Category: Networking

Technician performing cable certification testing on business network cabling

Cable Certification Importance

Reading through a whitepaper from an industry leader in structured cable certification and realized the importance and cost savings that comes from the certification process. Here is a summation of their findings:

Cable Certification Less Expensive Than Downtime

Running the numbers against enterprise sized environments showed that for an average cost of $750 worth of cable certification and repair the business was able to insure themselves against $67,000 of downtime. Consider how much each hour of downtime is worth to your organization then think about how much even 8 hours of downtime per year will cost you – that is the difference between 99.9% and 99.99% uptime.

Product Warranties Don’t Cover Workmanship

Even if you have product warranties from the manufactures of your network equipment and cable there is no guarantee as to the quality of the installation without cable certification.

Certification & Re-certification

The idea here is to future proof your business by making sure that cabling exceeds the current standards. This often can lead to extended return on investment (ROI) when newer technology standards are introduced and the current cabling can go through cable certification again to prove that it meets those standards. For example many Cat6 installations that originally were thought to be running at 1Gbps have been proven to run at 10Gbps over short distances thereby saving the company money and expanding their network bandwidth.

Cable Certification Saves Money

Landlords are mentioned here as a direct beneficiary of the cost savings inherent in cable certification. The costs of certifying a building full of cable prior to new tenants moving in is minimal in comparison with the cost of running all new wires – often only 5-10% of the cost.

Reducing Waste

Instead of demolishing current cable infrastructure to comply with National Electric Code standards of removing abandoned cabling, why not have the cable certification done to mark it for future use? It saves money and the environment

Unscrupulous Installers

No-name copper vendors are putting out so-called Cat5 or Cat6 cables that are manufacture outside the country with inferior goods and facilities. This is then used by unscrupulous installers to lower their overall costs whether or not they pass that savings on to the client. To avoid the use of these inferior cables make sure to only use vendors that supply cable certification for their work.

If your company is unsure about their current structured cable infrastructure or is looking to have new network cabling done, then contact us for assistance.

Missing Western Digital MyCloud Drive

Recently took over an account from another tech and was informed by the client that their Western Digital MyCloud drive was unreachable and they had not been able to access their files shared their with the computers in the office for some time. Since the MyCloud is just a simplified Network Attached Storage (NAS) device for the home / SMB market, I decided to go onsite and find out what was causing the issue.

How to find a missing MyCloud

I first investigated the shortcuts that were sitting on the desktop to figure out what was going wrong with the drive or if there were some bread crumbs as to where it was previously. Found one called Dashboard which pointed to an IP address on their current subnet that went nowhere – this was likely the former IP address of the device. Found a shortcut to the “Public” folder which pointed to an IP address that was on another subnet than theirs – this was likely from a setup before another network change and had not been removed since then. Found another shortcut to the “Public” folder which pointed to the same IP address on their current network as the Dashboard shortcut, so this confirmed that this was the last known IP address.

Ran a network scan using my personal favorite, SoftPerfect Network Scanner, to discover what was on the current subnet and if the MyCloud was still functional at another IP address. Found that the IP address for the device had changed to another similar address, so figured that it was getting its IP address from DHCP and when the old address lease ran out it just grabbed another one from the router. Checked the router and found that indeed the DHCP table contained the IP address for the device, so added a DHCP reservation to the router for that devices MAC address mapping it to the old IP address to make the broken shortcuts work again. Tested opening the dashboard and “Public” folders successfully which thankfully still had all of their information intact.

The final thing to do was to correctly set permissions within the device for each of the users and corresponding user folders within the device to allow them to connect and “backup” their documents to the device like they were used to. Although I would not recommend using this type of device to any of my clients, it was good to get this company backup up and running successfully. If your company is using Western Digital MyCloud drive for shared file access or are considering adding file shares to your network, then contact us for assistance.

Remote Desktop Network Printer Redirection

Found myself setting up a client with a remote desktop connection to a local workstation from a remote site to use their Client Management System (CMS). Even after successfully getting them connected to the local workstation and warning them there would be issues with using their network printer at the remote office, they stated it would be just fine. Found out later indeed they were not able to use the printer successfully due to the inherent issue with network printers across a Remote Desktop Connection. Found this little workaround to provide Remote Desktop network printer redirection in the Microsoft forums:

Remote Desktop network printer redirection workaround

Click on the Start button and open Control Panel then open “Devices and Printers”
Right click on the network printer that needs to be redirected and choose “Printer Properties”
Click on the Ports tab and put a check next to “Enable printer pooling” and next to the “LPT1:” in the list then click the OK button to finish.
Click on the Start button and open Remote Desktop Connection then click on the “Local Resources” tab.
Click on the “More…” button at the bottom then put a check next to the Ports item then click the OK button.
Make sure to go back to the General tab and click on save before clicking on the Connect button.
Once connected download and install the needed print driver but do not create the printer itself yet.
Inside the Remote Desktop connected computer click on the Start button and open Control Panel then open “Devices and Printer”
Click on the Add Printer button at the top then click on the “The printer that I want isn’t listed” link at the bottom of the window that opens.
Click on the radio selection next to “Add a local printer or network printer with manual settings” then click on the next button.
Click on the list “Use an existing port” and choose “TS001:” which usually corresponds to the LPT1: port redirection, but it may take some trial and error going through this list later to figure out which one it is.
Search through the list of drivers to pick the one associated with the one being connected then click on the Next button.
If requested, choose to “Replace the current driver” and click on the Next button.
Change the name as needed and click on the Next button.
Choose “Do not share this printer” and click on the Next button.
Test the printer by clicking on “Print a test page” then click the Finish button.

If the printer does not print then open the printer properties on the Remote Desktop connected computer and change the port to TS002: on the Ports tab, click Apply then click “Print a test page” on the General tab to test again. Repeat down the list until the correct port is found. If your company is using Remote Desktop Network Printer Redirection or need help getting the network connected printers working properly, then contact us for assistance.

Multi-user Switching Quickbooks H202 Error

Had a client with a simple peer-to-peer network of three machines that was using Quickbooks for their accounting and customer database. Their main bookkeeper’s workstation was the “file server” for their network with the rest as “client” workstations on their network. This allowed the secretary to access the customer data while scanning in contracts. Regularly these computers would become disconnected and their secretary was unable to connect properly. It would give a Quickbooks H202 error when trying to open across the network. This was causing multiple files to be created and their bookkeeper was often contacted to “fix” the problem. When I got an opportunity to work on their network there were several issues that needed addressing to properly fix the issue:

In a peer-to-peer environment, hosting should only be enabled on the hosting computer (file server).

On each workstation (not the file server), open QuickBooks and choose File Utilities.
If you see Host Multi-User Access on the list, this computer is not hosting the company file and you can go to the next computer. Note: Don’t change anything if you see Host Multi User Access at your workstation.
If you see Stop Hosting Multi-User Access, select that option.

Click Yes to confirm. In the Company File Must Be Closed window, click Yes.
Repeat steps 1-4 on each computer.

Verify QuickBooks Services

When working with QuickBooks in a multi-user mode, QuickBooks services need to be running on the file server computer.

Make sure the QuickBooksDBXX (XX represents the year of QuickBooks) and QBCFMonitorService services are started.
1. Click the Windows Start button.
2. Press the Windows key + R to bring up the run box.
3. Type services.msc and press Enter.
In the services window, scroll down and look for the QuickBooksDBXX service. Note: XX represents the year of QuickBooks you are troubleshooting.
- If you do not see the QuickBooksDBXX service, open QuickBooks, go to File– Utilities– and make sure hosting is enabled (it should say Stop Hosting Multi User access. If it says Host Multi User mode, click it to enable hosting on the server)
Double-click the QuickBooksDBXX service and make sure the Startup Type is set to Automatic and service status is Started.
Click the Recovery tab.
Click the drop-down menu for First failure and select Restart the Service. This will automatically restart the QuickBooksDB service if it fails. Do the same for Second failure and Subsequent failures:
Click OK to save the changes.
Repeat steps 1-6 above for the QBCFMonitorService.
Open QuickBooks in multi-user mode on each affected workstation. If the issue persists, try to make sure the QuickBooksDBXX service is a member of the administrator group and has the appropriate permissions.

Open the Network Ports QuickBooks Uses to Transmit Data

Perform the following on each computer:

Access Windows Firewall Settings
- For Windows 8
  1. Hover the mouse in the upper or lower right-hand corners and select Settings
  2. Click on Control Panel and choose Windows Firewall
  3. On the left, click on Advanced Settings
- For Windows Vista/Windows 7/Windows Server 2008
  1. Click the Start menu and enter firewall.
  2. Click on Windows Firewall with Advanced Security.
On the left, right-click on Outbound Rules, and choose New Rule
- Note (Windows Vista/Windows 7/Windows Server 2008): It’s a little tricky, you have to left-click Outbound Rules first to highlight it, then right-click on it.
Choose Ports and click Next.
Select TCP and in the specific local ports box, enter in the following ports:
- QuickBooks 2016: 8019, 56726, 55368-55372
- QuickBooks 2015: 8019, 56725, 55363-55367
- QuickBooks 2014: 8019, 56724, 55358-55362
- QuickBooks 2013: 8019, 56723, 55353-55357
Click Next and select Allow the Connection.
Click Next to enter a name in the name field (for example, “QuickBooks ports” ) and click Finish.
Repeat steps 1-5 for the Inbound Rules.
Open QuickBooks in multi-user mode.
- If you have a third party antivirus/firewall program, you may need to configure any other firewall or antivirus software.
- Note: For a temporary solution, you may disable the anti-virus/firewall program to identify it as a problem and make sure to re-enable it when you’re done with the test. If the error persists, continue to step 3 (Ping the Server Computer).

Once these three items are configured properly on each of the network workstations then there should be no problems with connectivity or get any further Quickbooks H202 errors – that is of course as long as the “file server” workstation is not turned off or allowed to go to sleep. Also the file cannot be switched to single user mode on any computer unless it is then set back to multi-user mode once advanced configuration is done. If your company is using Quickbooks for your accounting or customer database and need help getting the network connected to the file, then contact us for assistance.

Configure Multiple DHCP Option 66 Settings

Recently ran into an issue where a company wanted to use multiple types of VoIP phones that required seperate settings to download their configuration with a vendor – this is usually done in a homogeneous environment via DHCP option 66 settings. (Option 66 is part of IETF RFC 2132 which states that this option uses FQDN or IP address to point to a TFTP server.) In this particular setup only one VoIP phone vendor at a time could be specified in the option 66, so custom settings were going to be needed to make all the other vendors phones work properly. Found that this could be done via DHCP reservation on either their Windows Server 2012 R2 Standard or on their Cisco 871w router, but I am sure their are ways to do it on other vendors equipment (which is outside the scope of this article). So here is how to configure the

Windows Server DHCP Option 66 Reservation

Turn the phone on its back and record the MAC address of the device.
Start the DHCP administrative tool on the server.
Expand the tree into the IPv4 then into the Scope needing the reservation.
Right Click on Reservations and choose “New Reservation…”
Give the new reservation a name, specify IP address and MAC address previously recorded.
Right click on the new reservation and choose Configure Options.
In the Reservation options scroll down to 066 Boot Server Host Name and enter the URL or IP of the vendors configuration server.
Make sure the vendor has reset the authorization token and factory reset the phone to pull the new reservation and configuration files.

Cisco 800 Series DHCP Option 66 Reservation Setup

Something to remember is that each reservation is treated as its own DHCP pool by the router. (I recommend exporting the configuration file to a local workstation and manually editting if there are more than a couple edits to make.)

Login to router and enter configuration terminal mode:

Router#configure terminal
Enter the name of the DHCP pool as follows:

Router(config)#ip dhcp pool Pool_Name
Enter the IP address of the device:

Router(dhcp-config)#host 192.168.1.100 255.255.255.0
Enter the MAC address of the device:

Router(dhcp-config)# hardware-address AABB.CCDD.EEFF
Enter Option 66 information:

Router(dhcp-config)#option 66 ascii http://vendor.url/configuration.xml
Enter Default Gateway:

Router(dhcp-config)#default-router 192.168.1.1
Enter DNS servers:

Router(dhcp-config)#dns-server 8.8.8.8 8.8.4.4
Make sure to copy the running configuration to startup configuration:

Router(dhcp-config)#end
Router#copy running-config startup-config
Clear the current DHCP bindings to make sure the phone will grab the correct address:

Router#clear ip dhcp binding *
Make sure the vendor has reset the authorization token and factory reset the phone to pull the new reservation and configuration files.

That is all there is to it. Enjoy a multi-vendor VoIP environment. If you need help configuring your Windows Server or Cisco IOS based router please contact us for support.

Social Wifi Hotspot Router Drives Traffic

While investigating ambient music service for a business through Pandora for business, found this incredible new way for businesses to socially connect with the users of their free WiFi service. With Social Wifi using the Mood WiFi router setup properly users will be taken to a portal page upon connecting to the free WiFi system. This portal page asks for them to login via Facebook, Twitter, Instagram account or email address then for those who connect with social media are asked to like the business they are connecting at to gain access to the internet. This system brilliantly allows business to track who is using their internet service and deeply connect with them via social media. I could easily see this as a huge benefit for any small retail store or restaurant wanting to expand their advertising dollar with a very small budget ($35 per month).

RDP Gateway NULL SID errors

Recently converted a client’s Windows Standard 2012 R2 terminal server into a Remote Desktop Protocol (RDP) Gateway server so that remote users could connect to their workstations inside the corporate network. (The details of how to do this properly will follow soon in another post.) Once the setup was completed it was time to test the connectivity as follows:

Testing RDP Connectivity

Log into a remote workstation
Open Microsoft Terminal Services Client (MSTSC)
Type in the Computer name and User name into the General tab:
Click on the Advanced tab and then on the Settings… button.
Choose Use these RD Gateway server settings then type in the external URL of the RDP Gateway
Choose Bypass RD Gateway server for local addresses
Choose Use my RD Gateway credentials for the remote computer then click OK
Should then be able to click Connect to tunnel into that workstation

Issues with NULL SID as follows:

Getting errors during login process about inability to connect, noticed that it allowed for credentials at RDP Gateway but then failed when trying to login to local worksations.
Attempted to connect from machines without the KB2592687 and KB2830477 installed, but same errors occurred.
Checked the event logs for the local workstation and found Event ID #4625 NULL SID errors. Which should have pointed to issues with authentication.
Tested NTLMv2 login issues via changing the following registry entry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] – LMCompatibilityLevel set above 3
Did the same thing via Group Policy using the following setting:

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options – “Network security: LAN Manager authentication level” set to Send NTLMv2 response only
Finally narrowed it down to NTP settings on the router not being set and mismatch of time.

Securing RingCentral via Juniper SRX

Recently wrestled with a Juniper SRX 220 router that a client needed help with securing RingCentral on. This entailed creating port forwarding rules for specific secure port ranges for TLS transport and linking those with rules for specific IP ranges belonging to RingCentral servers. Here are the specific lines of code that were used to make this connection possible (I am also throwing in the CoS settings used to shape traffic for good measure):

Setting to configure Juniper SRX for RingCentral

class-of-service classifiers dscp TRAFFIC_CLASSIFIER import default
class-of-service classifiers dscp TRAFFIC_CLASSIFIER forwarding-class PHONE_QOS_CLASS loss-priority low code-points 101110

class-of-service forwarding-classes queue 0 PHONE_QOS_CLASS
class-of-service forwarding-classes queue 1 Best_Effort_Class

class-of-service interfaces ge-0/0/0 scheduler-map WAN_SCHEDULE_MAP
class-of-service interfaces ge-0/0/0 unit 0 classifiers dscp TRAFFIC_CLASSIFIER

class-of-service scheduler-maps WAN_SCHEDULE_MAP forwarding-class PHONE_QOS_CLASS scheduler PHONE_SCHEDULER
class-of-service scheduler-maps WAN_SCHEDULE_MAP forwarding-class Best_Effort_Class scheduler BE_SCHEDULER

class-of-service schedulers PHONE_SCHEDULER transmit-rate percent 20
class-of-service schedulers PHONE_SCHEDULER buffer-size percent 20
class-of-service schedulers PHONE_SCHEDULER priority strict-high

class-of-service schedulers BE_SCHEDULER transmit-rate remainder

security alg sip disable

security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT match source-address RingCentral_IP1
security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT match destination-address any
security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT match application RingCentral
security policies from-zone Internet to-zone LAN policy RingCentral_IP1_NAT then permit

security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT match source-address RingCentral_IP2
security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT match destination-address any
security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT match application RingCentral
security policies from-zone Internet to-zone LAN policy RingCentral_IP2_NAT then permit

security zones security-zone Internet address-book address RingCentral_IP1 199.255.120.0/22
security zones security-zone Internet address-book address RingCentral_IP2 199.68.212.0/22

applications application RingCentral term Mobile_App_Media destination-port 4000-5000 protocol udp
applications application RingCentral term Phone_Registration_UDP destination-port 5060-6000 protocol udp
applications application RingCentral term Phone_Registration_TCP destination-port 5060-6000 protocol tcp
applications application RingCentral term RTP_SRTP_Softphone1 destination-port 8000-8200 protocol udp
applications application RingCentral term RC_Meeting_Signaling_UDP destination-port 8801-8802 protocol udp
applications application RingCentral term RC_Meeting_Signaling_TCP destination-port 8801-8802 protocol tcp
applications application RingCentral term RTP_SRTP_Deskphone destination-port 16384-16482 protocol udp
applications application RingCentral term RTP_SRTP_Softphone2 destination-port 20000-60000 protocol udp

This should be everything unless you have custom firewall filters to lock down management access or something else like that. Please feel free to contact us if you need any help configuring either your RingCentral account or Juniper routers or switches.

UmbreCrypt ransomware encrypting files on Terminal Server RDP—MSP prevention strategies for secure networks.

UmbreCrypt RansomWare Hits Terminal Server

This one scares me to read about. A new variant of ransomware called UmbreCrypt RansomWare is out there that is getting into business networks via hacking of terminal servers. This is even more reason to use the best practice of connecting to a Virtual Private Network (VPN) before connecting to your company terminal server. Please take the time to read this article from BleepingComputer.com to find out the frightening details. Feel free to call or email us to discuss how to proactively protect your business computer network with managed antivirus and offsite backups. Schedule a full network security audit to determine just how vulnerable your systems are and to determine what can be done to mitigate the risks.

ScreenConnect Remote Access Tool

I have had the privilege of using a new remote support tool called ScreenConnect which was recently acquired. This tool has all the major features of other remote support tools including a built in screen annotation feature and OCR capability that feeds into the built in research tool. Looking forward to training and trying all the features of this wonderful new software.