Uplogix provides remote-site lifeline

Envoy and EMS

It’s the bane of remote-site network administration: the moment you realize that the routing change you just made on a remote router has locked you out of the site entirely and knocked the site offline. It’s not necessarily a case of poor admin skills, but more likely a simple mistake.

Uplogix’s Envoy is designed to provide a parachute when mistakes happen, by automatically attempting to reset the configuration of a network device to a last-known good state, or at least by providing dial-up/dial-back access to any connected device.

Hooking Up the Hardware

The Envoy is a 1U rack unit with both RJ45 serial ports and standard 10/100 Ethernet ports, plus a dedicated out-of-band management port, switchable PDU control port, an embedded 56k modem, and a small LCD management console in the front. Installation is simple, using standard UTP cable to connect to RJ45 serial console ports on network devices as well as to the Ethernet management interfaces found on many switches, and setting an IP on the device via the front-panel console.

Armed with these connections and suitable configurations, all of your company’s connected network devices can now be managed centrally from the Envoy, both manually and automatically. However, Envoy works only with network devices that Uplogix supports. Such devices include Juniper routers, 3Com SuperStack switches, TippingPoint IDS, Cisco IOS, CatOS, and PIXOS, and some Nortel routers.

The Envoy is built on a Linux core, booting from an internal hard drive (the Achilles’ heel of network appliances), and is written completely in Java. The CLI is accessible only via SSH; it is quite rudimentary and vaguely based on the Cisco IOS CLI. There is no Web management UI on the Envoy itself, as the EMS (Envoy Management Station), which ships on a Dell 2U server, handles all management tasks.

In the lab, I connected a four-port Envoy unit to three Cisco switches: a Catalyst 4506 with a Supervisor II+10GE management blade, a Catalyst 4948-10G, and an older Catalyst 2924XL. The 4506 blade had a 10/100 management port cabled to the Envoy; the other switches relied solely on the console port for communication. I also connected a four-outlet Server Technology switchable PDU to the Envoy and each switch.

In the CLI, I defined each console port on the Envoy with a name and various connection parameters such as baud rate, stop bits, console passwords, and PDU outlet number. The Envoy pulled relevant data from the switches, such as the running configuration, startup configuration, and uptime, which appeared in the GUI.

The EMS Web GUI is adequate, providing at-a-glance device health and alarm status, task scheduling, device configuration file views, and other rudimentary configuration management tools. You can group devices via filters and push specific configuration commands to devices that meet the filter criteria, such as applying new passwords to every Juniper router.

Day-to-Day Operations

Under normal operating conditions, the Envoy runs tasks at set intervals to keep up with device configuration changes, availability, CPU and memory utilization, and so on. Also, the Envoy offers a direct link to the console of any connected network device via the Envoy CLI. This allows you to SSH into a remote-site Envoy and assume control of a switch or router’s serial console as if you were there with a laptop and a serial cable. The Envoy can also be configured as a terminal server, and SSH connections on different TCP ports will allow console access to connected devices.

Because the Envoy enjoys such a low-level connection to the network device, Uplogix built in a rudimentary rules-based recovery system. For instance, if the console connection is present (signified by the presence of a serial connection) but the device is unresponsive, Envoy will trigger a powercycle with a 30-second interval between powerdown and powerup to bring the device back up. There are a handful of built-in recovery rules, but you can define your own as well.

Any of the Envoy’s monitored parameters can be configured as a rule component, but the system lacks the capability to parse output from a connected device in order to match a rule, which can cause some stumbles. In my testing, I found that the boot sequence of the SupII+10GE was slightly different than that of prior supervisors, which triggered the Envoy’s problem boot detection code, and the switch ultimately failed to boot. Connecting to the Envoy CLI and assuming control of the switch’s console session allowed me to bring the switch up, but the situation illustrates how close the Envoy and the connected devices really are.

Another annoyance emerged with the Envoy CLI’s “SurgicalRollback” feature. Normally, the CLI allows an admin to take control of the console session after the Envoy saves a snapshot configuration. SurgicalRollback takes a slightly different tack: When the admin finishes the modifications to the switch or router, by default the Envoy will present the admin with the CLI equivalent of an “Are you sure?” dialog box and prompt the admin to commit to or to reject the changes.

If no choice is made, the Envoy pushes a session undo file to the device to remove the admin’s changes. This undo file is a custom-created string of commands to negate the specific commands given by the admin, native to the network device OS. I ran into this a few times, and wasn’t thrilled that I couldn’t instantly demand priority access to the device. It can be somewhat frustrating to try to access a connected device only to have the CLI put the brakes on your session while it tries to fix the problem for you.

Calling Home

The downside to this network monitoring system is the tight tolerance between the Envoy code and supported devices. If you have an unsupported device in a remote facility, the Envoy provides only serial console access.

That being said, Uplogix seems to be very customer-driven, and it plans to integrate support for four different satellite modems into the next release to meet specific customer needs. As the deployments grow, I would hope to see support for a wider variety of network devices.

I would also like to see more true configuration management tools in the EMS, and it would be nice to lose that hard drive in the appliance. But overall, Envoy is a good Swiss Army knife for remote site network admins.

InfoWorld Scorecard
Configuration (20.0%)
Performance (25.0%)
Management (25.0%)
Value (10.0%)
Scalability (20.0%)
Overall Score (100%)
Uplogix Envoy and EMS 8.0 8.0 8.0 9.0 8.0 8.1
Mobile Security Insider: iOS vs. Android vs. BlackBerry vs. Windows Phone
Recommended
Join the discussion
Be the first to comment on this article. Our Commenting Policies