. when it's dirty and the window is closed, a popup says "you have unsaved data, close will lose the data".
My thought is: it must be handled at client side, because not all valuechange is auto submitted. E.g., you type the 1st letter of a string in a input box, the server side does not know it, but save button should be enabled immediately.
Is it possible to capture all valueChange events in a page or a view at client side?
I'm not sure what is the best practise for setting dirty flag? If there is better solution? Does ADF provide facility for this?

public void save(ActionEvent event){
boolean formValid = isFormValid();
   if (formValid) {
save button is enabled.
    private boolean isFormValid() {
        boolean valid = true;
        if (Check Condition 1) {
            valid = false;
           showErrorMessage1();
        if (Check Condition 2) {
            valid = false;
           showErrorMessage1();
        return valid;
    private void showErrorMessage1() {
                when it's dirty and the window is closed, a popup says "you have unsaved data, close will lose the data".

Best practices for connecting to DB

Hi,
I am having 3 different java classes which will contact the DB for getting the data from the table. I wrote a separate java class for DB connection like this :
public class DBConnection {
private Connection con;
public Connection getConnection() {
try {
Class.forName("org.apache.derby.jdbc.ClientDriver");
con = DriverManager.getConnection("jdbc:derby://localhost:1527/StrutsDB", "username", "password");
} catch (SQLException ex) {
Logger.getLogger(DBConnection.class.getName()).log(Level.SEVERE, null, ex);
} catch (ClassNotFoundException ex) {
Logger.getLogger(DBConnection.class.getName()).log(Level.SEVERE, null, ex);
return con;
How to use this single connection object in all of the 3 classes? What are all the ways of doing so?
Is there any best practices for connecting to DB?
Thanks in advance,

The problem with "best practice" is it really depends on your situation. If you are creating a single user, desktop application then what you are doing will work but would be more efficient if the connection was declared as static and you used the singleton pattern.
public class DBConnection {
    private static final Connection con;
    private DBConnection() {
        try {
            Class.forName("org.apache.derby.jdbc.ClientDriver");
            con = DriverManager.getConnection("jdbc:derby://localhost:1527/StrutsDB", "username", "password");
        } catch (SQLException ex) {
            Logger.getLogger(DBConnection.class.getName()).log(Level.SEVERE, null, ex);
        } catch (ClassNotFoundException ex) {
            Logger.getLogger(DBConnection.class.getName()).log(Level.SEVERE, null, ex);
    public static Connection getConnection() {
        return con.
}The private constructor guarantees only one instance of the class will be created (since you can't use 'new' to create one) and initialized the database connection. Then any other object that require a connection simply call DBConnection.getConnection() and they will get the same database connection each time.
Note that this is a little simplistic and is not thread safe. If your classes will be executing on different threads you will need a more sophisticated approach. You will also need to make sure you commit or rollback any transactions when done or the next time you get the connection you may be in the middle of an existing transaction.

SAP Best Practises for Logistic Modules

Dear Reader,
Does anyone know how to find SAP Best Practises for Netweaver 2004s Logistic scenarios (SD, MM,)
The old Netwvr 2004 scenarioas are less helpful, especially in Inventory mgmt.
Thanks

Check this link, this is the latest I guess.
[SAP Best Practices|http://help.sap.com/bp_bw370/html/index.htm]
Cheers,
Neel.

Best practises for replication

Hi,
I want to know what is best practise for duration of replicaation of database between two Cisco ACS.
Regards,
Atif.

Hi Atif,
The replication time interval should always be higher.
Reason: Everytime you replicate the data it requires ACS services to restart so doing this frequently may affect your production enviroment.
However, if you want to replicate internal user's password then there is an option to replicate password changes right awayvwithout a full replication. You can enable this option under System Configuration -> Local Password Management. With this enabled you could potentially set the replications to a larger interval.
It also depend how often you do changes in your ACS. If its normal then I would say set it to every sunday 12:00 PM.
This is how replication happens:
The primary ACS stops its authentication and creates a copy of the ACSinternal database components that it is configured to replicate. During this
step, if AAA clients are configured properly, those that usually use the primary ACS fail over to another ACS. The primary ACS resumes its authentication service.
After the preceding events on the primary ACS, the database replication process continues on the secondary ACS. The secondary ACS stops its authentication service and replaces its database components with the database components that it received from the primary ACS. During this step, if AAA clients are configured properly, those that usually use the secondary ACS fail over to another ACS. The secondary ACS resumes its authentication service.
HTH
Regards,
JK
Plz rate helpful posts-

Best Practises for doing Master Scheduling using SNP

Hello Gurus ,
Can you please suggest the best practises for doing Master Scheduling using SNP . Which engine to use , what would that mean etc
Regards,
Nick

APC Back-UPS XS 1300. $169.99 at Best Buy.
Our power outages here are usually only a few seconds; this should give my server about 20 or 25 minutes run-time.
I'm setting up the PowerChute software now to shut down the computer when 5 minutes of power is left. The load with the monitor sleeping is 171 watts.
This has surge protection and other nice features as well.
-Noel

ECC 6.0 upgrade to Best practise for chemical industry implementation

Dear All.,
Please tell me what all the EHP3 must be updated in the SAP erp ecc 6.0. I have already updated
SAP_APPL 60304.
Tell me what is the next Ehp3 required before i start best practise in saint.
Thanks & Regards,
Manju

Dear sir.,
I have installed SAP ECC 6.0 for a chemical industry, now am planning to implement Best practise to reduce implementation time.
1) As per the SAP Quick quide i have downloaded best practise for chemical industry(IS) and implemented through SAINT, and the prerequisites were maintained as per the SAP notes 774615,1301301,1064635,
2)The above mentioned notes explains minimum stack11 and sapka=18,sapkb=18,sapbw=20,PI_Basis-2005_1_700=20 and sap_ap=15 to update Ehp3 for SAP_APPL603.
3) After updating all the above mentioned patch level i implemented the Best practise in saint and that was successful.
But still the problem persist in activation of BP by tcode /n/smb/bbi only 70% has been completed and activation stoped with *ABAP program error ASSIGNSUBSTRING_NOT_ALLOWED and relevent note is 1295083*_
Please any one tell me, is that required to update all the EHP3 components since i have maintained only SAP_APPL60304.
What all Ehp3 components should be updated to get a smooth activation og BP for chemical industry.

Wats the best practise for performance

Hi all,
In my out line i have 15 dimensions and for one dimension i have 39000 members so wat is the best practise for performance , If we have more dimensions and more meebers is there any problem for performance
so wat is the best practise for dimensions and members??
Thanks in advance??

If it is ASO application it is not a problem.
If it is a BSO application surely it will hit the performance.
More dimensions will create performance issues.
If the said 39000 members dimension is a Flat dimension. It will be another issue.
If BSO is obvious try to split into two models.
Create intermediate groupings for the Filat dimension.

How to install Best Practise for HCM

Hi all:
Could you please tell me how to install best practise for HCM , as there is no autoran file.
Thank you very much!!!
Best regards
Frank

Hi,
Did you chk this link;
http://help.sap.com/content/bestpractices/overview/index.htm
http://help.sap.com/bp_hcmv1600/HCM_US/HTML/index.htm
Regards
CSM Reddy

Suggest me the best practise for accesing database by JSP page

Hi,
Can you please suggest me the best practises to connect to database through JSP page.
I am using the Struts-Portlet environment. And I have to display some contents from the database to the jsp page(view.jsp).
Please suggest.
Saurabh.

If you know how to use struts and portlets, you wouldn't be asking this question. I suggest looking into the Model-View Controller pattern to get an idea how to set up a web application, then think about how to do it in a portlet environment.

Best Practises for Backup & Recovery windows

Hi All,
Could you please let me know the following .
1. Best Practises to be followed for backup & recovery on windows server 2008
2. how to plan for the DR on windows
Regards
Mohammed. Abdul Muqeet

Mohammed Abdul Muqeet wrote:
Hi All,
Could you please let me know the following .
1. Best Practises to be followed for backup & recovery on windows server 2008
As far as the Oracle database is concerned, best practices on Windows server 2008 are exactly the same as for any other OS.
http://docs.oracle.com/cd/E11882_01/backup.112/e10642/toc.htm
(and my own prejudice, developed over 30+ years in this industry and working with Oracle on Windows beginning with Oracle 7.3 on windows 3.11, is that best practice is to stay as far away from Windows as possible)
2. how to plan for the DR on windowsAs far as the Oracle database is concerned, best practices on Windows server 2008 are exactly the same as for any other OS.
Backup everything. Get the backups off site. Perform regular DR drills. Document everything. Keep a copy of the documentation off site. (Doesn't do any good to have the DR manual located such that it gets destroyed in the same disaster that takes out your data center. ) Have an off-site DR site.
While it isn't in your lane as a DBA, you need to keep reminding managment that DR is about more than just the database, and even more than just the data center itself. If there is a physical disaster (ask the people in Oklahoma City about that ... over the years - multiple F5 tornadoes, plus a truck bomb) all kinds of infrastructure and documentation issues. What about important records (like the DR manual) that exist only in someone's desk drawer? Where are the business units going to set up shop and how are they going to connect to the restored database at the DR site?
I've seen DR manuals that got down to the detail of temporary housing for employees and how to get coffee at the DR site.
>
>
Regards
Mohammed. Abdul MuqeetEdited by: EdStevens on May 23, 2013 7:44 AM

Best Practices for Connecting to WebHelp via an application?

Greetings,
My first post on these forums, so I appologize if this has already been covered (I've done some limited searching w/o success). I'm developing a .Net application which is accessing my orginazation's RoboHelp-generated webhelp. My organization's RoboHelp documentation team is still new with the software and so it's been up to me to chart the course for establishing the workflow for connecting to the help from the application. I've read up on Peter Grange's 'calling webhelp' section off his blog, but I'm still a bit unclear about what might be the best practices approach for connecting to webhelp.
To date, my org. has been delayed in letting me know their TopicIDs or MapIDs for their various documented topics. However, I have been able to acquire the relative paths to those topics (I achieved this by manually browsing their online help and extracting out the paths). And I've been able to use the strategy of creating the link via constructing a URL (following the strategy of using the following syntax: "<root URL>?#<relative URI path>" alternating with "<root URL>??#<relative URI path>"). It strikes me, however, that this approach is somewhat of a hack - since RoboHelp provides other approaches to linking to their documentation via TopicID and MapID.
What is the recommended/best-practices approach here? Are they all equally valid or are there pitfalls I'm missing. I'm inclined to use the URI methodology that I've established above since it works for my needs so far, but I'm worried that I'm not seeing the forest for the trees...
Regards,
Brett
contractor to the USGS
Lakewood, CO
PS: we're using RoboHelp 9.0

I've been giving this some thought over the weekend and this is the best answer I've come up with from a developer's perspective:
(1) Connecting via URL is convenient if (#1) you have an established naming convention that works for everyone (as Peter mentioned in his reply above)
(2) Connecting via URL has the disadvantage that changes to the file names and/or folder structure by the author will break connectivity
(3) Connecting via TopicID/MapID has the advantage that if there is no naming convention or if it's fluid or under construction, the author can maintain that ID after making changes to his/her file or folder structure and still maintain the application connectivity. Another approach to solving this problem if you're working with URLs would be to set up a web service that would match file addresses to some identifier utilized by the developer (basically a TopicID/MapID coming from the other direction).
(4) Connecting via TopicID has an aesthetic appeal in the code since it's easy to provide a more english-readable identifier. As a .Net developer, I find it easy and convenient to construct an enum that matches my TopicIDs and to utilize that enum to construct my identifier when it comes time to make the documentation call.
(5) Connecting via URL is more convenient for the author, since he/she doesn't have to worry about maintaining IDs
(6) Connecting via TopicIDs/MapIDs forces the author to maintain those IDs and allows the documentation to be more easily used into the future by other applications worked by developers who might have their own preference in one direction or another as to how they make their connection.
Hope that helps for posterity. I'd be interested if anyone else had thoughts to add.
-Brett

Best Practises for Error Handling

Hello
I have a PHP front end application and for now an Oracle database in the backend. User defined errors are returned back to PHP front end using RAISE_APPLICATION_ERROR(-20000,'error msg'), the PHP displays the message to the user. We have a problem where we are now going to provide a French version on the application and are stuck at what we are to do with the error messages.
What is the common practise for this?

Don't reinvent the wheel. Oracle provides built-in error globalization.
http://www.morganslibrary.org/reference/pkgs/utl_lms.html
SQL> set serveroutput on
SQL> DECLARE
2   s VARCHAR2(32767);
3   i PLS_INTEGER;
4 BEGIN
5    i := utl_lms.get_message(26052,'rdbms','ora','french', s);
6
7    dbms_output.put_line('before format, message is: ' || s);
8
9    dbms_output.put_line('formatted message is: '|| utl_lms.format_message(s, 96, 'my_string'));
10 END;
11 /
before format, message is: Type %d non pris en charge pour l'expression SQL sur la colonne %s.
formatted message is: Type 96 non pris en charge pour l'expression SQL sur la colonne my_string.
PL/SQL procedure successfully completed.
SQL> ed
Wrote file afiedt.buf
1 DECLARE
2   s VARCHAR2(32767);
3   i PLS_INTEGER;
4 BEGIN
5    i := utl_lms.get_message(26052,'rdbms','ora','german', s);
6    dbms_output.put_line('before format, message is: ' || s);
7    dbms_output.put_line('formatted message is: '|| utl_lms.format_message(s, 96, 'my_string'));
8* END;
9 /
before format, message is: Nicht unterstützter Typ %d für SQL-Ausdruck in Spalte %s.
formatted message is: Nicht unterstützter Typ 96 für SQL-Ausdruck in Spalte my_string.
PL/SQL procedure successfully completed.If you are writing your own messages then Tubby's recommendation is best but I'd be inclined not to put the messages into a table but rather to put them into a package header as constants which minimizes I/O overhead.

4400 Controllers - Best Practise for connecting to wired network

Similar Messages

Maybe you are looking for