I have received the inside scoop on #CLUS – Cisco Live 2017…   Here is the things you want to know.   First CLICK HERE to get details on the event.

CAE HEADLINER

Bruno Mars

What more is there to say, five Grammy awards, six number one singles, and multiple songs on the top 10 at the same time.    Bottom line you can expect a serious line up of amazing entertainment!

For details on the CAE, click HERE.

Social Media Contests

There are a ton of contests this year, best tweet, best photo, most engagement, the bottom line is, share and share alike.   Get social, even if you are not at the event, there are Amazon Gift Cards up for grabs.

All New Floor Plan

This year, Cisco Live is mixing it up, with previous years the DevNET zone, Cisco Store and World of Solutions were spread out across a pretty great distance – this year, no more.  An all new layout integrates the DevNET zone into the World of Solutions floor and an all new Industries and IoT Village.

Last year I was pleased to be selected for Networking Field Day 12 in Silicon Valley.   This event was amazing, and I was able to learn and publish tons of great information from some big companies in Silicon Valley.   Everyone from the big guys like Intel, to smaller startups like Teridion, Kentik and Nyansa.    Even a few presentations that made my brain bleed like those from Brocade.

For me the Networking Field Day events are about collaborating with amazing people, it is about working with some of the best people in the industry.  Learning and interacting with the up and coming tech companies and keeping myself ahead of the technology curve.

For me the huge take away from that event was that SD-Networking is not coming, it is here.   Innovations in microsegmentation from the likes of Illumio.  New ways of thinking about networks and applications from companies like ThousandEyes.

What is cool about Networking Field Day is – while I have been selected as a delegate, everyone can participate, the event is as interactive (or more so) than Cisco Live, you can virtually attend as a virtual or community contributor.   Every event is live streamed, you can send in your questions on twitter, and I promise you, someone WILL ask it.

So head over HERE to check out who and what will be happening at Networking Field Day 15, April 6-7.  As of this writing we have ipInfusion and TelioIP presenting but more will be announced soon.

Live video links will be posted on the Networking Field Day page, and my page, and on twitter during the event, so grab that extra monitor and a pair of headphones and join in on the action – besides, it’s FREE!

Zero Day Exploits,  0-Day,   custom malware, tailored malware,  infected humans.   All things we have no way to protect against using signatures.

Signatures have been our life in security for a long time.  Virus update packs, signature updates.   Vendors like Cisco even helped build complex and expensive security reach task forces like TALOS – amassing over 250+ researchers who look for new malware, take it apart and then build protection against it – in almost real time.   This means we are reasonably well protected from things we know about

I still wash my hands

What?   That is because I don’t trust licking my palms when they are not clean.  If I trusted that I had all of the immunizations and that new “flu” vaccine gave me everything I needed – I could run around never washing my hands, but we all know that the flu vaccine only covers last years and SOME of what is coming.

Then why are firewall IPS signatures, and virus signatures enough for many corporations and end users?

Trust No-One

” Sorry boss, but there’s only two men I trust. One of them’s me. The other’s not you.”  – Cameron Poe (Character in Con-Air played by Nicholas Cage)

Anyone that knows me, knows I tend to use movie quotes a lot.   Customers look at me funny when I say something similar.   Trust nobody,  don’t even trust me.   Every person, machine or connected object could become ‘Weaponized’.    The minute you start trusting you are opening the door.   We all lock our front doors, but we do not lock our interior doors,  but if you found out someone else MIGHT be running around with a universal set of keys – you might start locking that bedroom, and maybe do it with a different kind of lock so that the person with the universal key has a harder time.  So why do we rely on traditional firewalls so much and then leave our interior networks wide open?

Vault7 – Wikileaks

The latest release from the team at Wikileaks proves the need for Zero-Trust models.    If the CIA was accessing vulnerabilities that were not publicly known,  that means hackers and bad actors in your networks could be using them as well.    The CIA is very well funded, and this release provides a glimse into how well organized and funded they are.    I want to be clear, this isn’t a negative comment towards the CIA, in actual fact I would have been surprised if they were NOT doing everything they could to protect the country.

This is a very good glimpse into the inside of an organized cyber activity program, and what we need to learn from this is – zero-trust or bust.

There is a small silver lining to such a leak – this view into an organized and well funded cyber program and the tools, tactics, and methods they used will help organizations learn about how to protect themselves.   Not that we didn’t know much of this before, but this will help harden and strengthen networks as a whole.    A wake up call, a chance to learn and a chance to realize that when they are well funded (which organized crime organizations are) they can mount cyber campaigns of significant complexity and capability.

Bad Actors Are Everywhere

Do not think for a second others around the globe are not doing the exact same thing,  foreign governments and organized crime are very much involved in these types of activities as well – it is just that in this case Wikileaks is calling out the CIA because that is the leak data they received.    We can learn from this, we can become a more security information technology industry

Zero Trust Design

A new world of security products has started to emerge in recent times, and new design philosophies are being suggested, but it does require a paradigm shift in thinking, and the realization that security will start to impact users day to day lives a bit.    No different than when seatbelts became mandatory.

Encryption In The Way

On a recent podcast (Cisco Champion Radio) Peter Jones from the Cisco Catalyst team tossed out this quote (sorry I do not have the original writers name) “The days of scratch and sniff on packets is over”.   Everything is encrypted.   Google requires any site with a login to be HTTPS by Jan 2017 otherwise you are flagged, and the majority of network traffic is encrypted.

That means technologies like NBAR and other deep packet inspection – DPI technologies are going to cease to function, which makes managing our networks more difficult.

Technologies like TOR allow telescoping encryption tunnels to anonymize traffic as it flows across transport networks, DPI is useless there.

Network-As-A-Sensor / Enforcer

Technologies like Cisco StealthWatch (previously LanCope) provide analysis of NetFlow data, which does not require payload to detect network traffic, scanning for deviations in standard network traffic and then providing analysis.

Tetration collects network flows and then build connectivity patterns looking for deviations from baselines, similar to StealthWatch but has a component of unsupervised machine learning.

MicroSegmentation

Cisco ACI operates under the guides of micro segmentation between object groups in the data centre, locking down interactions (assuming you implement it correctly) between objects in the network.  The way I explain ACI to my clients is simple – the network is turned on it’s head from “trust everything” (in a typical switch/router arrangement) to “Trust Nothing) where every interaction requires a rule (or Contract)

Then we have break out companies like Illumio who are thinking a little different, in their mind each system already has great security technologies, and without changing the network at all they orchestrate the packet protection engines within the operating system to provide Micro Segmentation.  Great content on Illumio can be found on Tech Field Day 12 – Click Here for that.

Final Thoughts – What Does This Mean?

This should be a wake-up call – stop thinking traditionally, start realizing the threats are out there.  Realize that security exploits are spending years in the wild without detection and that ZERO TRUST is the only model that matters anymore.   Do not rely on signatures and definitions to protect you.   A layered approach to security is your only defense against a growing world of threats, but firewalls and intrusion prevention is no longer good enough.   You need a strategy, and a plan to protect yourself because it is not a matter of if, it will be when – and you better be ready to respond.

Trust No-One.

http://www.youtube.com/watch?v=BaPeZk8Isxs&t=0m23s

DNA Goes Virtual

A huge update to the Cisco DNA Strategy has been released, and it comes with some pretty big news.   I am going to distill it down into the “need to know” and give you the low down.

We have all seen SDN – Software Defined Networking take off, commodity hardware becoming more and more popular – like the Trident 2 powered Nexus 3K models.     With a move to the software driven infrastructure, Cisco is virtualizing it all.   ISR, ASA, WLC, WAAS, – and even 3rd party applications.

In addition – they have a new platform to host it all – and this is all going to be automated.

What are we virtualizing?

Well, just about everything.   The idea here is to run an entire branch office in a box – yes you have heard this before – but – this is different, this is not an ISR with a UCS-E blade (although you could do that).  This is about choice.

ISR:  You can run most ISR features virtualized, if you are using the new platform (later in this doc) you can even use NIM modules.   Voice modules are exempt.

WLC:  Totally virtualized WLC

ASA: Virtualized security with virtual ASA and threat defense

WAAS: Nuff Said

3Rd Party:   I don’t do alot of rumors, but through DEVNET you will be able to deploy certified 3rd party application services,  and even Windows, Linux and other OS VM’s within the Virtualized DNA Platform

Cisco Launches ENCS

For a new DNA design, we need new DNA Hardware.   Cisco is announcing the first “DNA” specific hardware platform design specifically for the DNA architecture.  The ENCS 5400 Series.

Think of this as the combination of an ISR and a UCS server in one.

CPU:  6, 8 or 12 core XEON-D options today

Memory: 16-64GB

Storage:  M2 and dual hard drive with hardware raid as an option

Hardware Acceleration for VM Traffic, Switching and Crypto

The best part is – you can run your own VM’s on this platform as well as all of the virtualized Cisco kit – all of this managed by APIC-EM

What are we running this on?

Almost anything.    ISR with UCS-E,  UCS Servers or in public clouds, or the new ENCS 5400 platform.     Run it in the cloud, run int on your premise in all sorts of “NFV” gear or on a traditional routing platform.    Control it all with APIC-EM.

Cisco One Licensing – Future Proof Licensing

Many of my clients have said “Tell me why Cisco One is a good value” and the argument has been difficult if you are not on a 2-3 year refresh cycle, but with virtualized platforms the Cisco One story just became compelling.    If today you have an ISR 4K physical router with Cisco One, you can migrate to an NFV platform like the ENCS and not repurchase your licensing.

Not only does Cisco One protect you with licensing, it now allows you to migrate to a new platform – and while not everyone is ready for NFV today, it does mean moving to NFV later doesn’t involve purchasing all new licensing.  It also means moving to cloud services with NFV in the cloud could be at very limited cost.

While no real announcement has been made yet, we knew that Cisco Spark voice in Canada was coming soon.

ThinkTel – a company previously known to many as Distributel has announced they are the provider for Cisco Spark Voice offerings in Canada.

http://www.thinktel.ca/services/thinktel-voice-services-cisco-spark/

It would appear that they plan to be fully integrated with the Cisco Cloud Collaboration Management Portal (CCMP).

ThinkTel has been in the VoIP and SIP space for a long time, as one of the largest Lync / Skype4Business service providers in Canada, and one of the first certified Lync SIP providers – as many know, Lync required TCP based SIP service and had some specialized requirements.  They also provide ExpressRoute services for Office 365 SIP connectivity.

In the coming days I would expect an annoucement soon from both Cisco and ThinkTel about costs and services – but it appears that ThinkTel at least has let the cat out of the bag.

The pieces are coming together in “ClockGate” and it would appear that Intel the worlds largest CPU manufacturer is in the centre of the mess.   According to TheRegister – and while not confirmed, Intel’s C2000 processor has a fault that will cause device bricking, but nobody is talking.   A cross section of equipment from various manufacturers, and confirmed with my investigation – they all have this same Intel C2000 processor.   After Intel’s comments to the register, I think the culprit has been found.

Who is affected

The first to open up about was Cisco – admitting to problems with everything from ISR 4K’s, NCS Optical Gear, some ASA 5500 series firewalls, a few Nexus 9K Fabric modules and both the MS350 switch and MX84 firewall from Meraki.   I was going to write about it – but wanted to figure out what is actually going down here.

Cisco is not alone – Dell is also affected, users of Synology storage devices have been talking about it.  HP, NEC, NetGear, SuperMicro, and the list goes on and on.

HP MoonShot M300/M350,   Dell FX,  Segate home NAS products,  PFSense NetGate

I applaud Cisco for being first out of the gate to say “We have a problem, and we are fixing it”,  many vendors would sit around and figure out how they can sweep this under the rug, but Cisco is getting out in front of it.

The list of who is affected is growing – hourly.

The Cone of Silence

Nobody is talking,  Cisco is refusing to name the vendor, and Intel is refusing to name the product manufacturers but the writing is clearly on the wall.  Dell also isn’t talking, and when we reached out to some of our contacts – we received no responses from a few vendors (including Cisco).

The silence is not that much of a surprise, Intel is a huge partner with everyone involved and without Intel, these companies have no products, and without products, Intel isn’t selling silicon – so everyone is protecting everyone.

Cisco is at at the table with how to replace the affected devices – others are still quiet.

What caused this?

This little guy – the Intel Atom C2000.   Designed to provide power and scale into smaller footprints for intelligent system applications, systems on a chip and as a processor in the DPDK – the Data Plane Development Kit with the ability to improve packet processing speeds.

This little guy did.  The Intel C2000 series.  Intel issues an errata note AVR.54 that basically states that “System May Experience Inability to Boot or May Cease Operation,” because the clock outputs on the chip simply stop functioning.  Apparently this is occurring because Intel didn’t think people would use this SOC – constantly, and as a result the clock output is failing.

If you want all the nerdy specs on the C2000 – Click Here.. 

You need a clock – without it, CPU’s lose touch with the rest of the system – including things like BIOS and bus connected devices.   So once this clock signal fails – your system will not even boot up.

The statement is not really acceptable, you sold it for DPDK, and as a scaleable IoT processor, but yet in your own words (via TheRegister) ” degradation of a circuit element under high use conditions at a rate higher than Intel’s quality goals after multiple years of service”

How do we fix this?

Intel is issuing a new stepping for the Atom C2000 and has to fix this in silicon – that is a pretty expensive fix.     Some kind of board level repair might be possible, but we cannot find details right now.

If you have Cisco SmartNet with On Site support they will send someone to replace it, but that is not the magic bullet, because someone has to arrange and co-ordinate that all.  Partners will have to be involved – who will pay for all these services.

In a discussion with CRN Magazine – Jennifer Ho – Manager of Cisco’s Business Critical Communications has said “Unfortunately, because our funding is focused on providing the products, we are unable to reimburse for on-site services to replace the affected devices. Customers may have field engineering service as an option for their services contract, in which case the field engineering support would be included with the replacement.”

Cisco is clear – they are only paying for product.

There is also a delay – with so many people asking for replacements – rationing of replacement hardware is already occurring.

Justin’s Thoughts….

This is one of the largest fiasco’s since CapacitorGate, when one guy stole a faulty capacity formula and gave it to another company, who sold it to tons of manufactures of motherboards – and then I was replacing cap’s on motherboads in my house along with millions of others.

I’m pretty happy with Cisco on this one (Yeah bring on the “your a Cisco fan boy” comments) but the evidence is clear, they were first in front of it, and didn’t try to blame someone else they are just out there to fix it.

The big problem is who is going to pay for all this work – Cisco has said, they will not.

This is a pretty big hit – and these types of things need to stop – IoT devices with faulty ANYTHING can spell disaster and be potentially dangerous.   Just think if an electric car was powered by this chip, and one day the computer didn’t start up, or failed while driving.  Think of the oil rig which had a drill being controlled by a chip like this.

Right now nobody is really being hurt with this one – but it makes me worry about things to come in the IoT market with failures like this.

I am pleased to announce that I have been invited to continue my work with the Cisco Champion program for 2017.

The Cisco Champion program provides early access to product development, and direct access to technology business units.    Some of the benefits of being a part of this program are

• Building relationships around the world with global, like-minded technology enthusiasts
• Participate in exclusive Cisco activities, tech briefings, and pre-launch announcements
• Leverage the Cisco network of Blogs, Social Media, and Ambassadors to publish and share content across Cisco

Wait isn’t this a blogger for hire program?

No.  It isn’t – go ahead and read my disclaimer – I’m not for sale, and Cisco receives no promise from me that I will publish something about their stuff.   As always, if I find it interesting – I will write about it.  Let me be PERFECTLY clear – I receive no renumeration for being in this program.   Obviously if they didn’t like my work, or my contribution, I wouldn’t be invited back – but – I have been.

Doesn’t this mean you have to say nice things?

I’m sure they would like me to – but go and look at last years blogs – it was not all positive, and I was quite critical of many things – but I feel my writing is fair, un-biased and honest.   So no, I am not required to be nice.

Why do you want to be in this program?

When cool new stuff comes out,  I like to talk to the designers, ask them the hard questions, this program provides me access to people INSIDE Cisco.    Part of why my perspective is the way it is, and the reason I get the detail that I get – is that I am given access, and time with the people that can answer the questions.   As a blogger/writer, this is invaluable to providing quality content.   A good example is my recent Spark Board coverage, the Cisco Champion program was instrumental in that early product access so that I could provide that content.

Networking Field Day 14 kicks off this week January 18-20, 2017 held in Silicon Valley.   At this event, we will see a ton of great content from Juniper, Anuta Networks, Barefoot Networks, Big Switch Networks, Kentik, Nyansa, Riverbed and Silver Peak

CLICK HERE FOR LIVE STREAM

Here is the presentation calendar for this week’s event – as always join in on the conversation on twitter with the hashtag #NFD14 and head over to techfieldday.com to watch the live stream.

Watch as the team asks the hard questions, these are in-depth technical session with limited marketing content – if you want to catch up on these innovative technology companies, tune in to the live stream.