@tim_g said in Networking and 1U Colocation:

fail2ban

Fail2ban does nothing with key based access. It's denied before fail2ban even sees it.

As long as it is on the SysVol\Policies\PolicyDefinitions folder then you should be fine.

@eddiejennings said in Voting for Topics:

Ok, I'm an idiot. The vote tally circled in the picture is based on the upvotes / downvotes of the first post in the thread.

0_1518021528380_b1a8af93-bd11-440c-b201-eb961dc0fa2f-image.png

For my side business, I do tenths of an hour. I come from Legal IT background though and that is how Lawyers charge so I go with what I know.

@mike-davis said in How MSPs provide their services:

@scottalanmiller said in How MSPs provide their services:

That's a lot of investment for a system like that. If you have hundreds of customers, it can make sense. But it takes a lot of customers to recoup the lost time into that system. It can work out well for a traditional MSP, but depends on large scale standardization to justify the investment.

I don't know about hundreds of customers. The number of end points might be more relevant. For me at about 10 MSP customers I can justify the investment. When you look at the time it takes to set up something like a zabbix server and maintaining a WSUS server vs not having to that helps make it worth it. Missed revenue because you didn't have a system in place to capture every minute hurts.

It would be a blend, I'm sure. A single customer with a million end points wouldn't make sense because you'd use more traditional tools in a single customer scenario. And a hundred with only one end point each wouldn't do it either. So some combination of enough end points for volume and enough customers for complexity put together.

And here in Nebraska too.

@bigbear said in Purchasing new workstations with monitors:

@matteo-nunziati said in Purchasing new workstations with monitors:

here in Italy there is no real difference in price buying from dell of any online shop (any brand). so I usually buy monitors with pcs.

Yeah nuc are nice, but if you assembly one you also had to add the windows tax (considering standard office workflow, linux is not cosidered here) and it doesn't worth anymore.

I'm currently working with a microsoft oem. then they deploy nucs internally and it really worths it!

So you do the Intel NUCS and like them? I dont know if there is a Dell or HP equivalent system.

Dell Mini are very unlikely candidates for this, NUCs are awesome and we use it with Volume License for their OS.

That's an idea. 🙂

@dustinb3403 said in VoIP Bandwidth:

@coliver said in VoIP Bandwidth:

@dustinb3403 said in VoIP Bandwidth:

@coliver said in VoIP Bandwidth:

0_1515804053103_Capture.PNG

Welp... 7% packet loss looks like I need to call the phone company.

Phone company...?

(Everyone else sees it, right?)

DSL...

Ha.. "what are packets" is what I expect them to ask

Pretty much. I've got a few contacts in the backend I hope I can tap to bypass the support hell that they contracted out to.

@dbeato said in Passing traffic between a remote access VPN and Site-to-site VPN on an Edge Router Lite:

@dashrender said in Passing traffic between a remote access VPN and Site-to-site VPN on an Edge Router Lite:

@dbeato said in Passing traffic between a remote access VPN and Site-to-site VPN on an Edge Router Lite:

@eddiejennings said in Passing traffic between a remote access VPN and Site-to-site VPN on an Edge Router Lite:

Thanks to @Dashrender for the assist. It looks like the problem was authentication. I authenticated to the VPN using domain\username rather than using the User Principal Name. Doing the latter allowed me to reach DFS shares.

Woops, that's crazy but definitely there is an issue with DNS

huh?

If the user cannot login with UPN there is an issue with DNS.... As you should be able to use domain.com.

User can login with UPN. They were using the old domain\username method rather than UPN, which apparently caused problems with accessing stuff via the DFS namespace.

100% correct. I misread my quote, and thought it was X per socket, rather than X for two sockets.

@eddiejennings said in Configuration naming conventions: ERL, ASA, etc:

For my Edge Router Lite, I'm considering whether or not I want to create address groups for single hosts. My reasoning for "yes" would be I'd configure an IP address in one place (the address group), and then multiple configuration aspects can reference that address group. If the IP address of the host in question changes, then I only have to update one thing.

I'm curious to know if you folks do the same for your devices. I know ASA's have objects, which function similarly to the idea of an address group.

Sonicwall are Address Objects and there are groups as well. So yeah I do that.

Yep, setting protected-mode to no did the trick. SELinux was re-enabled and stuff works.

Now the question is can I get stuff to work with the most current version of Redis and on Fedora. 🙂

@nerdydad said in Redundant Network Connections:

We do have dual-wan connections, but we're also connecting 3 locations together. If we only had one connection connecting all 3 locations together, and one connection died, then that location (more than likely to be a plant) will be spending the day without any productivity because they wouldn't have access to the resources that they need. We're talking 250 people working at any one time at at least $11/hr.
11x250=$2750/hr (along with the added value they make to the company) versus $100-600/month for the extra WAN connection. It only makes sense for us to have the availability here to keep people working.

The City (another job I had) had every offsite pointing via Dish to Cityhall just to get internet. Some were 3-4 jumps. Single point of failure for the entire City. Every electrical storm took our 25% of our dishes.

@tim_g said in CALs: Silly or Not?:

In that example, their authentication could have been done on their AD server (as one example), which is not a web-workload server. That's why they would then require a CAL, as they mentioned.

If their authentication was done on their front-end web-workload server (web server via mangoDB as in the Mangolassi case, i think), then no CALs are needed.

I tend to agree with this as well.

@eddiejennings said in Traffic not flowing for hosts behind NAT - Edge Router Lite:

@dbeato said in Traffic not flowing for hosts behind NAT - Edge Router Lite:

@eddiejennings said in Traffic not flowing for hosts behind NAT - Edge Router Lite:

Take 3 is a partial success. All hosts except the IIS host has full Internet connectivity. The IIS host is accepting web and FTP traffic (so NAT's doing its job now :D); however, I can't ping outside my local network, and it can't resolve DNS.

So what is the DNS Server on that Server?

Same as all of the other servers that could resolve DNS. The issue was forgetting to reconfigure the source NAT rule.

Makes sense now!

@eddiejennings said in Who needs an MSDN subscription?:

@bigbear said in Who needs an MSDN subscription?:

@tim_g said in Who needs an MSDN subscription?:

@eddiejennings said in Who needs an MSDN subscription?:

This thread is inspired by the never-ending thread about licensing and replication in I Can't Even.

I know that developers who use Visual Studio probably get their Visual Studio license through an MSDN subscription. One benefit of the subscription is that you're allowed to spin up Windows servers, SQL servers, etc., for development and testing.

For organizations who have full-on lab environments or IT staff who need to spin up a VM Windows Server VM here and there to try something out, how do they stay in compliance? Do they also buy a MSDN subscription (perhaps MSDN platforms) for the IT staff member? Do they have their IT staff continually use Windows server 180-day evaluation licenses? Do they turn a blind eye as they give their IT staff activation keys from a dev's MSDN subscription and hope their organization is never audited?

MSDN subscriptions are user-specific. To stay in compliance, every person who wants to take advantage of an MSDN benefit, will need to have their own MSDN subscription. They cannot be shared. Any VM spun up under the MSDN subscription cannot be used in any way by another person.

Ah, didnt read the full OP post and assumed it was for him.

However Bizspark MSDN does provide startup organizations with multiple user accounts all for internal use and testing. It is not for production or internal use.

Yeah. It's not for me. I was just musing about the test VMs and such we need to spin up as IT, and I was curious how larger businesses or businesses with test labs license those test Windows VMs. I figured MSDN platforms wasn't used because of [see the above responses], but perhaps truth was going to be stranger than fiction.

Larger is different. Once you are of any size you have enterprise agreements and your labs are just covered.

@eddiejennings said in Food for Thought: Backups - from terrible to functional:

@jaredbusch Wow.

Was an initial seed of a server. So totally expected when the WAN pipe is only 10mbps up.

120GB of real data on a thin provisioned 500GB vhdx.

@dashrender you could see opensips as a software version of this, but in high load scenarios or in transcoding the example @scottalanmiller gives about restricted instruction sets on the video chip is a great example.

If Asterisk was created after SIP standards were made it probably would have some type of domain filtering that would make the mobile issue a very easy fix.

That being said the responsive firewall was a huge leap forward, but i don’t see anything in their big requests that indicates they are going to go further. I’ve not tried to use the Sangoma SBC or to fix the issue since I’ve moved on. I’m guessing the domain for mobile access is very low amongst FreePBX users, or maybe it’s used on desktops inside a LAN that is not using the responsive firewall.

I use them less than once every five years.