PingPros

So recently the buzz around the cloud conventions, vendors, and corporations has been around the utilization of BYOD and user freedom.

The challenges many corporations claim is that it is a “security risk”.

I was on in agreement with this particular train of thought until I was recently hit with an epiphany: As much as IT hates the idea of losing control, consumerization of the workplace is happening and we either need to get on board or we will eventually be forced down that path.

We no longer live in a world that IT tells people what’s best for them; we now live in a world that the user is educated enough and tells IT what they want in order to get the job done in a more productive manner. The problem is is that IT needs to open its ears and start listening and providing the services. It is therefore my great honor to share an idea to the reader.

With people utilizing MDM solutions that sandbox mobile data, I will argue that, with time, will see a similar containerization/sandbox environment for Desktop/Laptop Operating Systems. One can argue that with the latest Mountain Lion and Windows 8 releases, we are coming ever closer the merger of Mobile OS to Desktop/Laptop OS Platforms.

The New Age Staff Member
Todays staff members looks at company time as “their own time”. They have played with cooler technologies than what the workplace can offer. They know exactly what they need to get the job done.

The new employee is not going to change so it’s easier for IT to accept the fact and work on coming to a solution that will allow for a more collaborative, productive, happy end staff member.

So you ask…what is the new BYOD? It’s the ability to bring in any of their personal technologies (laptop, phone, etc…) that they deem an item that will make work better. Not just a mobile phone solution. While there are solutions that offer this in the mobile world via Mobile Device Mangers (MDM), they simply are too focused on mobile devices.Instead I will dub a new term called Corporate Device Manager (CDM) as a more comprehensive solution. One can think of it as VMWare but with less overhead and a much more secured approach. To give you an idea of a CDM see the image below:

Figure 1-1:

Benefits giving users freedom and the ability to BYOD:

• Higher Productivity
  • A user will always be more comfortable with their own devices
  • Less lock downs on the devices but maintain corporate data compartmentalized and freely wipable

• Allowing staff members choice is a sure way to improve loyalty and happiness

• Staff members will become more accessible
  • Will always carry around their own personal devices (even on vacation) over corporate devices

• More focused security
  • Having a containerized sandbox in the users environment means that you no longer have to worry about the entire devices. Instead you can focus on all security technologies (DLP, etc…) running on only the sandboxed resource itself

• Companies lower cost
  • If a company lets users purchase their own devices they have a cost saving
    • The company can also really make a bigger impact by paying a certain fee $1000 every x years out of their own pocket that allows users a choice

However, time and technology, may need to catch up as I write this today.

Having utilized routing-instances in the MX series to segregate management functions/protocols away from insecure internet sources I ran into an instance that’s quite unique to the SRX platform only.

Normally for management items on an MX series one would create a separate routing instance away from the routing instance (see image below). This allows for segregation and reduces potential security holes in your design.

Design Main Points:
Create a MGMT routing-instance and import/export ribs between the the main and mgmt inet.0 routing tables, NAT and re-route certain management protocols/functions (NTP, netconf, syslog, snmp, etc…) from the main routing table (inet.0) to mgmt.inet.0.

Note: This assumes that your company is very strict on opening ports and doing NAT device cross talk between your outside region. Valid in corporations with standards…not so much within smaller companies that don’t care for security of course.

Underlying Problem:
While most items can be re-routed and transferred over, one particular item is not doable on the SRX systems themselves.

If you want to use an internal ntp client to maintain and manage time for all of your server equipment SRX series routers simply cannot route ntp over any instance but the main one (IE. inet.0).

So why doesn’t it work on the SRX Series?
It’s the way the SRX bootup procedures are setup. It will always use the main routing table (inet.0).

KB Article:
http://kb.juniper.net/InfoCenter/index?page=content&id;=KB22499&actp;=RSS

The little things and difference are usually annoying so hopefully somebody will find this article in case they have similar designs and requirements.