uniWIKI - User contributions [en]

Information Systems:Automatic Email Manager

2025-05-01T18:26:10Z

Danielc: /* Overview */

==Overview==

Automatic Email Manager refers to software that periodically checks mailboxes (inboxes) and performs actions. It was acquired primarily to facilitate an important part of the SRFax workflow [http://owl.unipharm.local/mediawiki/index.php/Information_Systems:SRFax_(desktop_faxing)_Administration#Automatic_Email_Manager (the auto-printing of inbound faxes)], but it is a generic utility that can be used for other purposes.

The software is installed on (172.30.18.17), under a perpetual license that was purchased from their site in May, 2018.

Your license name is: admin@unipharm.com
The registration number is: 156285579-5619449231T-8263123240445380

==Configuration==
The software should be intuitive to any technical admin and does not require elaborate documentation. "Your Accounts" contains the emails being checked. "Actions" contains the actions. RTFM for the rest.

The monitored emails are (@unipharm.com):
* accountingautoprint
* faxangelac
* faxelaho
* faxreceiving
* faxrong
* faxstein
* datamon

Note: These target email addresses are MDaemon accounts.

==Additional Notes==
* A second use of this software is for Accounting to forward emails with many attached PDFs to an AEM email to autoprint the attachements on that printer.
* Another use for this is to save attachments from emails received on the Data Monitor account (for Integrator) to a folder.

[[Category: Email]]

Information Systems:CheqMaster

2025-03-13T16:17:29Z

Danielc:

=Overview=
Cheque Master a.k.a. Chequemaster is used to print cheques in A/P.

We do not print cheques on the i (i.e ASW); instead we use a PC package that prints as well as keeping a cheque register. The cheque is generated by ASW, but instead of printing, the spool file is sent to the IFS, where Cheque Master can read and process it. When completed, the file is moved to an archive folder.

==Technical Support==

Michael Guenzel (pronounced Gun zel, accent on second syllable)
VisionCraft
Suite 1600 Sun Life Plaza
144 - 4th Avenue SW
Calgary, Alberta, Canada T2P 3N4
Tel: (403) 232-6080 or (800) 265-6080
Fax: (403) 547-6213
mguenzel@visioncraft.com

==iSeries Setup==

Created an outq named CHEQUE in library QUSRSYS, which is not attached to a printer, but will be used to store the spool file until the cheques have printed.

Created a folder named ChqMaster in the IFS, that contains the VISION programs, cheque printing files, and an archive folder of completed cheque files.

Created a data file named APCHEQUE, that the spool files will be copied into.

Changed the RPGLE program FLR128 (Cheque printout - Blank stock) to put the cheque spool file into the outq CHEQUE, with a status of HOLD.

Changed the CLLE program FLC128 (Cheque printout – Blank stock) to copy the spool file to the file APCHEQUE, and then to ChqMaster in the IFS.

==Cheque Printer==
The cheque printer is an HP LaserJet printer capable of printing MICR font. It is served on the network by superserver as '''chqprt'''. This device name is important for the program to recognize it.

Cheqmaster is set to print to port LPT2 (via a setting in General Administration). Since this is a physical port, the CHEQUES2 bat file that is used to start Cheqmaster issues a <code>net use</code> command to specify/spoof the network printer chqprt as existing on port LPT2.

==Signatures==

The signature tool (signature.exe) is on tech/common/iSeries/Vision AP Cheques/signature. However, as it is a .net application, it will not currently run from a network drive, so it must be (temporarily) copied to a local drive.

The first step is to print the Signature Template (the form to be used to scan in signatures). Load the signature tool, and press the template button. Select the printer, press Print, then OK.

Have the signing officers sign this sheet. Note that in our test, the signature had to be approximately a quarter of an inch in from the side borders. Scan the sheet as TIF, black and white, at 300 dpi.

Go back into the signature tool. Press the Graphic File Select button, highlight the scanned file, and press Open. The template will appear in the box to the left. Click on the black square to the upper left to select a signature.

The selected signature will appear in the Signature box to the right. Use the scroll bars to center it between the lines.

Go to the Signature ID box and select either the Top or Bottom Signature. Press the Output File Select button. The selections will be automatically set for current directory, with the correct file name for the chosen signature ID, and the correct type. Press Save. Note, however, that this does NOT save the object; it just does the preparation. Press the Save button in the lower right corner to write the selected output file.

Repeat for both the top and bottom signature. When complete, copy visionB.bin and visionT.bin to the finance/vision folder on the iSeries.

It is possible to adjust the positions of the signatures and the micr line. Edit the text file MICR_ADJ.VCD to do this. The first pair of numbers is the X and Y co-ordinates of the micr line, the middle pair is the top signature, and the last pair is the bottom signature. ‘+’ means down or to the right. ‘-‘ is up or to the left. The unit of measure is 300th of an inch. Be very careful to make no other changes to this file.

==Print A/P Cheques==

Create A/P payment proposal, and do any maintenance necessary. When ready, do an option 8 – payment order. This will generate cheques, but will not print them. Instead the spool file will be copied to a shared folder, from where a PC cheque application will be able to print them.

Using explorer, double click on the drive mapped to finance/vision on BART. Key in your user ID and password to allow you to access the application and cheque printing files. This step only has to be done once a day.

Click on the A/P Cheque icon, and print cheques.

When the cheques have been successfully printed, go back to the iSeries. Confirm and update the A/P payment proposal.

Eventually, the outq and the APCHEQUES data file will have to be cleared.

==Potential Problems==

====Signatures====

If either the signatures or the micr line are not in the correct location, they can be moved. See the section on ‘Signatures’ for instructions on how to this.

====Load forms first====

Cheque forms must be loaded before printing starts. If the cheque printer does not have cheque forms loaded, nothing will print. When this happens, cheques must be voided and recreated.

====Error message when reading cheque file====

Message is “An unrecoverable error occurred during the preview scanning of the current file – call Vision Craft at 403-232-6000 for assistance”. Only the person that creates the cheque file in ASW can print it with ChqMaster. Whoever logged onto the computer (Windows logon) needs authority to the cheque files. Any IT person can go into iSeries Navigator and change the permissions on the cheque files.

====Disappearing data / signatures (really a printing issue)====

The transit # in the MICR line was changed in the test system to prepare for corporate clearing. Nancy turned off signatures, printed cheques from an old test file, and they looked fine. A few minutes later, when Mary printed production cheques, they came out blank, except for variable data -- no headings, no company name, no MICR line. We reset the printer, and Mary backed out of Chqmaster and went back in, but she still got an unusual message about signatures. We thought it was okay for her to proceed. Everything looked okay (including transit #), except the production cheques were missing signatures.

ANSWER: Mary got the message about the signatures because the file had already been printed. Chqmaster was flagging that a supervisor would need to be involved for signatures on the second run.

The reason the headings, company name, MICR line, etc. were dropped on Mary's first cheque run -- a coincidence of timing. Between Mary's pressing F1 and printing the cheques, Nancy logged out of Chqmaster. The act of logging out deleted all the data that Mary's F1 had set up. In short, the printer was made unready to receive Chqmaster data.

====User cannot print or connect to printer====
One of the steps in the CheqMaster routine is Initialize Printer, in which the program tries to connect to a printer on port LPT2. If this step doesn't work, the program was likely run via the executable, cheques.exe, rather than the batch file, which sets up the printer port first. Run CHEQUES2.bat instead.

==Edit MICR code using Chqmaster menu==

Log into Cheque Master. The program is cheques.exe, but the desktop icon is the easiest way to get in. Id and password are in CONFIGUR.VCD, which can be emailed to Michael Guenzel mguenzel@vision-craft.com in the event of a problem. First try restoring the contents of ChqMaster from the most recent backup.

From the Main Menu, F6 Administration

F3 Forms Maintenance: There will be 3 forms – CAD, USD, and Imp and three actions – add, change, delete.

F2 Change / Select form (CAD)

F8 Edit MICR line: overtype field to be changed (e.g., change branch transit number 00900 to 30120)

Press Enter

F9 repeatedly to get out

Print a test cheque

=Technical Notes=

* The cheque file is simply a text file with a .dat extension. It can be opened with Notepad to examine the cheque data for troubleshooting purposes. *DO NOT ALTER THE FILE UNDER ANY CIRCUMSTANCES.*
* The cheque file is placed on the IFS. Ensure that the user generating cheques has read/write privileges to the IFS share, otherwise the process will stop mid-way and no file will be available to print.
* Following the Windows 11 24H2 update, Legacy Console hosting has been disabled by default. However, Cheqmaster requires this feature to display correctly.
To resolve this, we need to log in with an administrator account on the affected user PCs and manually re-enable Legacy Console hosting by following these steps:
1. Open Start > Settings > System > Optional features
2. Click Add an optional feature
3. Search for Legacy Console hosting and install it

Tags: Cheque master, Chequemaster
[[Category: Software connected to IBM i]]

Information Systems:LAN infrastructure at uniPHARM

2024-10-09T21:36:49Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || Newvisionit! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| OTC-SWITCH || 172.30.16.20 || Cisco CBS350 || OTC-Picking Station || OTC-SWITCH || Gu20Da51NewEra ||
|-
| HABA-SWITCH || 172.30.16.21 || Cisco CBS350 || HABA-Picking Station || HABA-SWITCH || Gu20Da51NewEra ||
|-
| HHC-SWITCH || 172.30.16.26 || Cisco CBS350 || HHC-Picking Station || HHC-SWITCH || Gu20Da51NewEra ||
|-
| TEST-SWITCH || 172.30.16.23 || Cisco CBS350 || Outside Jeremy's office || TEST-SWITCH || Gu20Da51NewEra ||
|-
| DCTEST-SWITCH || 172.30.16.24 || Cisco CBS350 || Manager's Office in DC || DCTEST-SWITCH || Gu20Da51NewEra ||
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:Information Systems:MobiControl Cloud

2024-05-08T22:52:01Z

Danielc:

Step 1: Set Up Android Enterprise

Enroll in Android Enterprise: Access the Google Play Console and sign up for an Android Enterprise account if you haven't already.
Create an Enterprise Service Account: Generate an enterprise service account, which will serve as the link between your MobiControl Cloud instance and Android Enterprise.
Link MobiControl Cloud with Android Enterprise: Navigate to the Android Enterprise section within the MobiControl Cloud console and follow the provided instructions to integrate your account. Ensure to input the generated service account credentials for authentication.

Step 2: Configure Device Profiles

Create Device Configuration Profiles: Within the MobiControl Cloud console, proceed to the "Profiles" or "Configurations" section and initiate the creation of a new configuration profile tailored for your barcode scanners.
Configure General Settings: Establish fundamental device parameters such as Wi-Fi configurations, VPN settings, and passcode policies.
Define App Policies: Specify which applications are permissible or prohibited on the barcode scanners. Additionally, set up app configurations for specific apps if required.
Establish Network Policies: Customize network settings to enable secure connectivity of the barcode scanners with your organization's resources.
Set Restrictions: Implement restrictions on device functionalities and features in accordance with your organization's security and compliance mandates.

Step 3: Apply Profiles to Devices

Create Device Groups: Group your barcode scanner devices logically based on factors like departments, locations, or other relevant criteria.
Assign Profiles: Select the appropriate configuration profiles you created earlier and allocate them to the respective device groups containing the barcode scanners. This ensures that the designated settings and policies are applied uniformly across the devices within each group.

Recover

go to enter the recovery menu.

To do this on a SX5, while the device is powered off, long hold the power button + scan right until the first Datalogic logo appears, then release both.

From the recovery menu follow the instructions on screen to factory reset the device.

Information Systems:Information Systems:MobiControl Cloud

2024-05-07T23:27:03Z

Danielc: Created page with "Step 1: Set Up Android Enterprise Enroll in Android Enterprise: Access the Google Play Console and sign up for an Android Enterprise account if you haven't already. Create an..."

Information Systems:Building Power

2024-01-17T23:34:24Z

Danielc:

==Overview==
uniPHARM uses a generator to provide power in the event of a hydro outage. As the generator requires time to start and become ready, there is a large UPS in the server room that provides the room and select outlets throughout the building with continuous power.

==Design==
The attached JPG is a diagram of how electric power is organized in the Server room. The rack closest to the door and the middle rack are fed power from the Liebert UPS which filters power from Hydro or in the event of a Hydro failure, the generator. The rack farthest from the door containing the Power8 hardware has 2 different power feeds, one from the Liebert UPS and the other straight from Hydro. The second feed from Hydro plugs into the Power8 UPS at the bottom of that rack. The Power8 rack has each of its 2 feeds of power protected by a UPS so even if 1 UPS fails or drains, the other UPS will still provide electricity so that the Power8 will remain up. The only way that the Power8 system will go down is if both UPS's fail AND we have Hydro AND generator failure. Highly unlikely.
==UPS==
The main UPS is a Liebert APS unit (12kVA,with max capacity of 20kVA),The warranty included with the purchase of the device will expire in January 2026. There is an Eaton (400ish VA) UPS in the rack dedicated to the Power server and its related components (disk enclosure etc.)

The technical support number and account information for Liebert is on the top right side of the UPS.

Support for Liebert UPS
* Support phone number: 1-800-543-2378
* Support phone number (direct): +1-800-222-5877 (ext 2 for Liebert, ext 2 for Geist)
* Device model: Nfinity Power System
* Device serial number: 2316100003AU063

Support for Eaton UPS
* 1-800-356-5737

[[File:Server Room Power Diagram Jan 2015.jpg|400px]]

==Web page of Liebert APS UPS==
IP:172.30.18.228

Username: administrator

Password: NewVisionIT2051!

Alert message will send to: itgroup@unipharm.com

Zabbix polls this agent via SNMP - both voltage and battery stats can be viewed.

==Insights on the future of Liebert UPS==
(Jan 2024) Unipharm updated the UPS equipment, and the current model is Liebert APS. Considering that the equipment in the IT room may be migrated to the cloud in the future, we reduced the UPS battery from 20KVA to 12KVA. However, this model of equipment is scalable. If necessary in the future, we can purchase battery modules to expand it to 20KVA.

[[Category: Power, Alarms, and Monitoring]]

Information Systems:Building Power

2024-01-17T23:30:01Z

Danielc:

Information Systems:Building Power

2024-01-17T23:29:29Z

Danielc:

Information Systems:Building Power

2024-01-17T23:19:51Z

Danielc:

==Overview==
uniPHARM uses a generator to provide power in the event of a hydro outage. As the generator requires time to start and become ready, there is a large UPS in the server room that provides the room and select outlets throughout the building with continuous power.

==Design==
The attached JPG is a diagram of how electric power is organized in the Server room. The rack closest to the door and the middle rack are fed power from the Liebert UPS which filters power from Hydro or in the event of a Hydro failure, the generator. The rack farthest from the door containing the Power8 hardware has 2 different power feeds, one from the Liebert UPS and the other straight from Hydro. The second feed from Hydro plugs into the Power8 UPS at the bottom of that rack. The Power8 rack has each of its 2 feeds of power protected by a UPS so even if 1 UPS fails or drains, the other UPS will still provide electricity so that the Power8 will remain up. The only way that the Power8 system will go down is if both UPS's fail AND we have Hydro AND generator failure. Highly unlikely.
==UPS==
The main UPS is a Liebert Nfinity unit (12kVA,with max capacity of 20kVA). There is an Eaton (400ish VA) UPS in the rack dedicated to the Power server and its related components (disk enclosure etc.)

The technical support number and account information for Liebert is on the top right side of the UPS.

Support for Liebert UPS
* Support phone number: 1-800-543-2378
* Support phone number (direct): +1-800-222-5877 (ext 2 for Liebert, ext 2 for Geist)
* Device model: Nfinity Power System
* Device serial number: 2316100003AU063

Support for Eaton UPS
* 1-800-356-5737

[[File:Server Room Power Diagram Jan 2015.jpg|400px]]

==web page of Liebert UPS==
IP:172.30.18.228
Username: administrator
Password: NewVisionIT2051!

Zabbix polls this agent via SNMP - both voltage and battery stats can be viewed.

==Insights on the future of Liebert UPS==
(April 2021) This information originates from a conversation with both a tech support rep and a field agent (Jas) regarding the future of the UPS

* Usually, 15 years is when they advise customers to ''start planning'' for a replacement. The Liebert is on its 14th year as of April 2021.
* The Nfinity line of UPS that we have is end of life, but the units are still solid. The replacement product line is Liebert APS.
* The current UPS is a modular, 20kVA-capable unit with 12kVA configured across 4 batteries that are independent of each other (or at least the whole thing is resilient to a 1-2 battery failure).
* Apparently, a possible improvement that could be implemented during replacement (would likely incur additional cost) is to decouple the UPS bypass switch/mechanism from the UPS, to make it easier to switch to hydro. A panel similar to a circuit breaker would be installed, with a large switch that would flip the power to hydro or back through UPS (and then hydro). However, when the agent was on-site, they were able to put the UPS into bypass mode without any interruption (they do this during maintenance visits), so I'm not sure what advantage this new design would have.
* Lithium-ion is starting to be introduced, but is not feasible/available yet for the type of UPS we would be getting. This is bound to change rapidly. The advantage to this is obviously better battery tech and smaller footprint.

[[Category: Power, Alarms, and Monitoring]]

Information Systems:Building Power

2024-01-17T23:19:25Z

Danielc:

==Overview==
uniPHARM uses a generator to provide power in the event of a hydro outage. As the generator requires time to start and become ready, there is a large UPS in the server room that provides the room and select outlets throughout the building with continuous power.

==Design==
The attached JPG is a diagram of how electric power is organized in the Server room. The rack closest to the door and the middle rack are fed power from the Liebert UPS which filters power from Hydro or in the event of a Hydro failure, the generator. The rack farthest from the door containing the Power8 hardware has 2 different power feeds, one from the Liebert UPS and the other straight from Hydro. The second feed from Hydro plugs into the Power8 UPS at the bottom of that rack. The Power8 rack has each of its 2 feeds of power protected by a UPS so even if 1 UPS fails or drains, the other UPS will still provide electricity so that the Power8 will remain up. The only way that the Power8 system will go down is if both UPS's fail AND we have Hydro AND generator failure. Highly unlikely.
==UPS==
The main UPS is a Liebert Nfinity unit (12kVA,with max capacity of 20kVA). There is an Eaton (400ish VA) UPS in the rack dedicated to the Power server and its related components (disk enclosure etc.)

The technical support number and account information for Liebert is on the top right side of the UPS.

Support for Liebert UPS
* Support phone number: 1-800-543-2378
* Support phone number (direct): +1-800-222-5877 (ext 2 for Liebert, ext 2 for Geist)
* Device model: Nfinity Power System
* Device serial number: 2316100003AU063

Support for Eaton UPS
* 1-800-356-5737

[[File:Server Room Power Diagram Jan 2015.jpg|400px]]
[[File:Model-SN-Numbers-For-EatonUPS.jpg|400px]]

==web page of Liebert UPS==
IP:172.30.18.228
Username: administrator
Password: NewVisionIT2051!

Zabbix polls this agent via SNMP - both voltage and battery stats can be viewed.

==Insights on the future of Liebert UPS==
(April 2021) This information originates from a conversation with both a tech support rep and a field agent (Jas) regarding the future of the UPS

* Usually, 15 years is when they advise customers to ''start planning'' for a replacement. The Liebert is on its 14th year as of April 2021.
* The Nfinity line of UPS that we have is end of life, but the units are still solid. The replacement product line is Liebert APS.
* The current UPS is a modular, 20kVA-capable unit with 12kVA configured across 4 batteries that are independent of each other (or at least the whole thing is resilient to a 1-2 battery failure).
* Apparently, a possible improvement that could be implemented during replacement (would likely incur additional cost) is to decouple the UPS bypass switch/mechanism from the UPS, to make it easier to switch to hydro. A panel similar to a circuit breaker would be installed, with a large switch that would flip the power to hydro or back through UPS (and then hydro). However, when the agent was on-site, they were able to put the UPS into bypass mode without any interruption (they do this during maintenance visits), so I'm not sure what advantage this new design would have.
* Lithium-ion is starting to be introduced, but is not feasible/available yet for the type of UPS we would be getting. This is bound to change rapidly. The advantage to this is obviously better battery tech and smaller footprint.

[[Category: Power, Alarms, and Monitoring]]

Information Systems:LAN infrastructure at uniPHARM

2024-01-13T20:24:09Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || Newvisionit! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| OTC-SWITCH || 172.30.16.20 || Cisco CBS350 || OTC-Picking Station || OTC-SWITCH || Gu20Da51NewEra ||
|-
| HABA-SWITCH || 172.30.16.21 || Cisco CBS350 || HABA-Picking Station || HABA-SWITCH || Gu20Da51NewEra ||
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:Automatic Email Manager

2023-12-28T20:54:38Z

Danielc:

==Overview==

Automatic Email Manager refers to software that periodically checks mailboxes (inboxes) and performs actions. It was acquired primarily to facilitate an important part of the SRFax workflow [http://owl.unipharm.local/mediawiki/index.php/Information_Systems:SRFax_(desktop_faxing)_Administration#Automatic_Email_Manager (the auto-printing of inbound faxes)], but it is a generic utility that can be used for other purposes.

The software is installed on WDS(172.30.18.17), under a perpetual license that was purchased from their site in May, 2018.

Your license name is: admin@unipharm.com
The registration number is: 156285579-5619449231T-8263123240445380

==Configuration==
The software should be intuitive to any technical admin and does not require elaborate documentation. "Your Accounts" contains the emails being checked. "Actions" contains the actions. RTFM for the rest.

The monitored emails are (@unipharm.com):
* accountingautoprint
* faxangelac
* faxelaho
* faxreceiving
* faxrong
* faxstein
* datamon

Note: These target email addresses are MDaemon accounts.

==Additional Notes==
* A second use of this software is for Accounting to forward emails with many attached PDFs to an AEM email to autoprint the attachements on that printer.
* Another use for this is to save attachments from emails received on the Data Monitor account (for Integrator) to a folder.

[[Category: Email]]

Information Systems:3CX IP-PBX Administrator's Guide

2023-11-29T23:02:44Z

Danielc:

==Administration Portal==
3CX Administration Web Portal:

URL: https://3cx.unipharm.local:5001
Username: Administrator
Password: NewTechIS21!

==3CX Server Appliance==
Username: root
Password: NewVisionIT
==License==
Our 3CX license is '''Professional Perpetual''' with 16 simultaneous calls. Simultaneous calls includes internal/extension-to-extension calls, and both parked and queued calls. To date, our real world usage has never come close to reaching this. Nonetheless, the license can always be upgraded at a pro-rated cost.
::[[File:2021-03-31 11_25_29-3CX Phone System Management Console.png|400px]]

The license is renewed annually through TelData.

==Configuration==
===Extensions===
{| class="wikitable"
!colspan="3"|Noteworthy Extensions
|-
|Extension
|}

===SIP Trunks===
A SIP trunk is what allows a PBX to make and receive outbound calls. A SIP trunk is configured for 1 or more channels (simultaneous calls). 3CX has 2 SIP trunk configurations:
* [[Information Systems: ThinkTel SIP Trunk | ThinkTel SIP Trunk]]
* [[Information Systems: RingOffice SIP Trunk | RingOffice SIP Trunk]]

The ''SIP Trunks'' section in 3CX shows the following configuration:
:[[File:2021-03-31 11_51_37-3CX Phone System Management Console.png|400px]]
* The order is alphabetical and does not imply call routing precedence; that is defined in ''Outbound Rules''
* As seen in the figure, only RingOffice has Register information. This characteristic differentiates the two SIP trunks: the RingOffice trunk does ''registration-based'' authentication, while ThinkTel is IP-based. [https://www.3cx.com/docs/sip-trunk-registration-authentication/ Read more about this here.] There is a slight benefit to Register-based authentication in that you can tell when the connection goes down (Register failed).
* The number of Sim calls is defined manually. It should match the number of channels of the SIP trunk service, but can be used to control usage (e.g. putting a max of 3 when there are really 6 usable channels will cause 3CX to use the next available trunk for the 4th sim call).
* The WebMeeting bridge is an internal and automatically configured trunk (can be ignored).

===External Call Routing===
Calls to and from external numbers are routed according to the rules defined in the ''Inbound Rules'' and ''Outbound Rules'' sections. There are two main concepts:

* DID mapping in ''Inbound Rules''
* Call routes in ''Outbound Rules''

====Inbound Rules====
* DIDs (Direct Inward Dialing) are what we know as phone numbers (604-123-4567). They can be mapped in ''Inbound Rules'', either to local extensions, call queues, ring groups etc. Several DIDs can be mapped to the same internal target. For example, the toll-free and main company phone number map to the Customer Service call queue (technically the digital receptionist extension, but eventually routed there).
Part of the Inbound Rules page is shown here:
:[[File:2021-03-31 12_37_13-3CX Phone System Management Console.png|400px]]
====Outbound Rules====
:[[File:2021-03-31 12_19_44-3CX Phone System Management Console.png|400px]]
* Outbound rules specify the routes that outbound calls take. Notice that there is no 1:1 mapping of extensions to outbound routes. This is possible but absolutely unnecessary. Instead, the rules are catch-alls for other criteria (prefix, extension range).
* The prefix routes (9) are there to match the old phone system (where dialing 9 was necessary to "call out"). This is also still a common practice in many phone implementations, presumably as an extra validation measure for users i.e. to have users confirm their intent in dialing an external number.
* These rules are evaluated in order, from top down. This is why the 911 rule is at the top.

===Call flow===
Call flow refers to the path a call takes through the system. The settings in Inbound and Outbound Rules define part of the flow, but it can be

Most call flows are straightforward e.g. DID to local extension, voicemail if not available.

===Voicemail===
Voicemail works as it does in other phone systems - there is a message center that users access to listen and otherwise manage their messages. This extension is 999. There are however, serveral additional enhancements related to voicemail:

* Email notifications: Voicemails can be emailed, with a transcription of the text, an attached wav file of the audio message, or both. This is set per extension and is disabled by default.
* Voicemail transcription: Voicemail transcription transcribes voice messages to text so users can read instead of listen to the audio message. The functionality is set up system-wide in the 3CX settings, however, it needs to be enabled per-extension (for those that want it). It uses the Voice-to-Text service within Google Cloud Platform, and is billable monthly past the first 60 minutes (every month) of transcribed audio.

====Customer Service Voicemail====
Extension ''501'' is used solely for

====Google cloud services (GCP) integration====
3CX uses the following Google Cloud Platform services to provide special features:
* Firebase: Push notifications for 3CX mobile app ('''Android''' app only, Apple uses its own APNS)
* Cloud Speech API: Voicemail transcription (voice-to-text)

GCP Web Portal access:

URL: https://console.cloud.google.com/
Username: root@unipharm.com (uniPHARM Google account)
Password: NewVisionIT
Project name: UWD 3CX (use dropdown to select project)

See the Billing section for Cloud Speech API billing. GCP gives a $400 credit for the first year, therefore during this first year, when looking at the billing, "One-time credits" may need to be toggled to see the actual billed usage that we would have paid.

Firebase can be viewed in the section of the same name. However, integration with 3CX is just an API token to use the PUSH notification service, so this doesn't need regular maintenance unless changing the token.

===Other Notes===
====Backup====
*( 3CX is being backed up to: <code>smb://superserver.unipharm.local/Tech/common/ConfigBackups/3CX</code>. It should be here <code>\\superserver.unipharm.local\Tech\Logs And Backups</code>, but spaces in the backup location path are not allowed (at least for SMB backups). This should be tweaked in the future. The last 20 backups are kept (auto-rotated).
* Because 3CX is both a virtual appliance and a fairly easy/small installation, there is no system image backup (would waste a Veeam license). A disaster recovery situation would then entail reinstallation of the 3CX virtual appliance and restoration of the backup config.

[[Category: Phone System]]

Information Systems:3CX IP-PBX Administrator's Guide

2023-11-29T23:01:20Z

Danielc:

Information Systems:LAN infrastructure at uniPHARM

2023-11-15T19:56:43Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || NewVisionIT! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| OCT-SWITCH || 172.30.16.20 || Cisco CBS350 || OCT-Picking Station || OCT-SWITCH || Gu20Da51NewEra ||
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:LAN infrastructure at uniPHARM

2023-11-15T19:56:16Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || NewVisionIT! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| OCT-SWITCH || 172.30.16.20 || Cisco CBS350 || OCT-Picking Station || OCT-SWITCH || Gu20Da51NewEra || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:LAN infrastructure at uniPHARM

2023-11-15T19:55:42Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || NewVisionIT! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| OCT-SWITCH || 172.30.16.20 || Cisco CBS350 || OCT-Picking Station || OCT-SWITCH || Gu20Da51nNewEra || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:Datalogic RF gun

2023-10-25T18:15:33Z

Danielc:

=Overview=
=Hardware maintenance and repair=
- It is easiest to email rma.usa@datalogic.com or call 1-800-BAR-CODE (227-2633) and provide the following information:

- Full company name:

- Billing address (cannot accept a PO Box without a street address) provided information

- Shipping address:

•Product serial number(s) -

•Problem description -

•Contact (first/last name, e-mail, phone)

Information Systems:Datalogic RF gun

2023-10-25T18:13:38Z

Danielc:

=Overview=
=Hardware maintenance and repair=
- It is easiest to email rma.usa@datalogic.com or call 1-800-BAR-CODE (227-2633) and provide the following information:
- Full company name
- Billing address (cannot accept a PO Box without a street address) provided information
- Shipping address
•Product serial number(s) -
•Problem description -
•Contact (first/last name, e-mail, phone)

Information Systems:Datalogic RF gun

2023-10-25T18:13:28Z

Danielc: /* Hardware maintenance and repair */

=Overview=
==Hardware maintenance and repair==
- It is easiest to email rma.usa@datalogic.com or call 1-800-BAR-CODE (227-2633) and provide the following information:
- Full company name
- Billing address (cannot accept a PO Box without a street address) provided information
- Shipping address
•Product serial number(s) -
•Problem description -
•Contact (first/last name, e-mail, phone)

Information Systems:Datalogic RF gun

2023-10-25T18:13:08Z

Danielc: Created page with "=Overview= ===Hardware maintenance and repair=== - It is easiest to email rma.usa@datalogic.com or call 1-800-BAR-CODE (227-2633) and provide the following information: - Full..."

=Overview=
===Hardware maintenance and repair===
- It is easiest to email rma.usa@datalogic.com or call 1-800-BAR-CODE (227-2633) and provide the following information:
- Full company name
- Billing address (cannot accept a PO Box without a street address) provided information
- Shipping address
•Product serial number(s) -
•Problem description -
•Contact (first/last name, e-mail, phone)

Information Systems:VMWare Production Infrastructure

2023-10-14T03:56:14Z

Danielc:

=Hardware=
uniPHARM purchased a pair of Lenovo x3650 M5 servers in March of 2018 from Anisoft to act as hosts for VMware. The machine type of both servers is 8871-16A and the serial numbers are J121W8C and J121W8D. Both servers do have identical hardware components and as of March 2018, they also have identical and current firmware. Both servers have an Intel Xeon E5-2620 v4 processor populating the first socket. The second socket for both servers is empty. The Xeon has 8 cores and 16 threads. Both machines came with an initial 16GB stick of memory in the first slot. An additional 6 sticks of 8GB were installed into each server so that each has 64GBs of memory. Be aware that the motherboard has specific requirements for where additional memory can be inserted. The numerical order for which memory slots can be used is clearly displayed on the top side lid of the server. If more memory is purchased and installed for these servers, the instructions on the top lid must be followed, or the memory will not be recognized correctly. The memory slots labeled from 13 to 24 on the motherboard cannot be used until the second CPU socket has a processor.

Each server has an ServeRAID M5210 controller that is attached to the motherboard. For each M5210, there is also a RAID5 daughter card that is attached which provides additional capabilities. The M5210 can control up to 24 drives for each server. The initial purchase included 5 drives for each server that are 960GB SSDs. Both of the M5210 controllers are configured with a RAID6 set containing the 5 SSDs. The RAID6 volume can survive the failure of 2 drives before there is data loss. There are no warm or cold spare drives available as of March 2018. The total amount of storage space on each server is 2679GB. The strip size is 256KB. All parameters of the RAID6 set were set to default for the M5210 controller. Each server also has a USB thumb drive that is plugged into the motherboard where the hypervisor software is installed. The thumb drive is 2GB in size and is USB2.0.

Each server has 4 network ports that use the Broadcom NetXtreme chip. Each server has an additional network port that is for dedicated IMM2 access. More on the IMM2 is below. Each server has 2 USB and a VGA port on the front side and the back side. The purchased configuration of each server did not include any riser cards for PCIe expansion cards so if there is a need for extra abilities, the riser cards are also required. Each server has 2 power supplies which can share the load as well as take the entire electrical load should 1 fail. Each server has different power sources feeding into each power supply. The top, or number 2 power supply for each server, is fed from the right side PDU in the Power8 rack. The bottom, or number 1 power supply, is fed from the left side PDU. The PDU's are the "power strips" on each side of the rack where the right side gets power from the Leibert UPS and the left gets power from the Power8 UPS at the bottom of the rack. This all means that in the event of a Hydro power failure, the servers will stay up and operational even if one out of two UPS's fails. Both servers will immediately power off if there is a Hydro power failure AND BOTH UPS's also fail or run out of battery power.

Both servers are located in the Power8 rack and are 2U in size. The top server is at rack unit 18 and the bottom server is at rack unit 16. Both servers can be pulled out on the rack rails and serviced while powered on. The hard drives and power supplies are hot swappable but the memory is not. Neither server has a CD-ROM drive so if a disc needs to be used, the only option is to plug in a USB optical drive.

==Hardware - Network Port Map==
This list shows the layout of the network cables that connect the servers to the stacked core network switches in the Server Room.
* Server Room Stacked Switch (1of4 - Top) Port 2 goes to VMHost01 dedicated IMM2 port
* Server Room Stacked Switch (1of4 - Top) Port 14 goes to VMHost02 dedicated IMM2 port
* Server Room Stacked Switch (1of4 - Top) Port 3 goes to VMHost01 Management Port on eth2
* Server Room Stacked Switch (1of4 - Top) Port 15 goes to VMHost02 Management Port on eth2
* Server Room Stacked Switch (1of4 - Top) Port 4 goes to VMHost01 vMotion Port on eth3
* Server Room Stacked Switch (1of4 - Top) Port 16 goes to VMhost02 vMotion Port on eth3
* Server Room Stacked Switch (1of4 - Top) Port 5 goes to VMHost01 LAN1 Uplink on eth0
* Server Room Stacked Switch (1of4 - Top) Port 17 goes to VMHost01 LAN2 Uplink on eth1
* Server Room Stacked Switch (1of4 - Top) Port 6 goes to VMHost02 LAN1 Uplink on eth0
* Server Room Stacked Switch (1of4 - Top) Port 18 goes to VMHost02 LAN2 Uplink on eth1

==Hardware Purchase Details==
The purchase order number for this project is 8226136 (dated Feb 13, 2018) with a vendor number of 20145 and invoices numbers 19253, 19254, 19256 dated March 14, 2018.

==Hardware Support==
uniPHARM has a hardware maintenance contract with Lenovo to provide 24x7x365 onsite parts and labour with a 4 hour response time for the period of March 6, 2018 to March 5, 2021. A renewal of this maintenance contract is expected in February of 2021 because the expected life span of these servers is 5 to 6 years. Note that "maintenance" is not a good descriptor of the service. If a hardware component fails, then the replacement of that part is provided by Lenovo at no cost and is installed by a Lenovo technician at no cost. If uniPHARM adds in non-Lenovo parts they are not covered by the existing contract. Additional Lenovo branded parts that are installed after initial purchase are covered under the existing contract. If a non-Lenovo part is installed and causes damage to the server, the agreement becomes null and void. The phone number for parts replacement and technical support under this contract is 1-800-426-7378. This contract does not cover any VMware software.

=IMM2=
The Integrated Management Module II is an out of band service used to control the x3650 server hardware. It is comparable to the HMC for the Power8. The IMM2 is on and active and accessible as long as the server has power feeding into the power supplies. If both power supplies are unplugged, the IMM2 is not active and accessible. The IMM2 resides on a small "SystemOnChip" on the motherboard and is served by a webserver within a small Linux OS within the SOC. The IMM2 also has a dedicated network port that is only used by that function. On smaller 1U servers the IMM2 shares the first Broadcom network port.

The IP addresses assigned to each of the 2 IMM2's are 172.30.18.54 and 172.30.18.55. The host names are bmvmhost01.unipharm.local and bmvmhost02.unipharm.local. BM is a hold over from a previous IBM product called "Baseboard Management" and this naming convention is a continuation of that. The username for both IMM2's is adminit and the password is visionit. The IMM2's are not accessible from the public side of the firewall and need VPN access if logging in from outside the local network.

* https://bmvmhost01.unipharm.local
* https://bmvmhost02.unipharm.local

The IMM2 web interface is primarily used to control the hardware, alert for hardware failures and to provide a screen console for the server when no physical screen-keyboard-mouse is attached. This is a critical function for troubleshooting or diagnosing software crashes no matter what OS or hypervisor is installed. The console screen function can be presented using a ActiveX, or Java, or HTML5 app that is served from the IMM2 - no need to install any EXE on a laptop. The Java client works consistently. The IMM2 can power on or off the server and show very detailed information on temperatures, fan speeds, voltages and firmware levels of all components. The IMM2 is also setup to email alerts to I.S. staff when hardware events occur such as a failed hard drive or power supply. The IMM2 is also configured to call home to Lenovo when a hardware component fails in the same manner that the HMC connects to IBM when a Power8 hardware failure occurs.

As of March 2018, the x3650 servers do have the latest available firmware and should not need any firmware updates unless Lenovo requires it for replacement parts. If updated firmware is needed, it can be installed from within the IMM2 web interface.

=vSphere ESXI Hosts=
The vSphere (ESX) hypervisor is installed on the USB thumb drive that is plugged into the internal motherboard port for each server. The customized Lenovo version of the ESX installer was used as it is pre-compiled with all of the device drivers present in Lenovo branded hardware. Each server, now known as a host, is set to only boot from that USB thumb drive. The hypervisor operating system boots and loads into memory and is thusly ready to house and run virtual machines.
* Server with serial number J121W8C has a host name of vmhost01.unipharm.local
* The administrator username is root
* The administrator password is NewVisionIT2051!
* The management network is on eth2 which is the third network port on the back of the server
* The management network IP address is 172.30.18.19 subnet 255.255.248.0 gateway 172.30.16.1 and is configured to do DNS lookups to 172.30.18.13 and .14
* The management network is using the default VLAN
and
* Server with serial number J121W8D has a host name of vmhost02.unipharm.local
* The administrator username is root
* The administrator password is NewVisionIT2051!
* The management network is on eth2 which is the third network port on the back of the server
* The management network IP address is 172.30.18.20 subnet 255.255.248.0 gateway 172.30.16.1 and is configured to do DNS lookups to 172.30.18.13 and .14
* The management network is using the default VLAN
The web administration pages to directly access the ESX hypervisor and bypass vCenter are:
* https://vmhost01.unipharm.local
* https://vmhost02.unipharm.local
The above links that go directly to the hypervisor don't need to be used or accessed for day to day administration because all administrative tasks should be done within the vCenter user interface. The above links only need to be accessed if vCenter is unavailable, down or broken.

=vCenter Server Appliance=
During Stage 1 of the VCSA setup, the following settings were used
* The FQDN of the VCSA is vcsa.unipharm.local
* The IP address of the VCSA is 172.30.18.23
* The password for the VCSA is NewVisionIT@2051
* The password requires upper and lower case letters AND a number AND a special character but no spaces are allowed.
* The VCSA has an integrated, as in no external, Embedded Platform Services Controller
* The VCSA was deployed in "Tiny" mode and is using a thin provisioned virtual disk
During Stage 2 of the VCSA setup, on the SSO configuration screen, the following settings were used
* Single Sign-On domain name is vsphere.local
* Single Sign-On user name is administrator
* Single Sign-On password is NewVisionIT@2051
* Site name is uniPHARM
* SSH access was enabled
* The following link was used as a guide for the very confusing and badly designed SSO setup https://esxsi.com/2016/11/16/vcsa65/
Please note that if the VCSA virtual machine needs to be rebooted, it will take a good 5 minutes for the web page to be accessible and you may see a plain text page saying the interface is initializing so be patient as the appliance settles down after a reboot.
==vCenter Management==
* The URL for vCenter Flash site is https://vcsa.unipharm.local/vsphere-client/
* The URL for the vCenter HTML5 site is https://vcsa.unipharm.local/ui <------ The HTML5 site is waaaaaaaaay better than the Flash site AND it has a dark mode them which is bananas.
* Username is administrator@vsphere.local
* Password is NewVisionIT@2051
* The URL for the vCenter Appliance Management site is https://vcsa.unipharm.local:5480
* The username is root and the password is NewVisionIT@2051
The virtualization infrastructure is designed according to VMware's best practices. In vCenter, a datacenter has been created and called "uniPHARM Datacenter". It contains a cluster called "uniPHARM Cluster. The cluster contains both hosts and any virtual machines are listed under the hosts. The cluster was created with DRS and HA turned off to begin with, however they can be turned on a later time. Each host has a single datastore and they are named VMHost01DataStore01 and VMHost02DataStore01. Each datastore is the entire RAID6 set of 5 SSDs, totaling 2.62TB of usable space. If, in the future, there is ever a need to add storage, the naming convention should continue with VMHost01DataStore02 or VMHost01DataStore03.

===vCenter Management - vNetwork===
As mentioned above, each host has 4 gigabit network ports. The network configuration for our VMware infrastructure is not complex, by VMware standards but the information below is critical to understanding how it has been designed:
* The first (vmnic0) and second (vmnic1) NICs are used for everyday ordinary network traffic going in or out from or to the virtual machines
* The first (vmnic0) NIC is connected to vSwitch2 and is labeled as "uniPHARM Production LAN" - imagine that an invisible virtual switch lies between the first NIC and the real physical switch in the Server Room
* The second (vmnic1) NIC is initially not configured to do anything as of March 2018 but it can be used for a second Production LAN or some sort of testing LAN or fail over if licensing permits
* The third (vmnic2) NIC is configured as a vmKernel port (172.30.18.19 & 20) connected to vSwitch0 acting as the "Management Network"
* The third (vmnic2) NIC and vSwitch0 are only used as a connection that vCenter uses to control the hosts and its setup is a best practice from VMware
* The fourth (vmnic3) NIC is configured as a vmKernel port (172.30.24.1 & 2) connected to vSwitch1 on VLAN 3 acting as the "vMotion Network" and is only used when a virtual motion needs to move from one host to another
It is CRITICALLY important that ANY vnic, vSwitch or vmKernel configuration changes that are made on one host are precisely repeated on the other host. Having different vSwitch labels, for example, prevents vMotion from succeeding. Our EPK license does not permit distributed switches so we have to do the configuration changes manually to each host.

===VUM VMware Update Manager===
VUM has been configured with a dynamic baseline for the hosts and for the VCSA. The best explanation of how VUM works is this link - https://www.youtube.com/watch?v=X_xGihAfLSo Please note that the safest way to apply patches and updates to the hosts hypervisor is to vMotion all the VM's on one host to another and then to remediate the empty host, then vMotion all the VM's back and do the other host. Since we only have 2 or 3 hosts and don't apply patches very often, this method (while time consuming) results in very little down time and a patched infrastructure. An alternate method is to schedule a Saturday, for example where all the VM's can be gracefully shutdown and then when they are ALL off, use VUM to do a patch cycle of each host one at a time.

If the VCSA itself needs to be updated, see this VMware KB article. https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.upgrade.doc/GUID-6751066A-5D4E-47AC-A6A4-5E90AEC63DAA.html The VCSA should be updated and rebooted BEFORE applying any new patches or versions to a host.

===vCenter Alarm Configuration===
vCenter has been configured to use a small number of alarms that email alerts when certain conditions are encountered. The alarm configuration is done at the VCSA level in the hierarchy:
* "Host connection and Power State alarms when the Connection State is equal to Not Responding and the host is at Standby or Powered Off - then emails DarrenF and NorwinU
* "Host CPU Usage" alarms a warning when CPU is above 75% for 10 minutes and a critical when the CPU is above 90% for 10 minutes - then emails DarrenF and NorwinU
* "Virtual Machine CPU Usage" alarms a warning when a vCPU is above 90% for 20 minutes and alarms critical when vCPU is at 100% for 30 minutes - emails DarrenF and NorwinU
* "Virtual Machine Memory Usage" alarms a warning when a memory is above 90% for 10 minutes and alarms critical when memory is above 95% for 10 minutes - emails DarrenF and NorwinU
* "Datastore Usage On Disk" alarms a warning when datastore usage is above 80% and alarms critical when above 90% - emails DarrenF and NorwinU
* "uniPHARM Alarm Network Unplugged" alarms when a NIC is unplugged - emails DarrenF and NorwinU
* "uniPHARM Alarm VM Powered Off" alarms when a VM is powered off - emails DarrenF and NorwinU

===Content Library===
Within vCenter, a content library called uniPHARM Content Library has been created. The purpose of the library is to store ISO and OVF files that are used when creating new VM's so that an OS can be booted - remember that the VMHosts don't have attached CD-ROM drives. Since creating new VM's is not a daily occurrence, the content library should be empty or mostly empty for the majority of the time in order to not consume storage space that is best served for VM's. The content library can only be used for virtual machines created on VMHost01 because that is the datastore where the content library is located. A newly created virtual machine on the other 2 hosts can't use the content library because it's not on shared storage. Also be aware that IE11 cannot upload ISO files greater than 4GB in size, you have to use a different browser. Please for the love of Bhudda, label what you are uploading to the Content Library so that others know what it is.

=Virtual Machines=
A virtual machine is like a bucket. The bucket contains a simulated processor, memory and a flat file that acts as a hard drive. An OS can be installed inside the bucket and can be given a network connection which is also simulated. The OS can't tell the difference between real hardware and simulated so it behaves normally. The bucket that contains the simulated hardware and the OS install, sits on top of the hypervisor. The hypervisor takes simulated hardware calls and maps them to real physical hardware so that each bucket can get a slice of processor and memory. The real hardware can house many buckets and the contents of each bucket don't mix or interact preserving the containerization. And finally buckets can be moved to different hardware without interrupting the OS contents via hocus pocus magic.
==VCSA==
The vCenter appliance VM was created with all the default settings as they were set by the ISO installer. It currently has 2 vCPUs and is using 1.5GB of memory. It has a very unique way of using 14 different thin provisioned VMDK files that act as its hard drives and is currently only using 25GB of real storage space. The VM hardware version is 10. This VM is very important to safe and healthy operation of our virtualization infrastructure.

==XClarity==
XClarity is a software based virtual appliance from Lenovo that shows hardware inventory and does hardware alerting. XClarity is a much more slimmed down modern packaged that is what IBM Director was supposed to be. The OS for the VM is a Linux something where access by the user is restricted. The VM is using 1 vCPU and 8GB of memory and is thin provisioned for 64GB of storage and is actually using only 12GB of storage. The IP address assigned to the VM is 172.30.18.2 and the URL for the sit is :
* https://xclarity.unipharm.local/ui/login.html
The local login for the above URL is:
* Username - adminit
* Password - NewVisionIT2051
* Active Directory SSO is currently not working in XClarity 1.4
The XClarity 1.4 software appears to be fairly straight forward and is able to talk to all the IMM's for our current small fleet of Lenovo servers. The software is set to email DarrenF and NorwinU if there is a hardware failure on any of the Lenovo servers. These alerts are in addition and perform the same function as the IMM's on each machine and is strictly limited to hardware failures. There is an excellent Android app that talks to XClarity over a VPN connection, however it requires that the XClarity appliance root and subordinate certificates be installed on the phone in order to gain access. This is security overkill but DarrenF did install those certificates on his phone and the app is worth this effort though others are free to disagree. This VM appliance was created from an OVA file on May 9, 2018. As of May 2018, this VM is not being backed up by anything and doesn't really need to be because it can be recreated from the OVA file. This VM is in no way business critical and can be powered off if needed.
* It was discovered after the setup of XClarity 1.4 was completed that there is a 2.0 that will be installed and configured again as a VM appliance at a later date. Both versions are supported by Lenovo but because the software is the free version, uniPHARM has no support contract.
* XClarity cannot talk to the IMM on the old SuperServer hardware because the hardware is not on the XClarity HCL. We are going to continue using SuperServer hardware for Veeam but XClarity cannot monitor that hardware. XClarity also cannot monitor Lenovo desktops or laptops - only Lenovo servers, storage SANs and Lenovo switches.

==Thermoprofile==
This is the first physical server to be converted into a virtual machine:
* Shrunk the 2 physical hard drives - C: from 150GB to 100GB and D: from 250GB to 150GB
* Configured the VM to use 1 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
This VM is ultimately going to go away because the applications on it (Spiceworks, KiwiSyslog, WDS/MDT need to be migrated onto a freshly made Windows Server 2012R2 VM where the OS license is re-used. The conversion of the Windows Server 2008R2 physical machine is acting as a test case for more critical conversions.
* Thermoprofile VM had its applications (Spiceworks and KiwiSsylog + WDS) moved to a new VM called WDS.unipharm.local on Friday June 8, 2018. The Thermoprofile VM was powered off and removed from the BackupExec jobs. The VM was deleted on June 13, 2018.

==Mail==
This is the third physical server to be converted into a virtual machine:
* The physical hard drive was thick provisioned and not shrunk
* Configured the VM to use 2 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on this server, please see the following link: http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:Mail_Server

==SuperServer==
This is the fourth physical server to be converted into a virtual machine:
* The physical hard drives were thick provisioned and shrunk during the conversion process
* The C: drive was configured to be 100GB, the D: was configured to be 1000GB and the E: was configured to be 500GB
* Configured the VM to use 2 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on this server, please see the following link: http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:SuperServer

==WindowsXP JetDirect==
DarrenF created this VM a long time ago in VMware Workstation so that the HP JetDirect boxes at each picking station can be controlled, configured and setup correctly. The JetDirect boxes are so old that their web administration pages only work with Microsoft Java, which only exists in a 2002 version of WindowsXP prior to SP1 or SP2. The web administration page of the JetDirect boxes works in the same manner as pages for all the other network attached printers. The admin page for the JetDirect boxes need to have the correct IP address and host name set plus other print and network options. New Windows OS's like Windows 7 and 10 are not able to display the JetDirect web admin page because the version of Java it needs does not exist in newer versions of Windows. Having a VM with an old version of Windows is the most convenient method if someone needs to configure a JetDirect box, otherwise, the VM can be left powered off. This VM is only taking up 16GB of storage space.

==Lucy==
This is the second physical server to be converted into a virtual machine:
* Shrunk the 2 physical hard drives - C: from 150GB to 75GB
* Configured the VM to use 2 vCPU and 4GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
* The VM does not have the serial ports that the physical machine had installed in its PCI slots

==Smithers==
This is the fifth physical server to be converted into a virtual machine:
* The physical hard drive was thick provisioned and shrunk during the conversion process
* The C: drive was configured to be 150GB
* Configured the VM to use 2 vCPU and 16GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
The physical server that was Smithers, had a red coloured USB licensing dongle that was used for the Kofax scanning software. Prior to the P2V, the licensing dongle was moved to the Gauss scanning station in Accounting. The Gauss software "package" on the Smithers VM, plus both scanning desktops now point to the USB dongle in Accounting for licensing compliance. The Smithers VM has no special USB pass-through because the USB dongle was moved prior to the P2V. For more information on this server, please see the following link: http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:Smithers

==WDS==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install for housing the Windows Deployment Service and Spiceworks and KiwiSyslog. WDS is where desktop and laptop images are stored and downloaded from when a workstation does a PXE boot to install Windows.
* The virtual hard drive was thin provisioned at 70GB
* The C: drive was configured to be 100GB
* Configured the VM to use 1 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13

==UWDDC1==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install to act as an Active Directory Domain Controller.
* The virtual hard drive was thin provisioned at 50GB
* The C: drive was configured to be 50GB
* Configured the VM to use 1 vCPU and 4GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on Active Directory, see the following link: (Yes, it shows UWDDC3, just ignore that, the documentation is valid and still correct)
http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:UWDDC3_Domain_Controller

==UWDDC2==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install to act as an Active Directory Domain Controller.
* The virtual hard drive was thin provisioned at 50GB
* The C: drive was configured to be 50GB
* Configured the VM to use 1 vCPU and 4GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on Active Directory, see the following link: (Yes, it shows UWDDC3, just ignore that, the documentation is valid and still correct) http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:UWDDC4_Domain_Controller

==XTGUI==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install to act as a server for the Iptor XT GUI.
* The virtual hard drive was thick provisioned at 40GB
* The C: drive was configured to be 40GB
* Configured the VM to use 2 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13

==3CX Server Appliance==
This is a new virtual machine created from an ISO file downloaded from the 3CX website. The ISO is an automated install of Debian 64bit plus the 3CX software. The purpose of this VM is to act as a software PBX intended to replace the physical Toshiba PBX hardware. There is a Windows based version of 3CX, however it was deemed that using a prebuilt VM appliance was a better option.
* The virtual machine is configured with 1 vCPU, 4GB of memory and 50GB of thick provisioned disk space. <-- Woops my bad sorry on the thick provisioned space.
* The virtual machine is using the VMXNET3 network interface on the Production LAN at 172.30.18.27
* As of September 2018, this VM is not being backed up in any way
* The virtual machine has the OpenVM Tools installed
* The virtual machine is located on VMHost03
* There is a special VM network that has been created on VMHost03 (only) so that this VM can use the Shaw coax internet connection. Because of this unique network configuration, this VM cannot be vMotioned as the vSwitch is not present on VMHost01 or 02

==Zabbix NMS VM Appliance==
This is a Linux based virtual appliance that is used for network monitoring, graphing and alerting. The VM appliance is an LTS version of Ubuntu with the OSS package called Zabbix baked in. The open-vm-tools package is present so vCenter can control this VM. While this VM is not business critical, it took a lot of effort to setup and configure so try not to let it get wiped out with no backups.
* The virtual machine is configured with 2 vCPU, 4GB of memory and 40GB of thin provisioned disk space.
* The virtual machine is using the VMXNET3 network interface on the Production LAN at 172.30.18.13
* As of July 2019, this VM is not being backed up in any way
* The virtual machine has the OpenVM Tools installed
* The virtual machine is located on VMHost02

=Third Host Used For Testing=
On Monday May 28, 2018 a third host server was added to the VMware cluster. The hardware that was used was previously the "Smithers" server. The machine is a Lenovo x3550 M5 and the machine type is a 5463-AC1 and the serial number is E2ZR351. The server has 2 populated processor sockets and contains Intel Xeon E5-2620v3 processors. It has 32GB of memory and has 2 SSD drives that have been put into a RAID0 array. There are 4 network ports at the back of the server and they are used and setup in the same way as the original 2 hosts. This third host has the same IMM2 and the URL and credentials are below:
* https://bmvmhost03.unipharm.local
* adminit
* abc123
The third host has the same build of ESX as the other 2 hosts and it is also installed on a USB thumb drive but the thumb drive in the third host is not a Lenovo part and is not covered under warranty. The third host is also setup to boot directly from the thumb drive instead of the RAID0 SSD array. The RAID0 array has been configured as VMHost03DataStore01 and is 440GB in size. The root password for the installed hypervisor on the third host is the same compared to the other 2 hosts and the management IP used is 172.30.18.21 and the vMotion IP is 172.30.24.3. The third host has an existing Lenovo maintenance agreement that expires on August 26, 2020.

IMPORTANT INFORMATION: The purpose of the third host is for testing and housing a testing environment. The third host is not meant to permanently house any VMs that are used in production. If we care that a VM gets deleted because the datastore was blown away and recreated - then that VM never should have been on the third host. The third host also has a different version of Intel Xeon processor compared to the other 2 hosts. A 2620v3 versus a 2620v4. This matters for doing a vMotion of a running VM either to or from the third host. A vMotion of a powered on VM to or from the third host cannot happen until EVC mode is turned on for the entire cluster. As of May 2018, EVC mode is disabled because enabling it requires an outage where all the VMs in the cluster are powered off and this linked procedure be followed https://kb.vmware.com/s/article/1013111 . If a VM needs to vMotion to or from the third host, it must be powered off and it must fit within the 440GB datastore.

=VMware Tools=
VMware Tools is a package of tools and drivers that most virtual machines need to have installed within the guest OS. VMware Tools allows the hypervisor to talk and manipulate the virtual machine. The tools package also contains many of the virtual hardware drivers that Windows needs to properly enumerate all the "fake" hardware. For example, if a virtual machine is running Windows7, the OS will load the default VGA driver for the video card because natively Windows can't identify a virtualized video card. Same deal for a virtualized network card, Windows won't and probably shouldn't load a built in Microsoft driver. This is where VMware Tools comes in and provides those drivers for the OS. When creating a virtual machine or converting a physical machine, the VMware Tools installer should be installed as soon as possible. The installer can be triggered from the vSphere web interface. The only exceptions to the rule that VMware Tools needs to be installed is if the virtual machine is an "appliance" or pre-built OVF deployment.

=vCenter Standalone Converter=
The vCenter Standalone Converter is a badly named application that converts real physical computers into virtual machines running on a host. The application is Windows based and is typically installed on an IT laptop or workstation. The software creates a "triangle" where it talks to the source computer and the destination host. To begin with the Converter needs the FQDN of the source computer and local administrator credentials. AD administrator credentials are good enough if they are in the local admin group on the source machine. The Converter then uses a WMI connection to figure out what hardware and OS is present on the source machine. During the "Convert Machine" wizard, the Converter also opens a connection to the VCSA which manages the uniPHARM Cluster. Once the Converter understands the source and destination, the user doing the conversion has a chance to customize certain options like how many vCPUs are in the converted VM and how much memory there is and whether or not the source machine is powered off at the end of the conversion.

At the end of the wizard the Converter creates an empty "shell" virtual machine on the chosen destination host and begins to copy the source hard drive(s) to it. It is important to note that the drive copy is direct from the source to the destination and does not hop to the laptop controlling the conversion. The hard drive copy process is using VSS in the context of converting Windows machines so the VMware best practice is to turn off any non-Microsoft services that are running prior to the conversion process to minimize any chance that VSS can't get a lock on a file. It is also best practice to set the source machine in the convert wizard to power off at the end of the last sync so that the newly created VM can be up and running after the last sync and so that there is no duplicate IP address/name conflict. According to VMware documentation, the same "magic" that makes a vMotion happen is used in the Converter to take running physical machines and turn them into running VMs with only a second or two of pause.

When the Converter is finished copying the hard drive(s) and the last sync, the VM is set to either be up and running or powered off and ready to be powered on for the first time as a VM. In the second scenario, when the converted VM is powered on for the first time, it will recognize a bunch of new hardware. For example, an older IBM server would have a physical Broadcom NIC, when it is converted it will have a VMXNET NIC (and therefore use DHCP). The Converter will inject all the drivers the newly converted VM will need to recognize all the different virtualised hardware. There may be a need to do a reboot for a newly created VM as Windows typically asks for one when new hardware drivers are installed. The person doing the conversion can also choose to have the Converter automatically install the VMware Tools package if needed.

Be aware that the amount of time it takes to convert a physical machine to a VM is limited by network bandwidth. All potential source machines are on the same switch stack as the VMHosts so that's as fast as it is going to be. A source machine that has SSDs would be bottlenecked by a 1GB network connection, however an older slower source server with mechanical hard drives might not be. In any case, there is a hard limit on how fast a 1GB connection can move data. Also be aware that after the conversion process is finished and the VM is up and running, Windows may prompt to re-activate the OS license due to how much "hardware" has just changed. Our servers are using volume licenses so there is no reason a re-activation should fail.

The Converter application is currently installed on DarrenF's laptop, but can be installed on other I.S. laptops and is not tied to any licensing. The Converter is free to use but can't do anything useful without vCenter.

=VMware Licensing And Support=
uniPHARM has purchased a vSphere 6 Essentials Plus Kit that includes vCenter. This means that the license entitles us to have a maximum of 3 hosts each having a maximum of 2 CPU sockets and we are entitled to 1 instance of vCenter. The license is usable forever, but the attached technical support is renewed yearly. The licenses and keys are available through the MyVMware portal at
* www.vmware.com
* Username is darrenf@unipharm.com
* Password is visionit
* Account number 114624681
* Customer number 9027898369
uniPHARM also owns a license for a very old version of VMware Server 2.0 and Workstation 9.0 which are both EOL and not usable. While the current EPK licenses are installed correctly inside vCenter, if vCenter needs to be re-installed, the process is to run a licensing report from MyVMware, which generates a CSV file that is imported into vCenter. The next step is to assign the vCenter license to itself and the vSphere licenses to the hosts. VMware has announced that the End Of General support for vSphere 6.5 is November 15, 2021. A support contract for version 6.5 would not be purchasable after that date and if we wanted support, we would be prompted to upgrade to 6.7 or later. This end of general support date applies to the hypervisor install and the vCenter install. Again, the licenses are perpetual and never expire, the support contract is renewable and does expire.

=VM To Host Optimized Layout=
The following chart describes where a virtual machine should be located so as to balance the processing, memory and storage loads evenly among the 3 hosts in the cluster. VM's can be moved around or shuffled from host to host when doing maintenance but this is the preferred layout of which hosts house which VM's. Changes to this chart will be documented in the change log at the bottom of this page.
{| class="wikitable"
|-
! style="width: 15%"|VMHost01 !! style="width: 15%"|VMHost02 !! style="width: 15%"|VMHost03
|-
| XClarity || SuperServer || 3CX Appliance
|-
| Lucy || UWDDC2 || TestServer1
|-
| Mail || VMware vCenter Server Appliance || UbuntuDevVM
|-
| Smithers || XTGUI || Windows7 Ent For Adobe LifeCycle
|-
| UWDDC1 || Zabbix NMS VM Appliance || WindowsXP Pro HP JetDirect
|-
| WDS || || Windows10 Ent Eval
|-
| || || Windows10 Pro Eval
|-
|}

=Backups=
==Veeam==
As of May 2018, uniPHARM is evaluating Veeam Backup And Replication 9.5 as the platform used to do backups of VMware infrastructure and VM's. This section is mostly a placeholder but the sub sections are full of relevant documentation.
===Hardware===
On December 20, 2010, uniPHARM purchased an IBM x3650 M3 server from Anisoft, with asset number 827. The machine type is 7945-AC1 and the serial number is KQ128AR. This machine (as of May 2018) has no IBM/Lenovo hardware maintenance agreement so if and when it has any sort of hardware failure of any kind, IBM/Lenovo will not come onsite with parts to repair. This machine was used as the "SuperServer" until that OS was turned into a VM. This machine does have an older IMM that can be accessed from the following URL and IP:
* http://bmveeam.unipharm.local
* Username adminit
* Password abc123
* IP 172.30.18.46
Because this machine has a very old IMM, it cannot be managed by XClarity. As of May 2018, this machine has the latest firmware for the IMM and UEFI and hard drive controllers. It contains 2 different hard drive controllers. The ServeRAID M1015 and the ServeRAID M5015. This machine has 16 slots for hard drives, numbered 0 to 15 and currently all the slots are populated with 15K-RPM spinning hard drives. The hard drives in slots 0 and 1 are 136GB drives and 2 through 15 are 300GB drives. The 136GB drives are in a RAID1 set and are used as the bootable C: drive with an install of Windows Server 2012R2. The drives in slots 2 to 7 are in a RAID0 as well as drives 8 to 15 in another RAID0 on the second controller. The M1015 and M5015 cannot create a JOBD or RAID0 across controllers because the controllers don't talk to each other. In order to get the maximum amount of disk storage for Veeam, a striped Dynamic Disk was created in Windows as a layer on top of the 2 RAID0 sets to make 1 large D: that is 3.8TB. A failure of any 1 hard drive in slots 2 through 15 will result in a LOSS OF ALL DATA on the D: drive. The 136GB RAID1 set acting as the OS drive on C: can tolerate the failure of a single hard drive without data loss - a failure of both drives will result in data loss. The above arrangement of hard drives is not a best practice, but is an acceptable risk given the nature of backups and budgets.

This machine has a pair of 1GB network cards that are using QLogic drivers as QLogic bought out Broadcom and when Windows Server 2012R2 was installed in May of 2018, the QLogic drivers were installed, however the chips for the NICs are Broadcom. Only the first NIC is being used on IP 172.30.18.9, however the second NIC can be used in a team to provide a 2GB connection with the core Server Room switches are replaced. The older IMM is using a dedicated port on the back of the machine. This server has 1 out of 2 processor sockets occupied with an 8 core Xeon E5620 and 8GB of memory.

===Veeam Software Installation===
In May of 2018, Veeam Backup And Replication 9.5 was installed. This package also installs the Express version of Microsoft SQL 2012 plus supporting files for SQL. Along with Veeam Backup and Replication, Veeam Enterprise Manager and Veeam ONE were also installed as they come free with the perpetual license. Veeam Enterprise Manager is a web based front end for the Veeam Console and has a subset of functions and features compared to the Console. Veeam ONE is a reporting and BI tool that displays graphs and charts and statistics in regards to a VMware/Veeam environment. While Veeam ONE is included free with the perpetual license, it is geared to much larger environments compared to ours - as in hundreds of hosts and thousands of VMs and lots and lots of storage. The full Veeam Console should be also installed on an IT laptop so administrators can make configuration changes if needed without using remote desktop to the physical server. This is very similar to how BackupExec worked. The Veeam Backup And Replication package needs to use the administrator@vsphere.local account to access the VCSA and any subordinate VM's. This account is critical to successful backups and if the password is changed, that change needs to also be changed within the credential manager inside Veeam. The Active Directory domain administrator account is also used to access the remaining physical servers via the Veeam Agent, so if that password is changed, it also needs to be changed within the credential manager inside Veeam.

===Veeam Licensing===
We will probably get perpetual licensing with renewable annual support
===What Is Veeam Backing Up?===
Veeam will be able to backup the VM's and itself and whatever few remaining physical servers that are still in use.
===Backup Strategy And Scheduled Jobs===
Placeholder something something something.
===How Veeam Uses Tape Hardware===
Placeholder something something something.
===Veeam Technical Support===
Put the terms of the support contract in here plus the phone number and expiry dates.

=Change Log - Try And Record Any Major Configuration Or Software/Hardware Changes To The Infrastructure Here=
==2018==
# Both servers have their UEFI/BIOS set to only boot from the USB thumb drive
# Both servers have their UEFI/BIOS set to use maximum performance in the power settings as per this KB article https://www.ibm.com/support/home/docdisplay?lndocid=migr-5098137
# Initial ESX version installed on March 21, 2018 is 6.5.0 Build 7388607
# VMHost01DataStore01 created as the first datastore
# The local datastores are seen as non-ssd by ESX because they are behind a RAID controller and not part of a vSAN
# VCSA password is NewVisionIT@2051
# vcsa.unipharm.local is at 172.30.18.23
# VCSA virtual machine set to automatically start when the hypervisor on VMHost01 boots
# VCSA added to Active Directory as a computer object for SSO on March 22, 2018, located in the Servers OU
# Configed SSO according to https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.vcsa.doc/GUID-08EA2F92-78A7-4EFF-880E-2B63ACC962F3.html
# Added DarrenF and NorwinU AD user accounts as being able to log into VCSA web client
# vMotion IP on VMHost01 is 172.30.24.1 IP on VMHost02 is 172.30.24.2
# 8 minutes to vMotion 60GB Win7 cagepc as a test P2V on March 23, 2018 with no VLAN
# Created content library and uploaded the xclarity OVF and 3CX ISO files March 23, 2018
# Added VLAN 5 to vMotion Network - NorwinU configed physical switch to use VLAN 5 on ports 4 and 16 on Stacked Switch 1of4 March 23, 2018
# Changed VLAN 5 to 3 for some reason and changed the TCPIP stack for the vMotion Network for optimization
# Added DarrenF and NorwinU AD accounts as permitted Administrators to the entire VCSA hierarchy and got SSO working correctly
# Configured VUM to scan for updates each Monday of every week and email DarrenF
# Ran a VUM Remediation to install Spectre VIBs via the VUM wizard both hosts now at 6.5 build 7967591 March 26, 2018
# P2Ved the Thermoprofile physical server onto VMHost01 March 26, 2018
# Set the Thermoprofile VM to autostart on VMHost01 March 28, 2018
# Tweeked CPU usage alarm to have more time at 90 and 100% - updated documentation April 3, 2018
# P2Ved the Lucy physical server onto VMHost01 April 7, 2018
# P2Ved the Mail physical server onto VMHost01 April 15, 2018
# Logged into the VCSA PSC Controller and set the root password to never expire instead of expiring every 90 days April 25, 2018
# Set the administrator@vsphere.local account to expire its password every 9999 days April 25, 2018
# Turned on the BASH shell for the VCSA PSC and set the correct time zone for NTP April 25, 2018
# Downloaded the VMware trusted root CA certificate from https://vcsa.unipharm.local and installed that into the Trusted Root store on DarrenF's laptop so that the webclient is trusted by IE11 and makes uploading of ISO files to the Content Library possible using an SSO login May 3, 2018
# P2Ved the SuperServer physical server onto VMHost02 May 5, 2018
# Uploaded the ISO for Windows Server Standard 2012R2 to the Content Library May 7, 2018
# Created the XClarity VM appliance from an OVA file in the Content Library - May 9, 2018
# Created a VM for NancyN to use for Adobe LifeCycle - see the notes pane in the Flash client for details on this otherwise undocumented VM - May 16, 2018
# P2Ved the Smithers physical server onto VMHost01 May 19, 2018
# Added hardware that used to be the Smithers server as a third host to the cluster (VMHost03) May 28, 2018
# VMware support ticket 18814250705 for how to enable EVC mode opened and then closed with no changes because enabling EVC requires all VMs to be off May 30, 2018
# VMware support ticket 18815369505 for how to get a database backup from the VCSA to FTP opened May 30, 2018
# New VM created called WDS.unipharm.local with the purpose of housing the WDS feature and Spiceworks and KiwiSyslog - June 8, 2018
# New VMs created called UWDDC1 and UWDDC2 to act as Active Directory Domain Controllers - June 11, 2018
# Thermoprofile virtual machine deleted from the datastore on June 13, 2018
# XClarity virtual appliance deleted and then recreated using the version 2.0 OVA file
# Created new virtual machine called XTGUI with the purpose of it being used as a server for the Iptor DC1 GUI - June 21, 2018
# Created an internal backup of the VCSA and uploaded that to ftp.unipharm.com - August 27, 2018
# Uploaded the VCSA upgrade ISO (6.5.0.22000-9451637) to VMHOST01DATASTORE01 - August 27, 2018
# Upgraded the VCSA to 6.5 U2C build 9451637- August 27, 2018
# Upgraded ESX hypervisors on hosts to 6.5 U2C build 9298722 - September 1, 2018
# Upgraded all VMware Tools installed in all Windows VM's to 10305 - September 1, 2018
# Changed configuration setting "VMkernal.BootHyperthreadingMitigation" from False to True on VMHost03 due to its older processor - September 5, 2018
# Cleared BIOS event logs on VMHost03 and undid the hyperthreading changes from above - September 5, 2018
# Created a new VM called 3CX Server Appliance from an ISO in the Content Library to be used as a PBX - September 26, 2018
# Created new virtual port groups on vSwitch2 on each host to enable VMs to be on Alt-Guest VLAN. The port group is tagged to VLAN 2. - September 28, 2018
# vMotion 3CX appliance to vmhost03 where I can play with it. -17:05, 28 September 2018 (PDT)
# Increased hard drive from 70GB to 100GB on the WDS virtual machine to accommodate new desktop images - October 19, 2018
# Created TestServer1 on VMHost03 - a Windows 2016 server for generic testing purposes. NetStore and TLAForm will be installed on it for testing with DC1.
# Created virtual switch VoIP LAN (VLAN 6). - November 29, 2018
# 3CX Server VM reinstalled and connected to VoIP VLAN. - November 29, 2018
# Created UbuntuTestVM VM, as a generic test VM that can be connected to different VLANs for various network testing / diagnostics purposes. - November 29, 2018
==2019==
# DarrenF created 2 VMs for Windows10 testing on April 4, 2019. The VM's are on VMHost02.
# DarrenF removed an old snapshot for the XTGUI Server and for the vCenter VM on May 8, 2019.
# DarrenF made a backup of the VCSA on May 17, 2019 and saved the backup file to the SuperServer.
# DarrenF upgraded the VCSA from 6.5.0-22000 to 6.5.0.24000 on May 22, 2019 and finished that with a reboot.
# DarrenF upgraded all 3 hosts to ESX version 6.5.0-13635690 on May 24, 2019
# DarrenF upgraded the UEFI and IMM2 and DSA firmware on all 3 hosts on May 24, 2019.
# DarrenF upgraded the VMware Tools install on some VM's that could be rebooted during the day on May 27, 2019 - remaining VM's will be upgraded at a later date.
# DarrenF updated this documentation with information on which VM's should located on each host - May 27, 2019.
# DarrenF created a new VM for the Zabbix NMS VM Appliance using an ISO located in the Content Library - July 10, 2019
# DarrenF enabled SNMP on all three hosts and the VCSA so that Zabbix could monitor via SNMP - July 12, 2019.
[[Category: Virtualization]]

Information Systems:VMWare Production Infrastructure

2023-08-19T21:14:51Z

Danielc:

=Hardware=
uniPHARM purchased a pair of Lenovo x3650 M5 servers in March of 2018 from Anisoft to act as hosts for VMware. The machine type of both servers is 8871-16A and the serial numbers are J121W8C and J121W8D. Both servers do have identical hardware components and as of March 2018, they also have identical and current firmware. Both servers have an Intel Xeon E5-2620 v4 processor populating the first socket. The second socket for both servers is empty. The Xeon has 8 cores and 16 threads. Both machines came with an initial 16GB stick of memory in the first slot. An additional 6 sticks of 8GB were installed into each server so that each has 64GBs of memory. Be aware that the motherboard has specific requirements for where additional memory can be inserted. The numerical order for which memory slots can be used is clearly displayed on the top side lid of the server. If more memory is purchased and installed for these servers, the instructions on the top lid must be followed, or the memory will not be recognized correctly. The memory slots labeled from 13 to 24 on the motherboard cannot be used until the second CPU socket has a processor.

Each server has an ServeRAID M5210 controller that is attached to the motherboard. For each M5210, there is also a RAID5 daughter card that is attached which provides additional capabilities. The M5210 can control up to 24 drives for each server. The initial purchase included 5 drives for each server that are 960GB SSDs. Both of the M5210 controllers are configured with a RAID6 set containing the 5 SSDs. The RAID6 volume can survive the failure of 2 drives before there is data loss. There are no warm or cold spare drives available as of March 2018. The total amount of storage space on each server is 2679GB. The strip size is 256KB. All parameters of the RAID6 set were set to default for the M5210 controller. Each server also has a USB thumb drive that is plugged into the motherboard where the hypervisor software is installed. The thumb drive is 2GB in size and is USB2.0.

Each server has 4 network ports that use the Broadcom NetXtreme chip. Each server has an additional network port that is for dedicated IMM2 access. More on the IMM2 is below. Each server has 2 USB and a VGA port on the front side and the back side. The purchased configuration of each server did not include any riser cards for PCIe expansion cards so if there is a need for extra abilities, the riser cards are also required. Each server has 2 power supplies which can share the load as well as take the entire electrical load should 1 fail. Each server has different power sources feeding into each power supply. The top, or number 2 power supply for each server, is fed from the right side PDU in the Power8 rack. The bottom, or number 1 power supply, is fed from the left side PDU. The PDU's are the "power strips" on each side of the rack where the right side gets power from the Leibert UPS and the left gets power from the Power8 UPS at the bottom of the rack. This all means that in the event of a Hydro power failure, the servers will stay up and operational even if one out of two UPS's fails. Both servers will immediately power off if there is a Hydro power failure AND BOTH UPS's also fail or run out of battery power.

Both servers are located in the Power8 rack and are 2U in size. The top server is at rack unit 18 and the bottom server is at rack unit 16. Both servers can be pulled out on the rack rails and serviced while powered on. The hard drives and power supplies are hot swappable but the memory is not. Neither server has a CD-ROM drive so if a disc needs to be used, the only option is to plug in a USB optical drive.

==Hardware - Network Port Map==
This list shows the layout of the network cables that connect the servers to the stacked core network switches in the Server Room.
* Server Room Stacked Switch (1of4 - Top) Port 2 goes to VMHost01 dedicated IMM2 port
* Server Room Stacked Switch (1of4 - Top) Port 14 goes to VMHost02 dedicated IMM2 port
* Server Room Stacked Switch (1of4 - Top) Port 3 goes to VMHost01 Management Port on eth2
* Server Room Stacked Switch (1of4 - Top) Port 15 goes to VMHost02 Management Port on eth2
* Server Room Stacked Switch (1of4 - Top) Port 4 goes to VMHost01 vMotion Port on eth3
* Server Room Stacked Switch (1of4 - Top) Port 16 goes to VMhost02 vMotion Port on eth3
* Server Room Stacked Switch (1of4 - Top) Port 5 goes to VMHost01 LAN1 Uplink on eth0
* Server Room Stacked Switch (1of4 - Top) Port 17 goes to VMHost01 LAN2 Uplink on eth1
* Server Room Stacked Switch (1of4 - Top) Port 6 goes to VMHost02 LAN1 Uplink on eth0
* Server Room Stacked Switch (1of4 - Top) Port 18 goes to VMHost02 LAN2 Uplink on eth1

==Hardware Purchase Details==
The purchase order number for this project is 8226136 (dated Feb 13, 2018) with a vendor number of 20145 and invoices numbers 19253, 19254, 19256 dated March 14, 2018.

==Hardware Support==
uniPHARM has a hardware maintenance contract with Lenovo to provide 24x7x365 onsite parts and labour with a 4 hour response time for the period of March 6, 2018 to March 5, 2021. A renewal of this maintenance contract is expected in February of 2021 because the expected life span of these servers is 5 to 6 years. Note that "maintenance" is not a good descriptor of the service. If a hardware component fails, then the replacement of that part is provided by Lenovo at no cost and is installed by a Lenovo technician at no cost. If uniPHARM adds in non-Lenovo parts they are not covered by the existing contract. Additional Lenovo branded parts that are installed after initial purchase are covered under the existing contract. If a non-Lenovo part is installed and causes damage to the server, the agreement becomes null and void. The phone number for parts replacement and technical support under this contract is 1-800-426-7378. This contract does not cover any VMware software.

=IMM2=
The Integrated Management Module II is an out of band service used to control the x3650 server hardware. It is comparable to the HMC for the Power8. The IMM2 is on and active and accessible as long as the server has power feeding into the power supplies. If both power supplies are unplugged, the IMM2 is not active and accessible. The IMM2 resides on a small "SystemOnChip" on the motherboard and is served by a webserver within a small Linux OS within the SOC. The IMM2 also has a dedicated network port that is only used by that function. On smaller 1U servers the IMM2 shares the first Broadcom network port.

The IP addresses assigned to each of the 2 IMM2's are 172.30.18.54 and 172.30.18.55. The host names are bmvmhost01.unipharm.local and bmvmhost02.unipharm.local. BM is a hold over from a previous IBM product called "Baseboard Management" and this naming convention is a continuation of that. The username for both IMM2's is adminit and the password is visionit. The IMM2's are not accessible from the public side of the firewall and need VPN access if logging in from outside the local network.

* https://bmvmhost01.unipharm.local
* https://bmvmhost02.unipharm.local

The IMM2 web interface is primarily used to control the hardware, alert for hardware failures and to provide a screen console for the server when no physical screen-keyboard-mouse is attached. This is a critical function for troubleshooting or diagnosing software crashes no matter what OS or hypervisor is installed. The console screen function can be presented using a ActiveX, or Java, or HTML5 app that is served from the IMM2 - no need to install any EXE on a laptop. The Java client works consistently. The IMM2 can power on or off the server and show very detailed information on temperatures, fan speeds, voltages and firmware levels of all components. The IMM2 is also setup to email alerts to I.S. staff when hardware events occur such as a failed hard drive or power supply. The IMM2 is also configured to call home to Lenovo when a hardware component fails in the same manner that the HMC connects to IBM when a Power8 hardware failure occurs.

As of March 2018, the x3650 servers do have the latest available firmware and should not need any firmware updates unless Lenovo requires it for replacement parts. If updated firmware is needed, it can be installed from within the IMM2 web interface.

=vSphere ESXI Hosts=
The vSphere (ESX) hypervisor is installed on the USB thumb drive that is plugged into the internal motherboard port for each server. The customized Lenovo version of the ESX installer was used as it is pre-compiled with all of the device drivers present in Lenovo branded hardware. Each server, now known as a host, is set to only boot from that USB thumb drive. The hypervisor operating system boots and loads into memory and is thusly ready to house and run virtual machines.
* Server with serial number J121W8C has a host name of vmhost01.unipharm.local
* The administrator username is root
* The administrator password is NewVisionIT2051!
* The management network is on eth2 which is the third network port on the back of the server
* The management network IP address is 172.30.18.19 subnet 255.255.248.0 gateway 172.30.16.1 and is configured to do DNS lookups to 172.30.18.13 and .14
* The management network is using the default VLAN
and
* Server with serial number J121W8D has a host name of vmhost02.unipharm.local
* The administrator username is root
* The administrator password is NewVisionIT
* The management network is on eth2 which is the third network port on the back of the server
* The management network IP address is 172.30.18.20 subnet 255.255.248.0 gateway 172.30.16.1 and is configured to do DNS lookups to 172.30.18.13 and .14
* The management network is using the default VLAN
The web administration pages to directly access the ESX hypervisor and bypass vCenter are:
* https://vmhost01.unipharm.local
* https://vmhost02.unipharm.local
The above links that go directly to the hypervisor don't need to be used or accessed for day to day administration because all administrative tasks should be done within the vCenter user interface. The above links only need to be accessed if vCenter is unavailable, down or broken.

=vCenter Server Appliance=
During Stage 1 of the VCSA setup, the following settings were used
* The FQDN of the VCSA is vcsa.unipharm.local
* The IP address of the VCSA is 172.30.18.23
* The password for the VCSA is NewVisionIT@2051
* The password requires upper and lower case letters AND a number AND a special character but no spaces are allowed.
* The VCSA has an integrated, as in no external, Embedded Platform Services Controller
* The VCSA was deployed in "Tiny" mode and is using a thin provisioned virtual disk
During Stage 2 of the VCSA setup, on the SSO configuration screen, the following settings were used
* Single Sign-On domain name is vsphere.local
* Single Sign-On user name is administrator
* Single Sign-On password is NewVisionIT@2051
* Site name is uniPHARM
* SSH access was enabled
* The following link was used as a guide for the very confusing and badly designed SSO setup https://esxsi.com/2016/11/16/vcsa65/
Please note that if the VCSA virtual machine needs to be rebooted, it will take a good 5 minutes for the web page to be accessible and you may see a plain text page saying the interface is initializing so be patient as the appliance settles down after a reboot.
==vCenter Management==
* The URL for vCenter Flash site is https://vcsa.unipharm.local/vsphere-client/
* The URL for the vCenter HTML5 site is https://vcsa.unipharm.local/ui <------ The HTML5 site is waaaaaaaaay better than the Flash site AND it has a dark mode them which is bananas.
* Username is administrator@vsphere.local
* Password is NewVisionIT@2051
* The URL for the vCenter Appliance Management site is https://vcsa.unipharm.local:5480
* The username is root and the password is NewVisionIT@2051
The virtualization infrastructure is designed according to VMware's best practices. In vCenter, a datacenter has been created and called "uniPHARM Datacenter". It contains a cluster called "uniPHARM Cluster. The cluster contains both hosts and any virtual machines are listed under the hosts. The cluster was created with DRS and HA turned off to begin with, however they can be turned on a later time. Each host has a single datastore and they are named VMHost01DataStore01 and VMHost02DataStore01. Each datastore is the entire RAID6 set of 5 SSDs, totaling 2.62TB of usable space. If, in the future, there is ever a need to add storage, the naming convention should continue with VMHost01DataStore02 or VMHost01DataStore03.

===vCenter Management - vNetwork===
As mentioned above, each host has 4 gigabit network ports. The network configuration for our VMware infrastructure is not complex, by VMware standards but the information below is critical to understanding how it has been designed:
* The first (vmnic0) and second (vmnic1) NICs are used for everyday ordinary network traffic going in or out from or to the virtual machines
* The first (vmnic0) NIC is connected to vSwitch2 and is labeled as "uniPHARM Production LAN" - imagine that an invisible virtual switch lies between the first NIC and the real physical switch in the Server Room
* The second (vmnic1) NIC is initially not configured to do anything as of March 2018 but it can be used for a second Production LAN or some sort of testing LAN or fail over if licensing permits
* The third (vmnic2) NIC is configured as a vmKernel port (172.30.18.19 & 20) connected to vSwitch0 acting as the "Management Network"
* The third (vmnic2) NIC and vSwitch0 are only used as a connection that vCenter uses to control the hosts and its setup is a best practice from VMware
* The fourth (vmnic3) NIC is configured as a vmKernel port (172.30.24.1 & 2) connected to vSwitch1 on VLAN 3 acting as the "vMotion Network" and is only used when a virtual motion needs to move from one host to another
It is CRITICALLY important that ANY vnic, vSwitch or vmKernel configuration changes that are made on one host are precisely repeated on the other host. Having different vSwitch labels, for example, prevents vMotion from succeeding. Our EPK license does not permit distributed switches so we have to do the configuration changes manually to each host.

===VUM VMware Update Manager===
VUM has been configured with a dynamic baseline for the hosts and for the VCSA. The best explanation of how VUM works is this link - https://www.youtube.com/watch?v=X_xGihAfLSo Please note that the safest way to apply patches and updates to the hosts hypervisor is to vMotion all the VM's on one host to another and then to remediate the empty host, then vMotion all the VM's back and do the other host. Since we only have 2 or 3 hosts and don't apply patches very often, this method (while time consuming) results in very little down time and a patched infrastructure. An alternate method is to schedule a Saturday, for example where all the VM's can be gracefully shutdown and then when they are ALL off, use VUM to do a patch cycle of each host one at a time.

If the VCSA itself needs to be updated, see this VMware KB article. https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.upgrade.doc/GUID-6751066A-5D4E-47AC-A6A4-5E90AEC63DAA.html The VCSA should be updated and rebooted BEFORE applying any new patches or versions to a host.

===vCenter Alarm Configuration===
vCenter has been configured to use a small number of alarms that email alerts when certain conditions are encountered. The alarm configuration is done at the VCSA level in the hierarchy:
* "Host connection and Power State alarms when the Connection State is equal to Not Responding and the host is at Standby or Powered Off - then emails DarrenF and NorwinU
* "Host CPU Usage" alarms a warning when CPU is above 75% for 10 minutes and a critical when the CPU is above 90% for 10 minutes - then emails DarrenF and NorwinU
* "Virtual Machine CPU Usage" alarms a warning when a vCPU is above 90% for 20 minutes and alarms critical when vCPU is at 100% for 30 minutes - emails DarrenF and NorwinU
* "Virtual Machine Memory Usage" alarms a warning when a memory is above 90% for 10 minutes and alarms critical when memory is above 95% for 10 minutes - emails DarrenF and NorwinU
* "Datastore Usage On Disk" alarms a warning when datastore usage is above 80% and alarms critical when above 90% - emails DarrenF and NorwinU
* "uniPHARM Alarm Network Unplugged" alarms when a NIC is unplugged - emails DarrenF and NorwinU
* "uniPHARM Alarm VM Powered Off" alarms when a VM is powered off - emails DarrenF and NorwinU

===Content Library===
Within vCenter, a content library called uniPHARM Content Library has been created. The purpose of the library is to store ISO and OVF files that are used when creating new VM's so that an OS can be booted - remember that the VMHosts don't have attached CD-ROM drives. Since creating new VM's is not a daily occurrence, the content library should be empty or mostly empty for the majority of the time in order to not consume storage space that is best served for VM's. The content library can only be used for virtual machines created on VMHost01 because that is the datastore where the content library is located. A newly created virtual machine on the other 2 hosts can't use the content library because it's not on shared storage. Also be aware that IE11 cannot upload ISO files greater than 4GB in size, you have to use a different browser. Please for the love of Bhudda, label what you are uploading to the Content Library so that others know what it is.

=Virtual Machines=
A virtual machine is like a bucket. The bucket contains a simulated processor, memory and a flat file that acts as a hard drive. An OS can be installed inside the bucket and can be given a network connection which is also simulated. The OS can't tell the difference between real hardware and simulated so it behaves normally. The bucket that contains the simulated hardware and the OS install, sits on top of the hypervisor. The hypervisor takes simulated hardware calls and maps them to real physical hardware so that each bucket can get a slice of processor and memory. The real hardware can house many buckets and the contents of each bucket don't mix or interact preserving the containerization. And finally buckets can be moved to different hardware without interrupting the OS contents via hocus pocus magic.
==VCSA==
The vCenter appliance VM was created with all the default settings as they were set by the ISO installer. It currently has 2 vCPUs and is using 1.5GB of memory. It has a very unique way of using 14 different thin provisioned VMDK files that act as its hard drives and is currently only using 25GB of real storage space. The VM hardware version is 10. This VM is very important to safe and healthy operation of our virtualization infrastructure.

==XClarity==
XClarity is a software based virtual appliance from Lenovo that shows hardware inventory and does hardware alerting. XClarity is a much more slimmed down modern packaged that is what IBM Director was supposed to be. The OS for the VM is a Linux something where access by the user is restricted. The VM is using 1 vCPU and 8GB of memory and is thin provisioned for 64GB of storage and is actually using only 12GB of storage. The IP address assigned to the VM is 172.30.18.2 and the URL for the sit is :
* https://xclarity.unipharm.local/ui/login.html
The local login for the above URL is:
* Username - adminit
* Password - NewVisionIT2051
* Active Directory SSO is currently not working in XClarity 1.4
The XClarity 1.4 software appears to be fairly straight forward and is able to talk to all the IMM's for our current small fleet of Lenovo servers. The software is set to email DarrenF and NorwinU if there is a hardware failure on any of the Lenovo servers. These alerts are in addition and perform the same function as the IMM's on each machine and is strictly limited to hardware failures. There is an excellent Android app that talks to XClarity over a VPN connection, however it requires that the XClarity appliance root and subordinate certificates be installed on the phone in order to gain access. This is security overkill but DarrenF did install those certificates on his phone and the app is worth this effort though others are free to disagree. This VM appliance was created from an OVA file on May 9, 2018. As of May 2018, this VM is not being backed up by anything and doesn't really need to be because it can be recreated from the OVA file. This VM is in no way business critical and can be powered off if needed.
* It was discovered after the setup of XClarity 1.4 was completed that there is a 2.0 that will be installed and configured again as a VM appliance at a later date. Both versions are supported by Lenovo but because the software is the free version, uniPHARM has no support contract.
* XClarity cannot talk to the IMM on the old SuperServer hardware because the hardware is not on the XClarity HCL. We are going to continue using SuperServer hardware for Veeam but XClarity cannot monitor that hardware. XClarity also cannot monitor Lenovo desktops or laptops - only Lenovo servers, storage SANs and Lenovo switches.

==Thermoprofile==
This is the first physical server to be converted into a virtual machine:
* Shrunk the 2 physical hard drives - C: from 150GB to 100GB and D: from 250GB to 150GB
* Configured the VM to use 1 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
This VM is ultimately going to go away because the applications on it (Spiceworks, KiwiSyslog, WDS/MDT need to be migrated onto a freshly made Windows Server 2012R2 VM where the OS license is re-used. The conversion of the Windows Server 2008R2 physical machine is acting as a test case for more critical conversions.
* Thermoprofile VM had its applications (Spiceworks and KiwiSsylog + WDS) moved to a new VM called WDS.unipharm.local on Friday June 8, 2018. The Thermoprofile VM was powered off and removed from the BackupExec jobs. The VM was deleted on June 13, 2018.

==Mail==
This is the third physical server to be converted into a virtual machine:
* The physical hard drive was thick provisioned and not shrunk
* Configured the VM to use 2 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on this server, please see the following link: http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:Mail_Server

==SuperServer==
This is the fourth physical server to be converted into a virtual machine:
* The physical hard drives were thick provisioned and shrunk during the conversion process
* The C: drive was configured to be 100GB, the D: was configured to be 1000GB and the E: was configured to be 500GB
* Configured the VM to use 2 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on this server, please see the following link: http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:SuperServer

==WindowsXP JetDirect==
DarrenF created this VM a long time ago in VMware Workstation so that the HP JetDirect boxes at each picking station can be controlled, configured and setup correctly. The JetDirect boxes are so old that their web administration pages only work with Microsoft Java, which only exists in a 2002 version of WindowsXP prior to SP1 or SP2. The web administration page of the JetDirect boxes works in the same manner as pages for all the other network attached printers. The admin page for the JetDirect boxes need to have the correct IP address and host name set plus other print and network options. New Windows OS's like Windows 7 and 10 are not able to display the JetDirect web admin page because the version of Java it needs does not exist in newer versions of Windows. Having a VM with an old version of Windows is the most convenient method if someone needs to configure a JetDirect box, otherwise, the VM can be left powered off. This VM is only taking up 16GB of storage space.

==Lucy==
This is the second physical server to be converted into a virtual machine:
* Shrunk the 2 physical hard drives - C: from 150GB to 75GB
* Configured the VM to use 2 vCPU and 4GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
* The VM does not have the serial ports that the physical machine had installed in its PCI slots

==Smithers==
This is the fifth physical server to be converted into a virtual machine:
* The physical hard drive was thick provisioned and shrunk during the conversion process
* The C: drive was configured to be 150GB
* Configured the VM to use 2 vCPU and 16GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
The physical server that was Smithers, had a red coloured USB licensing dongle that was used for the Kofax scanning software. Prior to the P2V, the licensing dongle was moved to the Gauss scanning station in Accounting. The Gauss software "package" on the Smithers VM, plus both scanning desktops now point to the USB dongle in Accounting for licensing compliance. The Smithers VM has no special USB pass-through because the USB dongle was moved prior to the P2V. For more information on this server, please see the following link: http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:Smithers

==WDS==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install for housing the Windows Deployment Service and Spiceworks and KiwiSyslog. WDS is where desktop and laptop images are stored and downloaded from when a workstation does a PXE boot to install Windows.
* The virtual hard drive was thin provisioned at 70GB
* The C: drive was configured to be 100GB
* Configured the VM to use 1 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13

==UWDDC1==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install to act as an Active Directory Domain Controller.
* The virtual hard drive was thin provisioned at 50GB
* The C: drive was configured to be 50GB
* Configured the VM to use 1 vCPU and 4GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on Active Directory, see the following link: (Yes, it shows UWDDC3, just ignore that, the documentation is valid and still correct)
http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:UWDDC3_Domain_Controller

==UWDDC2==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install to act as an Active Directory Domain Controller.
* The virtual hard drive was thin provisioned at 50GB
* The C: drive was configured to be 50GB
* Configured the VM to use 1 vCPU and 4GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13
For more information on Active Directory, see the following link: (Yes, it shows UWDDC3, just ignore that, the documentation is valid and still correct) http://elearning.unipharm.local:8080/mediawiki/index.php/Information_Systems:UWDDC4_Domain_Controller

==XTGUI==
This is a new virtual machine created (not converted) with a fresh Windows Server 2012R2 OS install to act as a server for the Iptor XT GUI.
* The virtual hard drive was thick provisioned at 40GB
* The C: drive was configured to be 40GB
* Configured the VM to use 2 vCPU and 8GB of memory
* Configured the VM to use a VMXNET3 and connect it to the Production LAN
* The VM hardware level is 13

==3CX Server Appliance==
This is a new virtual machine created from an ISO file downloaded from the 3CX website. The ISO is an automated install of Debian 64bit plus the 3CX software. The purpose of this VM is to act as a software PBX intended to replace the physical Toshiba PBX hardware. There is a Windows based version of 3CX, however it was deemed that using a prebuilt VM appliance was a better option.
* The virtual machine is configured with 1 vCPU, 4GB of memory and 50GB of thick provisioned disk space. <-- Woops my bad sorry on the thick provisioned space.
* The virtual machine is using the VMXNET3 network interface on the Production LAN at 172.30.18.27
* As of September 2018, this VM is not being backed up in any way
* The virtual machine has the OpenVM Tools installed
* The virtual machine is located on VMHost03
* There is a special VM network that has been created on VMHost03 (only) so that this VM can use the Shaw coax internet connection. Because of this unique network configuration, this VM cannot be vMotioned as the vSwitch is not present on VMHost01 or 02

==Zabbix NMS VM Appliance==
This is a Linux based virtual appliance that is used for network monitoring, graphing and alerting. The VM appliance is an LTS version of Ubuntu with the OSS package called Zabbix baked in. The open-vm-tools package is present so vCenter can control this VM. While this VM is not business critical, it took a lot of effort to setup and configure so try not to let it get wiped out with no backups.
* The virtual machine is configured with 2 vCPU, 4GB of memory and 40GB of thin provisioned disk space.
* The virtual machine is using the VMXNET3 network interface on the Production LAN at 172.30.18.13
* As of July 2019, this VM is not being backed up in any way
* The virtual machine has the OpenVM Tools installed
* The virtual machine is located on VMHost02

=Third Host Used For Testing=
On Monday May 28, 2018 a third host server was added to the VMware cluster. The hardware that was used was previously the "Smithers" server. The machine is a Lenovo x3550 M5 and the machine type is a 5463-AC1 and the serial number is E2ZR351. The server has 2 populated processor sockets and contains Intel Xeon E5-2620v3 processors. It has 32GB of memory and has 2 SSD drives that have been put into a RAID0 array. There are 4 network ports at the back of the server and they are used and setup in the same way as the original 2 hosts. This third host has the same IMM2 and the URL and credentials are below:
* https://bmvmhost03.unipharm.local
* adminit
* abc123
The third host has the same build of ESX as the other 2 hosts and it is also installed on a USB thumb drive but the thumb drive in the third host is not a Lenovo part and is not covered under warranty. The third host is also setup to boot directly from the thumb drive instead of the RAID0 SSD array. The RAID0 array has been configured as VMHost03DataStore01 and is 440GB in size. The root password for the installed hypervisor on the third host is the same compared to the other 2 hosts and the management IP used is 172.30.18.21 and the vMotion IP is 172.30.24.3. The third host has an existing Lenovo maintenance agreement that expires on August 26, 2020.

IMPORTANT INFORMATION: The purpose of the third host is for testing and housing a testing environment. The third host is not meant to permanently house any VMs that are used in production. If we care that a VM gets deleted because the datastore was blown away and recreated - then that VM never should have been on the third host. The third host also has a different version of Intel Xeon processor compared to the other 2 hosts. A 2620v3 versus a 2620v4. This matters for doing a vMotion of a running VM either to or from the third host. A vMotion of a powered on VM to or from the third host cannot happen until EVC mode is turned on for the entire cluster. As of May 2018, EVC mode is disabled because enabling it requires an outage where all the VMs in the cluster are powered off and this linked procedure be followed https://kb.vmware.com/s/article/1013111 . If a VM needs to vMotion to or from the third host, it must be powered off and it must fit within the 440GB datastore.

=VMware Tools=
VMware Tools is a package of tools and drivers that most virtual machines need to have installed within the guest OS. VMware Tools allows the hypervisor to talk and manipulate the virtual machine. The tools package also contains many of the virtual hardware drivers that Windows needs to properly enumerate all the "fake" hardware. For example, if a virtual machine is running Windows7, the OS will load the default VGA driver for the video card because natively Windows can't identify a virtualized video card. Same deal for a virtualized network card, Windows won't and probably shouldn't load a built in Microsoft driver. This is where VMware Tools comes in and provides those drivers for the OS. When creating a virtual machine or converting a physical machine, the VMware Tools installer should be installed as soon as possible. The installer can be triggered from the vSphere web interface. The only exceptions to the rule that VMware Tools needs to be installed is if the virtual machine is an "appliance" or pre-built OVF deployment.

=vCenter Standalone Converter=
The vCenter Standalone Converter is a badly named application that converts real physical computers into virtual machines running on a host. The application is Windows based and is typically installed on an IT laptop or workstation. The software creates a "triangle" where it talks to the source computer and the destination host. To begin with the Converter needs the FQDN of the source computer and local administrator credentials. AD administrator credentials are good enough if they are in the local admin group on the source machine. The Converter then uses a WMI connection to figure out what hardware and OS is present on the source machine. During the "Convert Machine" wizard, the Converter also opens a connection to the VCSA which manages the uniPHARM Cluster. Once the Converter understands the source and destination, the user doing the conversion has a chance to customize certain options like how many vCPUs are in the converted VM and how much memory there is and whether or not the source machine is powered off at the end of the conversion.

At the end of the wizard the Converter creates an empty "shell" virtual machine on the chosen destination host and begins to copy the source hard drive(s) to it. It is important to note that the drive copy is direct from the source to the destination and does not hop to the laptop controlling the conversion. The hard drive copy process is using VSS in the context of converting Windows machines so the VMware best practice is to turn off any non-Microsoft services that are running prior to the conversion process to minimize any chance that VSS can't get a lock on a file. It is also best practice to set the source machine in the convert wizard to power off at the end of the last sync so that the newly created VM can be up and running after the last sync and so that there is no duplicate IP address/name conflict. According to VMware documentation, the same "magic" that makes a vMotion happen is used in the Converter to take running physical machines and turn them into running VMs with only a second or two of pause.

When the Converter is finished copying the hard drive(s) and the last sync, the VM is set to either be up and running or powered off and ready to be powered on for the first time as a VM. In the second scenario, when the converted VM is powered on for the first time, it will recognize a bunch of new hardware. For example, an older IBM server would have a physical Broadcom NIC, when it is converted it will have a VMXNET NIC (and therefore use DHCP). The Converter will inject all the drivers the newly converted VM will need to recognize all the different virtualised hardware. There may be a need to do a reboot for a newly created VM as Windows typically asks for one when new hardware drivers are installed. The person doing the conversion can also choose to have the Converter automatically install the VMware Tools package if needed.

Be aware that the amount of time it takes to convert a physical machine to a VM is limited by network bandwidth. All potential source machines are on the same switch stack as the VMHosts so that's as fast as it is going to be. A source machine that has SSDs would be bottlenecked by a 1GB network connection, however an older slower source server with mechanical hard drives might not be. In any case, there is a hard limit on how fast a 1GB connection can move data. Also be aware that after the conversion process is finished and the VM is up and running, Windows may prompt to re-activate the OS license due to how much "hardware" has just changed. Our servers are using volume licenses so there is no reason a re-activation should fail.

The Converter application is currently installed on DarrenF's laptop, but can be installed on other I.S. laptops and is not tied to any licensing. The Converter is free to use but can't do anything useful without vCenter.

=VMware Licensing And Support=
uniPHARM has purchased a vSphere 6 Essentials Plus Kit that includes vCenter. This means that the license entitles us to have a maximum of 3 hosts each having a maximum of 2 CPU sockets and we are entitled to 1 instance of vCenter. The license is usable forever, but the attached technical support is renewed yearly. The licenses and keys are available through the MyVMware portal at
* www.vmware.com
* Username is darrenf@unipharm.com
* Password is visionit
* Account number 114624681
* Customer number 9027898369
uniPHARM also owns a license for a very old version of VMware Server 2.0 and Workstation 9.0 which are both EOL and not usable. While the current EPK licenses are installed correctly inside vCenter, if vCenter needs to be re-installed, the process is to run a licensing report from MyVMware, which generates a CSV file that is imported into vCenter. The next step is to assign the vCenter license to itself and the vSphere licenses to the hosts. VMware has announced that the End Of General support for vSphere 6.5 is November 15, 2021. A support contract for version 6.5 would not be purchasable after that date and if we wanted support, we would be prompted to upgrade to 6.7 or later. This end of general support date applies to the hypervisor install and the vCenter install. Again, the licenses are perpetual and never expire, the support contract is renewable and does expire.

=VM To Host Optimized Layout=
The following chart describes where a virtual machine should be located so as to balance the processing, memory and storage loads evenly among the 3 hosts in the cluster. VM's can be moved around or shuffled from host to host when doing maintenance but this is the preferred layout of which hosts house which VM's. Changes to this chart will be documented in the change log at the bottom of this page.
{| class="wikitable"
|-
! style="width: 15%"|VMHost01 !! style="width: 15%"|VMHost02 !! style="width: 15%"|VMHost03
|-
| XClarity || SuperServer || 3CX Appliance
|-
| Lucy || UWDDC2 || TestServer1
|-
| Mail || VMware vCenter Server Appliance || UbuntuDevVM
|-
| Smithers || XTGUI || Windows7 Ent For Adobe LifeCycle
|-
| UWDDC1 || Zabbix NMS VM Appliance || WindowsXP Pro HP JetDirect
|-
| WDS || || Windows10 Ent Eval
|-
| || || Windows10 Pro Eval
|-
|}

=Backups=
==Veeam==
As of May 2018, uniPHARM is evaluating Veeam Backup And Replication 9.5 as the platform used to do backups of VMware infrastructure and VM's. This section is mostly a placeholder but the sub sections are full of relevant documentation.
===Hardware===
On December 20, 2010, uniPHARM purchased an IBM x3650 M3 server from Anisoft, with asset number 827. The machine type is 7945-AC1 and the serial number is KQ128AR. This machine (as of May 2018) has no IBM/Lenovo hardware maintenance agreement so if and when it has any sort of hardware failure of any kind, IBM/Lenovo will not come onsite with parts to repair. This machine was used as the "SuperServer" until that OS was turned into a VM. This machine does have an older IMM that can be accessed from the following URL and IP:
* http://bmveeam.unipharm.local
* Username adminit
* Password abc123
* IP 172.30.18.46
Because this machine has a very old IMM, it cannot be managed by XClarity. As of May 2018, this machine has the latest firmware for the IMM and UEFI and hard drive controllers. It contains 2 different hard drive controllers. The ServeRAID M1015 and the ServeRAID M5015. This machine has 16 slots for hard drives, numbered 0 to 15 and currently all the slots are populated with 15K-RPM spinning hard drives. The hard drives in slots 0 and 1 are 136GB drives and 2 through 15 are 300GB drives. The 136GB drives are in a RAID1 set and are used as the bootable C: drive with an install of Windows Server 2012R2. The drives in slots 2 to 7 are in a RAID0 as well as drives 8 to 15 in another RAID0 on the second controller. The M1015 and M5015 cannot create a JOBD or RAID0 across controllers because the controllers don't talk to each other. In order to get the maximum amount of disk storage for Veeam, a striped Dynamic Disk was created in Windows as a layer on top of the 2 RAID0 sets to make 1 large D: that is 3.8TB. A failure of any 1 hard drive in slots 2 through 15 will result in a LOSS OF ALL DATA on the D: drive. The 136GB RAID1 set acting as the OS drive on C: can tolerate the failure of a single hard drive without data loss - a failure of both drives will result in data loss. The above arrangement of hard drives is not a best practice, but is an acceptable risk given the nature of backups and budgets.

This machine has a pair of 1GB network cards that are using QLogic drivers as QLogic bought out Broadcom and when Windows Server 2012R2 was installed in May of 2018, the QLogic drivers were installed, however the chips for the NICs are Broadcom. Only the first NIC is being used on IP 172.30.18.9, however the second NIC can be used in a team to provide a 2GB connection with the core Server Room switches are replaced. The older IMM is using a dedicated port on the back of the machine. This server has 1 out of 2 processor sockets occupied with an 8 core Xeon E5620 and 8GB of memory.

===Veeam Software Installation===
In May of 2018, Veeam Backup And Replication 9.5 was installed. This package also installs the Express version of Microsoft SQL 2012 plus supporting files for SQL. Along with Veeam Backup and Replication, Veeam Enterprise Manager and Veeam ONE were also installed as they come free with the perpetual license. Veeam Enterprise Manager is a web based front end for the Veeam Console and has a subset of functions and features compared to the Console. Veeam ONE is a reporting and BI tool that displays graphs and charts and statistics in regards to a VMware/Veeam environment. While Veeam ONE is included free with the perpetual license, it is geared to much larger environments compared to ours - as in hundreds of hosts and thousands of VMs and lots and lots of storage. The full Veeam Console should be also installed on an IT laptop so administrators can make configuration changes if needed without using remote desktop to the physical server. This is very similar to how BackupExec worked. The Veeam Backup And Replication package needs to use the administrator@vsphere.local account to access the VCSA and any subordinate VM's. This account is critical to successful backups and if the password is changed, that change needs to also be changed within the credential manager inside Veeam. The Active Directory domain administrator account is also used to access the remaining physical servers via the Veeam Agent, so if that password is changed, it also needs to be changed within the credential manager inside Veeam.

===Veeam Licensing===
We will probably get perpetual licensing with renewable annual support
===What Is Veeam Backing Up?===
Veeam will be able to backup the VM's and itself and whatever few remaining physical servers that are still in use.
===Backup Strategy And Scheduled Jobs===
Placeholder something something something.
===How Veeam Uses Tape Hardware===
Placeholder something something something.
===Veeam Technical Support===
Put the terms of the support contract in here plus the phone number and expiry dates.

=Change Log - Try And Record Any Major Configuration Or Software/Hardware Changes To The Infrastructure Here=
==2018==
# Both servers have their UEFI/BIOS set to only boot from the USB thumb drive
# Both servers have their UEFI/BIOS set to use maximum performance in the power settings as per this KB article https://www.ibm.com/support/home/docdisplay?lndocid=migr-5098137
# Initial ESX version installed on March 21, 2018 is 6.5.0 Build 7388607
# VMHost01DataStore01 created as the first datastore
# The local datastores are seen as non-ssd by ESX because they are behind a RAID controller and not part of a vSAN
# VCSA password is NewVisionIT@2051
# vcsa.unipharm.local is at 172.30.18.23
# VCSA virtual machine set to automatically start when the hypervisor on VMHost01 boots
# VCSA added to Active Directory as a computer object for SSO on March 22, 2018, located in the Servers OU
# Configed SSO according to https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.vcsa.doc/GUID-08EA2F92-78A7-4EFF-880E-2B63ACC962F3.html
# Added DarrenF and NorwinU AD user accounts as being able to log into VCSA web client
# vMotion IP on VMHost01 is 172.30.24.1 IP on VMHost02 is 172.30.24.2
# 8 minutes to vMotion 60GB Win7 cagepc as a test P2V on March 23, 2018 with no VLAN
# Created content library and uploaded the xclarity OVF and 3CX ISO files March 23, 2018
# Added VLAN 5 to vMotion Network - NorwinU configed physical switch to use VLAN 5 on ports 4 and 16 on Stacked Switch 1of4 March 23, 2018
# Changed VLAN 5 to 3 for some reason and changed the TCPIP stack for the vMotion Network for optimization
# Added DarrenF and NorwinU AD accounts as permitted Administrators to the entire VCSA hierarchy and got SSO working correctly
# Configured VUM to scan for updates each Monday of every week and email DarrenF
# Ran a VUM Remediation to install Spectre VIBs via the VUM wizard both hosts now at 6.5 build 7967591 March 26, 2018
# P2Ved the Thermoprofile physical server onto VMHost01 March 26, 2018
# Set the Thermoprofile VM to autostart on VMHost01 March 28, 2018
# Tweeked CPU usage alarm to have more time at 90 and 100% - updated documentation April 3, 2018
# P2Ved the Lucy physical server onto VMHost01 April 7, 2018
# P2Ved the Mail physical server onto VMHost01 April 15, 2018
# Logged into the VCSA PSC Controller and set the root password to never expire instead of expiring every 90 days April 25, 2018
# Set the administrator@vsphere.local account to expire its password every 9999 days April 25, 2018
# Turned on the BASH shell for the VCSA PSC and set the correct time zone for NTP April 25, 2018
# Downloaded the VMware trusted root CA certificate from https://vcsa.unipharm.local and installed that into the Trusted Root store on DarrenF's laptop so that the webclient is trusted by IE11 and makes uploading of ISO files to the Content Library possible using an SSO login May 3, 2018
# P2Ved the SuperServer physical server onto VMHost02 May 5, 2018
# Uploaded the ISO for Windows Server Standard 2012R2 to the Content Library May 7, 2018
# Created the XClarity VM appliance from an OVA file in the Content Library - May 9, 2018
# Created a VM for NancyN to use for Adobe LifeCycle - see the notes pane in the Flash client for details on this otherwise undocumented VM - May 16, 2018
# P2Ved the Smithers physical server onto VMHost01 May 19, 2018
# Added hardware that used to be the Smithers server as a third host to the cluster (VMHost03) May 28, 2018
# VMware support ticket 18814250705 for how to enable EVC mode opened and then closed with no changes because enabling EVC requires all VMs to be off May 30, 2018
# VMware support ticket 18815369505 for how to get a database backup from the VCSA to FTP opened May 30, 2018
# New VM created called WDS.unipharm.local with the purpose of housing the WDS feature and Spiceworks and KiwiSyslog - June 8, 2018
# New VMs created called UWDDC1 and UWDDC2 to act as Active Directory Domain Controllers - June 11, 2018
# Thermoprofile virtual machine deleted from the datastore on June 13, 2018
# XClarity virtual appliance deleted and then recreated using the version 2.0 OVA file
# Created new virtual machine called XTGUI with the purpose of it being used as a server for the Iptor DC1 GUI - June 21, 2018
# Created an internal backup of the VCSA and uploaded that to ftp.unipharm.com - August 27, 2018
# Uploaded the VCSA upgrade ISO (6.5.0.22000-9451637) to VMHOST01DATASTORE01 - August 27, 2018
# Upgraded the VCSA to 6.5 U2C build 9451637- August 27, 2018
# Upgraded ESX hypervisors on hosts to 6.5 U2C build 9298722 - September 1, 2018
# Upgraded all VMware Tools installed in all Windows VM's to 10305 - September 1, 2018
# Changed configuration setting "VMkernal.BootHyperthreadingMitigation" from False to True on VMHost03 due to its older processor - September 5, 2018
# Cleared BIOS event logs on VMHost03 and undid the hyperthreading changes from above - September 5, 2018
# Created a new VM called 3CX Server Appliance from an ISO in the Content Library to be used as a PBX - September 26, 2018
# Created new virtual port groups on vSwitch2 on each host to enable VMs to be on Alt-Guest VLAN. The port group is tagged to VLAN 2. - September 28, 2018
# vMotion 3CX appliance to vmhost03 where I can play with it. -17:05, 28 September 2018 (PDT)
# Increased hard drive from 70GB to 100GB on the WDS virtual machine to accommodate new desktop images - October 19, 2018
# Created TestServer1 on VMHost03 - a Windows 2016 server for generic testing purposes. NetStore and TLAForm will be installed on it for testing with DC1.
# Created virtual switch VoIP LAN (VLAN 6). - November 29, 2018
# 3CX Server VM reinstalled and connected to VoIP VLAN. - November 29, 2018
# Created UbuntuTestVM VM, as a generic test VM that can be connected to different VLANs for various network testing / diagnostics purposes. - November 29, 2018
==2019==
# DarrenF created 2 VMs for Windows10 testing on April 4, 2019. The VM's are on VMHost02.
# DarrenF removed an old snapshot for the XTGUI Server and for the vCenter VM on May 8, 2019.
# DarrenF made a backup of the VCSA on May 17, 2019 and saved the backup file to the SuperServer.
# DarrenF upgraded the VCSA from 6.5.0-22000 to 6.5.0.24000 on May 22, 2019 and finished that with a reboot.
# DarrenF upgraded all 3 hosts to ESX version 6.5.0-13635690 on May 24, 2019
# DarrenF upgraded the UEFI and IMM2 and DSA firmware on all 3 hosts on May 24, 2019.
# DarrenF upgraded the VMware Tools install on some VM's that could be rebooted during the day on May 27, 2019 - remaining VM's will be upgraded at a later date.
# DarrenF updated this documentation with information on which VM's should located on each host - May 27, 2019.
# DarrenF created a new VM for the Zabbix NMS VM Appliance using an ISO located in the Content Library - July 10, 2019
# DarrenF enabled SNMP on all three hosts and the VCSA so that Zabbix could monitor via SNMP - July 12, 2019.
[[Category: Virtualization]]

Information Systems:LAN infrastructure at uniPHARM

2023-08-02T18:25:46Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || NewVisionIT! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:LAN infrastructure at uniPHARM

2023-06-26T16:09:40Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || Newvisionit! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || Cisco CBS250 || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:LAN infrastructure at uniPHARM

2023-05-25T17:39:48Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || Newvisionit! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || 3Com 4200G? || Candy Mezzanine || adminit || Newvisionit! || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:Remote Desktop Gateway

2023-01-16T21:45:45Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password: windows login password

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

''Tips: how to generate a CSR on the server:https://www.bitdefender.com/support/How-to-create-a-Certificate-Signing-Request-(CSR)-on-Windows-Server-and-Mac-2237.html''

'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Information Systems:Remote Desktop Gateway

2023-01-16T21:44:21Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

''Tips: how to generate a CSR on the server:https://www.bitdefender.com/support/How-to-create-a-Certificate-Signing-Request-(CSR)-on-Windows-Server-and-Mac-2237.html''

'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Information Systems:Remote Desktop Gateway

2023-01-16T21:44:02Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

tips: how to generate a CSR on the server:https://www.bitdefender.com/support/How-to-create-a-Certificate-Signing-Request-(CSR)-on-Windows-Server-and-Mac-2237.html

'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Information Systems:Remote Desktop Gateway

2023-01-16T21:43:54Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.
tips: how to generate a CSR on the server:https://www.bitdefender.com/support/How-to-create-a-Certificate-Signing-Request-(CSR)-on-Windows-Server-and-Mac-2237.html

'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Information Systems:Remote Desktop Gateway

2023-01-16T21:43:40Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.
tips: how to generate a CSR on the server:https://www.bitdefender.com/support/How-to-create-a-Certificate-Signing-Request-(CSR)-on-Windows-Server-and-Mac-2237.html
'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Information Systems:Remote Desktop Gateway

2023-01-16T21:40:34Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Information Systems:Remote Desktop Gateway

2023-01-16T21:40:06Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

'''Connection Authentication Policy'''

The user must be added to the "RD-users" group in AD

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

Information Systems:Remote Desktop Gateway

2023-01-16T21:39:59Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

'''SSL certificate'''

We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

'''Connection Authentication Policy'''
The user must be added to the "RD-users" group in AD

Domain name：rmtgw.unipharm.com

UNIPHARM\username

password

Information Systems:Remote Desktop Gateway

2023-01-16T21:35:47Z

Danielc:

Information Systems:Remote Desktop Gateway

2023-01-16T21:35:38Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1

'''SSL certificate'''
We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

rmtgw.unipharm.com

UNIPHARM\username

password

Information Systems:Remote Desktop Gateway

2023-01-16T21:35:27Z

Danielc:

Remote Desktop Gateway

Developed Spring 2020 due to COVID WFH

lives on DC1
'''SSL certificate'''
We purchased the SSL certificate from the network solution, and it will be automatically renewed every September. We need to generate a CSR on the server to activate the SSL certificate.

rmtgw.unipharm.com

UNIPHARM\username

password

Information Systems:LAN infrastructure at uniPHARM

2023-01-16T16:47:41Z

Danielc:

==Overview==
This is the main page for the LAN (wired network configuration) at uniPHARM.

==Switches==
This table outlines the physical network switches that make up the network.

{| class="wikitable sortable"
|-
! Hostname !! IP address || Switch model !! Location !! Username !! Password !! Notes
|-
| '''coresw''' || 172.30.16.4 || Cisco CBS350 || Server room || adminit || Newvisionit! || '''Core switch.''' Stack of 3.
|-
| atpsw || 172.30.16.3 || 3Com 4200 || Server room || admin || visionit || Feeds data to POE injectors for Mirador temp. sensors '''(Retired)'''
|-
| accountingsw || 172.30.16.11 || Cisco SG350-28P || Accounting Wallmount Network Rack || adminit || NewVisionIT || POE, ~175W power budget
|-
| buyerswcisco || 172.30.16.18 || Cisco SG350-28P || Buying department closet || adminit || visionit|| -
|-
| itsw || 172.30.16.6 || 3Com 4200G || IT department ceiling tile. Yup. || admin || visionis || -
|-
| cagesw || 172.30.16.12 || 3Com 3870 || Computer lab || admin || visionit
|-
| dumpsw.unipharm.local || 172.30.16.7 || 3Com 4200G? || Electrical Room? || admin || visionds || -
|-
| pickingsw || 172.30.16.8 || 3Com 3870? || Rx picking zone network rack || adminit || visionit || -
|-
| receivingswcisco || 172.30.16.17 || Cisco SG350-28P || DC Manager's Office || adminit || visionit || -
|-
| wallsw || 172.30.16.9 || 3Com 4200G? || Candy Mezzanine || admin || visionns || Functions merely to bridge the physical wiring between Receiving area and core network
|-
| jeremymsw || 172.30.16.16 || TP-Link SG105E || Jeremy's office || admin || visionit || Used for testing Yealink, web-managed smart switch
|-
| itlabswcisco || 172.30.16.19 || Cisco SG350-10MP || IT Lab/Cage || adminit || visionit ||
|}

* External link to backdoor access and hidden menus for the 3com 3870 switches http://etherhack.wikia.com/wiki/3Com_3870
* There is a spare, ready to use 3com 3870 24 port switch located at the very bottom of the networking rack in the server room. The switch has been reset to factory defaults and the username is admin and the password is blank. The switch is ready to be put into the core stack if needed.

==VLANs==
We started using VLANs in 2016, for the same reason why anyone would use VLANs - to manage/separate multiple networks using one physical switch infrastructure. The VLAN implementation being used is the standard 802.1q. The following table outlines the VLAN infrastructure.

{| class="wikitable sortable"
|-
! VLAN ID !! Name !! L3 Network / IP Range !! Description !! Notes
|-
| '''1''' || Main LAN || 172.30.16.0/21 (172.30.16.1 - 172.30.23.255) || Default VLAN, untagged across the network for simplicity (so that every device doesn't have to be configured to talk this VLAN, or even be VLAN-aware at all). || Routed out Telus Fibre
|-
| '''2''' || Alt LAN (Staff/ guest BYOD, Shipping terminals) || 192.168.0.1/23 (192.168.0.1 - 192.168.1.254) || Colloquially known as the "Guest VLAN", but staff wifi devices are not technically guest devices. Currently, shipping computers are on this network, but they should be moved to VLAN 7 when it is created. || Routed out Shaw Business Internet
|-
| '''3''' || vMotion LAN || ?? || Small network to isolate vMotion traffic between the 3 virtual hosts. || -
|-
| '''4''' || Shaw WAN interfaces || Network of the Shaw static WAN IP (/32) || Network to isolate WAN traffic between Shaw modem and Sophos WAN interface from the rest of the network. Lots of ARP going on here! || -
|-
| '''5''' || Telus WAN interfaces || Network of our Telus WAN IPs (/27) || Network to isolate WAN traffic between Telus modem and Sophos WAN interface from the rest of the network. || -
|-
| '''6''' || VoIP LAN || 192.168.44.0/24 || Contains PBX and IP phones || Routed out Telus and Shaw (Sophos multipath)
|}

=Helpful Stuff=
The command to view what MAC address(s) is in use on a port for the Cisco SG350 switch is as follows. You will need to login to the switch via SSH in order to do this:
* show mac address-table interface gi1 (or ge1 sometimes too)
The port name is visible from the switches web interface and goes from gi1 to gi28 or ge1 to ge28. Then cross checking the MAC address in Spiceworks for example will allow you to see who is plugged into what port - however all the Cisco switches should already have human readable labels attached to all in-use ports as of July 2019.
[[Category: Networking]]

Information Systems:UWDOSS - Open Source Development Server

2023-01-06T22:29:21Z

Danielc:

==Overview==
uwdoss.unipharm.local is a production server VM that hosts InfoNext as well as the integrations database. The software components installed on this machine constitute the majority of the modernization stack uniPHARM is using for new development, with the other component being [[Information Systems:Iptor Integrator|Iptor Integrator]], integration middleware that exists on xtgui.unipharm.local

The server runs '''Debian Linux'''.

===History===
Prior to this server, uniPHARM ran strictly Windows Server for all server applications and workloads. However, there began to be a need for open-source software. For example, Moodle and Mediawiki have been in production since 2015. These are currently being hosted on Windows, using a pre-packaged WAMP stack that arguably is better-suited for development environments. It was decided a Linux server would be useful to uniPHARM's growing need and usage of open-source software.

==Installed Software==
The major software components running on this server are:
* PostgreSQL relational database (no longer used)
* MariaDB (MySQL) relational database
* Apache web server - Hosts the Django application through mod_wsgi, as well as the static files (HTML/CSS/Javascript)
* Redis DB - In-memory cache for loading frequently used datasets (e.g. customer name and number)
* Python - To run Django, and other supporting scripts.
* Django, Django REST Framework, which are Python packages
* Other Python packages, such as venv and mysqlclient to help support the solution

==Projects==
* InfoNext - extension of Infonet (company intranet)
* uwdpy - random scripts/utilities for housekeeping, reports. Replaced by Integrator, but this development environment may still be useful (Python is often quicker to get going with, and connectivity to IBM i is sufficient i.e. XML Toolkit, ODBC)

==Server Administration==
General Linux administration skills are required for the administration of this server. uniPHARM currently has these skills in-house.
This server does not have a GUI. Instead, command-line prompt through vSphere remote console or SSH can be used. Credentials for the user and admin user are as follows:

'''Generic user'''
Username: unipharm
Password: visionit

'''Dev/admin user'''
Username: uwddev
Password: CH3CH3O

'''Superuser (root)'''
Root user: root
Password: visionit

====Software updates====
The software listed above are all installed as Debian packages and managed with apt/aptitude. The setup is such that there should be no issues doing upgrades and distribution upgrades using the standard Debian upgrade process (i.e. using <code>apt-get dist-update</code> and <code>apt-get upgrade</code>, or the aptitude counterparts).
====Python Virtual Environment (venv)====
InfoNext uses a virtual environment (through the venv Python module), which is located in <code>/uwdapps/lib/.venv/inx</code>. To activate a particular venv in a console/SSH session:
<code>source /root_path_of_venv/bin/activate</code>
For InfoNext this is:
<code>source /uwdapps/env/bin/activate</code>
uwdpy also has its own virtual environment.
====ODBC====
pyodbc is installed in the inx Python virtual environment. This is for facilitating direct connections to IBM Db2. A DSN for the connection to bart is configured in /etc/odbc.ini. However, this connection is not registered in Django.

==Troubleshooting and how-to==
====Restart web server====
* To restart Apache: <code>sudo systemctl restart apache2</code>
====Renew SSL certificate====
InfoNext uses a LetsEncrypt certificate for https. certbot is installed on this server to manage the cert (it was used to generate it as well). LetsEncrypt certs can use HTTP or DNS validation. For HTTP validation, the site must be accessible through HTTP. Since the site is not publicly accessible (only VPN and intranet), certbot renewal has been switched to DNS challenge using the DNSME (DNS Made Easy) certbot plugin. DNSME API credentials are stored in /home/unipharm/
* Enable nat rules on the firewall, DNAT rules have been established, can be found in SOPHOS-Network Protection-NAT, the name is InfoNext Server DNAT
* Run <code>certbot renew</code> on linux server .
* Disable the DNAT and firewall rules.

==Other Notes==
* This server is backed up using Veeam.

[[Category: Servers]]

Information Systems:UWDOSS - Open Source Development Server

2023-01-04T05:40:46Z

Danielc:

==Overview==
uwdoss.unipharm.local is a production server VM that hosts InfoNext as well as the integrations database. The software components installed on this machine constitute the majority of the modernization stack uniPHARM is using for new development, with the other component being [[Information Systems:Iptor Integrator|Iptor Integrator]], integration middleware that exists on xtgui.unipharm.local

The server runs '''Debian Linux'''.

===History===
Prior to this server, uniPHARM ran strictly Windows Server for all server applications and workloads. However, there began to be a need for open-source software. For example, Moodle and Mediawiki have been in production since 2015. These are currently being hosted on Windows, using a pre-packaged WAMP stack that arguably is better-suited for development environments. It was decided a Linux server would be useful to uniPHARM's growing need and usage of open-source software.

==Installed Software==
The major software components running on this server are:
* PostgreSQL relational database (no longer used)
* MariaDB (MySQL) relational database
* Apache web server - Hosts the Django application through mod_wsgi, as well as the static files (HTML/CSS/Javascript)
* Redis DB - In-memory cache for loading frequently used datasets (e.g. customer name and number)
* Python - To run Django, and other supporting scripts.
* Django, Django REST Framework, which are Python packages
* Other Python packages, such as venv and mysqlclient to help support the solution

==Projects==
* InfoNext - extension of Infonet (company intranet)
* uwdpy - random scripts/utilities for housekeeping, reports. Replaced by Integrator, but this development environment may still be useful (Python is often quicker to get going with, and connectivity to IBM i is sufficient i.e. XML Toolkit, ODBC)

==Server Administration==
General Linux administration skills are required for the administration of this server. uniPHARM currently has these skills in-house.
This server does not have a GUI. Instead, command-line prompt through vSphere remote console or SSH can be used. Credentials for the user and admin user are as follows:

'''Generic user'''
Username: unipharm
Password: visionit

'''Dev/admin user'''
Username: uwddev
Password: CH3CH3O

'''Superuser (root)'''
Root user: root
Password: visionit

====Software updates====
The software listed above are all installed as Debian packages and managed with apt/aptitude. The setup is such that there should be no issues doing upgrades and distribution upgrades using the standard Debian upgrade process (i.e. using <code>apt-get dist-update</code> and <code>apt-get upgrade</code>, or the aptitude counterparts).
====Python Virtual Environment (venv)====
InfoNext uses a virtual environment (through the venv Python module), which is located in <code>/uwdapps/lib/.venv/inx</code>. To activate a particular venv in a console/SSH session:
<code>source /root_path_of_venv/bin/activate</code>
For InfoNext this is:
<code>source /uwdapps/env/bin/activate</code>
uwdpy also has its own virtual environment.
====ODBC====
pyodbc is installed in the inx Python virtual environment. This is for facilitating direct connections to IBM Db2. A DSN for the connection to bart is configured in /etc/odbc.ini. However, this connection is not registered in Django.

==Troubleshooting and how-to==
====Restart web server====
* To restart Apache: <code>sudo systemctl restart apache2</code>
====Renew SSL certificate====
InfoNext uses a LetsEncrypt certificate for https. certbot is installed on this server to manage the cert (it was used to generate it as well). LetsEncrypt certs can use HTTP or DNS validation. For HTTP validation, the site must be accessible through HTTP. Since the site is not publicly accessible (only VPN and intranet), certbot renewal has been switched to DNS challenge using the DNSME (DNS Made Easy) certbot plugin. DNSME API credentials are stored in /home/unipharm/
* Enable the DNAT and firewall rule in the firewall (or if already enabled, ensure that the 'Any IPv4' object is added to the Source of the rule)-in Sophos NAT-25.
* Run <code>certbot renew</code>.
* Disable the DNAT and firewall rules.

==Other Notes==
* This server is backed up using Veeam.

[[Category: Servers]]

Information Systems:New Computer Setup

2022-11-18T20:15:50Z

Danielc: /* Setup Steps */

This Page will give you brief information about what to do to set up a new computer.

==Windows 10 Image==
Generally, Lenovo's laptop images are good so, there is no need to format and use a generic Windows 10 image.

==Setup Steps==
# Select '''Canada''' in region and click '''Yes'''.
# In keyboard layout select '''US'''.
# Skip the second keyboard option.
# Connect with the internet, you can connect with the ethernet cable or connect to a Wifi.
# Create a local user with '''username: adminit Password: visionit''' or '''username: Unipharm Password: Unipharm''' and click '''next'''.
# Select '''NO in location''' option and click '''Accept'''.
# Select '''NO in Find my Device''' user can't connect to their MS account due to Group Policy, So, the option is pointless.
# Select '''Send Required diagnostic data''' and select '''Accept'''.
# Select '''NO in Improve inking and typing''' option and click '''Accept'''.
# Select '''NO for tailored experiences with diagnostic data''' and click '''Accept'''. This will not reduce the number of ads, but this option will not send data to Microsoft.
# Select '''NO for advertising ID''' and click '''Accept'''.
# Use '''Not now for Cortana'''.
# Now Windows is set up. It will take some minutes to complete the setup process.

==Computer Name Notations==
After windows is setup up, We want to change the default computer name to a more appropriate name before we connect the computer to the Domain. The computer naming convention is as follow:
 ''Department'' '''''-''''' ''User's full Firstname and last name initial'' '''''-''''' ''number depending how many computer a user have'' For Example:'''''IT-JackM-01''''' OR '''''IT-JackM-02''''' OR '''''DC-Common-01''''' (Common Computers) If there are two people with same name, last name initials with help in identifying between them.

===Notations===

{| class="wikitable"
|-
! Department !! Notation
|-
| Finance|| FIN
|-
| warehouse || DC
|-
| Information Technology || IT
|-
| Purchasing || PUR
|-
| Buying || BUY
|-
| Customer Service || CS
|-
| Executives || EXC
|-
| Spare || SPARE
|-
| Others || UWD
|}

==Softwares to install==
This section will guide through different software required on a machine. Not all machines require all software so, be decide where the computer will be deployed and install accordingly.

{| class="wikitable"
|-
! No. !! Software !! Which Computer to Install !! Where to Find !! Notes
|-
| 1. || Mocha TN5250 || All Computers || Can be found on superserver (\\superserver\UWD Software\MochaSoft) (registration: UNIPHARM / 040965) || ERP System (Green Screen)
|-
| 2. || ASW || All Computers || Can be found on superserver (\\superserver\UWD Software\ASW\ASW GUI\Disk1) || GUI Version of Mocha TN5250
|-
| 3. || Chrome || All Computers || Can be found on superserver (\\superserver\UWD Software\Chrome) || Google Chrome
|-
| 4. || Adobe Acrobat Reader || All Computers || Download from web || Just the free version
|-
| 5. || Microsoft Office Home & Business 2019 || All Computers || Can be found on superserver (\\superserver\UWD Software\Microsoft Office), Keys Can be found at (\\superserver\Tech\common\Business Case Documents\2020\MS Office Upgrade & Email Migration (Complete)\Microsoft Office 2019 Licence Keys copy.xlsx) || Read More about MS Office
|-
| 6. || ACR Trend Reader || Warehouse || Can be foundon superserver (\\Superserver\UWD Software\ACR TrendReader) || Reads Thermostat Temp
|-
| 7. || 3CX Client || Customer Service || Can be found on superserver (\\Superserver\UWD Software\3cx) || To make/receive calls from computer
|-
| 8. || VIP Doc View || All Computers || Can be found on Superserver (\\Superserver\UWD Software\Gauss\VIP DocView) || Scanning Liberary
|-
| 9. || SRFax || All Computers || Can be Found on Superserver (\\Superserver\UWD Software\SRFax Printer Driver) || Driver to convert doc for fax
|-
| 10. || Fixme.it || All Computers || Can be found on Superserver (\\Superserver\UWD Software\Techinline Fix Me Unattended Client) || Unattented clients for remove service
|-
| 11. || ACS Analyser || Managers || Can be found on Superserver (\\Superserver\UWD Software\ASW Analyzer Newest Version) || Database software need configuration
|-
| 12. || iBMi Access || Selective Computers || Can be found on Superserver (\\Superserver\UWD Software\IBMiAccess_v1r1_WindowsAP_English) || Utility software for IBMi
|-
| 13. || Vantage || Laptops || Can be found in MS Store || For lenovo updates
|-
| 14. || SEP || All Computers || NA || NA
|}

Information Systems:New Computer Setup

2022-11-18T20:15:35Z

Danielc: /* Setup Steps */

This Page will give you brief information about what to do to set up a new computer.

==Windows 10 Image==
Generally, Lenovo's laptop images are good so, there is no need to format and use a generic Windows 10 image.

==Setup Steps==
# Select '''Canada''' in region and click '''Yes'''.
# In keyboard layout select '''US'''.
# Skip the second keyboard option.
# Connect with the internet, you can connect with the ethernet cable or connect to a Wifi.
# Create a local user with '''username: adminit Password: visionit''' or'''username: Unipharm Password: Unipharm''' and click '''next'''.
# Select '''NO in location''' option and click '''Accept'''.
# Select '''NO in Find my Device''' user can't connect to their MS account due to Group Policy, So, the option is pointless.
# Select '''Send Required diagnostic data''' and select '''Accept'''.
# Select '''NO in Improve inking and typing''' option and click '''Accept'''.
# Select '''NO for tailored experiences with diagnostic data''' and click '''Accept'''. This will not reduce the number of ads, but this option will not send data to Microsoft.
# Select '''NO for advertising ID''' and click '''Accept'''.
# Use '''Not now for Cortana'''.
# Now Windows is set up. It will take some minutes to complete the setup process.

==Computer Name Notations==
After windows is setup up, We want to change the default computer name to a more appropriate name before we connect the computer to the Domain. The computer naming convention is as follow:
 ''Department'' '''''-''''' ''User's full Firstname and last name initial'' '''''-''''' ''number depending how many computer a user have'' For Example:'''''IT-JackM-01''''' OR '''''IT-JackM-02''''' OR '''''DC-Common-01''''' (Common Computers) If there are two people with same name, last name initials with help in identifying between them.

===Notations===

{| class="wikitable"
|-
! Department !! Notation
|-
| Finance|| FIN
|-
| warehouse || DC
|-
| Information Technology || IT
|-
| Purchasing || PUR
|-
| Buying || BUY
|-
| Customer Service || CS
|-
| Executives || EXC
|-
| Spare || SPARE
|-
| Others || UWD
|}

==Softwares to install==
This section will guide through different software required on a machine. Not all machines require all software so, be decide where the computer will be deployed and install accordingly.

{| class="wikitable"
|-
! No. !! Software !! Which Computer to Install !! Where to Find !! Notes
|-
| 1. || Mocha TN5250 || All Computers || Can be found on superserver (\\superserver\UWD Software\MochaSoft) (registration: UNIPHARM / 040965) || ERP System (Green Screen)
|-
| 2. || ASW || All Computers || Can be found on superserver (\\superserver\UWD Software\ASW\ASW GUI\Disk1) || GUI Version of Mocha TN5250
|-
| 3. || Chrome || All Computers || Can be found on superserver (\\superserver\UWD Software\Chrome) || Google Chrome
|-
| 4. || Adobe Acrobat Reader || All Computers || Download from web || Just the free version
|-
| 5. || Microsoft Office Home & Business 2019 || All Computers || Can be found on superserver (\\superserver\UWD Software\Microsoft Office), Keys Can be found at (\\superserver\Tech\common\Business Case Documents\2020\MS Office Upgrade & Email Migration (Complete)\Microsoft Office 2019 Licence Keys copy.xlsx) || Read More about MS Office
|-
| 6. || ACR Trend Reader || Warehouse || Can be foundon superserver (\\Superserver\UWD Software\ACR TrendReader) || Reads Thermostat Temp
|-
| 7. || 3CX Client || Customer Service || Can be found on superserver (\\Superserver\UWD Software\3cx) || To make/receive calls from computer
|-
| 8. || VIP Doc View || All Computers || Can be found on Superserver (\\Superserver\UWD Software\Gauss\VIP DocView) || Scanning Liberary
|-
| 9. || SRFax || All Computers || Can be Found on Superserver (\\Superserver\UWD Software\SRFax Printer Driver) || Driver to convert doc for fax
|-
| 10. || Fixme.it || All Computers || Can be found on Superserver (\\Superserver\UWD Software\Techinline Fix Me Unattended Client) || Unattented clients for remove service
|-
| 11. || ACS Analyser || Managers || Can be found on Superserver (\\Superserver\UWD Software\ASW Analyzer Newest Version) || Database software need configuration
|-
| 12. || iBMi Access || Selective Computers || Can be found on Superserver (\\Superserver\UWD Software\IBMiAccess_v1r1_WindowsAP_English) || Utility software for IBMi
|-
| 13. || Vantage || Laptops || Can be found in MS Store || For lenovo updates
|-
| 14. || SEP || All Computers || NA || NA
|}

Information Systems:Xerox printers

2022-11-03T22:18:03Z

Danielc: /* Xerox Device Agent Software */

uniPHARM uses Xerox printers for office printing (as opposed to Lexmark printers used in the warehouse). These printers are under either lease or managed print service agreements. Our service provider is West-X Network Solutions, but technical support is still done with Xerox.

==Inventory==

{| class="wikitable sortable"
|-
! Printer hostname !! Model !! Serial !! Location / purpose !! Contract type
|-
| reccopier || Xerox VersaLink B405DN || 9HB368640 || Receiving area office || Managed Print Services
|-
| rtncopier || Xerox VersaLink B405DN || 9HB368638 || Returns department || Managed Print Services
|-
| elaho || Xerox Versa C60 || E2B110152 || 2nd-floor printing alcove || Leased
|-
| stein || Xerox AltaLink B8055 || Y4X849851 || 1st-floor [[:Category:uniPHARM Dictionary|dumps area]] || Leased
|}

==Support info==

* Contact number for leased printers (Xerox One Number): 1-800-275-9376
* Contact number for printers under Managed Print Services: 1-866-487-4239
* Contract end date: December 12,2023
* West-X: 604-668-2536

==Administration==
===Xerox Fleet Management===
This is a useful portal site that Xerox provides for leased or managed printers
* https://office.services.xerox.com/FMP/LoginPage.aspx
* Username is darrenf@unipharm.com
* Password is NewVisionIT2051@!

===Xerox Device Agent Software===
There is an application from Xerox called the Xerox Device Agent, installed on the WDS3(172.30.18.11) virtual machine. This program sends the page meter reads for the copiers in Returns and Receiving to WestX for billing purposes. This application consumes a lot of CPU time. DarrenF tried for 4 months to get Xerox and its developers to figure out why a crappy little program uses so much CPU 24/7. Xerox wasn't willing to acknowledge a problem or allow a conversation to happen with their in-house developers - so the support ticket was closed as unresolved. The Xerox Device Agent software needs to continue to run and report billing data to WestX so if the CPU usage becomes a problem, try to get a new version of the app or open a new ticket with Xerox and prepare for pain.

This was resolved, it was due to not having the newest version of the app provided by west X , running smooth now.

===Xerox NeckBeard Support===
On June 13th, 2019, a Xerox technician was called onsite to fix the C60 that was not copying paper in the top feeder or from the glass. He determined that the OS was corrupt and did a factory reset of the machine which wiped out all of its configuration settings. He failed to notify anyone that he was doing a factory reset and he failed to create a backup clone file of the configuration to restore. This caused a great deal of inconvenience and extra work that was not necessary if a clone file was available. If this dumbfuckery ever happens again, there are saved clone files on the SuperServer in the following location : \\superserver.unipharm.local\Tech\Logs And Backups\Xerox Copier Clone Files\. In that folder are clone files for all the leased and MPS copiers as of June 2019. The 2 Xerox MFDs that are used by RonG and AngelaC cannot produce clone files. In case you haven't caught on, a clone file is a file that contains all the settings that are configured on a printer, with the purpose of "cloning" itself onto another printer of the same model or the exact same one after some asshat decides to do something idiotic.

Xerox support is very helpful, when called they respond within a day. They are willing to teach and leave extra supplies in case of emergent need. Recently the C60 needed to have maintenance, remember that the bottom drawer has a security screw, if need be to release the drawer and unjam the document, replace pick rollers.

==Notes==
* The Altalink, also under the service has temporary files that need to be cleared out regularly, this can be scheduled, and takes 20-60 minutes based on what you are clearing.
* Software update performed may 12 2021, with support, to resolve network card restart issue.

===Old printers===
This section is for reference purposes. These printers are no longer being used.

There are 4 different Xerox copier models in use as of 2016. The 7775 is located in the printing alcove on the second floor. The has 2 fax lines connected so that it can fax inbound and outbound at the same time. The 7775 is leased and Xerox provides consumable toner and other supplies as part of the lease cost. Xerox also provides technical support and repairs as part of the lease. When requesting supplies, repairs or support you must provide the serial number which can be found on the copiers admin page.

*[http://elaho.unipharm.local/ Elaho Administration Web GUI]
*admin
*1111

At this time you must use edge/explorer for web administration.

The WorkCentre 5855 is located next the Supervisors Office in the shipping area of the DC. It has no colour capability but it does have the ability to fax inbound/outbound. The supplies the 5855 uses are different from the 7775 and there is a much smaller and less complicated touch screen. The 5855 is also on the same lease program as the 7775.

*[http://stein.unipharm.local/ Stein Administration Web GUI]
*admin
*1111

The WorkCentre 4265 copiers are located in the Receiving Office and the Returns Areas in the DC. They are smaller copiers with fewer paper trays. They both do have a single fax phone line attached and have very similar software capabilities compared to the 5855 and are on the same lease program as the 5855 and 7775.

*[http://reccopier.unipharm.local/ Reccopier Administration Web GUI]
*[http://rtncopier.unipharm.local/ Rtncopier Administration Web GUI]
*admin
*1111

The WorkCentre 6605 copiers are slightly smaller than the 4265s but otherwise perform and behave in the same way. The 6605s were free from Xerox and are NOT on the lease program and toner and supplies DO need to be purchased for the 2 that are used by the payroll administrator and general manager. Both of the 6605s are network and fax attached.

[[Category: Printing]]
[[Category: Pages with Contact Information]]

Information Systems:3CX IP-PBX Administrator's Guide

2022-10-31T20:45:55Z

Danielc: /* Administration Portal */

==Administration Portal==
3CX Administration Web Portal:

URL: https://3cx.unipharm.local:5001
Username: Administrator
Password: NewTechIS21!

==License==
Our 3CX license is '''Professional Perpetual''' with 16 simultaneous calls. Simultaneous calls includes internal/extension-to-extension calls, and both parked and queued calls. To date, our real world usage has never come close to reaching this. Nonetheless, the license can always be upgraded at a pro-rated cost.
::[[File:2021-03-31 11_25_29-3CX Phone System Management Console.png|400px]]

The license is renewed annually through TelData.

==Configuration==
===Extensions===
{| class="wikitable"
!colspan="3"|Noteworthy Extensions
|-
|Extension
|}

===SIP Trunks===
A SIP trunk is what allows a PBX to make and receive outbound calls. A SIP trunk is configured for 1 or more channels (simultaneous calls). 3CX has 2 SIP trunk configurations:
* [[Information Systems: ThinkTel SIP Trunk | ThinkTel SIP Trunk]]
* [[Information Systems: RingOffice SIP Trunk | RingOffice SIP Trunk]]

The ''SIP Trunks'' section in 3CX shows the following configuration:
:[[File:2021-03-31 11_51_37-3CX Phone System Management Console.png|400px]]
* The order is alphabetical and does not imply call routing precedence; that is defined in ''Outbound Rules''
* As seen in the figure, only RingOffice has Register information. This characteristic differentiates the two SIP trunks: the RingOffice trunk does ''registration-based'' authentication, while ThinkTel is IP-based. [https://www.3cx.com/docs/sip-trunk-registration-authentication/ Read more about this here.] There is a slight benefit to Register-based authentication in that you can tell when the connection goes down (Register failed).
* The number of Sim calls is defined manually. It should match the number of channels of the SIP trunk service, but can be used to control usage (e.g. putting a max of 3 when there are really 6 usable channels will cause 3CX to use the next available trunk for the 4th sim call).
* The WebMeeting bridge is an internal and automatically configured trunk (can be ignored).

===External Call Routing===
Calls to and from external numbers are routed according to the rules defined in the ''Inbound Rules'' and ''Outbound Rules'' sections. There are two main concepts:

* DID mapping in ''Inbound Rules''
* Call routes in ''Outbound Rules''

====Inbound Rules====
* DIDs (Direct Inward Dialing) are what we know as phone numbers (604-123-4567). They can be mapped in ''Inbound Rules'', either to local extensions, call queues, ring groups etc. Several DIDs can be mapped to the same internal target. For example, the toll-free and main company phone number map to the Customer Service call queue (technically the digital receptionist extension, but eventually routed there).
Part of the Inbound Rules page is shown here:
:[[File:2021-03-31 12_37_13-3CX Phone System Management Console.png|400px]]
====Outbound Rules====
:[[File:2021-03-31 12_19_44-3CX Phone System Management Console.png|400px]]
* Outbound rules specify the routes that outbound calls take. Notice that there is no 1:1 mapping of extensions to outbound routes. This is possible but absolutely unnecessary. Instead, the rules are catch-alls for other criteria (prefix, extension range).
* The prefix routes (9) are there to match the old phone system (where dialing 9 was necessary to "call out"). This is also still a common practice in many phone implementations, presumably as an extra validation measure for users i.e. to have users confirm their intent in dialing an external number.
* These rules are evaluated in order, from top down. This is why the 911 rule is at the top.

===Call flow===
Call flow refers to the path a call takes through the system. The settings in Inbound and Outbound Rules define part of the flow, but it can be

Most call flows are straightforward e.g. DID to local extension, voicemail if not available.

===Voicemail===
Voicemail works as it does in other phone systems - there is a message center that users access to listen and otherwise manage their messages. This extension is 999. There are however, serveral additional enhancements related to voicemail:

* Email notifications: Voicemails can be emailed, with a transcription of the text, an attached wav file of the audio message, or both. This is set per extension and is disabled by default.
* Voicemail transcription: Voicemail transcription transcribes voice messages to text so users can read instead of listen to the audio message. The functionality is set up system-wide in the 3CX settings, however, it needs to be enabled per-extension (for those that want it). It uses the Voice-to-Text service within Google Cloud Platform, and is billable monthly past the first 60 minutes (every month) of transcribed audio.

====Customer Service Voicemail====
Extension ''501'' is used solely for

====Google cloud services (GCP) integration====
3CX uses the following Google Cloud Platform services to provide special features:
* Firebase: Push notifications for 3CX mobile app ('''Android''' app only, Apple uses its own APNS)
* Cloud Speech API: Voicemail transcription (voice-to-text)

GCP Web Portal access:

URL: https://console.cloud.google.com/
Username: root@unipharm.com (uniPHARM Google account)
Password: NewVisionIT
Project name: UWD 3CX (use dropdown to select project)

See the Billing section for Cloud Speech API billing. GCP gives a $400 credit for the first year, therefore during this first year, when looking at the billing, "One-time credits" may need to be toggled to see the actual billed usage that we would have paid.

Firebase can be viewed in the section of the same name. However, integration with 3CX is just an API token to use the PUSH notification service, so this doesn't need regular maintenance unless changing the token.

===Other Notes===
====Backup====
*( 3CX is being backed up to: <code>smb://superserver.unipharm.local/Tech/common/ConfigBackups/3CX</code>. It should be here <code>\\superserver.unipharm.local\Tech\Logs And Backups</code>, but spaces in the backup location path are not allowed (at least for SMB backups). This should be tweaked in the future. The last 20 backups are kept (auto-rotated).
* Because 3CX is both a virtual appliance and a fairly easy/small installation, there is no system image backup (would waste a Veeam license). A disaster recovery situation would then entail reinstallation of the 3CX virtual appliance and restoration of the backup config.

[[Category: Phone System]]

Information Systems:Server Hardware Inventory and Assessment (2021)

2022-10-18T17:50:07Z

Danielc:

{| class="wikitable"
|-
! Server name !! Server model !! Server description !! CPU !! RAM installed (GB) !! Storage (GB) !! Storage controller !! Notes
|-
| VMHost01 || X3650 M5 || ESXi virtualization host 1 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 5000 (6x1TB in RAID-5) || M5210 || -
|-
| VMHost02 || X3650 M5 || ESXi virtualization host 2 || 1 x E5-2620 v4 || 64 (1x16, 6x8) || 5000 (6x1TB in RAID-5) || M5210 || -
|-
| VMHost03 || X3550 M5 || ESXi virtualization host 3 || 2 x E5-2620 v3 || 64 (4x16) || 2000 (2x2000GB in RAID-1 || M5210 || -
|-
| UWDDC3 (former) || X3250 M5 || Former domain controller, physical server || E3-1230 || 16 || 2x128GB || - || -
|-
| UWDDC4 (former) || X3250 M5 || Former domain controller, physical server || E3-1230 || 16 || 2x128GB || -
|-
| Stewie || X3550 M4 || Unused || E5-2620 v2 || 8 || - || Can be replaced with 2xE5-2650 v2 = 16c/32t for very cheap!
|-
| Veeam || X3650 M3 || Currently a Veeam proof-of-concept machine. || E5620 || - || - || - || Should be an archive server. Should have more SSDs.
|}

==Notes==
* Same-generation servers use the same hard drive caddies.

==Ideas==
* Decommission old Superserver/Veeam machine.
* Decommission Stewie
* Add and reconfigure storage on VMHost03
* Reinstate UWDDC3/4 i.e. reinstall in the rack.
:* Create backup server out of one of these
:* Use the other as a play server
* Buy 32GB more memory for VMHost03 (https://www.axiomupgrades.com/productdetail/01KN301-AX/)

[[Category: Servers]]
[[Category: I.T. Projects and Ideas]]