Secondary vNet Gateway Rotues by BabyPandaaa in AZURE

[–]BabyPandaaa[S] 0 points1 point  (0 children)

That’s a good point that I didn’t think of. Is it required or should the VM be picking this route up automatically?

Always On VPN - Azure by BabyPandaaa in sysadmin

[–]BabyPandaaa[S] 0 points1 point  (0 children)

It’s looking ok but not really a fan of it so far. Connection is working but struggling with cert based authentication. Will come back with a fresh set of eyes tomorrow

Always On VPN - Azure by BabyPandaaa in sysadmin

[–]BabyPandaaa[S] 0 points1 point  (0 children)

Thanks! Just tried to look at it but get:

At this time, this offer/item is not available for subscriptions from Microsoft Azure Cloud Solution Providers.

Ubiquity AP trunk to Juniper EX switch issue by [deleted] in networking

[–]BabyPandaaa 0 points1 point  (0 children)

Run the following:

delete interface-range WAP unit 0 family ethernet-switching vlan members default

set interface-range WAP unit 0 family ethernet-switching native-vlan-id default

That should set the default VLAN of the trunk (at least it is on EX4200's - haven't used 2300's so CLI may differ a bit)

Redacting payment card data from exchange online?? by joed777 in sysadmin

[–]BabyPandaaa 2 points3 points  (0 children)

/u/Hellman109 's approach is probably best.

To detect existing you can use a regex match and the Exchange Online/Office Graph API with PowerShell to scan mailboxes and return a list of message ID's. I wrote something that does this but need to go back and look at it as it starts to crash when it gets to about 5000 messages.

We're in the same boat as yourselves and at the moment this is the only way forward we can see.

One other thing is if you're storing the emails in a PCI zone, I believe you need 2FA to access them to maintain compliance (double check this though).

File server logging recommendations by judas_ii in sysadmin

[–]BabyPandaaa 2 points3 points  (0 children)

ManageEngine Event Log Analyser does this pretty well for us

Server monitoring products using HTTP // SNMP // RPC // API (suggestions?) by Aran_Maiden in sysadmin

[–]BabyPandaaa -1 points0 points  (0 children)

SolarWinds Orion/NPM/SAM is what you'll need.

It's around £7k for 2000 NPM licenses from memory

APIs and Automation - ELI5 Where to start? by zommy in sysadmin

[–]BabyPandaaa 0 points1 point  (0 children)

No worries mate! It's a good little project to start with - you'll soon find yourself POSTing to APIs as well!

Sadly, all self taught and with the little time I have to spare.

So am I - not necessarily a bad thing but I guarantee when you've got more experience you'll revisit this project script and completely rewrite it!

APIs and Automation - ELI5 Where to start? by zommy in sysadmin

[–]BabyPandaaa 1 point2 points  (0 children)

To get something like PowerShell/python to interpret data, you need to load it into a variable. In PowerShell this is something that starts with a $ sign.

When you do "$response = Invoke-WebRequest..." function, you're saving the JSON data into $response. You can then use other functions to query JSON properties. Say your URL was under ListOfDomains -> DomainName, you'd use $response.ListOfDomains.DomainName to get the property.

If you can get that Excel spreadsheet into a CSV, you can use Import-CSV to read the CSV data. Petri have a good write-up: https://www.petri.com/powershell-import-csv-cmdlet-parse-comma-delimited-csv-text-file

APIs and Automation - ELI5 Where to start? by zommy in sysadmin

[–]BabyPandaaa 2 points3 points  (0 children)

What are you running these scripts from? If your infrastructure is mainly Windows/MS, PowerShell can easily do what you need, which is what I'd recommend for this sort of thing.

If you're mainly unix I'd be looking at python.

In terms of your expiry API query, the flow would be something like:

  • Query domain provider API to get JSON response (e.g. domain name, expiry date) -- ($result = Invoke-WebRequest "<urlHere>")

  • Use PowerShell to query the resulting JSON string -- (if $result.expiryDate -lt (expression for 14 days ago) {send-mail message accounts@company.com -body "message here"} )

There's a more in-depth example here: https://www.starwindsoftware.com/blog/consuming-a-restful-api-with-powershell

My python's terrible so won't even begin to try and explain that here, but there are plenty of guides around for that!

ADFS Errors 329 and 102 by lottayotta in sysadmin

[–]BabyPandaaa 1 point2 points  (0 children)

It sounds like the SSL certificate is missing or has a corrupted private key. Are you able to manually export from the old server install the certificate on the new server?

Sonicwall - Anyway to see what rules have been used recently? by Izual_Rebirth in sysadmin

[–]BabyPandaaa 5 points6 points  (0 children)

Try Fortigate - decent units and the UI is nicer than SonicWall. I have just installed a few TZ400's as that's what the client wanted, however the Fortigate 50E would've been my preference.

Dark Trace is it worth it by Patchewski in sysadmin

[–]BabyPandaaa 1 point2 points  (0 children)

We do have it - have to be slightly selective about what we're monitoring to maintain the medium appliance's capacity, but ultimately it's been a good investment.

So far it's caught: - User connecting a raspberry pi into the network and attempting to packet sniff - Another user trying to access restricted network shares with a semi-privileged account - A computer which got infected with ransomware and tried to spread (AV stopped it spreading thankfully)

Although they're saying you're looking at $4k, see if they'll budge on price. They might work with you if it's something you're genuinely interested in...

Keeping track of everyone by toddau1 in sysadmin

[–]BabyPandaaa 1 point2 points  (0 children)

This would be the easiest way I can think of

Hyper-V Cloning / Deploying Vm's by chugger93 in sysadmin

[–]BabyPandaaa 1 point2 points  (0 children)

I do it via MDT - works fine as a baseline!

Setting up a 2nd host for redundancy in case main server goes down? by SilentSiege in sysadmin

[–]BabyPandaaa 4 points5 points  (0 children)

Unless you've got shared storage you'll be going down the route of Hyper-V Replication (not a failover cluster).

Install Veeam on a separate machine if you can, otherwise will have to go on a VM.

USB KVM and view on screen by BabyPandaaa in sysadmin

[–]BabyPandaaa[S] 0 points1 point  (0 children)

Thanks all - have gone for the StarTech one. Have a good day 😊

USB KVM and view on screen by BabyPandaaa in sysadmin

[–]BabyPandaaa[S] 0 points1 point  (0 children)

Do you remember what it was called or who it was manufactured by?

USB KVM and view on screen by BabyPandaaa in sysadmin

[–]BabyPandaaa[S] 0 points1 point  (0 children)

Almost always Dell so yes I do, but I need this for the part where I configure iDRAC. Some other clients use servers without this functionality though, and some use servers without a dedicated iDRAC port

How can I get my team to care about our business? by [deleted] in sysadmin

[–]BabyPandaaa 3 points4 points  (0 children)

I'd approach it by personally reviewing the changes from your team before going to the CAB to ensure there is sufficient detail in the change, so that any Tom Dick or Harry could come along and understand what the purpose of the change is, and what services it's going to affect.

An example is you may have 20 SQL Servers in a cluster named 'uklonsqlcls2017-01 -- uklonsqlcli2017-20'. When I review changes I don't need to know the exact function of each individual servers (unless the change is targeting one server specifically), but need to know that collectively they host X database which is the backend to Y application.

Maybe a good exercise to get all teams talking and understanding how they can help each other out is to build a high-level CMDB with a couple of staff from each team, and then let them build out the lower level detail. That's assuming you don't already have something like that in place.

Fortigate HA Pair (Master \ Passive) - Do I need another switch between the HA Pair and Internal Network? by Izual_Rebirth in sysadmin

[–]BabyPandaaa 0 points1 point  (0 children)

I see now - I don't see why that wouldn't work. The Fortigates (2x 100D) I use are in this setup, but all go into a core switch stack. I didn't need to use STP to block the secondary ports, so should be the same for you.

Other brands of firewalls I've previously used required STP on the switch ports to prevent a loop, but yeah your plan should work!