I.T.HINK …So you don't have too…

4/4/19

Finding that using these commands on a daily basis help me troubleshoot issues and just wanted to share:

netstat -f = this command tried to resolve every connection to their FQDN

netstat -r = this command show the local routing tables on the PC

netstat -a = show all active TCP/IP connections on the PC

netstat -e = this shows any errors on the network adapters or lost packets

ping -t = this allows for a constant ping of an address

ipconfig = this show basic network configuration of the local adapter

ipconfig /all = this shows every detail about all network adapters on the local PC

arp -a = this show the mac address table on the local machine for the devices it’s “talked” to on the network and has saved in memory. Once you reboot this table clears.

nslookup [internal IP or external IP or FQDN] = this commands allow me to resolve internal or external dns names to see what address come back, if the response on local addresses comes back with a :unknown: this means that reverse DNS lookup is not setup.

Useful command on checking to see if a networks DNS server is secure:

1. type ‘nslookup’
2. type ‘DNS servers IP address]’ and press enter – cheat: do a nslookup [name of the local domain if you hover over the network adapter on the Windows desktop and this will reveal the local DNS server IP address]
3. type ‘set type=any’ and press enter – note: notice no spaces
4.  type ‘ls -d [domain name] – [domain name is the name of the domain that you found in the hint in #2 above or any public domain like google.com as an example]
5. If this comes back with the SOA, NS, A, and MX records then this domain is allowing zone transfers and this is BAD! – it means I could redirect DNS to a rogue DNS server

Below is an example of  what a blocked zone transfer looks like in a mock DNS server in the lab.

Zone Transfer Blocked!

Useful Website for looking up the security of a public website:

https://tools.pingdom.com/#5a7a0a61d8000000

I hope this little write up is helpful to some. 🙂

Always-be-Labbing!

~Trevor

2/5/19

SIEM systems are something more and more people are adopting to use with defense-in-depth and its a good move.

The company I work for partners with a SIEM solution provider called SocSoter and they have these affordable units that you deploy on a network and it has an interface in every network device you desire.

These device come in a few flavors, a VMS and SMA to name a couple. The SMA proactively monitors the network that it’s mirroring and allows for syslog monitoring of switches and storage appliances including taking Windows Server Event logs. On the flip side the VMS does proactive vulnerability scans of the network to find problems with the network/systems and provides steps on how to fix them.

These devices, when used in conjunction with directory services like Active Directory, Edge Firewalls, Next Generation AV, auditing policies, 802.1X, routing cryptography, and inline/at-rest encryption enables the deployment of a very comprehensive defense-in-depth approach to security. 🙂

2/5/19

I’d like to discuss a few things around the classification of data types coming thru a firewall or security device. I think pretty much even know the slang of false positives, but there is in-fact 4 types.

1. True Positive – means an action was taken, that was true and accurate
2. True Negative – means it has not acted, because there was no activity
3. False Positive – means a security control acted based on a threat but it was a error
4. False Negative – means the security control didn’t act even though there was a threat

11/28/18

As a form of motivation and because I’m finding with work being so crazy busy I’m having less and less time to devote to studies. But I’ve made a plan for me (been working this plan for about a month now) to read 2 hours every day either in the morning or at night (considering most nights I don’t go to bed til 11 pm for either work projects or reading) and then wking up at 4 to 6 am to study takes it’s toll on me.

But I’m on the last 5 chapters of review with the CompTIA CASP+ exam and I plan on taking the exam in the last weeks of January, so I’m committed to this journey, not stopping now!

I know this has been a 5+ month charge but I had no idea the CASP book, CAS-003, would have so much technical knowledge in it, moreso than the CompTIA CySA+. I love reading the book but my brain feels like it’s going to explode.

I do feel more relevant and useful in my day-to-day though after reading, labbing, and studying the material and it’s funny all three of those doesn’t even touch that I do use 60% of the CASP’s content daily at my job. So that right there just goes to show how much of it is relevant information.

Recently went to a CompTIA CIO Roundtable discussion in NYC, yesterday in-fact, and it was very interesting to hear CISSP’s talk about cybersecurity and how I don’t really want to be in management-level cybersecurity but actually in the trenches doing the 1’s and 0’s and that is where the CompTIA CASP+ shines. I look forward to the journey in the technical side of cybersecurity.

-Trevor

Hey peeps,

So just want to share some things for you to make sure you have enabled to ensure the best possible security posture on your network, just a few tidbits.

1.  Ensure in Windows Server DNS under Zone Transfers that you define your DNS Name Server that are allowed to make transfers and set it to allow only those servers. This way rogue attackers can’t seize your DNS records. Once you do with open up a Linux machine and type “dig afxr [your DNS server].yourdomain.com yourdomain.com” and see if you can or can’t get a zone transfer, the goal is for you to not have one. 😛

2. Make sure that your firewalls on the WAN/LAN ports block ICMP requests. This way when someone does a tracert of your DNS servers or network they can’t resolve any of your servers. Example: if you did a tracert of domain, typically the last two addresses are internal resources. if you do a tracert and then comes back with a * * then this means ICMP is blocked; this is what you want!

3. Make sure on routers that you have CHAP authentication enabled for all routers and L3 switches that share routing typically the command to enable this (like on Cisco) is “encapsulation ppp” and then the two modes are PAP which send the password in cleartext or with CHAP (the preferred method) which doesn’t send the password in the clear but instead salts the password so that routers and L3 switches with the CHAP can validate that the device is authorized to update the routes and routing tables, this way you can prevent routing tables from being poisoned with false routes from rogue routers and man-in-the-middle attacks.

4. A useful tool for malware sandboxing, vulnerability assessment and SIEM is a appliance provided by SocSoter and those interested should seek them out.

Just some security minded pointers. 🙂

8/11/18

So I did it, I stopped procrastinating the reading and I hunkered down for two month and passed the exam. I even cancelled my World of Warcraft Subscription that I reactivated for some reason for a month??? O.o .. maybe I was bit nostalgic of years past… 😛 — But I wanted to focus so I didn’t renew it, glad I did! 🙂

Honestly going into the exam I thought I flunked it. But after just 40 minutes I got done with all of the questions, I had all of the simulation in the beginning and from past experience flagged them all and went on-to the questions. This saved me a bunch of time, but time I actually didn’t need. They were easy simulations, I just hyped myself thinking they were harder.

I really enjoyed the prep work and exam, I feel much better about security and now being 3 years since I took the Security+, it was a nice fresher.

The knowledge gained for the prep and learning I’ve been applying in my day-to-day and I want to go onward into the CompTIA CASP and the newly drafted PenTest+ course. For now since the PenTest+ is so new, as in this month, I’m going onward into CASP. I think that cyber security is a big issue in IT and I felt the need to get my foot in the door. If I want to work in the cloud, I really need to make solutions that accomplish the results customers need and at the same time have the level of security required to protect assets from external attackers and to mitigate these threats, the CompTIA CySA+ helped me in this area.

I already have the CAS-002 and just got the CAS-003 books from Amazon. I’m already up to chapter 3 in the CAS-003 book and plan to attempt the exam the end of September. 😛

My goal for the rest of 2018 is to pass the CASP and the Microsoft 70-413 exam. This way I get a VCP6-NV, CompTIA CySA+, CompTIA CASP, and a Microsoft MCSA: 2012 for 2018. In 2019 I’ll wrap up with the MCSE: 2012 and then recertify the VCP6 to VCP6.5-DCV.

My goals for 2019 are: VCP6.5-DCV, MCSE: 2012, MCSE:2016, and VCP7-CMA. Maybe someplace in there I’ll do CompTIA Pentest+. 2020 will be CISSP, CCNA: R&S v3 and a VMware vCAP (undecided which one).

6/26/18

Hey all,

So with me taking the CySA+ exam in a little over 2 weeks after many months now of studying and bringing myself up to speed with Kali Linux, I feel the need to make a new title for upcoming pages. All pages that are Cyber Security oriented will start with the tag “Cyber Security:”.

I feel that in order for me to really stay relevant in the cloud that I really needed an intermediate to advanced knowledge of “Defense in Layers” and then how to penetrate those “Layers of Defense” so that I can provide defense from said attacks as I go about making cloud solutions moving forward.

The biggest concern of all customers and providers alike is not only the cost of the cloud, moving to the cloud but more-so than ever the security around the cloud.

3/25/18

Well I did it, passed the VCP6-NV exam. it’s been an adventure and a journey. After failing the exam in January I was to be honest very disheartened by that loss and I was slow to get back on the bandwagon. Took me nearly 3 weeks to pony up the energy to study again. But study I did, from 2 am til 7 am every morning for 2 months after working out on the Bowflex Xtreme 2 SE I would study: labs, watch Pluralsight, read VMware press micro-books on NSX, and the official VCP6-NV book over and over again. Also read all of the NSX guides on the Kindle that I could muster.

I’d like to personally thank Chris McCann who with Eva Leong at VMware the were gracious enough to provide me resources and voucher for me to take the exam, after all they did bestow upon me the VMUG NV package back in May of last year; it’s been a long journey, but fun along the way.

I plan on now finishing up my MCSE:2016 track as I got some more to take, but I’d like to pursue the VCAP6-NV track or is it VCIX? O.o dunno the names keep changing.

So my next goal is the MCSE, the the CompTIA CSA+, then back to VCAP6-NV.  I’d like to dabble into VCP7-DTM too. Maybe I’ll aim for all 4 of them. 😉

I will admit, having my Cisco background did help a little bit but more-so having an actual home-lab with Cisco and Netgear switches was even more useful, having those 10G switches and 10G CNA’s really paid off for labbing.

My only advice for anyone planning on taking the exam themselves: study the NSX design guide, get the 5 book bundle of NSX VMware Press mini books, watch videos on Pluralsight and then this is key, after you study take a 23 minute nap to retain the knowledge. Drink plenty of water and eat clean. 🙂

Persistence is key..

3/13/18

Decided to apply an SSL certificate, get premium DNS, and Mcafee Secure virus protection (you’ll see it in the bottom right of the page). Wanted to increase the blog security and sustainability and provide some reassurance to viewers that this site is protected. 🙂

-Trevor

Figured I’d get this up here as I’m deep in the NSX track right now. 🙂

2/18/18

So my goals for 2018 are smaller that 2017 but none the less intense.

I currently working on the VCP6-NV study, after failing the exam last month by about 20 points. So I’m working very hard at studying to pass the exam in a litter over 5 weeks.

After that I’ll be studying for the CompTIA CSA+ and MCSE: SI 2016, if I have time the AWS:SA. That’s my goal for 2018. it’s a smaller list than last year but no less focused. Once I get those 3 exams after NSX I’ll decide the path I’ll take next.

I think VCIX-NV is my next goal with VCIX-DCA shortly afterwards.

Sometime down the road CompTIA CASP and CISSP are on my roadmap but I need a few more years, for me, before I decide ot go down that path.

I’d like to make a fresh attempt at my CCNA: R&S and DC at some point and perhaps a CCNP just to have the knowledge when designing VMware infrastructures.

On a personal note, my goal fiscally is to get 30k into savings and to invest 15k. For my health, I bought a Bowflex Total Gym and my goals with that is to get into fit and trimmed shape.

I’d like to keep journaling daily, working on reading a leisure book a week, keep saving money, building my credit score upwards to 775, blogging on here more often, getting a few modifications for my new Subaru WRX, spending more time with my parents and dog, spending more time with my friends and doing a little bit of traveling. I’ve recently got into cooking, painting, and playing my grandfather guitar, so my list of hobbies just seems to keep on growing….

somewhere along the lines I hope to meet an amazing woman again after now being single for almost 2 years in April. But my goals aren’t on that part of my life as my life is very busy and focused and that’s most important to me. My goal by 2020 is to strongly consider buying a house.

But this is my outlook for 2018.

Hey peeps,

so wanted to update the blog. Passed the 70-410 and 411 recently and onward to 412, then 413 and 414 for MCSE 2012.

I felt it was needed for me to get a MCSE since I’m a VCP and they go hand-n-hand. Plus I wanted to have the credential to back me up so I can no longer have people judge me by what I say. 😛

So take that judgemental fellow IT people, take that and shove it up you a**! 😉

I know I’m kind of late with this, but better late than never. Been really busy with work, but I wanted to put this up on the blog. 🙂

I was on the VMware forums on Wednesday and one of the biggest names in Software Defined Networking at VMware made a posting about a offering VMware was giving away in regards to training for VMware’s Software-Defined Networking for the datacenter and for vCloud, the software behind what makes the ‘cloud’ a reality for MSP industry who are “in-deep” as they say, so I was like sure why not I’ll make a post about my career and see what happens…

I feel that for the MSP world to really work, there needs to be a shift from private clouds to a hybrid with a public to public IaaS fabric that solves one of the biggest problems in IT right now, Security. VMware NSX is one of the most secure public to public frameworks I have ever seen. It solves the problems we, as IT professionals face, in regards to the concerns of customers around security and this was expressed in the posting.

Well, I was a little shocked this morning, as I got selected!
Here is what the reward was and what they asked. 🙂

3/27/17

Well after a few months of studying and failing the exam the end of December I wanted to pass it this time, so I blew away my home-lab like 5 times and did it in 4 different ways to make sure I knew the content. Took the exam on March 25th and passed the exam with a score of 383.

Now onto the road towards the following exams:

1. VCP6-NV
2. VCP6-DTM
3. CompTIA CSA+
4. MCSE: 2012
5. VCP6-CMA
6. VCAP? – one of them…. to-be-determined!

Nuff said….

6/3/15

So I’m going to do something new for my blog and that is to at-least make monthly updates to my progression for the month.

This month has been busy I’ve been studying like a banshie for the CCNA exam while at the same time work on a project at work. I’ve schedule my exam for the 29th of June, now that the massive work-project, explained below, is done and I’ve been re-focusing on my studies. On a non-technical note I completed a 22 mile hike around Bear Mountain, CT on the weekend of 16th of May and that was pretty amazing.

Picture from hike:

(Typically I’ve seen a project of this scale done by a few engineers but I was able to do it all solo and without a problem. It’s something I give credit to my home-lab cause I was able to visualize both mentally and physically which allowed me to plan it out accordingly and if I ran into problems with the production environment I just brought it home to the home-lab and troubleshooted it at home.)

The project at work entailed the following hardware/software/consolidation:

1. (2) new Dell R700 series servers on Dual Xeon HT-enabled processors with 128 GB’s of RAM each with 8 gigabit nics w/ internal flash for ESXi 5.5.

2. Equalogic 4100S SAN with 18 TB’s in a RAID 10.

3. (2) Dell N3048 L3 switches in a super-stack for iSCSI/vMotion only traffic – completely separated from production.

4. (6) Dell N2048 switches in a super-stack to replace a aging Dell 2824 switching fabric for production. This also has employed over 5+ vLAN’s now compared to the previous solo flat /24 subnet.

5. 195 minutes of APC UPS backup runtime with Network Shutdown 4.0 remote shutdown module for a DR-power-outage scenario with email alerts for a controlled-monitored shutdown if needed.

6. Network re-cabling of CAT5e and fiber uplinks for the entire network replacing aging CAT 3/5 drops w/ proper punch-down placement and cable management.

7. Employment of a complete VMware Data Center platform with ESXi, vCenter, vCops, VUM, svMotion, vMotion, comprehensive snapshots both virtually and on the storage array, along with use of Backup Assist for backups of the VMware assets.

8. Complete Server Physical-to-Virtual Migration of all server assets with a redundant solo DC “outside of cookie jar” setup for domain fault-tolerance with a an affinity rule for ‘Core’ servers to live on the same host for inter-vSwitch performance benefits.

Benefits of the Project

1. Consolidation of server assets into a centrally managed infrastructure which now allows for greater ease of administrative/resource management, aggregated performance and disaster recovery.

2. Server “right-sizing” for all servers to adjust for higher resources pools which resulting in a 50% performance increase across the board.

3. With the deployment of a SAN for storage, we gained the performance of a centralized array for all servers to access which resulted in a 46% increase in IO speeds for high-demand servers such as our ERP application and SQL databases.

4. With a properly designed network infrastructure broadcasts and security are controlled now with the proper deployment of vLAN’s and ACL’s as-well as performance increases from network segmentation that now all now lives on a 228 Gpbs throughput core switching fabric. The network re-design coupled with the network re-cabling improve network performance drastically from proper placement of cabling away from EMI and the removal of aging CAT 3/5 cabling.

5. Cost savings, by reducing the server footprint we’ve reduced out power costs of the 20+ servers into just a few servers while at the same time reduced our cooling needs.

6. Stability, with the entire server infrastructure we’ve been able to maintain a higher up-time that previously achieved which is amazing coming from a company that in the past was accustomed to daily server crashes which equated into lost revenue.

Overall the month of May was an amazingly fun and busy time for me. I loved every bit of it when it came to doing the project as-well as my CCNA study. When I got done with the project I stepped back and it hit me; “I did it”, I completed the project from start (design/planning) to finish (implementation/configuration/administration) all by myself without any outside help. To me that feeling of achievement was amazing that with my commitment to my certifications and home-lab/self-study I was able to do this project without any problems at all. This just proves to me that I’m doing the right things with my career and I look forward to a promising future. 🙂

I’d like to say a special thanks to the guys/gals over at Techexams.net; your invaluable insight into my questions has been hands-down essential, and I’d like to thank my co-worker Juan Ayala for being super supportive, also for my parents and friends who said I was estranged from them but in-fact I was just dedicated to completing the project.

~Trevor