Category: Networking

Why 2FA is Necessary for Business

Businesses are face an increasing number of cyber threats. To protect sensitive data and prevent hackers from gaining access, implementing stronger security measures is crucial. One such measure is 2-factor authentication (2FA). Let’s look at the importance and security benefits of 2FA for businesses.
 

Enhanced Account Security:

2FA adds an extra layer of security to the traditional username and password login process. By requiring users to provide a second form of authentication, such as a unique code sent to their mobile device, it significantly reduces the risk of hackers from gaining access. Even if a hacker manages to obtain a user’s password, they would still need the second factor to gain access.
 

Mitigation of Password-related Risks:

Passwords are often the weakest link in security systems. Many users tend to reuse passwords across multiple accounts or choose weak and easily guessable ones or re-use the same password while incrementally changing a digit or two. With 2FA, even if a password is compromised, the additional authentication factor acts as a safeguard, making it significantly harder for attackers to gain access.
 

Protection Against Phishing Attacks:

Phishing attacks, where attackers trick users into revealing their login credentials, are a common threat to businesses. 2FA provides an additional layer of defense against such attacks. Even if a user unknowingly falls victim to a phishing attempt and enters their credentials on a fake website, the second authentication factor would prevent the attacker from accessing the account.
 

Compliance with Industry Regulations:

Many industries, such as finance, healthcare, government contractors, and e-commerce, are subject to strict data protection regulations. Implementing 2FA helps businesses meet compliance requirements and avoid potential penalties. It demonstrates a commitment to safeguarding sensitive customer information and builds trust with clients.
 

Cost-Effective Security Measure:

Implementing 2FA does not require significant financial investment. Many 2FA solutions are readily available and can be easily integrated into existing systems. Considering the potential financial and brand reputation damage caused by a security breach, the cost of implementing 2FA is minimal compared to the benefits it provides.
 
In an era where cyber threats are constantly evolving, businesses must prioritize security measures to protect their valuable data. 2-factor authentication offers a simple yet effective way to do so. 

If your company is interested in implementing 2FA across the entire organization, then contact us for assistance.

Basic Setup of Ubiquiti Wireless Controller on Synology NAS

This is the third in a series that documents the Tier 3 / Co-Managed IT work we did to setup a wireless test bed for a Linux based scientific device. The testing environment included two different wireless network hardware types (Ubiquiti and Cisco). There was also a Synology device used for various purposes including hosting the Ubiquiti controller inside a Kubernetes container, providing certificate services, providing LDAP authentication, and providing RADIUS authentication. Each article will detail a separate piece of the project. This article shows the basic setup of Ubiquiti Wireless Controller as a Docker instance on the Synology.

Setup Synology for Docker Container

  1. Login to Synology via HTTP
  2. Open Package Manager
  3. Search for Docker & InstallSynology Docker Package
  4. Open Docker
  5. Click on Container tab
    • Click Create
    • Select the image just downloaded and click Next
    • Select Use the same network as Docker Host and click Next
    • Give the container a name
    • Enable resource limitations (increase memory for larger installations)
    • Enable auto-restart then click nextSynology Docker General Settings
    • Click on Advanced Settings
    • Add environment variables
      • BIND_PRIV = false
      • RUNAS_UID0 = falseSynology Docker Advanced Settings
  6. Click Add Folder
    • Highlight the Docker folder and click Create folder then create a Unifi folder and then highlight it and click Select Synology Docker Add Volume
    • Change Mount path to /unifi then Next
    • Click Done

Configure Ubiquiti Controller

  1. Login to new controller – https://[IPAddressofSynology]:8443/manage
  2. Name the Ubiquiti Controller and Check the agree to terms box then click Next
  3. Change to Advanced settings
  4. Turn off remote and Ubiquiti account
  5. Create administrator user
  6. Create password
  7. Create admin email then click Next
  8. Enable Auto Backup and click Next
  9. Skip device setup by clicking Next
  10. Skip Wifi setup by clicking Skip
  11. Change time zone if needed and Click Finish

Setup Wireless Access Point

  1. Connect access point to same network
  2. Adopt in controller
    • Find IP address of access point
    • SSH into access point
    • Login with defaults ubnt / ubnt
    • Type: set-inform https://[IPAddressofSynology]:8080/inform
  3. Login to Controller – https://[IPAddressofSynology]:8443/manage
    • Click on Devices on the left
    • Click on access point and choose Adopt

If your company has highly customized setup requirements that you need consulting for, then contact us for assistance.

Basic Setup of Synology NAS

This is the second in a series that documents the Tier 3 / Co-Managed IT work we did to setup a wireless test bed for a Linux based scientific device. The testing environment included two different wireless network hardware types (Ubiquiti and Cisco). There was also a Synology device used for various purposes including hosting the Ubiquiti controller inside a Kubernetes container, providing certificate services, providing LDAP authentication, and providing RADIUS authentication. Each article will detail a separate piece of the project. This article shows the basic setup of Cisco Wireless Controller.

Setup of Synology NAS

  1. Physically install hard drives into bays
  2. Plug into network
  3. Plug into power
  4. Find IP address by pinging ‘Diskstation’ on network
  5. Start web browser and connect to IP address
  6. Run Setup Wizard
  7. Install Synology OS on drives
  8. Wait for reboot
  9. Start setup
    • Give it a name
    • Create admin account / password
    • Install only important updates automatically
    • Sign-In to or Create Synology Account
    • Create quickconnect ID
    • Enable DSM backups
  10. Create storage pool
    • If it states that no drives are available – check under HDD/SSD to see if there are required firmware updates. Install all available.
    • Use SHR-2 RAID
    • Choose all drives to be in the RAID (not m.2 cache drive)
    • Use Max Allocated size
    • Use Btrfs file system
    • Click Apply
    • Click OK to erase all drives
  11. Open Package Center App
    • Accept terms of service
    • Update any Installed
    • Install LDAP Server and RADIUS Server
    • Close Package Manager

If your company has highly customized setup requirements that you need consulting for, then contact us for assistance.

Basic Setup of Cisco Wireless Controller

This is the first in a series that document the Tier 3 / Co-Managed IT work we did to setup a wireless test bed for a Linux based scientific device. The testing environment included two different wireless network hardware types (Ubiquiti and Cisco). There was also a Synology device used for various purposes including hosting the Ubiquiti controller inside a Kubernetes container, providing certificate services, providing LDAP authentication, and providing RADIUS authentication. Each article will detail a separate piece of the project. This article shows the basic setup of Cisco Wireless Controller.

Setup of Cisco Wireless Controller

  1. Plug -in ethernet of Computer to port 2 on controller
  2. Boot controller and wait for SYS light to go solid
  3. Open web browser to http://192.168.1.1
  4. Create admin username
  5. Create password
  6. Fill in the needed information:
    1. System nameManagement IP Subnet MaskDefault Gateway
    1. Click Next
  7. Fill in temporary information for wireless
    1. Network BSSIDCreate PassphraseEnter local DHCP server address
    1. Click Next
  8. Click Apply and wait for reboot
  9. Click on Commands tab
  10. Click on Set Time on the left-hand menu
  11. Change needed values
  12. Click Set Date and Time
  13. Click Save Configuration at the top

If your company has highly customized setup requirements that you need consulting for, then contact us for assistance.

A Medical Office’s Journey to the Cloud

Today we tell the story of a medical office’s journey to the cloud. This particular client was facing their server operating system reaching end of support (a HIPAA violation) in the near future. They had begun by looking at their electronic medical records software company’s online offering, which didn’t have all the functionality of their on-premises software and was very expensive (this is typical).


They next decided to look into moving their current on-premises software into the cloud and we were asked to help with the testing. We determined that it would be best to move the file portion of the server to SharePoint / OneDrive to increase their mobility and flexibility. We also determined that it would be best to move them away from on premises Active Directory into Azure Active Directory / Intune to allow authentication and security policies. Finally we began testing the on-premises software hosted on a server in Azure with a VPN connection to their office.


The SharePoint / OneDrive and Azure Active Directory portions went through with little issues. The server, however, was not as we had hoped. The Azure VPN connection was expensive due to it always being on and no way of turning it off outside of business hours. The performance of the SQL database that the on-premises software used was basically unusable. The other option would be to create virtual desktops on Azure for this purpose but the cost and functionality was not what the customer was hoping for.


This has lead them back to searching for an online EMR software that will meet all their requirements. This will be tough because most companies are good at some things, but not all things and compromises usually have to be made. Our hope is that this story is a lesson to other companies. The cloud may sound like the newest and best way to work, but the costs and functionality are often worse than expected.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

What every business has in common?

Every modern business has one thing in common – the internet.

Businesses are using computers, smart phones, tablets, etc. to connect to the internet for research, shopping, advertising, or any number of things. With a connection to the internet comes the need for routers, switches, wireless, and other network hardware to distribute internet connectivity across the company. There are malicious people on the internet that are setting traps and trying to break into companies which necessitate the use of tools like antivirus, internet filtering, spam filtering, and other protective measures. There are also people who work from their homes and need to have a way of tunneling safely into the network to use the resources there. 

All of this has to be managed by someone in the company or you can contract with a managed IT service provider. 

If your company needs help managing all the things connected to your internet, then contact us for assistance.

Setup Azure to Araknis IPSec VPN

Had a local medial office want to move their current server into the cloud and because they are already an Office 365 customer, I chose to use Azure for their Virtual Machine. I helped them setup Azure to Araknis IPSec VPN to connect their headquarters to the hosted server. This tutorial will go into detail about the creation of this tunnel starting with the Microsoft Azure side first using Resource Manager. It will be using the following parameters:

  • VNet Name: TestNetwork
  • Address Space: 10.10.0.0/16
  • Subnets:
    • Primary: 10.10.10.0/24
    • GatewaySubnet: 10.10.0.0/24
  • Resource Group: TestResourceGroup
  • Location: West US
  • DNS Server: Azure Default
  • Gateway Name: TestVPNGateway
  • Public IP: TestVPNGatewayIP
  • VPN Type: Route-based
  • Connection Type: Site-to-site (IPsec)
  • Gateway Type: VPN
  • Local Network Gateway Name: TestSite
  • Local Subnet: 10.20.20.0/24
  • Connection Name: VPNtoTestSite

Configure an Azure VPN gateway

This part takes the longest, so it should be done first:

  • Click on the “+” icon at the top left hand side of the Resource Manager, then search for “Virtual Network Gateway” and click on the “Create” button.
  • Give the Virtual Network Gateway a name
  • Select matching Region to where Azure resources are located
  • Leave Gateway & VPN type the defaults
  • Choose a SKU <- These have changed since the article was created, so my “standard” now is WpnGw1 with Active / Active turned off (this is a good balance of performance and cost)
  • Choose or create a local network (not covered here, but must contain Gateway Subnet) that matches internal resources
  • Choose or create a Public IP Address
  • Leave the remaining values as their defaults and then click the “Create” button. (Please note the reminder that this takes 45 minutes to create!)Azure Virtual Network Gateway

Configure an Azure Local Network Gateway

This is a reference to your on-premise network so that subnets can pass traffic:

  • Click on the “+” icon at the top left hand side of the Resource Manager, then search for “Local Network Gateway” and click on the “Create” button.
  • Give the Local Network Gateway a name
  • Select matching Region to where Azure resources are located
  • Specify the external IP address of the local on-premise site
  • Specify the on-premise address space (subnet)
  • Leave the remaining values as their defaults and then click the “Create” button.
  • Azure Local Network Gateway

Configure an Azure VPN Connection

This will create the tunnel from Azure to the on-premise site:

  • Click on the “+” icon at the top left hand side of the Resource Manager, then search for “Connection” and click on the “Create” button.
  • Choose “Site-to-site (IPSec)” as the connection type
  • Give the Connection a name
  • Select matching Region to where Azure resources are located
  • Leave the remaining values as their defaults and then click the “OK” button. On the summary screen click on the “OK” button to create the connection.Azure Connection Basics
  • Choose the newly created Virtual Network Gateway
  • Choose the newly created Local Network Gateway
  • Specify a shared key
  • Leave the remaining values as their defaults and click the “Create” button.
  • Azure Connection Settings

This completes the setup of the Azure side of the VPN tunnel. Now to work on the Ubiquiti USG side.

Configuring an Araknis IPSec VPN Network

  • Connect to Araknis router (need at least a 310 for this to work)
  • Click on Advanced > VPN
  • Scroll down to IPSec and click add new tunnel
  • Fill in the Remote IP address of the Azure VPN Gateway
  • Araknis VPN Settings
  • Fill in the Remote Subnet Mask
  • Araknis VPN Settings
  • Make the following changes to IPSec Setup
  • Araknis VPN Settings

That is all there is to it. If your company is currently using either Microsoft Azure or Araknis routers and would like a VPN created, then contact us for assistance.

Zero Trust – Network Security

This is the ninth in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on Network Security. 

Network Security

Network Security is having the proper hardware and configuration of that hardware in place to protect the business network. This configuration includes segmenting network traffic to keep specific types of traffic, like guest devices, separate from traffic of business devices. It also includes keeping outsiders out of the network and detecting when they have breached security measures. Here are some questions to ask:

  • Do you have a business class router / firewall?
  • Do you have business class switches and access points that support segmentation?
  • Is your network configured to segment business traffic from guest traffic?
  • Are devices like VoIP phones and network cameras on their own network?
  • Is geo-location blocking turned on for non-essential countries?
  • Is network traffic being analyzed for suspicious activity?
  • Do you filter internet traffic?
  • Can your network detect and respond to a breach?

If your company is wanting to lock down network security, then contact us for assistance.

Benefits of Wi-Fi 6e 

VoIP Telephone System - Grants Pass, OR

Wi-Fi technology is ingrained into our everyday lives WE COLLECTIVELY STREAM more movies and TV shows, play more online games, and make more video calls than ever before, and all this activity puts a serious strain on our Wi-Fi networks. Wi-Fi 6e has various features to improve the efficiency and data of your wireless network and reduce latency. the latest Wi-Fi 6e standards offers a range of benefits, including faster and more reliable access. So, what is Wi-Fi 6e and what are some of the benefits?

Wi-Fi 6e explained 

Existing technologies operate on two frequencies 2.4 GHz and 5GHz which have become more congested over time; Wi-Fi 6e adds access to a third frequency, 6GHz. now wireless devices can also use the 6GHz band. And the 6GHz band opens up the opportunity for higher transfer speeds. On top of that, currently there are about four 160 MHz-wide channels with normal Wi-Fi this 6GHz band brings with it seven 160 MHz-wide channels, More available channels mean more available spectrum for Wi-Fi service “and less overlap between networks in crowded areas like apartment complexes or offices,”. with less overlap and congestion you are able to connect more devices with the same efficiency expectation. Additionally there have been security improvements with Wi-Fi 6E that puts the burden on the router, rather than you, to secure connections between your devices. WPA3 is mandatory for all Wi-Fi 6 certified devices, which provides the latest security and authentication protocols. 

Summary of Benefits 

  • Faster, more reliable connection
  • Transmits data faster with less interference. 
  • You don’t have to compete with traffic from other devices or networks.
  • Security improvements making it more secure and harder to hack 
  • Accommodates more connected devices

If your company is looking to upgrade the wireless coverage in your office, whole building, or entire business complex, then contact us to evaluate your WiFi needs.

Surviving a Flood

Had a client walk into their office to find it flooded with an inch and a half of water on the ground and it got me thinking about what could be done to mitigate the risks associated with this sort of “Act of God” at the office.

Can’t Stop the Flood

It goes without saying that there is no way to realistically prevent a flood besides the usual preventative building maintenance that most businesses are not in control of anyways. It makes sense then to choose an office space where the owner is into proactive repairs on the building, even if it costs a little extra per month. It would also be good to talk to your business insurance provider to make sure that such Acts of God are covered. Clean-up and recovery though usually covered by the building owner can get expensive if your contract doesn’t cover it. 

Prepare for the Worst

Practically speaking it may not be possible to keep computers out of the water in a flood. At this particular client we did have the computers up on blocks just in case of this very thing. All network equipment should also be in a safe place, ideally in a locked cabinet high off the ground.

Recovery can happen

If the worst does happen, the first thing to do is shut off the electricity to the building. After that take careful inventory of all that is plugged in and remove it from electrical outlets. If equipment is wet, keep it unplugged for a couple days in a dry environment to make sure it is free from moisture. Once sure it is dry, plug in the equipment and test whether it will come back online. If anything was submerged in water, it is best to plan on replacing it as most water has minerals in it that will stick to components in the computer and could cause and electrical short.

If your company is not ready for the worst, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2025 - Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

Error: Contact form not found.

And God will generously provide all you need. Then you will always have everything you need and plenty left over to share with others. As the Scriptures say,
“They share freely and give generously to the poor. Their good deeds will be remembered forever.”
For God is the one who provides seed for the farmer and then bread to eat. In the same way, he will provide and increase your resources and then produce a great harvest of generosity in you. - 2 Corinthians 9:8-10