Wireless Authentication/Security Design questions

Wireless newbie here...I was required to quicky stand up a wireless deployment at a new warehouse/office building. I have the basic network up and working. My remote AP's have associated with the 2106 in the main office and users can associate and authenticate with the 1130G AP's and can access the office network. I did the basic configs and am now looking to tighten up security. My questions are as follows:
1) The user clients are Dell Laptops with integrated wireless. They authenticate using LEAP..how do I migrate to EAP or do I need to. I have a Cisco ACS doing RADIUS authentication now.
2) Should I be using some kind of supplicant client on the laptops?
3) How do I filter mac's so rogue AP's and rogue clients cant try and associate.
4) Am I correct in assuming the connections between the 1130 AP's and 2106 are secured and if so do I need to tweak anything to tighten them up?
5) I have an AP in the main office building that I want to setup to detect rogue AP's. Do I have it associate as a regular AP and push some kind of policy to turn it into a detector?
I have attached a diagram to help explain. Any help would be appreciated.
v/r
Chad

1. LEAP is a form of EAP, so you must already have something terminating your EAP sessions. The WLC can do this to some extent, or ACS. Which one you chose will be based upon your requirements for manageability, scalability and feature-richness. I would suggest that PEAP-MSCHAPv2 provides a good balance of usability and security, and is significantly better than LEAP.
2. No, stick with Windows XP SP2 supplicant. This can be configured using domain policy (2k3 SP1 or better) and is pretty good. Just make sure your laptops have new Intel drivers on them. Dell in particular have been quite bad with sending out old drivers in the builds.
3. MAC authentication is now lergely regarded as a waste of time. It is so easy to spoof a MAC address it's ridiculous, and it's a fair amount of work for the admin(s).
4. The LWAPP tunnel encrypts all management / config / security related traffic between the AP and WLC, while user data is simply encapsulated in LWAPP, so it can potentially be read if packets are captured.
5. All APs will do rogue detection, don't really need to have dedicated APs unless you're REALLY paranoid. Main benefit is quicker detection, but drawback is that the 'detector' AP won't serve clients.
Regards,
Richard

Similar Messages

Wireless authentication network design questions... best practices... etc...

Working on a wireless deployment for a client... wanted to get updated on what the latest best practices are for enterprise wireless.
Right now, I've got the corporate SSID integeatred with AD authentication on the back end via RADIUS.
Would like to implement certificates in addition to the user based authentcation so we have some level of dual factor authentcation.
If a machine is lost, I don't want a certificate to allow an unauthorized user access to a wireless network. I also don't want poorly managed AD credentials (written on a sticky note, for example) opening up the network to an unathorized user either... is it possible to do an AND condition, so that both are required to get access to a wireless network?

There really isn't a true two factor authentication you can just do with radius unless its ISE and your doing EAP Chaining. One way that is a workaround and works with ACS or ISE is to use "Was machine authenticated". This again only works for Domain Computers. How Microsoft works:) is you have a setting for user or computer... this does not mean user AND computer. So when a windows machine boots up, it will sen its system name first and then the user credentials. System name or machine authentication only happens once and that is during the boot up. User happens every time there is a full authentication that has to happen.
Check out these threads and it explains it pretty well.
https://supportforums.cisco.com/message/3525085#3525085
https://supportforums.cisco.com/thread/2166573
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

ADF Security Design Question

Hi All,
I am developing an ADF web application. The security design is such that user authentication is mapped to database users. The design I see several pros and cons
1) Different database users means I cannot take advantage of connection pooling.
2) The architect argues SQL querying can be controlled at database level for each user.
I have never been involved in such a web application. Can anybody please guide me if this is the way to go for ADF web application, any other pros and cons. The database is Oracle 11g. I still believe that application security should not be tied to the database security.
Worst case if I have to go with this design, How to implement ADF security using database users.
Thanks

I blogged a use case for using Proxy Authentication with JPA here http://blogs.oracle.com/olaf/2010/04/using_oracle_proxy_authenticat.html. (Being a sample it includes a setter for user name, but a case with a JAAS Subject and Principal is easily adaptable).
I'll dig out an ADF BC example and blog about it, too.
--olaf

Security Design Question Role/ code

Hi ,
     we are developing a J2EE based application. I've a dilemma
and couldn;t deceide on which security method to use.
     i. Role based ( using descriptor)
     ii. Code based ( hard coding secruity in program)
All help appreciated and thanx !
Venki

Thanks Cameron, we've figured out our way , sorry for late response.
Venki
Cameron Purdy wrote:
If you can get away with simple role-based security, do it. Depending on how
complex and configurable the security has to be, you are better off going
with a specialized security solution. We always suggest Entegrity's
AssureAccess 2.0 product since they are a partner of ours ;-).
Peace,
Cameron Purdy
Tangosol, Inc.
Clustering Weblogic? You're either using Coherence, or you should be!
Download a Tangosol Coherence eval today at http://www.tangosol.com/
"Venki Seshaadri" <[email protected]> wrote in message
news:[email protected]..
Hi ,
we are developing a J2EE based application. I've a dilemma
and couldn;t deceide on which security method to use.
i. Role based ( using descriptor)
ii. Code based ( hard coding secruity in program)
All help appreciated and thanx !
Venki

Secure wireless authentication

I have just been reading all the posts about secure wireless access and I am
not happy with the direction Novell has chosen to take.
I have been extremely pleased with Netware, GroupWise & ZenWorks but Novell
is starting to loose it's appeal.
Let me summarize what I have learned and see if I have made any mistakes
with my understanding.
1. Novell has stopped development on their Radius server and have no plans
to resume development.
2. Novell contributed code to the open source FreeRadius project.
http://www.novell.com/news/press/arc...2/pr05008.html
3. There isn't any Radius server with 802.1x authentication that runs on
Netware (Netware kernel).
a. Novell's Radius server (BMAS or the newer NMAS server) doesn't do
802.1x authentication.
b. I have contacted Funk and this is their reply. Steel-Belted Radius
Server will run on Windows and Solaris (Linux is coming).
http://www.funk.com/News&Events/sbr_linux_pn.asp
c. MTG House hasn't gotten back to me about a solution for Netware. (I
am doubtful, I didn't find anything on their website.)
4. You need to run a Radius server that does 802.1x authentication and will
work/integrate with eDir.
a. FreeRadius (Linux) will integrate with Edir.
http://www.novell.com/documentation/...ius/index.html
http://www.novell.com/coolsolutions/feature/15383.html
b. Funk's Steel-Belted Radius server (Windows, Solaris & Linux is in
beta).
http://www.funk.com/radius/default.asp
c. Aegis Server
http://www.mtghouse.com/products/aeg...er/index.shtml
5. You need a 802.1x Client to authenticate to a Radius server for wireless
authentication.
a. Microsoft has 802.1x support in their client. (read this from other
posts in this forum)
b. Novell isn't planning on putting 802.1x support in the NW Client.
(read this from other posts in this forum)
c. There are 2 Radius clients that integrate with the NW Client for
Radius Edir authentication.
1. Funk's Odyssey Client ($45 - $50 per workstation depending on
quantity) + added annual maintenance costs.
$2281.25 for 50 Client licenses & annual maintenance.
http://www.funk.com/radius/wlan/wlan_c_radius.asp
2. Aegis' Client ($32 - $39.99 per workstation depending on
quantity) + added annual maintenance costs.
$2240.00 for 50 Client licenses & annual maintenance.
http://www.mtghouse.com/products/aeg...nt/index.shtml
http://www.mtghouse.com/novell_app_note_122204.pdf
3. When FreeRadius is integrated with Edir is this separate client
still needed?
I didn't see anything about a separate client being needed while
reading the Integrating FreeRadius with Edir documentation.
6. FreeRadius support is going to be built-in to the next version of Edir.
http://www.novell.com/news/press/arc...2/pr05008.html
Why didn't Novell contribute code to port FreeRadius to Netware?
At this point in time they are still giving us a choice between the Netware
kernel and the Linux kernel. To me that says they are willing to make
things work with both systems until they drop support for the Netware
kernel. Ok, so give me support for 802.1x authentication in the Netware
kernel. I don't have stray single purpose servers floating around my
network and I don't want to have to begin that practice just to get Radius
802.1x authentication working.
I also won't put my district at a disadvantage by upgrading to the Linux
kernel until I know Linux well enough to administer it properly. I am the
IT department at this district so I don't have a great deal of extra time to
run about learning the new things I would LOVE to learn. I'm sure I'm not
the only person in this situation so Novell should take these things into
concideration before they just drop support for a product they say they are
still supporting. Obviously all of the real support is going toward the
Linux side at Novell.
Daniel Blake
Milford Central School

Ok, I'll give them the benefit of the doubt and say fine the Netware kernel
might as well be considered dead. So they are giving me support via
FreeRadius if I just migrate to OES (Linux). Ok, I might/can live with that
as a Novell decision.
But that still doesn't explain why they don't give us some client to log in
via 802.1x. Giving us the server but not the client is like giving us a
locked door without a key. That's just plain stupid. I would rather stay a
Netware - OES shop, but if Novell can't think something this simple through
then I'm a little nervous about staying with them. What could they think up
next?
I guess Novell has decided to port all it's software to Windows cause it
sucks so bad at business decisions. GroupWise & ZenWorks run completely on
Windows now, so why do I need OES at all? Except for complexity &
integration issues of course. I mean why would I need to purchase Edir for
Windows if I didn't stay with OES? Or Nsure Identity Manager for that
matter. So if we start looking deeper into this we see Marketing all over
this thing. Novell Marketing has always done such a good job for Novell.
Novell has given me a real choice that will work though. If I migrate
completely to a Windows network it just works without any added costs. Heck
it even makes my installs easier without having to install the NW Client on
every new workstation. I can still run ZenWorks & GroupWise too.
Now, how is Novell Marketing going to screw up and make me hate GroupWise &
Zenworks so I migrate completely away from Novell products? Way to go
Novell!
Daniel Blake
Milford Central School
"Jim Michael" <[email protected]> wrote in message
news:[email protected]...
> mcsdtech wrote:
>
>> 1. Novell has stopped development on their Radius server and have no
>> plans to resume development.
>
> Correct, so far as we know.
>
>> 2. Novell contributed code to the open source FreeRadius project.
>> http://www.novell.com/news/press/arc...2/pr05008.html
>
> Yes. Code to allow easier integration with eDirectory.
>
>> 3. There isn't any Radius server with 802.1x authentication that runs on
>> Netware (Netware kernel).
>
> Correct.
>
>> a. Novell's Radius server (BMAS or the newer NMAS server) doesn't do
>> 802.1x authentication.
>
> Correct. It was developed quite a while before 802.1x even existed.
>
>> b. I have contacted Funk and this is their reply. Steel-Belted
>> Radius Server will run on Windows and Solaris (Linux is coming).
>> http://www.funk.com/News&Events/sbr_linux_pn.asp
>
> Correct, but Stell-Belted Radius is probably the last solution I would
> look at. Radiator is a commercial product that runs on Linux or Windows
> (it is Perl-based) and you will get far better support from them on
> eDirectory issues and general Radius problems. freeRADIUS is what I would
> run on Linux if you don't want to spend a dime on the software.
>
>> c. MTG House hasn't gotten back to me about a solution for Netware.
>> (I am doubtful, I didn't find anything on their website.)
>
> Not familiar with them.
>
>> 4. You need to run a Radius server that does 802.1x authentication and
>> will work/integrate with eDir.
>> a. FreeRadius (Linux) will integrate with Edir.
>> b. Funk's Steel-Belted Radius server (Windows, Solaris & Linux is
>> in beta).
>
>> c. Aegis Server
>
> And Radiator (what I run) http://www.open.com.au This is the solution we
> run.
>
>> 5. You need a 802.1x Client to authenticate to a Radius server for
>> wireless authentication.
>
> Correct.
>
>> a. Microsoft has 802.1x support in their client. (read this from
>> other posts in this forum)
>
> Correct. Technically, the "support" is in Windows, not the MS client.
>
>> b. Novell isn't planning on putting 802.1x support in the NW Client.
>> (read this from other posts in this forum)
>
> Correct.
>
>> c. There are 2 Radius clients that integrate with the NW Client for
>> Radius Edir authentication.
>> 1. Funk's Odyssey Client 2. Aegis' Client ($32 - $39.99 per
>> workstation depending on
>
> Correct.
>
>> 3. When FreeRadius is integrated with Edir is this separate
>> client still needed?
>
> Yes. You ALWAYS need a 802.1x supplicant (client) on the workstation.
> Windows has one built-in, which works FINE against eDirectory. HOWEVER,
> because of the way it works you must log into eDirectory *after* fully
> logging into windows. That is unacceptable to most organizations (you
> would have to manually log in and map drives to NW, etc). This is why
> there are third-party clients that integrate specifically with the NetWare
> client.. they allow the 802.1x authentication to "insert" itself
> in -between the Windows and eDirectory login, thus preserving all of the
> normal features like dynamic local user, zen policies, etc.
>
>> I didn't see anything about a separate client being needed
>> while reading the Integrating FreeRadius with Edir documentation.
>
> A client is always assumed.
>
>> Why didn't Novell contribute code to port FreeRadius to Netware?
>
> Because Novell's future direction is Linux, and there isn't much demand
> for a NetWare Radius server.
>
>> At this point in time they are still giving us a choice between the
>> Netware kernel and the Linux kernel. To me that says they are willing to
>> make things work with both systems until they drop support for the
>> Netware kernel. Ok, so give me support for 802.1x authentication in the
>> Netware kernel. I don't have stray single purpose servers floating
>> around my network and I don't want to have to begin that practice just to
>> get Radius 802.1x authentication working.
>
> You can always make your wishes known at
> http://support.novell.com/enhancement
>
>> I also won't put my district at a disadvantage by upgrading to the Linux
>> kernel until I know Linux well enough to administer it properly. I am
>> the IT department at this district so I don't have a great deal of extra
>> time to run about learning the new things I would LOVE to learn. I'm
>> sure I'm not the only person in this situation so Novell should take
>> these things into concideration before they just drop support for a
>> product they say they are still supporting. Obviously all of the real
>> support is going toward the Linux side at Novell.
>
> I understand the frustration, but I doubt things will change. There is a
> big difference between "supporting" existing products and adding major
> enhancements to products to support new standards. I just don't think
> Novell believes it is worth dedicating development resources to enhancing
> Radius on NetWare, for those few that can't/won't run a Linux or Windows
> box where the software already exists.
>
>
> --
> Jim
> NSC SYsop

Centralized WLC Design Question

Dears,
In my scenario, i am designing CEntralized WLC deployment. I have 30 AP in Buidling X(200 Users) and 20 AP in Buidling Y(150 Users). I am planning to install HA WLC CLuster where Pimary & Secondary WLC will reside in physically different Data Centers A & B.
I have a wireless Design Question and i am not able to get clear answers. Please refer to the attached drawing and answer the following queries:
If Buidling X users want to talk to building Y Users, then how Control & Data Traffic flow will happen between Buidling X & Y. Would all the traffic will go to Primary WLC from Bldg X APs first and then it will be Re Routed back to Buidling Y APs? Can i achieve direct switching between Bldg X&Y APs without going toward WLC?
If Building X & Y Users want to access the internet, how would be traffic flow? Would the traffic from X&Y AP will go tunnel all the traffic towards WLC and then it will be routed to internet gateway?is it possible for Bldg X&Y AP to directly send traffic towards Internet Gateway without going to controllers?
I have planned to put WLC at physically different locations in different DC A & B. Is it recommended to have such a design? What would be the Failver traffic volume if Primary WLC goes down and secondary controller takes over?
My Reason to go for Centralized deployment is that i want to achieve Centralized Authentication with Local Switching. Please give your recommendations and feedback
Regards,
Rameez

If Buidling X users want to talk to building Y Users, then how Control & Data Traffic flow will happen between Buidling X & Y. Would all the traffic will go to Primary WLC from Bldg X APs first and then it will be Re Routed back to Buidling Y APs? Can i achieve direct switching between Bldg X&Y APs without going toward WLC?
Traffic flows to the WLC that is the primary for the AP's, then its routed over your network.
If Building X & Y Users want to access the Internet, how would be traffic flow? Would the traffic from X&Y AP will go tunnel all the traffic towards WLC and then it will be routed to Internet gateway?is it possible for Bldg X&Y AP to directly send traffic towards Internet Gateway without going to controllers?
The WLC isn't a router, so you would have to put the Internet traffic an a subnet and route.
I have planned to put WLC at physically different locations in different DC A & B. Is it recommended to have such a design? What would be the Failover traffic volume if Primary WLC goes down and secondary controller takes over?
Like I mentioned... earlier, the two HA WLC has to be on the same layer 2 subnet in order for you to use HA. The guide mentions an Ethernet cable to connect both the HA ports on the WLC.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Wireless authentication to a windows network

IF this is the wrong group please let me know and I will re-post...
I am trying to solve some problems authenticating to a windows network using a airport card....
I keep getting a non-trusted certificate message after/during the 802.x authentication box..We are not using certificates, at least that is what the admin tells me...so I have logged in as root, opened keychain and set the certifcates in question to trust always for all settings...I log out and then relogin as a normal network account and I still get the message which I can click continue and now I have access..
the other problem is that my home folder will not mount...I have to mount it manually through the finder..I am assuming this is because the airport network services are not running until I authenticate locally with a cached password....Is there a way to have the login window authenticate through airport so I can have my home directory mount automatically...
thanks for your help...

unfortunately there are severla problems with the solution and it really doesn't address the issue. I can't mount the volume on the dock as it won't mount, probably because it is the server itself that has been mounted, not the shared home folder. Also it might create a conflict by having an alias to the home folder that would conflict with the auto mounted home folder when I use the ethernet as a connection source. What I have is a multi-purpose machine.
1) I use a hardwired connect at my desk...
2) If I need to go somewhere that a port in the wall is not active, I can then use a wirless connection which allows me access to everything I need....
What I need to do is get this working so that the rest of the area can use it as well....
So the question still remains: Does the wireless authentication not mount the home directory because it is not tied into the login window. For example, in a hardwired case I login to the system and this authenticates me and mounts my home folder. When I unplug the ethernet cable and turn on ariport and log off I login to the login window but the 802.x box comes up and asks for my password....which then brings up a not trusted certificate. Which I have tried everyhting I know to make this accepted by the system, including logging as root and going into keychain and setting it to be trusted. This DOES not work. I still get the untrusted certifcate message and the home directory does not mount. So what I need is someone who is authenticating to a windows network using wireless. I have followed all the 802.x suggestions which include using only peap to authenticate through.
I hope someone can tell me how to stop the untrusted certificate error and how to mount the home directories. It would seem that there should be some type of setting to make airport startup prior to the login window or be hooked into the login window and pas that through to the wireless authentication. This is beyond my experience as you can see...
thanks

NT Security Realm Question

Hi,
I an trying to set up WL 6.0 to use an NT Realm for authentication. My
question is how do you find or determine the class name of the Windows NT
Security realm that is to be supplied in the Basic Realm field?
thanks
Mike Horn

never mind... dumb question. it seems that the console supplies the class
name for me as weblogic.security.ntrealm.NTRealm
cheers
"Mike Horn" <[email protected]> wrote in message
news:[email protected]..
Hi,
I an trying to set up WL 6.0 to use an NT Realm for authentication. My
question is how do you find or determine the class name of the Windows NT
Security realm that is to be supplied in the Basic Realm field?
thanks
Mike Horn

Security/session questions

Hi,
I have some security/session questions for you guys.
My application uses flex, blazeds and spring. I use RemoteObjects to initiate calls from flex to java. The application consists of a login screen and 'other screens' available only to authenticated users after login. When the user logs in the server stores user credentials on the FlexContext (FlexContext.getFlexSession().setAttribute). So if the server timeout is reached and the user presses 'refresh' the user is thrown out and the login screen appears.
Question 1: How can I check if the timeout is reached when the user makes a call to the server, without checking manually against the FlexContext. Are there any config parameters to set?
Question 2: Is it necesssary to check against the user credentials in the session for every flex-to-server call? (I guess someone can omit the login screen and do a manual call)
Question 3: If the answer to question 2 is yes, how can I check against the session credentials? The only way I can think of is calling a method which checks the session attribute manually, but then I have to remember to add this method call to each of the methods called from flex through Blazeds. Is it, for example, possible to call the user-logged-in method before the method given in the RemoteObject is called? (If not authenticated, do not run method).
Hope someone got the time to help me out.

I appreciate your answer, but as you yourself write, I think there must be a blazeDS way. But as nobody with extensive BlazeDS knowledge answers this post, I probably have to google this topic even more.
Following are the main changes in my application: (Introducing spring security)
Everything seems to be working as it should. But as already stated, I'm a newbie. So if anybody see something suspicious, let me know.
The main problem I had implementing Spring Security was something that should be easy, but somehow it was not: the loading of the context files. Before introducing the spring security I only had one application-context file, and this was loaded by the DispatcherServlet. When introducing security I tried to add this to the same file. It did not work. Then I tried splitting up the files, and loading both using DispatcherServlet. It did not work. Then I tried loading both using ContextLoaderListener. It did not work. Finally I found the solution. Flex settings must be loaded by the DispatcherServlet, and spring security settings must be loaded by ContextLoaderListener. This work. I don't know if this is the only solution.
On the server:
web-xml:
<context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/config/web-application-config.xml
            /WEB-INF/config/web-application-security.xml
        </param-value>
    </context-param>
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <servlet>
        <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/config/flex-application-config.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
flex-application-context:
<flex:message-broker>
        <flex:secured/>
    </flex:message-broker>
web-application-context:
I had to implement my own authentication mechanism. Had to compare the username/password against an object attribute. So this bean is not mandatory, but I think you have to write down username/password/role in flex-application-context if not provided.
<bean id="customAuthenticationProvider" class="packagename.CustomAuthenticationProvider">
        <security:custom-authentication-provider/>
</bean>
web-application-security:
<http entry-point-ref="preAuthenticatedEntryPoint" />
    <beans:bean id="preAuthenticatedEntryPoint"
        class="org.springframework.security.ui.preauth.PreAuthenticatedProcessingFilterEntryPoint " />
    
    <global-method-security>
        <protect-pointcut expression="execution(*package.ServiceImpl.*(..))" access="ROLE_USER"/>
    </global-method-security>
On the client:
private function login():void {
    var cs:ChannelSet = ServerConfig.getChannelSet(loginRemoteObject.destination);
    var token:AsyncToken;
    token = cs.login(username, password);
// Add result and fault handlers.
token.addResponder(new AsyncResponder(loginResultHandler, loginFaultHandler));
private function logout():void {
    var cs:ChannelSet = ServerConfig.getChannelSet(loginRemoteObject.destination);
    var token:AsyncToken = cs.logout();
// Add result and fault handlers.
token.addResponder(new AsyncResponder(logoutResultHandler, logoutResultHandler));

SCA design question - PIX and SCA with dual logical SSL server.

I have a SCA design question. please correct or verify my solution.
1. connectivity.
<Client with port 443>--<ISP>--<PIX>--<SCA>--<SERVER(two IP on single NIC and each IP associates to WEB server) with port 81>
* client will access WEB server with x.x.1.100 or x.x.1.101
2. physical IP address
- PIX outside=x.x.1.1
- PIX inside=x.y.1.1
- SCA device=x.y.1.2
- SERVER NIC1=x.y.1.10
- SERVER NIC2=x.y.1.11
3. PIX NAT
- static#1=x.x.1.100 map to x.y.1.10
- static#2=x.x.1.101 map to x.y.1.11
4. SCA configuration.
mode one-port
no mode one-port
ip address x.y.1.2 netmask 255.255.255.0
ip route 0.0.0.0 0.0.0.0 x.y.1.1
ssl
server SERVER1
ip address x.y.1.10
localport 443
remoteport 81
server SERVER2
ip address x.y.1.11
localport 443
remoteport 81
Thanks,

The document http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/scacfggd/ has a link to a page which describes how to use the configuration manager command line interface to configure the Secure Content Accelerator. Several configuration examples are also included in this page.

Architecture/Design Question with best practices ?

Architecture/Design Question with best practices ?
Should I have separate webserver, weblogic for application and for IAM ?
If yes than how this both will communicate, for example should I have webgate at both the server which will communicate each other?
Any reference which help in deciding how to design and if I have separate weblogic one for application and one for IAM than how session management will occur etc
How is general design happens in IAM Project ?
Help Appreciated.

The standard answer: it depends!
From a technical point of view, it sounds better to use the same "midleware infrastructure", BUT then the challenge is to find the lastest weblogic version that is certified by both the IAM applications and the enterprise applications. This will pull down the version of weblogic, since the IAM application stack is certified with older version of weblogic.
From a security point of view (access, availability): do you have the same security policy for the enterprise applications and the IAM applications (component of your security architecture)?
From a organisation point of view: who is the owner of weblogic, enterprise applications and IAM applications. In one of my customer, application and infrastructure/security are in to different departments. Having a common weblogic domain didn't feet in the organization.
My short answer would be: keep it separated, this will save you a lot of technical and political challenges.
Didier.

Catalyst 3850 Stack VLANs, layer 2 vs. layer 3 design question

Hello there:
Just a generic, design question, after doing much reading, I am just not clear as when to use one or the other, and what the benefits/tradeoffs are:
Should we configure the switch stack w/ layer 3, or layer 2 VLANs?
We have a Catalyst 3850 Stack, connected to an ASA-X 5545 firewall via 8GB etherchannel.
We have about 100 servers (some connected w/ bonding or mini-etherchannels), and 30 VLANs.
We have several 10GB connections to servers.
We push large, (up to) TB sized files from VLAN to VLAN, mostly using scp.
No ip phones, no POE.
Inter-VLAN connectivity/throughput and security are priorities.
Originally, we planned to use the ASA to filter connections between VLANs, and VACLs or PACLs on the switch stack to filter connections between hosts w/in the same VLAN.
Thank you.

If all of your servers are going to the 3850 then I'd say you've got the wrong switch model to do DC job. If you don't configure QoS properly, then your servers will start dropping packets because Catalyst switches have very, very shallow memory buffers. These memory buffers get swamped when servers do non-stop traffic.
Ideally, Cisco recommends the Nexus solution to connect servers to. One of the guys here, Joseph, regularly recommends the Catalyst 4500-X as a suitable (and financial) alternative to the more expensive Nexus range.
In a DC environment, if you have a lot of VM stuff, then stick with Layer 2. V-Motion and Layer 3 don't go hand-in-hand.

Design question: Scheduling a Variable-timeslot Resource

I originally posted this in general java programming, because this seemed like a more high-level design descussion. But now I see some class design questions. Please excuse me if this thread does not belong here (this is my first time using the forum, save answering a couple questions).
Forum,
I am having trouble determining a data structure and applicable algorithm (actually, even more general than the data structure -- the general design to use) for holding a modifiable (but more heavily read/queried than updated), variable-timeslot schedule for a given resource. Here's the situation:
Let's, for explanation purposes, say we're scheduling a school. The school has many resources. A resource is anything that can be reserved for a given event: classroom, gym, basketball, teacher, janitor, etc.
Ok, so maybe the school deal isn't the best example. Let's assume, for the sake of explanation, that classes can be any amount of time in length: 50 minutes, 127 minutes, 4 hours, 3 seconds, etc.
Now, the school has a base operation schedule, e.g. they're open from 8am to 5pm MTWRF and 10am to 2pm on saturday and sunday. Events in the school can only occur during these times, obviously.
Then, each resource has its own base operation schedule, e.g. the gym is open from noon to 5pm MTWRF and noon to 2pm on sat. and sun. The default base operation schedule for any resource is the school which "owns" the resource.
But then there are exceptions to the base operation schedule. The school (and therefore all its resources) are closed on holidays. The gym is closed on the third friday of every month for maintenance, or something like that. There are also exceptions to the available schedule due to reservations. I've implemented reservations as exceptions with a different status code to simplify things a little bit: because the basic idea is that an exception is either an addition to or removal from the scheduleable times of that resource. Each exception (reservation, closed for maintenance, etc) can be an (effectively) unrestricted amount of time.
Ok, enough set up. Somehow I need to be able to "flatten" all this information into a schedule that I can display to the user, query against, and update.
The issue is complicated more by recurring events, but I think I have that handled already and can make a recurring event be transparent from the application point of view. I just need to figure out how to represent this.
This is my current idea, and I don't like it at all:
A TimeSlot object, holding a beginning date and ending date. A data structure that holds list of TimeSlot objects in order by date. I'd probably also hold an index of some sort that maps some constant span of time to a general area in the data structure where times around there can be found, so I avoid O(n) time searching for a given time to find whether or not it is open.
I don't like this idea, because it requires me to call getBeginningDate() and getEndDate() for every single time slot I search.
Anyone have any ideas?

If I am correct, your requirement is to display a schedule, showing the occupancy of a resource (open/closed/used/free and other kind of information) on a time line.
I do not say that your design is incorrect. What I state below is strictly my views and should be treated that way.
I would not go by time-slot, instead, I would go by resource, for instance the gym, the class rooms (identified accordingly), the swimming pool etc. are all resources. Therefore (for the requirements you have specified), I would create a class, lets say "Resource" to represent all the resources. I would recommend two attributes at this stage ("name" & "identifier").
The primary attribute of interest in this case would be a date (starting at 00:00hrs and ending at 24:00hrs.), a span of 24hrs broken to the smallest unit of a minute (seconds really are not very practical here).
I would next encapsulate the availability factor, which represents the concept of availability in a class, for instance "AvailabilityStatus". The recommended attributes would be "date" and "status".
You have mentioned different status, for instance, available, booked, closed, under-maintainance etc. Each of these is a category. Let us say, numbered from 0 to n (where n<128).
The "date" attribute could be a java.util.Date object, representing a date. The "status", is byte array of 1440 elements (one element for each minute of the day). Each element of the byte array is populated by the number designation of the status (i.e, 0,1,2...n etc.), where the numbers represent the status of the minute.
The "Resource" class would carry an attribute of "resourceStatus", an ordered vector of "ResourceStatus" objects.
The object (all the objects) could be populated manually at any time, or the entire process could be automated (that is a separate area).
The problem of representation is over. You could add any number of resources as well as any number of status categories.
This is a simple solution, I do not address the issues of querying this information and rendering the actual schedule, which I believe is straight forward enough.
It is recognized that there are scope for optimizations/design rationalization here, however, this is a simple and effective enough solution.
regards
[email protected]

LDAP design question for multiple sites

LDAP design question for multiple sites
I'm planning to implement the Sun Java System Directory Server 5.2 2005Q1 for replacing the NIS.
Currently we have 3 sites with different NIS domains.
Since the NFS over the WAN connection is very unreliable, I would like to implement as follows:
1. 3 LDAP servers + replica for each sites.
2. Single username and password for every end user cross those 3 sites.
3. Different auto_master, auto_home and auto_local maps for three sites. So when user login to different site, the password is the same but the home directory is different (local).
So the questions are
1. Should I need to have 3 domains for LDAP?
2. If yes for question 1, then how can I keep the username password sync for three domains? If no for question 1, then what is the DIT (Directory Infrastructure Tree) or directory structure I should use?
3. How to make auto map work on LDAP as well as mount local home directory?
I really appreciate that some LDAP experta can light me up on this project.

Thanks for your information.
My current environment has 3 sites with 3 different NIS domainname: SiteA: A.com, SiteB:B.A.com, SiteC:C.A.com (A.com is our company domainname).
So everytime I add a new user account and I need to create on three NIS domains separately. Also, the password is out of sync if user change the password on one site.
I would like to migrate NIS to LDAP.
I want to have single username and password for each user on 3 sites. However, the home directory is on local NFS filer.
Say for userA, his home directory is /user/userA in passwd file/map. On location X, his home directory will mount FilerX:/vol/user/userA,
On location Y, userA's home directory will mount FilerY:/vol/user/userA.
So the mount drive is determined by auto_user map in NIS.
In other words, there will be 3 different auto_user maps in 3 different LDAP servers.
So userA login hostX in location X will mount home directory on local FilerX, and login hostY in location Y will mount home directory on local FilerY.
But the username and password will be the same on three sites.
That'd my goal.
Some LDAP expert suggest me the MMR (Multiple-Master-Replication). But I still no quite sure how to do MMR.
It would be appreciated if some LDAP guru can give me some guideline at start point.
Best wishes

Design question for database connection in multithreaded socket-server

Dear community,
I am programming a multithreaded socket server. The server creates a new thread for each connection.
The threads and several objects witch are instanced by each thread have to access database-connectivity. Therefore I implemented factory class which administer database connection in a pool. At this point I have a design question.
How should I access the connections from the threads? There are two options:
a) Should I implement in my server class a new method like "getDatabaseConnection" which calls the factory class and returns a pooled connection to the database? In this case each object has to know the server-object and have to call this method in order to get a database connection. That could become very complex as I have to safe a instance of the server object in each object ...
b) Should I develop a static method in my factory class so that each thread could get a database connection by calling the static method of the factory?
Thank you very much for your answer!
Kind regards,
Dak
Message was edited by:
dakger

So your suggestion is to use a static method from a
central class. But those static-methods are not realy
object oriented, are they?There's only one static method, and that's getInstance
If I use singleton pattern, I only create one
instance of the database pooling class in order to
cionfigure it (driver, access data to database and so
on). The threads use than a static method of this
class to get database connection?They use a static method to get the pool instance, getConnection is not static.
Kaj

Wireless Authentication/Security Design questions

Similar Messages

Maybe you are looking for