Matthew Buck’s Blog – Principal Engineer at RatwareUK

Location, location, location.

I thought about writing this post after a friend of mine called me and said he’d found a new office for his business – but he’d heard reports that the broadband on-site was limited. He asked for my advice.

There are three key things you should remember when sourcing broadband for your business:

1) Is VirginMedia’s Fibre Optic (not ADSL – they offer this to non-fibre enabled areas) available in your location?
If so, purchase this and read no further. VirginMedia’s fibre service is unrivalled, both in their routing hardware and down to the wire. If you can’t go with VirginMedia’s fibre optic service you are stuck with ADSL. This isn’t too bad as long as you’re close to the exchange and your exchange has a wide range of operator presence.

2) What services are available in the exchange to which your potential phone line would be connected?
Some people sign up with [Random ISP] Ltd and then experience a poor level of internet service. This is usually because although [Random ISP] Ltd sell broadband to customers all over the UK – they don’t actually have their own hardware present in your local exchange to which your physical line is connected. This means that all communication between the wider internet and your router has to travel through BT’s core hardware first before being re-routed to another BT exchange to hop onto [Random ISP]‘s network. Clearly this is undesirable and users tend to experience lag, packet jitter and, during peak times, bandwidth throttling.

You can check exactly which operators are present in your local exchange by visiting Sam Knows . First make sure you get the correct exchange by entering your phone number and postcode (your line may be connected to any close by). My advice is that if the operator you want has no presence in your exchange, cut your losses and sign up with BT Broadband to receive the best service available.

3) Once you’ve found out which exchange you’re connected to, also check the distance you are away from it.
Many operators will sell you ‘ADSL2+ up to 24Mbps broadband’ – however if your premises is 8km away from the exchange you are likely to get a sketchy 2Mbps which drops on and of throughout the day. Not great if you use hosted services! Use Sam Knows Exchange Mapping to show/hide the coverage of your local exchange. If you are right on the edge of the exchange’s coverage, it’s likely you’ll need some expert help, such as a bonded broadband solution, leased line or in rare cases; satellite broadband. There are other factors to do with your physical line which will affect speed, but none really more so than your distance away from the exchange.

In answering my friend’s question, he didn’t move his business. It turns out that many existing tenants only received slow broadband and the premises was situated on the very edge of the local exchange’s coverage.

In summary:

• Can I avoid ADSL? If so, go with VirginMedia’s Fibe Optic Broadband.
• Does the operator I’m signing with have a presence in the exchange? If not, just go with BT as you’ll be using their network on your first hops anyway.
• Are you close enough to your exchange to receive a good level of service? Remember, operators will sell you 24Mbps and you may only ever be able to receive 6Mbps. So maybe find a cheaper deal, if available.

Could this new Draytek 2820 VOIP product be a further nail in the coffin for conventional telephony methods? Recently I implemented one of these, and at approximately £400 + VAT (including a couple of IP Phones), I have a fully functional local exchange, providing the usual functions such as; auto attendant, voicemail, hunt groups, call-logging, music-on-hold, conference calling etc. On each of the IP Phones you can set the voice compression method and from the IP-PBX you can swiftly implement upstream QOS, governing the VOIP system. After 2 months of constant use, I’m told that there is “no difference” to the quality of a conventional telephone line and no difference in the features of a conventional local PBX.

The Draytek is serviced by a 10Mbps/700Kbps Internet connection provided by Virgin Media, with a failover WAN2 USB Modem providing Orange 3G. It’s in a server room so it’s powered by an existing UPS, just like your conventional phone system should be.

The SIP provider is Draytel. They provide a host of telephony services. In this case; providing 5 simultaneous SIP Trunks (5 lines) including 2500 UK land line minutes for just £19.99 + VAT per month. That’s a better deal than BT and you aren’t tied to their ridiculous local exchange programme, which prohibits you from taking your phone number when moving your office. When this client moves, they’ll simply ensure broadband is present and then plug their Draytek router in. No reconfiguration, no costs, no downtime – phone and Internet moved simultaneously.

This small router provides support for up to 30 extensions, the next model up provides 100. Are products like this going to signal the death of conventional telephony?

I’ve been speechless for a while, because Dell have outdone themselves with their new thin client – the Optiplex FX160. Basically, thin clients don’t need hard drives. They run a local operating system such as Windows XP Embedded from solid state flash media. This flash media may only be around 2GB in size – just large enough to hold the operating system image. This makes the thin client very fast and very robust.

The 160′s are supplied with an embedded image providing a cut-down XP desktop with immediate support for Remote Desktop Connection, VMWare and Citrix. A quick modification to the image via a deployment server and you’re booting straight into your virtual environment. The units are fast, ultra-small and have a really low carbon footprint. Once more, this new thin client and a strategy of virtualisation takes away the need to “rebuild” systems on failure. There’s less to go wrong and no maintenance required. There’s more consolidation, security and control.

Dell Optiplex FX160 is now RatwareUK’s thin-client deployment of choice and a perfect partner when virtualising a network and desktop streaming. At approximately £270 + VAT per unit, this product is extremely cost-effective.

If I could have a pound for every time I’m meeting a new client and they ask “Can we have a wireless network, instead of a wired one?” we’d be a) rich and b) doing a serious mis-service. If everyone was as familiar with the words “virtualisation” as they are with “wireless” we’d be very happy. I guess it’s because people have wireless networking thrown at them by TV adds, ISPs and their savvy, computer-addict children. Why can’t people request virtualisation?

Today RatwareUK decided that, unless there was a specific technical circumstance against it, virtualisation was from now on, going to be the preferred solution we push to SMEs. VMware, memory and processing power have come a long way since I used to run Linux through a VM window on my home PC almost a decade ago. Now VMware is a credible and widespread solution, providing a multi-server deployment on minimal hardware and revolutionising IT support, security and provisioning. Within an SME context it consolidates everything and gets rid of the need for complex restoration processes and the constant up-hill support battle present on a multi-OS client environment. Virtualisation kills the need for complex group policy work, scripting and client upgrading. It pools your resources and configuration into one place.

I’m unsure what’s next for virtualisation. Maybe transferring your virtual machine solution from your office, to your hosting company’s cloud?

OK. I thought I’d stop twittering and do a blog post. I’m going to talk about a gateway solution we recently deployed for a customer – Untangle. I’m impressed. In brief, Untangle is a free, open source gateway solution designed to untangle the complex patch work quilt security solution that many network managers find themselves dealing with after a few years of running an expanding domain.

Installation

It’s essentially an out of the box Linux solution which can be installed on a relatively low specification machine with two network cards, bridging your LAN with the internet. In order to implement it on one of our networks, I took an old PC, jammed some more RAM into it, bought two new network cards and began the install:

The installation took approximately 20 minutes on our machine and required no Linux knowledge at all. If you understand the concept of network bridging, you’ll also fly through the setup wizard which asks you which network card is WAN facing, etc.

Configuration & Usability

Like many security devices that sit on your LAN, I expected that setup would be straightforward but that inevitably I would spend about a week tweaking the settings, ironing out all the false positives and getting Untangle running smoothly. This took me by surprise. I wasn’t – it took about 5 minutes and even better than this it has been running itself for a month!

The interface is graphical and the configuration again requires no Linux knowledge. It works on a drag-and-drop concept, where you can download and drop network devices onto a virtual rack. Some components you have to pay for, but the main and most useful ones are free.  I won’t bore you with the list, you can check it out here – Untangle Overview .

The interface is accessible from either the Untangle computer or via HTTP.  I’ve found it works much quicker via the web interface and obviously you’ve got full control over it from anywhere. I’m finding the Spam Blocker and Web Filter the most useful components, however this is because our requirement for these features is greater than anything else. Logging in today, the spam blocker has scanned 22,286 emails in 24 hours. 21,210 of these were rejected connection, some were quarantined and only 81 were passed through to mailboxes.

Users on the domain have also taken to their new spam quarantine like a duck to water. Each day, they receive an email digest linking to their Untangle quarantine. From there they can control their own whitelist/blacklist and release legitimate email caught up in the system. As Spam Blocker uses Spam-Assassin, Untangle learns automatically as it goes along. The process is so simple, out of approximately 70 users, I’ve had 2 queries on how to use the quarantine.

Conclusion

A very powerful, easily deployable and manageable security solution suitable for any SME network. I’m so impressed I have ditched Sophos Pure Message, providing the network with a better solution, with a saving of over £1,500 per year in subscription costs. It’s so good, I’m even thinking of decommissioning the networks hardware firewall, a Draytek 3300v.

Untangle is free (most of the components) and Untangle provide free updates. It is well worth some time to test it out.

Hello again. I felt guilty about not blogging here in a while and using twitter too much, so I thought I’d do a quick blog containing some pictures of the work we’d been busy with recently…

The above as pictured is unfinished, however it shows our ability to provide a high end, complete infrastructure install. The building was being renovated, so we installed 66 CAT5e points, one Avaya IPO phone system and two Dell PowerEdge servers providing virtualisation and redundancy. The complete package, all wrapped up in a RatwareUK custom server cabinet.

Network Installation

IT Relocation Case Study

At RatwareUK every customer comes to us with a different set of problems. Every business is different, we know this. We’re different too. It would be easy to roll out a template that 75-90% fits their requirements, but we’re perfectionists. A solution that fits with the client’s business as well as creating new depth and scalability is what we’re after. This is why last week, when we were designing a wide area network, myself and a couple of engineers worked on a Saturday to discuss and configure the VPN and servers.

Free from the daily tasks of maintenance and programming, we set up a projector, meeting desk and proceeded to discuss and design a company’s network – literally – on the wall. We found this workshop approach was extremely productive. As engineers we were actively learning and implementing new skills and our combined rigour and ingenuity was poured into the new system. We then continued bench-testing the system and it was eventually deployed the following week. It was a complete success and the customer was provided with a system that worked precisely the way they wanted it to. You’d be surprised, but this sort of forward thinking is discouraged in some organisations. I certainly, would not work for any other company.

Just thought I’d do a quick blog as it’s been a couple of weeks since we secured the new hosting deal with the data centre and things have worked out really well. Since closing the deal, we’ve deployed several Linux servers at the data centre, each hosting our clients special requirements such as online databases, high-dependency web applications and DNS.

The servers each run CentOS – one of my favorite Linux OSs for its stability and scalability. We’ve made sure each server has 4 processors (AMD Quadcore 9500), 2GB Ram minimum (plenty for Linux) and at least 2 hard drives configured in a mirrored Raid array. If one hard disk fails, the other can immediately take over and our Service Level Agreement with the data centre means that the failed drive will be replaced within 30 minutes. If both hard drives fail at once, which is highly unlikely – 0.0004%, all data is backed up every evening, and data periodically is uploaded to another RatwareUK secure server at a different geographic location. We’ve got eveything covered and we are passing on all the benefits to our customers!

The datacentre and RatwareUK co-manage the servers and have set up IP tables, anti-virus, ssh hardening and the centre runs daily security audits for us. The datacentre also offers excellent internet connectivity to our servers. They are now supplied by Tier-1 bandwidth providers and are just 1 hop away from 4,500+ networks. These new servers are fast and secure!

Finally, we have complete root access over the servers here in Wigan and have added them to our Pro-Active monitoring service. This means that, if the server stops responding, a service fails or there is a security alert – we’ll be advised within 60 seconds.

We are currently in the process of migrating data from our old hosting servers to the new ones. The new hosting servers are the pride of the company this month. At RatwareUK we like a good solution. For more information, please contact us.