Ask Slashdot: Best Management Interface On an IT Appliance?

tippen writes "The management user interface on most networking and storage appliances are, shall we say, not up to the snuff compared to modern websites or consumer products. What are the best examples of good UX design on an IT appliance that you've managed? What was it that made you love it? What should companies (or designers) developing new products look to as best-in-class that they should be striving for?"

Comments

Not enough Flash

[Anonymous Coward]

Not enough Javascript. Not enough external dependencies. Yeah, this totally needs to be more like modern websites.

Re:Not enough Flash

[Anonymous Coward]

It's a great point actually. The old Nokia IPSO routers used to have a web interface that was so simple it worked fine using elinks (and if you don't think that's useful; think you could SSH into the box, so if someone screwed the routing you could get in and use the GUI locally!).

There was this magic time in the middle when the interface worked both with links and had a bunch of "easy2uze" javascript.

Then later some marketing manager decided that they needed whizz-bang shit and messed the whole thing up by making it "more advanced". Worse still; they put in a CLI but didn't make it work.

Priority 1: works all the time. Works on any browser.

Re:Not enough Flash

[mwvdlee]

The two don't need to exclude each other.

Create a user interface that can do everything without javascript and without any flashy graphics, then add some CSS stylesheet to make it look nicer and flashier and add javascript to add more convenient ways of doing what you could already do without.

For example, take a classic list ordering GUI with up/down buttons. Works fine without javascript. Add javascript to make it also do drag&drop. It works better with javascript, but still works just fine without.

Web interfaces can gracefully degrade down to a very low level.

Re:Not enough Flash

[Anonymous Coward]

Web interfaces can gracefully degrade down to a very low level.

They usually don't, though. I'm waiting for the first router GUI which loads jQuery from the Google servers...

Re:Not enough Flash

[Chris Newton]

For example, take a classic list ordering GUI with up/down buttons. Works fine without javascript. Add javascript to make it also do drag&drop. It works better with javascript, but still works just fine without.

Web interfaces can gracefully degrade down to a very low level.

Yes they can, but not for free.

This sort of idea makes us geeks feel warm and fuzzy inside, but the reality is that you're talking about implementing two completely different versions of that UI feature. Doing so takes time and money, and you’d be spending that time and money purely to support a use case that probably represents a negligible number of users (people who want to run these UIs but have JS disabled).

Of course portability and compatibility are important for user interfaces, but this is a cost/benefit question. There is a line beyond which the results do not justify the effort, and any resources you’re spending past that line aren’t being spent on implementing other features or improving the usability elsewhere in your UI.

Re:Not enough Flash

[Antique Geekmeister]

I'm afraid that this usually means two entirely different interfaces, with overlapping features and writing to the same configurations. That is more than twice the development cost, since they involve distinct styles and expertise to develop or manage and the _negotiation_ between the two styles is an added cost. And it makes debugging more than twice as expensive, since tests have to involve both sets of interfaces and switching between them.

This is prohibitively expensive: the result is usually that the "plain" interface lacks critical features that are only available in the more sophisticated tool.

Re:Not enough Flash

[AlphaWolf_HK]

Actually I really like the way the freeware router firmware Tomato is designed. It uses AJAX, which is primarily javascript driven, but it works quite well. The UI alone makes Tomato a great firmware, but it's also more powerful feature wise than the competition (e.g. DD-WRT.)

Re:Not enough Flash

[vux984]

This sort of idea makes us geeks feel warm and fuzzy inside, but the reality is that you're talking about implementing two completely different versions of that UI feature. Doing so takes time and money,

This 100%.

and youâ(TM)d be spending that time and money purely to support a use case that probably represents a negligible number of users (people who want to run these UIs but have JS disabled).

And also "people in the future".

We have some old network gear at work, the web management interface is some java enabled shit, that doesn't work unless we have an antique version of java on an antique browser.

So no, you aren't just developing for that weirdo who runs no-script on his own router management interface, you are developing for everyone who has to use it when your current whizbang framework-du-jour has been relegated to the dustbins of time and anyone using a 'then modern browser' will throw its hands up say, "Yeah, that version of jquery is blocked, because its a steaming pile of exploit now. And even if we allowed it Javascript itself has evolved since then, and you'd have to run a legacy javascript interpreter to even run it, which is not installed by default... and would be blocked if you tried, because its also steaming pile exploit".. or something equivalent.

Of course portability and compatibility are important for user interfaces, but this is a cost/benefit question. There is a line beyond which the results do not justify the effort, and any resources youâ(TM)re spending past that line arenâ(TM)t being spent on implementing other features or improving the usability elsewhere in your UI.

Right. So just build it for the lowest common denominator using the most standards compliant code you can write, with as few dependencies as possible. Its network gear that might well run for 20 years or more, and its only ever going to be used by professionals. It needs to be future proof far more than it needs to be pretty.

And the answer is...

[namgge]

a command line.

Re:And the answer is...

[msauve]

That's like saying "a GUI." The OP was asking for a specific interface. My vote's with Junos, and its support for piping, commit confirmed, hierarchical structure, etc.

Re:And the answer is...

[Anonymous Coward]

I would agree. The best appliances have good CLIs and REST interfaces. Otherwise they are just a mess of crap. Have you ever seen a SAN interface? Or Vmware? Or Microsoft System Center? (if anyone can figure out what the hell is going on in that interface I would love to know.)

The best of the crappy interfaces is probably something like Qnap, they have great IOS interfaces, and the regular web interface is decent.

Re:And the answer is...

[mysidia]

I would agree. The best appliances have good CLIs and REST interfaces. Otherwise they are just a mess of crap. Have you ever seen a SAN interface? Or Vmware?

Yes.... NetApp DataOnTap's SSH shell + OnCommand and VMware ESXi SSH console and .NET vCenter client are some examples of Companies designing management interfaces properly.

If you think THOSE or bad............. then I got a ton of devices with crappy CLIs and GUIs to show you.

*Now VMware is moving in the crappiness direction with their whole deprecation of the .Net client, and shiny new crappy Web1.5 Flash-enabled webUI developed using Adobe flex, but newer vSphere not in production, so don't count the horrible unusable web "UI" against them just yet.

Re:And the answer is...

[Hognoxious]

That's like saying "a GUI."

No it's not. His post was funny.

Re:And the answer is...

[DeSigna]

I'd have to agree. VMware VI Client (the .NET one) is very well designed and thought out, but I'd add the HP 3PAR Management Console into the list of well-done management tools.

It's been a while since I used NetApp though. NetApp and 3PAR's management toolkits crap all over HP MSA/EVA or the various IBM SAN consoles for usability.

Re:And the answer is...

[Antique Geekmeister]

As an older programmer, I'm fond of some very good quality, older tools such as "webmin". Not all the modules added to it are excellent, but its very clean and very flexible for many core system utilities such as BIND based DNS. It's also much more robust than any configuration tool that relies on a separate, manually configured back end database.

Re:And the answer is...

[mysidia]

It's been a while since I used NetApp though. NetApp and 3PAR's management toolkits crap all over HP MSA/EVA or the various IBM SAN consoles for usability.

Yeah... welll.... I believe even Cisco's CLI, Dell Equallogic's management console, and even Nexenta craps on what HP provides with MSA/EVA.

I also hate the UIs of small business storage vendors, and I am thinking of a storage vendor targeting mid-sized companies in particular, where the management UI has pretty limited functionality, you don't get CLI access ("It's for your own protection, honest! [Or to secure our intellectual property!]"), AND you are limited to same basic Share/Volume setup/removal and told to "Call support" to request that they SSH in using remote support tunnel to perform any more advanced operations or configuration changes, such as setting up or turning off the replication between multiple systems, OR recover/remount the cluster filesystems after a backend Ethernet failure, or change your frontend IP addresses.

Of course, this Support requires continuous subscription payments, just to be able to make changes to your own configuration, and somewhat exorbitant costs just for software updates as well ------ this turns out to be important, because if something breaks during a software update, no mechanism is available to revert, and you have to call support.

In general: I hate the mentality of a number of vendors that they can push out a product that is not easy to administer, at low prices that will encourage management to buy: use a generic Linux system, but keep Shell/Root access to themselves (no CLI for the end user, just a menu), and require/insist engineers wait on their product support teams as a crutch for the product.

The same applies just as well to products that aren't well documented, or that require voluminous documentation to understand their UI sufficiently to perform basic operations.

junos cli

[BestNicksRTaken]

better than ios, easily parsed by scripts, regex support etc.

Focus upon usability, not looks ...

[MacTO]

For usability, you need to look at your target market. This means that you should be asking the people who will buy your product, rather than the people on Slashdot. (If we are your target market, at least let us know what you are developing so that we can provide meaningful input.)

Re:Focus upon usability, not looks ...

[Hognoxious]

This means that you should be asking the people who will buy your product

They're the last people you should ask. http://simpsons.wikia.com/wiki...

Take a look at Synology's DSM

[Anonymous Coward]

The best full featured modern UI on an appliance I have ever seen. I like it because it is easy to use. http://www.synology.com/en-global/dsm/index/overview

Re:Take a look at Synology's DSM

[PsyMan]

I would have to agree with you, Synology for their NAS range is very intuitive for non techy people, shame the hardware underneath is a bit underpowered for what it could be. For SOHO though you could pretty much run one as the main server. Great GUI for a linux backend. XPEnology is pretty good too though, best of both worlds when installed on to a mid end PC (thinking i5 / low end Xeon ?) not entirely legal though I suspect. I guess the usibility is why their NAS's hold their price second hand as it can't be the power of the hardware or reletively slow network transfer rates that keep them popular. Hmm, where have we seen that before ? Apple ?

Re:Take a look at Synology's DSM

[PsyMan]

Must get a spellchecker :P

Re:Take a look at Synology's DSM

[otis wildflower]

Synology is busybox-based, with md/lvm tools etc., and for the most part behaves properly. The GUI is handy for remote access and management (with self-signed cert), and is pretty functional for all but the corneriest of corner cases.

This past week I needed to ssh in in order to e2fsck my storage prior to lvextending it. Kinda disappointed I had to do that, but the fact is that I could and did. Also, since the RAID is in software, in theory I could pull my 7 drive RAID out and stick it in another linux box and vg(im|ex)port it.

My 1812+ has adequate power for pushing ~100+MB/s with its dual-core Atom and 3GB (it took a spare laptop SO-DIMM), and runs at a pretty low wattage rate vs. a handbuild mid tower. It can't transcode, but I have WDTV Live boxes that support most codecs fairly well for that.

None

[Charliemopps]

UI's suck... pretty much all of them. In order to look pretty they do away with functionality. Give me telnet access, command line, don't make your commands stupid and we're good to go.

Re:None

[msauve]

s/telnet/ssh/

I prefer my critical infrastructure management to be somewhat secure.

Re:None

[dfn5]

s/telnet/ssh/ I prefer my critical infrastructure management to be somewhat secure.

It could be kerberized telnet.

General goodness

[bertok]

Specific examples are hard to come by, but I've noticed the general trend that differentiates the "good" from the "barely usable"..

* Scalability. For example, a good interface will pop up a "search" box for finding a security group in Active Directory. A bad one will let me chose security groups from a list or a drop-down. Both look equally good when the developer is working in a test environment. The latter will crash when used in a million-object directory. Similarly, check out the DNS management dialog box in Windows, or some Oracle tools. Both will show you "all" objects up to some limit (e.g.: 5000), but then provide a filter option to allow you to narrow down the "search" to prevent the GUI from melting if you look at a database with 500K tables. Yes. It happens. A lot. More than you think. Really.
* Annotations. It's 2014 for Christ's sake! There is absolutely no reason not to include a general "note" or at least a "description" field with every. Single. Thing. Seriously. All of them. I'm not kidding. Look at VMware's vSphere interface as an example of this done reasonably well but not perfectly. They at least allow custom columns so you can tag things systematically. Better yet, newer versions of Microsoft's Group Policy allow annotations on every single setting.
* Versioning. For example, Citrix NetScaler keeps the last 'n' versions of its configuration automatically (5 by default I think). Why the fuck Cisco can't do the same with their 1KB but omfg-they're-ultra-critical-to-the-whole-goddamned-enterprise config files I just don't understand. Maybe they're trying to save precious bytes...
* Policy. Good examples are Cisco UCS Blades and, of course, Active Directory Group Policy. Settings should trickle down through hierarchies. I should never have to set the exact same setting five hundred times. Settings should set-and-unset themselves automatically based on the scenario, e.g.: replacing a blade should not involve having to reconfigure its BIOS settings by hand. A typical bad example is 99% of Linux, where every setting has to be either manually set or set via a script. A script is still manual, just faster. No! Smack yourself in the face! A script is NOT a replacement for a policy engine. Don't breathe in, ready to go on a rant about how great Linux is, and how easy it is to manage, because it's really not. Scripts are a "write only" management tool that result in impossible-to-reverse-engineer solutions that can only be replaced wholesale years down the track.
* Help. I'm not really a storage engineer, I just... dabble. However, I've set up labs with IBM and EMC kit, no problem. The one time I got asked to create a simple logical volume on a Hitachi array, I walked away backwards and refused to touch the stupid thing. It seriously had 10 pages of settings along the lines of "L3 Mode: 5/7?" I mean... wat? So sure, I press F1 for help like a naive fool. It helpfully informed me that the setting configures L3 Mode to either mode 5 or mode 7. I can press "OK" to accept the mode setting, or "Cancel" otherwise. I was enlightened. Meanwhile, the same dialog box on the EMC array basically asks for where, what size, and what RAID level.
* Behind the Scenes. Some GUIs have 1:1 mappings with some sort of underlying command-line or protocol. Consoles based on PowerShell such as most Microsoft and Citrix products come to mind, most Linux/Unix GUIs, and Database admin tools. The better ones will have a "tab" or a pop-up somewhere which shows the "script equivalent" of whatever you're doing in the GUI. This is very useful, particularly for beginners, and we're all beginners with every product at least once.

Really, GUI design is -- or should be -- a science, and not a trivial one! It integrates serious engineering constraints, business restrictions, project management priorities along with the fuzzy complexities of both individual psychology and the complex dynamics of interacting groups of people. It's done woefully wrong even by the largest c

Re:General goodness

[Chris Newton]

Thank you for the insightful post. I create user interfaces professionally, I share many of your frustrations with the generally poor standards in the industry, and I find it reassuring that at least some people who use the kind of tools I build do actually value good usability!

The one big thing I would add to your points is that whatever kind of user interface you’re building — CLI, GUI, API, whatever — it’s always going to be limited by how well thought-out the underlying configuration model is. If you have a system that requires 745 interacting settings to be correct before it works, and the guy who changes those settings is doing it at 4am after his pager woke him up, you’re unlikely to see a happy ending no matter how polished the presentation of those 745 settings might be in any UI. It never ceases to amaze me how many UIs don’t get their fundamentals down first, and just think it’ll be OK as long as the UI is pretty, compatible with Brand X, compatible with Scripting Tool Y, compatible with Management Protocol Z, or some other useful but second-tier benefit.

Please do share any other rants, general frustrations, examples of things that were really useful, or other similar comments you have. These kinds of threads are gold for those of us who work in the industry.

Re:General goodness

[Chris Newton]

Code monkeys never ask Rack monkeys what issues they face on the real field.

That’s not entirely fair. As a guy making UIs, I love hearing from the front-line what the users actually want, what they like and what they would like to see improved.

However, most development roles aren’t naturally customer-facing, and the focus for most people between the customers and the developers is usually on features (and commercial matters like pricing, of course), so this is the information that will naturally flow through an organisation and drive development.

Likewise, from the user’s side, often the people who are in contact with suppliers and making buying decisions aren’t the people who are personally going to get that 4am wake-up call to actually use these products. If there are things that matter and they aren’t obvious in the way that a tick in a feature column or a discount on a price are obvious, someone has to tell the guys doing the buying/negotiations so they can pass it on.

Basically, picking up more general usability issues like the ones bertok mentioned above either takes an exceptionally enlightened and well-structured organisation where this kind of information routinely gets passed on as well, or it takes guys at both ends of the chain who form side channels to get the little details through, and this goes on both the supplier and the customer side.

Re:General goodness

[bertok]

I love hearing from the front-line what the users actually want, what they like and what they would like to see improved.

This.

It's surprising how little feedback there is in the real world.

One of the best experiences of my career (when I had a developer hat on), was sitting in the room where Level 1 and 2 support staff were on the phone, supporting a system that I had built and was doing Level 3 support on. Until then, it would not have occurred to me that a good 20% of their time was wasted on looking up contact details. No problem, I integrated a one-click contact-lookup function into the dashboard system. They loved it. I never would have thought that "fast search" (think milliseconds) was a "feature" until I saw how important it was for a helpdesk person to not have to wait for anything while talking to someone interactively.

Things of that nature resulted in a UI that -- while a bit quirky from a developer's perspective -- allowed them to get their jobs done efficiently! It was all really simple stuff to implement, but I wouldn't have ever gone down that path if I didn't have that direct feedback and on-site observation of user behavior.

Re:General goodness

[skids]

Why the fuck Cisco can't do the same with their 1KB but omfg-they're-ultra-critical-to-the-whole-goddamned-enterprise config files I just don't understand. Maybe they're trying to save precious bytes...

They've started to in IOS 15.x. They even have started (gasp) to take mac address formats other than xxxx.xxxx.xxxx on some of their show commands.
(This day and age all network ready equipment should take pretty much any mac address format from IETF to colon delimited to even less seen stuff like xxxxxx-xxxxxx, but yet still does not, it's pathetic)

Having worked with a bunch of cisco-like devices I have to say cisco still has the best CLI I've seen so far among the major vendors. Being able
to pipe commands and output through a grepish utility is rarer than you might think, and a lot of the ciso workalikes do not have nearly the
discipline Cisco has about making sure you can paste or copy the text config file in and have an identically functioning device (minus just the private keys.)
Then again I haven't had a chance to work with Juniper yet which I've been told is pretty good.

* Behind the Scenes. Some GUIs have 1:1 mappings with some sort of underlying command-line or protocol. Consoles based on PowerShell such as most Microsoft and Citrix products come to mind, most Linux/Unix GUIs, and Database admin tools. The better ones will have a "tab" or a pop-up somewhere which shows the "script equivalent" of whatever you're doing in the GUI. This is very useful, particularly for beginners, and we're all beginners with every product at least once.

Not only that but in the NMS sector it would be super nice if they'd stop trying to just push all the configs out to switches and started allowing mods to be made on the CLI and the NMS to notice and integrate them. Sometimes you just want to have certain portions of the config controlled by switch-local configs, because they are easier to administer that way.

I'd add auto rollback to your list. All interfaces to networking equipment should offer the ability to apply changes, and have them take effect and then, if you do not confirm to make them permanent, revert the changes in a X minute window, like unto what the PC user does when changing a video mode. It's an essential last line of defense against human error, because most networking equipment can strand itself because it is managed in-band to save cash. (The number of NMS's that don't know how to renumber the far side of an interface first before the near side is like 99% of them, BTW)

Re:General goodness

[skids]

I never would have thought that "fast search" (think milliseconds) was a "feature" until I saw how important it was for a helpdesk person to not have to wait for anything while talking to someone interactively.

I was pretty much going to give up on the idea that anyone would ever bother making software work reasonably fast again, when I had the pleasure of discovering one of our new products is actually relatively snappy in most respects. The surprising thing was it was written in Java, which while technically capable of being fast, usually doesn't lead developers down the path the fastness.

Not having to wait for half a second or more for everything to happen during multi-stage interactive operations makes things sooooo much more tolerable, even when you're not on the phone with and end-user and/or lower-tier tech.

keep it simple

[redback]

Anything that doesnt require java, flash, silverlight, or god knows what else.

Anything that works in all browsers.

Re:keep it simple

[Golden_Rider]

Anything that doesnt require java, flash, silverlight, or god knows what else.

Anything that works in all browsers.

This. Seriously. Any management GUI which requires Java deserves to die in a fire. Because when you need to use it - which for some management GUI like a storage box which is configured once and then left alone until something needs to be changed might happen once every couple months - you can be ABSOLUTELY SURE that the computer you are sitting at either has no Java runtime environment at all or one which is the wrong version. At work, I have special VMs sitting around which I can fire up in case I need to connect to one of those ancient remote management boards which need Java 1.4.1 or stuff like that, and I have to be careful not to accidentally update those machines.

It is super annoying to find out that just to be allowed to click that one button, you first have to get a Java runtime (in the right version!) and install it, because sometimes you do not have an Internet connection available so you have to mess around with a USB stick, you introduce additional security risks by installing Java, most likely you accidentally forget about NOT leaving that Ask toolbar install option selected and have to clean up afterwards, etc.

CLI

[kjhambrick]

bash ; GNU tools ; ssh

Snapgear

[dbIII]

Snapgear had a really nice GUI front end to iptables on their firewall/routers. Considering how iptables could lend itself to end up like a mess of spaghetti if handled badly that's quite a feat.

Ui != Ux

[danknight48]

Windows XP
Debian + LXDE

Both on my IT appliance (the PC).
Both simple, fast and designed for functionality and not some new buzzword called "user experience".

simple and automatable

[vginders]

* A simple web frontend for manual things, that simply works in modern browsers
* A complete and easy (no SOAP please, yes I'm looking at you BIG-IP/F5) API and/or cli that can be driven from automation tools, and that provides easily for idempotency.

A power switch

[tlambert]

A power switch

If you need UI beyond that, then there is something wrong with the default settings for your device.

For a networking or storage appliance, it should get on the network using stateless autoconfiguration.

If a system on your network wants to use it, it should find the services the device offers via service discovery.

If you need access controls, the device itself should find your directory service on your network via service discovery.

The only thing you should possibly have to deal with explicitly is pairing with the directory service, and if that's necessary so that you can't be MITM'ed by someone making unauthorized use of your network, it should be a momentary contact button and an LED other than the power LED on the front of the device, combined with a serial number affixed to the device. Think "Bluetooth keyboard/headset pairing".

If you administer anything at all, it should be your directory server, mostly to establish accounts, and ACLs for the accounts, which are then used to authenticate the machines that consume services advertised by the appliances and servers on your network, and on the peer machines/clients which establish authentication sessions after you hit ctrl-alt-del, or login to the login window after boot.

Re:A power switch

[bill_mcgonigle]

For a networking or storage appliance, it should get on the network using stateless autoconfiguration.

Hey, man, you've given yourself away as being from the future.

pfSense is a good example of how to do an interface well for network configuration. I'm not sure that defining a network topology in a directory server would be easier or better.

Re:A power switch

[skids]

You obviously only administer small LAN systems in low security environments.

Stateless autoconf, uPNP, zeroconf, prolific service discovery stacks, and non-local authentication databases are the very first things we turn off on any system that requires security-in-depth and rock-solid stability. These are all end-user/domain features that have no place in WAN, metro-lan, and border network infrastructure.

Re:A power switch

[tlambert]

You obviously only administer small LAN systems in low security environments.

Stateless autoconf, uPNP, zeroconf, prolific service discovery stacks, and non-local authentication databases are the very first things we turn off on any system that requires security-in-depth and rock-solid stability. These are all end-user/domain features that have no place in WAN, metro-lan, and border network infrastructure.

Google recently went to the model where all connections to the Google internal network are VPN connections, even if you are in a Google cubicle in a Google building on a Google supplied computer plugged into a Google network port located in a secured area.

The idea that you need to secure network connectivity is bogus, and an artifact of scarcity of bandwidth. Without an artificial scarcity, there's no reason to not allow anyone who wants it connectivity, so long as gethostbyaddr() returns their actual affiliation, and gethostbyname() returns wherever they happen to be located in IPv6 space at the moment.

relative URLs; Isilon vs. NetApp; F5 BigIP

[Anonymous Coward]

For all the folks writing up the HTML code that goes into these things: use relative URLS!

Do not put the hostname (or IP address) of the device in any of the HTML. Us IT folks sometimes need to go through proxies (and SSH tunnels) to get to these devices (which are often on isolated "management" VLANs/networks). Simply put "/network/settings" instead of "http://mydevice/network/settings" in any [a href] links (or [img] or CSS references).

If the link in the HTML has "10.10.20.45" or "netdev01.mgt.example.com" in it, but my browser is actually connecting to "localhost" (because I have to do a SSH double-hop with forwarding), I'm going to think really evil thoughts about whomever wrote the HTML generator. I do not have to want to start editing my /etc/hosts or adding aliases to lo0 loopback interface.

As for general example of what to do, using storage appliances as examples: EMC Isilon is how to do things, which is mostly straight HTML. They have some Flash in there that I find annoying, and which they should probably replace with HTML5/AJAX/SVG/etc., but that's mostly for charts and not too big of a deal. NetApp's ONTAP is how not to do things: you double-click on an icon, it launches a Java app on your workstation, then launches your web browsers at localhost to talk to the Java app. WTF?

Another comparison about Isilon versus NetApp: on OneFS you SSH in and get a full, proper Unix prompt on a FreeBSD system (with rsync, zsh, bash, screen, etc.). With ONTAP (which is also using a FreeBSD system for the underlying OS) you get a limited Fischer Price set of commands.

F5's BigIPs are also pretty good: a nice Flash-free web interface (though some of the menu layouts are convoluted), but you can SSH in as well. The admin can create new accounts, and each account can be given either a full bash shell or a 'Fischer' Price shell on SSH login (which is a nice compromise between Unix-nerd-level users and moderately-advanced users).

Re:relative URLs; Isilon vs. NetApp; F5 BigIP

[tippen]

For all the folks writing up the HTML code that goes into these things: use relative URLS!

Do not put the hostname (or IP address) of the device in any of the HTML. Us IT folks sometimes need to go through proxies (and SSH tunnels) to get to these devices (which are often on isolated "management" VLANs/networks). Simply put "/network/settings" instead of "http://mydevice/network/settings" in any [a href] links (or [img] or CSS references).

If the link in the HTML has "10.10.20.45" or "netdev01.mgt.example.com" in it, but my browser is actually connecting to "localhost" (because I have to do a SSH double-hop with forwarding), I'm going to think really evil thoughts about whomever wrote the HTML generator. I do not have to want to start editing my /etc/hosts or adding aliases to lo0 loopback interface.

Great point and something easy to miss during the mayhem of implementation of a new product.

CLI is the best UX for me

[devlogic]

As a network administrator who configures routers, switches, and firewalls on a regular basis, I don't give a flying flip about what's commonly thought of as "good UX design" on IT appliances. The best UX for me is the one that's the fastest. Which means SSH, CLI, and text editors over anything graphical. As examples:
A router's web interface requires clicking through multiple pages to find the right box to check or fill in to add a new subnet to a BGP session (if it's even possible at all). Via CLI, I can do this with one config stanza.
I'd rather edit a config file (preferably one that's well-commented) in a text editor than wade through the web interface on any appliance.
I'll ALWAYS open up PuTTY instead of ASDM when I need to modify a firewall rule on a Cisco ASA.

Re:CLI is the best UX for me

[tippen]

Good UX design applies equally to CLI as well as GUI, which I'm guessing you actually do give a flying flip about.

Yes, which is why I asked about UX design instead of "best GUI"

Re:CLI is the best UX for me

[skids]

One advantage that CLI has over GUI that few people seem to realize is this:

Documentation for a CLI takes about 1/5th the resource to create, maintain, and display, is easily text searchable both inside the document and on the web, and rarely requires anything more than basic HTML to render. Just try to find "the button labeled 'address' under the 'resources' content pane tab reached by drilling down five levels in the menu tree each of which has an equally generic name. Oh yeah and the whole mess was opened unde the 'File' top menu.

I your lucky you'll find that after stringing that together into "FIle/foo/bar/phnord/derp/dee/resources/address" someone else bothered to do the same in your support forums.

WIth a cli, the command you need to paste into a search engine you are using is right there for you to cut from your command history.

Browser Based GUIs

[RealRav]

I personally hate the trend of browser GUIs. They are always sluggish and frustrating. If I can't have an installed application I'd rather have a CLI. An added bonus to the CLI is that it keeps out the TechTards and we all make more money!

Re:Browser Based GUIs

[skids]

The "sluggish and frustrating" school of coders have managed to work their vile magic on some CLIs I've seen in recent products, too. Their suck knowns no limits.

ZeroShell

[GWXerog]

The best WebUI I ever saw on a networking appliance is the one that comes with ZeroShell. High information density with very clear and concise controls http://www.zeroshell.org/ss/pr...

Palo Alto Networks firewalls

[certain death]

They have a good functional, easy to use web interface that is just as powerful, if not more so, than the CLI. Both the web interface and CLI are easy to use and just make sense.

Re:Palo Alto Networks firewalls

[tippen]

Is security policy management effective from the CLI on PAN firewalls?

For the relatively simple network settings (port config, user admin, etc.), CLI is fast and easy. Hard to imagine trying to deal with complex policy configuration from the CLI. Do you end up switching to the GUI for that?

Re:Palo Alto Networks firewalls

[Dakiraun]

Agreed. In the last 14 years that I've been exposed to WebGUIs or free-standing GUI shells for appliances, The Palo Alto one is one of the cleanest, most intuitive and best thought out. Is is perfect? No... there are still a lot of short comings, but it's well ahead of a lot of others not only in its own category, but just appliance GUIs in general. It works well on any OS, in nearly any browser and even without any lessons or tutorials, a person can get the feel for what they're doing in it relatively quickly.

Synology NAS is excellent

[horza]

If you don't mind home appliances, then the Synology one is the best I have experienced. Easy to use, stable, one click installs for everything, intuitive. It does the desktop metaphor but unlike all the JS libraries I've come across this one doesn't appear to lag. Well suited to its application.

In terms of server management, er probably none of them. Including the web based ones like cPanel, webmin and Plesk. OpenPanel has pretty screen shots, though you don't want to read phrases like "Please note that OpenApp always expects a clean install! Installing OpenApp packages on a non-clean system is likely to lead to data-loss or a non-functional system" so I wouldn't actually install it. All the ISPs present bottom-up approach to management, making it piecemeal. I'd rather have a top-down approach.

Phillip.

Netscreen OS

[David_Hart]

I agree with you about Junos. It is a very good CLI. However, for GUI interfaces, not much can beat ScreenOS....

Re:Netscreen OS

[entrigant]

Which is interesting considering ScreenOS has among the most annoying CLIs I've ever used. However, the web interface is so freaking good that I don't care.

I'm going to miss it when Juniper finally kills it..

LuCi from Openwrt

[JonathanP.Bennett]

I really do like the LuCi interface on the openwrt project. Though it's even more fun to turn it off, leaving only ssh access, and get calls from the clueless IT guy that is trying to twiddle something he shouldn't be.

BIOS Settings

[nuckfuts]

I press F1 for help like a naive fool. It helpfully informed me that the setting configures L3 Mode to either mode 5 or mode 7.

This reminds me of the "help" feature in every system BIOS I've ever worked with.

IP address AND the power switch

[billstewart]

You've got to set an IP address somehow. Typing a MAC address into your DHCP server isn't a cool way to do it, and you need an address that you know from the outside, not just an address the device can use to talk to servers it already knows about.

The equipment I've been using recently added a front-panel LCD/pushbutton mechanism that lets you set the IP address; previous versions of the hardware required you to either log in with an RS232 console that got a shell prompt or else use a VGA monitor and keyboard (and stupidly, the default on some versions of it required you to use the VGA/keyboard to tell the device to use the serial console.)

And while almost all the rest of the administration gets done using a web GUI, the system (which ran a custom Linux) didn't have an X server, so you typically needed to bring a VGA monitor and keyboard AND a laptop; the current versions let you do a bit more from CLI, so that's slightly less annoying.

But if you want to reimage the box (which you have to do for major version upgrades), ALMOST all of the steps can be done via the serial console. Except for the one step in the middle, where the box remembers its IP address settings but forgets that you were using a serial console instead of VGA, so you still need to have a technician onsite with a VGA, instead of being able to use a modem.

Re:IP address AND the power switch

[skids]

Sometimes with these troublesome devices you'll find that it's on a server with a LOM board with fully functional emulated VGA, so it's technically possible to get them off the ground with nothing but an additional (trusted) ethernet connection. It's usually only worth figuring out how to do that if you have a lot of them, though, due to the large variety of LOM systems and their various nuances,

But yes, it always sickens me when a Linux-based device ships with nothing but local GUI config tools.

Re:IP address AND the power switch

[tlambert]

You've got to set an IP address somehow. Typing a MAC address into your DHCP server isn't a cool way to do it, and you need an address that you know from the outside, not just an address the device can use to talk to servers it already knows about.

No you don't. If you run everything virtual private, and use IPv6, you really don't give a damn that you are giving third parties with physical access access to a routable IP address. DHCP is only for configuring things you can already configure automatically. For services (like DNS, proxy gateway, etc.), you can use service discovery.

The address from the outside is done using DNS update, which is done via cryptographic key. If you have a pre-shared key, then you can set your machines name in some remote network to point to your current IP Address, and use Source Address verification to verify that is in fact who it says it is. All DNS configuration can cascade upstream that way.

Occasionally, you need an explicit configuration for the cryptographic key (probably an X.509 cert) or the actual domain name vs. the delegates, which can, if needed, give the name of the IPv6 address on the delegation, to prevent collisions, or just make the delegate name part of the cert that gets verified by the DNS server before it enters the record.

This also goes for mail forwarding servers (use DNS to look up the mail server for the domain in which you've registered your delegate using your pre-shared cert.

It's actually pretty trivial to implement, if you don't care about guests using your bandwidth.

Negative Example

[the eric conspiracy]

NOT Sonicwall!!! Gawd it SUX.

The less your UI has in common with that clusterfuck the better.

API's

[cybaz]

I don't want any more GUI's, just RESTful API's that have complete functionality, not just a few commands for common tasks. Fancy UI's are fine for demo's so salespeople have something for customers to ooh and ahh over, or for small customers with limited IT staff. Most work these days is going into automation involving multiple tasks.

I have a number of them.

[attemptedgoalie]

NetApp

- Command Line in cDOT is pretty useful, I script a ton of things due to this.
- OnCommand System Manager has problems, it even lost functionality in the move from the non clustered OnTap to clustered OnTap. (easy to fix on their end, just a lack of attention to detail) But when you have 30+ filers across a dozen sites, it's all well organized. I'd like to see better performance, but it does 90% of what I need.
- The old FilerView worked for a small shop, but having all filers in the same interface is mandatory when you have as many as we do.

Isilon
- The web interface is pretty in OneFS7, but working with fileshares is kind of icky. When you have something that scales to 20-40PB, you'll have a few fileshares. And every time I have to work with one, it's not a great experience.

Violin
- My old 3000 series had an excellent interface, but it's limited since it's straight SAN, no CIFS/NFS. But fully HTML5, fully rearrangeable.
- The 6000 series interface is supposed to be a tremendous upgrade. I have one in a box waiting for me to get to our DR site to light it up, so hopefully soon I'll know more. But this has been my favorite interface so far.

Nimble
- I don't use this one weekly, a different admin works on it, but it seems pretty straight forward.

DataDomain
- Same as above. It works. Nothing to write home about.

FusionIO
- Big whoop. We're actually going to put Pernix in front of our FusionIO cards and stop using their interface as Pernix has so much better functionality and integration with vCenter.

PureStorage
- I don't own this, we are about to do a POC. But it seems pretty nice from the sales pitch/demos.

If you want to see a decent layout, NetApp's onCommand System Manager does a good job.

If you want to see excellent non-Adobe flash functionality, Violin.

Hope that's useful.

a few suggestions

[RobertLTux]

1 have a Quick Setup page with the most common settings all in one shot
2 Don't have "mystery magic" type settings (hint have a WIFI ON button not spread the ON function across 3 different settings that seem unrelated)
3 have a CLI "rail" so that CLI monkeys can bash the keys when they want to (but have something in the manual where it says
" to enable the SpeedConfig (TM) rail input %^73gH and the products serial number as your first command [this will be a permanent setting]")
4 put how to get to the admin console on a sticker on the item
5 do not assume that the person is using a laptop with 1024X768 res (hint there are things called netbooks running about and you also have smartphones)

PRTG

[mbeckman]

PRTG (paessler.com). This network management tool is not, strictly speaking, an IT appliance. But it might as well be, since it's trivial to install on a dedicated physical or virtual host, at which point it walks and quacks like any other IT widget. PRTG's interface makes extensive use of Ajax, real time charting, and sports an extremely logical organization that is both intuitive and powerful. It works equally well on desktop and mobile browsers, a rare treat for IT gear.

Unix shell

[manu0601]

NetBSD (or Linux if that is your faith) on a soerkis box. UI is a Unix Shell. What else?

Dell Compellent

[acoustix]

Dell Compellent's storage array has a very intuitive web management console. It is by far the easiest storage platform I have ever used.

Re:No web interface

[skids]

For the most part, yes, but there's something to be said for gui in the fwbuilder/ASDM space and for visibility operations. A minority of tasks are actually easier in a GUI, though it has to be a pretty good GUI or its a wash.

Re:Cisco IOS

[skids]

This reminded me to mention -- developers, please check that your terminal interface works from linux, not with some bastardized windows ssh client. Linux users are your most likely CLI users, and if you do anything with escape sequences, there is a tangible chance you'll step on an incompatibility. Oh, and don't activate the secondary VT100 screen please, we want to be able to scroll up and cut from our previous output. Also check that the CLI still works after exiting from your device by typing some multi-line commands and checking that the scrolling and line editing haven't been screwed up.

Re:F5 Load Balancers in particular APM module

[skids]

Cisco are the worst people for making UI that is useful.

Hit or miss, really. WCS was at least above par, for example.

Their ACS server is the worst.

Well, that's not a fair basis for judgement, since all attempts at GUIfying core AAA glue functionality is doomed to failure, because what is really needed is a policy language, not a bunch of windows and sequenced tables of rules, and nobody has managed to perfect GUIfying language yet.

Use FreeRADIUS. Unlang may be a bit primitive but at least its language shaped.

Re:What if you need to reboot

[msauve]

A proper console serial port with CLI is mandatory for any proper piece of networking gear. How else are you going to manage it if the network's down?

Re:No web interface

[tlambert]

For the most part, yes, but there's something to be said for gui in the fwbuilder/ASDM space and for visibility operations. A minority of tasks are actually easier in a GUI, though it has to be a pretty good GUI or its a wash.

That'd be a great argument, if all devices of a particular class used the same GUI; of course, then they'd be commodities, and the lowest price wins.

GUIs are a means of doing two things:

(1) Differentiating your product from someone else's to add margin to what is actually a commodity

(2) Causing knowledge to be vendor-specific in order to facilitate vendor lock-in through learning curve.

Oft Forgotten GUI Standards

[entrigant]

I find the little things often neglected such as:

Ctrl-A to select all
Triple Click
The ability to select text from e.g. labels to copy at all..
Proper ordering of widgets for tab
Click radio button/check box label

Etc.

If applications could just get the basics right it'd go a long way.

Barracuda and Ubiquiti

[charnov]

Barracuda's interface isn't too bad on most of their products considering how complex they are. Ubiquiti's AirOS on their wireless bridges and devices is wonderfully put together.

Also, m0n0wall and Tomato are favorites of mine.