FWSM and CSM in same 6509? Best Practice?

I have a customer that has a FWSM and CSM in the same 6509 chassis. Is there a best practices configuration for doing this?

Hi,
Here are good documents:
http://cisco.com/en/US/partner/netsol/ns340/ns394/ns224/ns304/networking_solutions_package.html
In particular:
http://cisco.com/application/pdf/en/us/guest/netsol/ns304/c649/cdccont_0900aecd8010e77f.pdf
Best regards,
Pascal

Similar Messages

FWSM and CSM (Load Balance) in the same chassi

Folks,
Is there any type of best practice (you ** must ** do like this) when you are going to implement the FWSM and the CSM modules on the same 6509 chassi ?
PS: The CSM is not doing FW loadbalance, it is doing loadbalance to servers located in a DMZ
PATH:
(outside) FWSM (inside) -> MSFC -> (inside) PIX (dmz) -> CSM , CSM -> (dmz) PIX (inside) -> MSFC -> (inside) FWSM
My main doubts:
1) FWSM using multi-context, Is there any integration problem with CSM ?
2) FWSM and CSS in routed mode, Is there any integration problem with both modules ?
3) Is it really necessary to operate the FWSM module in bus mode when using CSM in the same chassi (fabric switching-mode force bus) ?
Cisco Says:
"The CSM line card operates in bus mode. When using the CSM in conjunction with the FWSM line card,
Cisco recommends forcing the FWSM to operate in bus mode using the
fabric switching-mode force bus command. When service modules such as the CSM and the FWSM
operate in bus mode, traffic from DFC-enabled line cards still use the fabric connection."
In past it was a workaround due a bug, but I have found this recommendadon and know I am a little confused.
Tks !!!

Luis-
You will want to used a routed mode on the CSM so that the Firewall contexts don't see eachothers MAC Addresses for any traffic not destine to to a VIP. On the CSM VLANs, you will want to create alias IPs to use as the next hop destination between contexts for non-VIP traffic. Other than that, the CSM has no concept of contexts, so as long as the traffic is symetric when it flows through the CSM VLANs, it will be happy.
Regards,
Chris

Multiple IPs and Outbound IP on 2008, best practice suggestion...

Hello,
I need a suggestion on an issue;
I have a Windows 2008 R2 SP1 Std. Ed. I have 3 IPs for that server, each of them uses the same gateway. By design the IP which is closest to the gateway is the default outbound IP on W2K8_R2_SP1_SE.
I want to choose any other IP out of other 2 assigned IPs as default outbound one.
example:
GATEWAY: 10.0.0.1
IP1: 10.0.0.2 (default outbound by design)
IP2: 10.0.0.3 (the one I want it to be default outbound)
IP3: 10.0.0.4 (not important)
There are basically 2 choices available to me doable right now. Can you please take a moment and suggest one of the solutions below or state if you know the best practice for such a case? Thank you very much in advance =)
First Solution:
apply this command: Netsh int ipv4 add address 12 10.0.0.1 255.x.x.x skipassource=true
then apply these 3 hotfixes:
IP addresses are still registered on the DNS servers even if the IP addresses are not used for outgoing traffic on a computer that is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2386184
The "skipassource" flag of IP addresses is cleared after you use the GUI to change IP settings of a network adapter in Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/2554859
FIX: IIS Manager does not display IP addresses that are assigned to the network adapter together with the skipassource flag
http://support.microsoft.com/kb/2551090
Second Solution:
Simply create 2 interfaces. Use the first one with the IP that I want to be as outbound default, dump all other IPs to the second interface. 2 interfaces will have the same gateway but Windows will assume the first one as the outbound default.

I believe you want to set the metric on the interfaces.
You can do this by altering your routing table with
route.exe or alternatively, you can change the interface metric in the TCP/IP advanced properties for your network adapter (via Control Panel). By default it uses an automatic metric (i.e. Windows chooses which interface to use).
For your reference (and the reference of anyone else facing a similar challenge), the metric is a weighted value Windows will use to determine which interface to use for a particular endpoint. Here is the definition from the route.exe documentation:
metric Metric : Specifies
an integer cost metric (ranging from 1 to 9999) for the route, which is used when choosing among multiple routes in the routing table that most closely match the destination address of a packet being forwarded. The route with the lowest metric is chosen. The
metric can reflect the number of hops, the speed of the path, path reliability, path throughput, or administrative properties.
Jason Warren
@jaspnwarren
jasonwarren.ca
habaneroconsulting.com/Insights

FWSM and CSM

Folks,
I know a lot of customers like to implement both at the same time, so that FWSM can give protection to CSM. Can someone point me to the same config that talks about how to configure the 2 together. I remember looking at the config where the FWSM was configured in transparent mode and then the CSM was place behind the FWSM. But, there was a catch to the config which i forget.
so lets say my fwsm is bridging between vlan 10 and 11, will the csm vip be in vlan 11 (high security interface on the fwsm), will this work, where would my real servers reside, has anyone tested this and could share a sample config please.

i worked on a design where FWSM was in Routed Mode and CSM Server VLAN was on the secure network and FWSM had the necessary translations and Access-lists to pass the traffic.
For FWSM in Transparent mode, it would still be the same case where VIP is on the secure side of the network.
thanks
Nadeem

NX7K M and F series mixed chassis best practice?

I have NX7010 chassis' with mixed M and F series line cards. Fucntions to implement include VDC, vPC, VRF, and L3 routing. What are the best practices for mixed chassis? I once saw a Cisco document talking about it but couldn't find it right now.
Thanks in advance

Understand Layer 3 functions should be performed by M1 ports. But if I use F2e 10G ports to build a trunk between 2 NX7K, then use a SVI to make Layer 3 adjacency across this trunk connection, is it ok?
I can use M1 1G ports to build this trunk too but I would prefer F2e 10G ports if this is ok.
Thanks

Design Choices and is LiveCycle needed? best practices for using RTMP/AMF over HTTP/XML communicatio

Hi,
I am new to flex/RIA. I am exploring different design choices especially in client server communication. On client side we will be using Flash based RIA (using Actions scripts).
There will be some simple forms (like for login, registration, payments etc) and some simple reports including with several graphs and charts. Each chart might have 1000 to 1500 data points etc. There are not video or audio content as such. On server side we have Servlets, java API and some EJBs to provide the business logic and real time prices/content (price update is usually every 10 seconds) /data. Some of the content will be static as well.
I have following questions in my mind. Is it worth it to use RTMP/AMF channels for the followings?
1. For simple forms processing (Mapping Actions scripts classes to Java classes). Like to display/retrieve/update data for/from registration forms.
a. If yes, why? Am I going to be stuck with LCDS? Is it worth it? What could be the cons for heavy usage/traffic scenarios
b. If not what are the alternates? Should I create the web services? Or only servlets are sufficient (ie. Only HTTP+Java based server side with no LCDS+RTMP+AMF)? All forms need to communicate on secure channel.
2. For pushing the real time prices/content which we may need to update every 15 seconds on user interface using graphs and charts. Can I do it with some standard J2EE/JMS way with RIA (Flex) on front-end? i.e. Flash application will keep pulling data from some topic. Data can be updated after few secs or few minutes which cant be predicted.
3. Are there any scalability issues for using RTMP? What happens if concurrent users increase 10 times within a year?
4. What are the real advantages of using RTMP/AMF instead of simple HTTP/HTTPS probably using xml based objects
5. Do I need to use LCDS if I am using AMF only on client side? Basically I mean if I am sending an object in form of xml from a servlet. Can some technology in Flash (probably AMF) in client side map it an Action script object?
6. What are the primary advantages of using LCDS in a system? Is there any alternate solutions? Can I use some standard solutions for data push technologies?
I would like that my server side implementation can be used by multiple types of clients e.g. RIA browser based, mobile based, third party software (any technology) etc.
I appreciate if you can kindly refer me to some reading materials which can help me deciding the above. If this is not the right place to post this message then please do refer me to the place where I can post such questions.
Thanks and Kind regards,
Jalal

Hi Jalal,
Let me see if I can help with some of your questions
1. Yes, you can use LCDS for simple forms processing. Any time you want to
move data between the Flex client and the server, LCDS (or its free Open
source cousin BlazeDS) is going to help. I would expect you would use the
mx:RemoteObject MXML tag to invoke server side code, passing it the form
data input by the application user.
2. If you need to push near real-time data, LCDS gives you the RTMP channel
which can scale quite nicely. You can then use the mx:Consumer MXML tag to
subscribe the clients to the messages, which can come from almost anywhere,
include JMS topics or queues.
3. RTMP (included in LCDS) is the best option for scaling to tens of
thousands of users and the LCDS servers can be clustered to proved better
scaling.
4. The AMF3 protocol used over the RTMP channels performs much faster than
simple XML over HTTP. See this blog posting for some tests:
http://www.jamesward.org/census/.
5. If you are sending a Flex application XML, then I would recommend using
the E4X API to work with the XML. This is a pretty nice and powerful way to
work with XML. If you want Actionscript objects (and probably better
performance), then using AMF serialization to Actionscript objects is the
way to go.
6. Primary advantages? There are many, but mainly you can avoid thinking
about the plumbing and concentrate on solving your application and business
logic problems.
Hope this helps you a little
Tom Jordahl
Adobe

CF Standard, MS Exchange and SQL on one computer - best practices?

After attending Ryan Favro's session on vmware, I realized my
one box should function to it's full capacity (it's a dual physical
processor Supermicro/AMD Opteron w/ 8 hotswap Raptors, expandable
to a quad 2.6Ghz/8Gb RAM).
I had planned on running CF Standard (bought it), SQL
Express, and in fact all of my development stuff (Flex/Photoshop
CS2, which I also bought)) on this box, but that idea blew up when
I realized my PNY Quadro wouldn't run under Server 2003SBS (which,
you guess it, I also bought LOL). So, I've stripped out the
GUI-stuff - it's just going to be a server (web/email and database)
now. Webserver for my own sites, so no reason to spend money I
don't have on Enterprise CF. I will probably run a bunch of stuff
for friends under my domain in folders, i.e.,
faceitphoto.ca/mystuff, faceitphoto.ca/friend1stuff,
faceitphoto.ca/friend3 stuff...not more advanced than that. They
can forward/cloak however they see fit at their expense.
I see SQL Is available in a version that offers web services
- is that valid to me at all? Or am I good with just the MS SQL
Express?
Is MS Exchange going to function fine as the email server in
CF, i.e., can I point it as the source in Administrator? I have the
MX entry or whatever it's called from my ISP for faceitphoto.ca
pointed to my static IP.
Most importantly, as per the title, how would you recommend
setting this up? Should I buy XP Pro and run SQL under it, and CF
under my Server 2003 with the mailserver (Exchange) running in the
same environment? Is vmware the answer here?
Any other suggestions? I'm pretty much out of money after the
laptop comes...
And yes, I'm a bit out of my league here, so I will take the
recommendations to someone who knows what they are doing. I want
the OS/Apps drives all Ghosted when it's done (running, configured,
current updates applied). This isn't for a business (yet), so
please keep your $$$ recommendations with that in mind...but I am
very serious about trying to buildng something I COULD turn into a
small business down the road, i.e., I like to build photo galleries
and have 'informal' expectations at work to maybe cobble together a
dashboard with CF/SQL/Flex2/FDS2, and a few mgmt/reporting areas
(they'd run it from there, this would be a development
environment). Who knows from there...
Shawn

hi
"I see SQL Is available in a version that offers web services
- is that valid to me at all? Or am I good with just the MS SQL
Express?"
>Sql express is just fine for start, if you are not happy
stripped sql you can allways start to use other version and import
db's there.
"Is MS Exchange going to function fine as the email server in
CF, i.e., can I point it as the source in Administrator? I have the
MX entry or whatever it's called from my ISP for faceitphoto.ca
pointed to my static IP."
>yes you can. you can still use your isp mailserver if you
dont want to use/maintain exchange.
"Most importantly, as per the title, how would you recommend
setting this up? Should I buy XP Pro and run SQL under it, and CF
under my Server 2003 with the mailserver (Exchange) running in the
same environment? Is vmware the answer here?"
>same enviroment is fine. you can spend $ to dedicated sql
box but why?
you can use wmvare too, it up to yours how you want to
maintain you dev/prod enviroment.
"I want the OS/Apps drives all Ghosted when it's done
(running, configured, current updates applied)."
>set some raid to your disks like 2 system disks and rest
for data and/or apps.
wmvare and you can have easy machine images, it make life
easy when troubles come..
if you do not select wmvare you can use symantec ghost
software to create images
select some backup software and maybe external hd (network
capable) where you do your daily backups
and firewall to protect your stuff!
cheers
kim

Managing VMs in Azure and AWS : What's the best practice?

Hi guys,
I'm doing some research to understand what my options are when it comes to managing some machines in both Azure and AWS. I'd ideally like to treat each web service as a separate physical office site, demarking boundaries and putting a Distribution
Point (or maybe a secondary, based on the bandwidth costs) up in each to handle content distribution. The VMs within these services are routable, as in I can ping them and they can ping back to the core datacenter where I plan to put the primary.
Have you guys done something like this before? How did it work out? How would you recommend I approach managing less than 50 Azure + AWS VMs? I'm trying to keep this infrastructure as simple as is possible, and currently only
has one Primary site.
Thanks!
If this post was helpful, please vote up or 'Mark as Answer'! More of this sort of thing at www.foxdeploy.com

Managing Azure VMs from an on-prem ConfigMgr instance is supported and should work no problem assuming you have a VPN connection set up (which it sounds like you do):
http://support.microsoft.com/kb/2889321
There really is nothing special here. It's just network traffic and the VPN makes the actual physical location of the target managed system irrelevant. As long as the client can communicate with the MP, DP, and WSUS instance on the normal ports (80, 8530,
and 10123 by default) then it'll work.
Same goes with Amazon. Although of course it isn't specifically supported by Microsoft, neither is your internal networking infrastructure.
Jason | http://blog.configmgrftw.com | @jasonsandys

Use both iPhoto and Aperture with one library-best practice?

I'd like to use both iPhoto and Aperture, but have both programs use/update just one photo library. I have the latest versions of both programs, but was wondering if the optimum approach would be to:
a)point Aperture to the existing iPhoto library and use that as the library for both programs
or
b)import the entire iPhoto library into a new Aperture library, delete the iPhoto library, and point iPhoto to use the Aperture library.
I should point out that up to now I've been using iPhoto exclusively, and have close to 20K photos in the iPhoto library, tagged with Faces, organized into various albums, etc; if that makes a difference...
Appreciate any advice!
Thanks,
Dave

Thanks Frank! I'll try it that way.
Appreciate the help!

Lync backend databases and Lync local databases placement best practices

We are deploying Lync 2013 for 30,000 Lync users across 2 pools in 2 datacenters. Dedicated SQL server for Lync to host all databases for FE, PC and monitoring roles.
Can anyone provide guidance around disk drives for SQL databases and local databases?
Lync backend databases
Planning for Lync Server 2013 requires critical thinking about the performance impact that the system will have on your current infrastructure. A
point of potential contention in larger enterprise deployments is the performance of SQL Server and placement of database and log files to ensure that the performance of Lync Server 2013 is optimal, manageable, and does not adversely affect other database
operations.
http://blogs.technet.com/b/nexthop/archive/2012/11/20/using-the-databasepathmap-parameter-to-deploy-lync-server-2013-databases.aspx
Is it recommended to place all Lync DBs on one drive and logs on one drive or separate onto multiple drives using Databasemappath?
Lync 2013 local databases
In the Capacity Planning Guidance Microsoft
describes that the disk requirements for a Lync 2013 front end server, given our usage model, is eight disks configured as two drives.
One drive will use two disks in RAID 1 to store the Windows operating system and the Lync 2013 and SQL Express binaries
One drive will use six disks in RAID1+0 to store databases and transaction logs from the two SQL Express instances (RTCLOCAL and LYSS)
Is this enough or should we separate the local DBs and logs onto separate drives as well? Also how big do the local DBs get?

During the planning and deployment of Microsoft SQL Server 2012 or Microsoft SQL Server 2008 R2 SP1 for your Lync Server 2013 Front End pool, an important consideration is the placement of data and log files onto physical hard disks for performance.
The recommended disk configuration is to implement a 1+0 RAID set using 6 spindles. Placing all database and log files that are used by the Front End pool and associated server roles and services (that is, Archiving and Monitoring Server, Lync Server Response
Group service, Lync Server Call Park service) onto the RAID drive set using the Lync Server Deployment Wizard will result in a configuration that has been tested for good performance. The database files and what they are responsible for is detailed in the
following table.
http://technet.microsoft.com/en-us/library/gg398479.aspx
Microsoft's technet recommendation contradicts the blog recommendation for Lync 2010.

What is the best Practice to improve MDIS performance in setting up file aggregation and chunk size

Hello Experts,
in our project we have planned to do some parameter change to improve the MDIS performance and want to know the best practice in setting up file aggregation and chunk size when we importing large numbers of small files(one file contains one record and each file size would be 2 to 3KB) through automatic import process,
below is the current setting in production:-
Chunk Size=2000
No. Of Chunks Processed In Parallel=40
file aggregation-5
Records Per Minute processed-37
and we made the below setting in Development system:-
Chunk Size=70000
No. Of Chunks Processed In Parallel=40
file aggregation-25
Records Per Minute processed-111
after making the above changes import process improved but we want to get expert opinion making these changes in production because there is huge number different between what is there in prod and what change we made in Dev.
thanks in advance,
Regards
Ajay

Hi Ajay,
The SAP default values are as below
Chunk Size=50000
No of Chunks processed in parallel = 5
File aggregation: Depends largely on the data , if you have one or 2 records being sent at a time then it is better to cluster them together and send it at one shot , instead of sending the one record at a time.
Records per minute Processed - Same as above
Regards,
Vag Vignesh Shenoy

Best practices for JavaFX architecture and patterns?

Hi,
I want to write reusable, easy to maintain JavaFX code for a larger UI project and wonder what are the best practices doing so.
1) Are there preferred UI patterns? MVC, MVP, Presentation Model, ...?
2) Does it make sense to use FXML to separate View from Logic? Or should I use 2-3 Java classes instead (one for View, one for Logic, one for Domain Model, depending on the pattern)
3) How to organize all the views? Should I use Dependency Injection? Or Singletons for each view? Spring or Guice framework, if at all?
Currently I use singletons for most views, so that I can use them from anywhere in my application. If a window is closed and opened again, I use the same instance for that, which still resists in memory.
For patterns, I try to lean on Presentation Model, since this is what I know from Flex development: Having a View layer, which contains all the UI stuff and an abstract view layer, which holds properties, that describe the View, e.g. submitButtonDisabledProperty. The View knows the abstract layer (Presentation Model), but not vice versa and the UI elements are bound to its properties.
I am unsure if this is appropriate for JavaFX, too (for Flex or Silverlight it is).
What are your recommendations / experiences for large UI projects?

You are correct that in 'pure' MVP the View should know as little about it's presenter implementation as possible. The view should just notify one or more 'listeners' that something has happened.
You can use event listeners for this, but I would highly recommend not exposing your Control-specific GUI events and instead create your own. So for example, don't expose ActionEvent or MouseEvent as these expose too much detail about your View's implementation, instead create 'semantic' events, so you might have something like 'sayHelloRequested' or 'printOptionSelected' (whatever naming system you want). This hides how the option is implemented, so you might have a 'print' button, a 'print' menu option, a CTRL+P print shortcut, or a double tap anywhere on your screen to print. The listener knows only that the view thinks 'print was requested by the user' - decoupling achieved.
Once you start doing this however you end up with an explosion of event listener interfaces. So say a view has 10 callbacks it wants to notify about, then you end up with 10 interfaces, and if you're being really pure you also end up with 10 'Event' beans (or DTOs) to encapsulate the details of that event. It starts to get ungainly even for a semi-purist like me. So the logical progression from there is usually just to define all 10 callbacks in one interface and call it something like MyViewListener.
There are two common ways to implement listeners, the traditional way is to allow an arbitrary number of listeners to be added. Whereas another option is to allow only a single listener to be added. In JFX you will notice that Button for example has a setOnAction() method not a addOnAction() method - it allows a single event handler only and let's face it this is generally fine in 95% of cases. For the remaining 5% you can just write your own aggregate event handler that dispatches the event to multiple listeners.
So if we go down the road of single event listeners, using an interface for all of the callbacks and not bothering with full 'Event' objects, you end up with something like this:
public interface MyViewListener {
    void printRequested();
    void doSomething(int someParam);
    void doSomethingElse(String someOtherParam);
}And if you look closely at the 'Purist' option in my MVP pattern where I define interfaces for everything, then you will see that this is pretty much the exact interface I've created for the 'Presenter'. You could just as easily rename this interface to MyViewListener in this pattern and have the same outcome.
So to wrap all that up, yes, the Presenter should be decoupled and I highly favour the 'purist' option in my blog and would definitely use it if FXML didn't dictate a impure design pattern (there are some ongoing discussions about this on the OpenJFX discussion group). And, yes, my 'purist' option could be even more pure if you went for the full-blown event callback model and if you go down that road you will have an extremely clean architecture but also an extremely large code-base - totally your call whether it's worth it.
It's also worth remembering in all this, that there are a lot of people from a lot of different backgrounds using JFX and some people hate (passionately) even my semi-pure option - especially those coming from other, less heavy-weight languages. They just don't get why you wouldn't build it all into one class and reduce the overheads. So what you have in my blog is my thoughts on it, other people will most definitely differ. I'm a big fan of developer's choice, and that's why I did the smorgasboard approach even though I personally would never use some of those implementations.
Also this video on GWT is an awesome reference on GUI design patterns: http://www.youtube.com/watch?v=PDuhR18-EdM
JFX Flow draws a lot from GWT as I think it is a very clean architecture (just such a shame that they put all that effort into hiding the horrid, sordid mess that is the web+html+css, instead of making something proper, like JFX).
Hope that helps,
zonski

Which are the best practices with mail for machos and any email client for PC

I got some mac`s at the office, and I want make a best practices manual for my users, like, please open the clip to attach the file intead of drag and drop, beacuse the pc users see the photo embedded into the message body.
could someone helpme?

Why not print out Mail's Help files?

Best Practice: Where to put Listeners?

In a Swing application the typical way of handling events is to add a listener. So far, so good.
But where to locate the listeners? Obviously there are a lot of possible solutions:
- Scatter them all over your code, like using anonymous listeners.
- Implement all of them in a single, explicit class.
- Only uses windows as listeners.
- etc.
The intention of my question is not to get a rather long list of more ideas, or to get pros or cons of any of the above suggestion. My actual question is: Is there a best practice for where to locate a listener's implementation? I mean, after decades of Swing and thousands of Swing based applications, I am sure that there must be a best practice where to but listeners implementations.

mkarg wrote:
In a Swing application the typical way of handling events is to add a listener. So far, so good.
But where to locate the listeners? Obviously there are a lot of possible solutions:
- Scatter them all over your code, like using anonymous listeners.
- Implement all of them in a single, explicit class.
- Only uses windows as listeners.
- etc.
The intention of my question is not to get a rather long list of more ideas, or to get pros or cons of any of the above suggestion. My actual question is: Is there a best practice for where to locate a listener's implementation? I mean, after decades of Swing and thousands of Swing based applications, I am sure that there must be a best practice where to but listeners implementations.You've asked other similar questions about best practices. No matter how long Swing has been around, people still program in a variety of ways, and there are lots of areas where there are several equally correct ways of doing things. Each way has its pros and cons, and the specific situation drives towards one way or the other. One's best practice of using anonymous listeners will be another's code smell. One's best practice of using inner class will be another's hassle.
So you will probably only get opinions, and likely not universally recognized best practices.
That being said, here is my opinion (nothingmore than that, but it has a high value to me :o) :
In yous list of options, one thing that is more likely to form a consensus against it, is "only uses window as listeners". I assume you mean each frame is implemented as a MyCustomFrame extends JFrame , and add this as listener on all contained widgets.
This option is disregarded because
1) extending JFrame is generally not a meaningful use of inheritance (that point is open to debate, as it is quite handy)
2) register the same object to serve as a listener for several widgets makes the implementation of listener callbacks awkward (lots of if-then-else). See [that thread|http://forums.sun.com/thread.jspa?forumID=57&threadID=5395604] for more arguments.
Now, no matter what style of listeners you choose, your listeners shouldn't do too much work (how much is too much is also open to debate...):
if a listener gets complicated, you should simplify it by making it a simple relay, that transform low-level graphical events into functional events to be processed by a higher-level class (+Controller+). I find the Mediator pattern to be a best practice for "more-than-3-widgets" interactions. As the interactions usually involves also calls to the application model, the mediator becomes a controller.
With that in mind, sort anonymous listeners are fine: the heavy work will be performed by the mediator or controller, and that latter is where maintenance will occur. So "Scatter them all over your code" (sounds quite pejorative) is not much of an issue: you have to hook the widget to the behavior somewhere anyway, the shorter, the best.
For simpler behavior, see the previous reply which gives perfect advice.

I'm looking for best practice on allowing employees to install apps.

How does your company deal with employees uploading apps on company owned devices? Is there a request process? Can they expense them? What if they use their personal Apple accounts? Do you use an MDM to manage the devices? What are your security concerns? I'm in the process of formulating a policy (large multi national corp.) and am looking for some best practices.
Thanks

I think the main consideration is that you a multi-national organization, presumably widely distributed geographically. Local management via Configurator or USB IPCU really don't make sense over the long term. An MDM is designed for situations such as you describe. For licensing reasons,each iPad used by a different individual must have a unique Apple ID. One individual could use the same Apple ID on multiple devices he or she controls. Individual devices used by multiple individuals can also have a single Apple ID. In our environment, we typically ask each user to setup an individual Apple ID when they receive their device. They are allowed to download and pay for whatever personal apps they choose. Apps which would be used for Business purposes must be vetted by Security to ensure they protect organization data. Business apps can be deployed via the Apple VPP using our MDM, which is AirWatch. An MDM is included with Lion Server. You could look at this to get some ideas about what it does and how it does it. Airwatch offers a free trial. Some users of this forum have had experience with Meraki. That is another choice. You should also look at the Enterprise Deployment Guide
http://manuals.info.apple.com/en_US/Enterprise_Deployment_guide.pdf
and the VPP
http://www.apple.com/business/vpp/
Frankly, though it isn't completely applicable to your situation, the Education deployment guide has a great deal of good information
http://images.apple.com/education/docs/IOS_5_Education_Deployment_Guide.pdf
Hope this helps a bit.

FWSM and CSM in same 6509? Best Practice?

Similar Messages

Maybe you are looking for