Thursday, May 26, 2011

My top ten networking rules.

10. Always segment traffic. Storage traffic should be on a storage vlan, Backup traffic on a backup vlan, database traffic - guess where on the database vlan. I even promote farther segregation, prod, stage, test, and dev vlans.

9. Scan your network. If you properly segment traffic, you should never see ssh on your database vlan. This should throw a big red flag and be investigated.

8. Always allow all vlans at the core, filter which vlans are allowed at the aggregation / distro layer. The core should be static. The Core is the backbone upon which your network is built. It should be redundant and bullet proof. Admins should almost never login. The core should be transparent.

7. Create ACL's, some protocols should not transit the network (telnet, netbios). Server administrators should filter out 90% of unnecessary traffic. Network admins should put in rules in case they are lazy and to get the other 10%.

6. There shalt not be more than 5 network devices between the user and the internet ( or the voip phone and the router), not including firewalls. So the worse case, A user pc connects to an access layer switch, to the aggregation layer switch, to the distro switch, to the core switch, to the core router.

5. There shalt not be more than 4 layers of switches between the top and the bottom of any network.(Thanks for your rebuttal Kevin, I Still don't Agree. This rule is sign of good design. I think you should re-evaluate 6 layers is more than excessive. I know I break the cisco mold. The data center stack should be directly connected to the core. but on the client side and the access layer you should not have more than four layers. Core, distro, aggregation, access. How would you name 6 layers?)

4. There shalt never be more than 3 devices between server and server, this includes servers in other data centers. The worse case a server connects to the data center edge switch, to the core, to different data center edge switch.

3. Avoid over subscription. In the Data center the rule is 1.2:1 for 1g, 8.4:1 for 10g

2. The core router should be used for network ingress and egress traffic only.

1. Always route at the access layer if possible. Layer 3 switches provide greater throughput and routing speeds for trivial routing. Voip acts better if you route as close to the user as possible.

The last but not least. Keep it simple. Always err towards simplicity, complexity kills.

Tuesday, May 17, 2011

My top ten rules of Virtualization.

10. Never allow the OS to manage the memory. Always make it static.

9. Route as close to the virtual servers as possible.

8. You can strive as much as you want to improve your VMware infrastructure, more memory, flash disks, 40Gbe, but if you do not take a holistic approach and simplify the network from the servers to the servers and from the servers to the desktop, you are only going to realize a portion of those gains.

7. A hop is a hop is a hop. Don't let the network ugru, tell you with this seamless fabric there are no hops. Every time you leave a switch it is a hop.

6. You can never have enough memory on an esx host, always max the host regardless of cost. Once you start using APM and DPM, you will be amazed when during the weekend you have one server running in your datacenter and you save 4k every weekend and about .5K every night in data center power and cooling.

5. Don't add cores. Every time you add a core to a virtual your raise the cpu wait state by at least 10%. Optimize applications, distribute load, create another instance, do not add another VCPU.

4. Do not back up at the OS layer. Backup via VCB or at the storage with snapshots and ndmp. Never backup at the OS. Same applies in the physical world. Backup the data, you can re-provision in minutes what it takes hours to restore.

3. Never use RDMS. The fictional performance gains are not worth the lack of functionality.

2. Always install VMware tools in the OS, and use vxnet.

1. This is an absolute no bending. Never install a Windows / Linux / Solaris cluster of any kind in VMware.

Yes, I realize Guru is misspelled, as ugru, but come on have you actually met a network guru.