Probably the most important job it does for us though is for our firewalling, core network routing and traffic management for both bit10s internal systems and for the ISP hosting side of the business.

Our implementation is a highly bespoke customisation of Debian using things like iptables, IMQ, vconfig, etc. all good stuff and happily handles the routing and traffic management for our entire colocation and ISP services, however we would be the first to admit it isn’t the easiest to maintain and look after. The options in the commercial club (Cisco/Juniper) are simply way to expensive and don’t offer the flexibility we require.

A couple of months a go a client came to me needing some fairly significant network reorganisation. They had multiple offices around the world, at each site they had a very unsegmented ‘flat’ network, between the offices they had a mixture of MPLS and VPN tunnel solutions, and a number of single points of failure.

What we needed to do was to segment up each site into sensible subnets and bring additional resilience to the firewalls and routers.

Our initial reaction was to simply do another custom Linux configuration similiar to our own setup, however we were concerned about the time to get this right and the implications of future maintenance, so we look off the shelf and very quickly discovered Vyatta.

Vyatta for the uninitiated of you punts itself as ‘ The dawn of open-source networking’, personally I think this is a bit of pessimistic afterall we have been doing routing and firewalling with Linux as long as I can remember, its more of a ‘The late afternoon after a good siesta of open-source networking’.

However here at bit10 ‘Loving Doing Digital’ headquarters we can’t really criticise people on their taglines…

So why is Vyatta different?

The answer is simply its relatively easy to get to up and running, has a pretty web interface for those who have command line fear, and above all fantastic support.

Vyatta comes in two flavours, the fully open-source free ‘community edition’ and the ‘supported edition’. The community edition will suit you down to the ground if you have relatively simple requirements, basic routing/firewalling/etc., however if you have pushing the envelope you are going to the need the supported edition, which comes in two flavours ‘$647/£325′ for web only support, and ‘$897/£450′ for full telephone support, both supported flavours include free updates with the lastest fixes.

The telephone support is superb.

Vyatta does have limitations, especially if you are used to getting under the hood and having the full flexibility of Linux based routing, however the payback is a solution thats far simpler to manage.

Things we didn’t like:

1. We couldn’t configure the built in firewall to transparently push traffic to a Squid proxy server. We got around this by going under the hood and having a custom rc.local file that tag and forwarded the traffic (I will post our script on followup blog).
2. VRRP over VIFs. Vyatta supports VRRP (Virtual Router Redundancy Protocol) and VLANs out of the box, however you can only run VRRP on real ethernet inferfaces, which is troublesome if you are doing a ‘router on a stick’ solution. We have spoken to Vyatta about this and they have pencilled the functionality in for an upcoming build – good stuff!
3. The CLI, in a nutshell the CLI isn’t like IOS, its good and fulfill its job, its just that mental switch you have to make from IOS mode to something different.

Things we really liked:

1. VRRP (Virtual Router Redundancy Protocol) out of the box… VRRP was so simple to set up (on real ethernet interfaces), the village idiots really stupid cousin could have done it.
2. The separation of configuration from installation. Take a clean server, insert Vyatta CD, one line to install it to the local hard drive, copy your configuration onto it. Job done.
3. Support. The Vyatta team are passionate about their product, both on the telephone and on the web, and they know its limitations and will tell you so, so you don’t waste any time trying to make it do something it won’t.

Top Tips:

1. Unless you are doing something dead basic, go for the supported package, this ensures you get the latest version, you get the support and frankly you support Vyatta.
2. Don’t mess around trying to deploy it on that 5 yr old bodge of a server you have sat in the corner gathering dust, your firewall/routers will be business critical, so splash out on some decent hardware, we deployed on Dell 860s (<£1,000 each), which is all supported hardware and had no hardware related issues.
3. Think about what you are trying to achieve, plan it first.
4. Make sure you actually know a little about networking, while making life as simple as possible for the user, its not dumbed down to the level of a £50 ADSL router from PCWorld. If you don’t know the basics about routing, firewalling, etc. get someone to help you.

Performance:

I haven’t done any formal performance testing on Vyatta, however we have deployed it in bandwidth heavy environments, with upwards of 200 of LAN users across 10 network segments, and a single processor Dell 860 is running well under 10% load…
So is Vyatta Cisco on Shoestring… in my opinion if Vyatta can do the job you want, its definitely preferable to the Cisco option, probably the strongest reason beyond just price, is that Vyatta abstracts the software from the hardware, i.e. within reason you can redeploy a Vyatta configuration on any server with enough interfaces.

All in all well worth looking at.

(Parental Advisory – i.e. mum don’t listen to this )

http://www.backingblair.co.uk/london_underground/

Great stuff…

Today I finally got someone on the phone at the MS Partner program who could help me.

Essentially there is a highly painful online process to go through, which i set off onto using Firefox (under Ubuntu)…

Why oh why do this MS? It just looks bad, and reinforces peoples view of you as monopolistic.

When I mentioned it to the guy at the partner program, its response was ‘Well we give you the software under the partner program, so you have no excuse not to use it’… Completely missing the point that I might prefer to use Linux for other reasons…

Anyway, towing the line I struck up IE6 (yes using CrossOver Linux), and somewhat amusingly most of the navigation wasn’t visible to me unless I hovered over it.

Sigh…

Now I have had an interesting email through from a really nice guy called Gavin Jenks, who works for Autoglass and has commented on my blog more than a couple of times.

Gavin has asked me if I can delete a comment he made, because he doesn’t want to get in trouble with the powers that be at Autoglass. 

I am really sorry Gavin mate but I have thought about it a lot and I just don’t think it would be right, heres my reasoning:

1. The only thing with a longer memory than the Internet is the taxman, so even if I delete it, the comment will still exist on archive sites, etc. and just put into question other content here.
2. If Autoglass don’t give staff guidelines on this sort of thing then really they can’t do anything against you.
3. If the Autoglass marketing people are any good, they will long ago have discovered these blog entries and read them and if they were concerned about your comments they would have already taken action.
4. I just don’t think its in the spirit of blogging.

Gavin, if you want to retract the comment, please feel free to post a retraction and I will ensure it gets published.

Its a good job that I did have a good experience as a quick Google search for ‘Autoglass’, brings my blog entry up as fourth.

This goes a long way to demonstrate the power of blog and other content entries on Google results, its especially interesting for organisations like Autoglass for whom in the normal course of events don’t get much content written them about them. Therefore one good or bad customer review can make a huge difference to their business.

At bit10 we often experience the reverse of this problem for SME’s for whom we do SEO (Search Engine Optimisation) for, the classic problem is that no-one links to them with good or bad reviews, therefore their Google ranking suffers terribly, so even if you tick all the other SEO boxes, they will still do badly on a perfect search phrase for them.

A good example is Food4WildBirds, who as the name suggests specialise in ‘Food for Wild Birds’, basically they are the one stop shop for ‘Wild Bird Food‘ and other small animal feed and treats. Great company, great service, and great SEO work on our part, however they still suffer because of the lack of links to their site.

So how do we fix this? Well one way of course is blog entries like this, however more effective in the long term is to get affiliate marketing and linking engrained into the organisation, so they are building relationships and activities that will legitimately improve their Googlerank.

Hello Ben,
Thank you for writing to Windows Live ID Technical Support. I apologize for the delay in answering your e-mail. We normally respond within one business day, but we have received an unusually large number of messages recently. We appreciate your patience as we handle every customer request as quickly as possible. This is Juhn and based from what I have read on your message, you suspect that someone may have compromised your King@hotmail.co.uk account. I know how important this issue can be to you and I look forward in helping you resolve this problem.
I have successfully verified the data you provided and I have sent a password reset message to the e-mail address that you asked us to respond to, ben@bit10.net.
– so i am now happily back on MSN!

Update (21/07/2008)

After recieving many posts and emails with people asking and pleading with me to help them get their hotmail back I have prepared a handy document that tells you everything you need to know. I am making a small charge for this of $10, you can buy it here.

http://www.itoctopus.com/index.php?option=content&task=view&id=18&Itemid=27

I am just beyond part 1 of the problem, fingers crossed for a response from MS with a reset password email for me.

In the meantime my hacker continues to cause trouble!

Update (21/07/2008)

After recieving many posts and emails with people asking and pleading with me to help them get their hotmail back I have prepared a handy document that tells you everything you need to know. I am making a small charge for this of $10, you can buy it here.

My hotmail/msn messenger login has been stolen, I have for some years now had the hotmail address - king@hotmail.co.uk, which i won in a eBay charity auction (for NSPCC).

The address regularly attracts attention of hackers, I get frequent emails in my Hotmail ‘Reset your windows live password now’, not to mention at 10 people a day randomly adding me either to see who has the address or by mistake!

So how did they do it? Being in our business all our workstations are locked down, firewalled, security patched, anti-virussed, anti-spywared up to the hind teeth, so a workstation compromise seems unlikely.

The perpetrator (by all accounts a 19yr old Egyptian male), who has been boasting to my contacts about how ‘he works for msn, and has hacked my account’, by all accounts achieved this by the most artistic form of hacking ‘social engineering’.

‘Social engineering’, basically means he has convinced someone at MS Live to reset my account password, thus gaining him access to my account. He has then gone on to change the other pieces of information (secret phrase, alternate email address), thus stopping me resetting it back.

So I am in the annoying stage at the moment where someone else is logged onto my messenger, and I can’t do anything about it until MS sort it out. BOO!

Update (21/07/2008)

After recieving many posts and emails with people asking and pleading with me to help them get their hotmail back I have prepared a handy document that tells you everything you need to know. I am making a small charge for this of $10, you can buy it here.

You can see our progress on our Team 30 Cannonball website… http://www.team30.com.

So until I get back I will be blogging there, so pay us a visit and see how we are progressing.