Operational Meeting: Infrastructure Unit Report
25th March 2020

• There was a cooling failure on Sunday evening, as a result of some chilled-water issues. Unfortunately the backup system didn't start, though it has been serviced and tested recently. That's for further study, but meantime E&B have made some chilled-water adjustments to try to avoid the problem happening again.
• A new 16-way (*) distribution board - initially supplying 18 new 32A amp circuits for use in IF-B.02 and IF-B.Z14 - is currently being installed in IF-B.02.

  (* '16-way' means 16 sets of three phase outlets - i.e. the board will be capable of supplying 48 new single-phase 32A circuits in all.)

These had been scheduled for AT for 14th April. Whether it'll still go ahead seems unlikely at the moment. If we hear more we'll let you know.

IS and EE brought the new EdLAN firewalls into service on Thursday 12th, at which point we started seeing IPv6 problems speaking to outside EdLAN. There seems to be some ECMP-routing problem, which has been escalated with Fortinet. Meantime, IPv6 peering has been turned off on some of the paths between the new firewalls and the new core. This has given us stable routing again, but at the cost of less resilience. A proper fix is awaited.

We added another OpenVPN endpoint, in case the load on the other two service endpoints grows too high. The configuration files are in the usual places, named "-Covid", and should be installed in the usual way. It has a /23 IPv4 space, but no IPv6.

The new EdLAN VPN is imminent, but there are still a few odd problems being reported by testers. The biggest issue is that use of the new VPN seems to block non-VPN access to other EdLAN addresses, which will hit anyone where more than one device might be in use — where there are two University people working at home, for example. Again, this has been called in to Fortinet.

We are still seeing power bars reporting "near overload", most recently one of the AT cluster bars. If we do trip a breaker as a result, it may be a while before anyone can turn it back on again.

We now support acquisition of wildcard certificates and non inf.ed.ac.uk certificates through lcfg-x509. Documentation to follow (or speak to Toby in the meantime).

We are planning on upgrading the version of kerberos on the master KDC in the next week or so. This should cause no disruption, but may lead to a short period of no write access. This would be outwith normal working hours.