WirelessPhreak.com

I like to travel, f*ck with technology, and partake in the occasional tropical drink.
I am also a co-host on The NBD Show podcast.
Follow Me

After tasting every drink at our local Tiki bar my wife and I wanted to reproduce our favorite The Macadamia Nut Chi Chi. This drink is easy to make, but the most important part of the drink is a good quality Macadamia Nut liqueur. We cheeped out the first time and the drink tasted horrible, after finding the Trader Vics Macadamia Nut liqueur we reproduced the drink exactly.

Ingredients:
- 2 ounce Vodka
- 1 ounce Macadamia Nut liqueur
- 1 ounce Creme of Coconut
- 4 ounces Pineapple Juice

...
Instructions:
Fill a shaker with crushed ice
Add ingredients to the shaker and shake like crazy
(Longer you shake frothier it gets)
Poor into your favorite tiki mug

Aloha!!!!!

Enjoying Disneyland is different for everyone.  There are different ride preferences and different priorities whether you're old, young, or have kids; whether you flew around the world for a one-time experience or if you go to Disneyland frequently.

For my wife and I, enjoying the park when we were younger meant going hard for 16 hours to ride every ride as many times as we could.  Back then we'd only go once every 5-10 years. Now that we are a little bit older and were lucky enough to justify an annual pass this year we turned from young-go-hards to Disney pros. I am not saying we are the best at Disneyland — as if that's even a thing — but we have found time to enjoy the intricacies Imagineers and cast members put into the park.


Everyone one does Disneyland differently but we have found a system that works for us and lets us ride all the rides we want to normally by noon. So this is how we do it.

First key is to plan a trip on days that aren't expected to get too busy.  We like to use isitpacked.com and undercovertourist.com crowd prediction calendars.  The next key is to get to the park early.  I don't mean when its still dark, and at opening is already getting busy, so somewhere in-between.

Since about 2015 Disney instituted a security check point to ensure everyone enjoys a safe visit.  That will be your first line.  And it makes the day a lot brighter to be extra nice to the security officers as well as having any bags open and clear of contraband.  Nowadays we don't bring bags into the park at all, even my wife leaves the purse at home.  Only items that we can carry in our pockets, which is usually credit cards/Disneyland ticket in a wallet, a phone, sunglasses, and sometimes an expandable shopping bag that clips onto a belt loop if we know we're going to buy souvenirs.  Again, no kids. And on that note, find a line with the least strollers and backpacks and you'll breeze through security.

A rare time when there was no security line first thing in the morning.

Normally the park opens at 8am and we will arrive around 7am (although always check because times vary day-to-day, including Extra Magic Hour and Magic Mornings). That gets us through security and a good place in the line without waiting for hours. Also, the majority of families with kids aren't at the gate that early. We feel you families - its hard enough to get our adult-selves ready.


Then you'll get in line to enter the park.  We normally pick a line in the middle of the gates because they tend to move slightly faster. Strollers slow the line down as do first-day visitors because they get a picture taken.

Disneyland actually opens its front gates about 15 minutes prior to the actual opening time everyday. This allows them to start moving people through to the back of the park without stopping at Main Street shops.  They keep the park roped off either at the end of Main Street stores on a normal day, or around the entrances to the lands in the Plaza if you're enjoying an early morning such as Magic Morning (3 or more-day park hopper) or Extra Magic Hour (Disneyland Resort guests).  If you're at the park for an early morning, only Fantasyland and Tomorrowland are open.  People will queue up at the rope in anticipation of a magical morning!



Now to the meat of the morning.  The majority of visitors will sprint to the castle to get in line for Peter Pan (please walk in the park!).  Who voted Peter Pan the "Best Ride Ever", I don't know.  I mean I love it, but I love every ride.  If you want to ride Peter Pan without waiting 45+ minutes then do head that way and watch for the line that usually forms out towards the drawbridge on the right. It will seem long but the cast members "release" the line in stages as it fills.  If you don't go to Peter Pan first thing, another option is to hit Peter Pan right after fireworks in the evening.


Immediately after or instead of Peter Pan, we usually go straight into Tomorrowland.  This land is very popular and will become extremely packed as the day goes on, but in the early morning it's usually fairly empty.  Of course you'll want to take advantage of Fast Passes or Max Pass.  We usually book a fast pass for Space Mountain right away.  With the old fast pass system this means you walk all the way to the entrance in the back to get a fast pass.  Then we'll hop on Star Tours once or twice while the wait is 10-15 minutes and do Astro Blasters (walk on as many times as you want).


Next its on to New Orleans Square on the opposite side of the park.  You really get your steps in at Disneyland!  We always ride Pirates of the Caribbean first and as many times as we can.  Ever since Johnny Depp visited the ride its become a bit more popular.  After Pirates we ride Haunted Mansion. Then Pirates or Haunted again if the wait times are 20 minutes or less. At this point its usually time for Space Mountain (around 9:15 maybe) and that means we can get another fast pass!  We usually get a Big Thunder Railroad fast pass which allows us to walk directly on the ride - no waiting in the 30 minute line.  Nice right?  Then we head back over to Tomorrowland to ride Space Mountain.  If we can get another reasonable fast pass for Space Mountain or Star Tours (11 or 12 am), we do it.

Ah, the magic of no people in the park yet!

Then we head to Fantasyland to ride the original kiddie rides in the castle area.  Fantasyland is usually pretty empty by this point because the Peter Pan overflow rush is over and visitors are hitting the bigger rides we've already done.  Also, since these rides are older the AC does not work as well in lines and LA is hot.  Riding in the afternoon tends to be a bit warm in line.

After Fantasyland we like to take the path by Red Rose Taverne and head back to Adventureland/New Orleans Square.  Maybe get a fast pass for Indiana Jones at this point.  Watch that ride though as it frequently breaks down throughout the day.  It's usually repaired within the hour. We can ride Big Thunder, Pirates, and Haunted again as these are favorites.  Alternatively you could also ride Jungle Cruise, the Mark Twain Riverboat, or head around to Critter Country.  Splash Mountain is a good ride in the afternoon, cuz you will get wet.  But the line will get long so if you want to ride this one, around noon is a good time or take advantage of single rider.


This is a good time to eat and we like Bengal Barbecue a lot in Adventure Land. There are many eateries in Disneyland to choose from and that's another blog post!

The remainder of the morning/early afternoon we'll wander around and ride maybe The Many Adventures of Winnie the Pooh, Autotopia, and other Fantasyland rides we may have skipped if the line was long, like Alice in Wonderland.  We may also visit Toon Town.  Around 3 or 4pm you might want to hop on the Disneyland Railroad and take a lap or two around the park.  It's a good way to give your feet a break and cool down.  The best place to get on (with the shortest line) that we've found is in Tomorrowland.  We also love to ride the Monorail but usually time-it to when we want to go to Downtown Disney or if we're hopping to California Adventure.  Its nice in the evening too and since the Monorail does not have AC, it could be taken out of commission during hot days for safety reasons.


Of course there are a few rides we don't really care to ride (which may shock some readers so please be warned!).  We don't ride the Finding Nemo Submarine Voyage...bad experience...and we typically only ride Matterhorn Bobsleds and It's a Small World if we're visiting with others who haven't ridden or really want to ride these.  So these are missing from our tour on purpose.  From experience, Matterhorn line will get a very long during the day/evening and either riding in the morning or getting a fast pass are the ways to go. 


In the afternoon and evening you'll notice the park is much, much busier. Because you had a perfect Disney morning and hit all the rides, this is a good time to slow down and enjoy shops on Main Street, do some shows, read about the park (all in AC - LA is still hot).  We also like to do the Tiki Bar in the evening and get a Dole Whip.  If you're planning a show or parade, you'll usually need to start saving a seat at least an hour ahead of time.  You can always walk up last minute but you're not guaranteed a good spot.


Of course the key to all of this is to use the Disneyland app or any of the other wait time apps available to monitor ride times.  Don't wait if the ride is too long - get a fast pass and ride something else in between.

And think about investing in an annual pass if you are going to visit the park more than six days in the year.  At the end of 2016 we knew we had a couple trips lined up so we did the math on buying several 3-day park hoppers versus the annual pass.  At the price of a 2017 3-day park hopper pass (approximately $315), an annual pass (approximately $600) broke even for us if we went 6 days or more.  To do the math as prices adjust each year, just take the amount of the passes you would normally buy, divide by the total number of days visited in the year.  Then take the current annual pass price and divide by the same number of days to compare which is better.

We've ended up going 20+ days in 2017.  Tons of money saved on tickets....don't ask how much spent in support of the habit!
A delicious evening at Trader Sam's tasting some secret menu drinks. I will post the recipes as I find them in this post so keep checking back.

1. Krakatoa, this isn't a secret menu item but gets an honorable mention due to its excessive rum content.


(Krakatoa in a souvenir mug)

2. Old Kungaloosh, delicious drink it's vodka, coconut rum, midori and pineapple juice. I wasn't sure about the midori but it ads a subtle layer that balances the drink out perfectly. It was 9 out of 10 Recommend.


(Old Kungaloosh)
Recipe from my friend at SasakiTime.com (check out his blog it is Awesome)
Old Kungaloosh Recipe -- Circa 1997 
1 1/4 ounce vodka
1 1/4 ounce Malibu Rum
3/4 ounce Midori (melon liqueur)
2 tablespoons pineapple juice
1 splash cranberry juice 
Mix well.

3. Adult Dole Whip, holy crap this is so good. I think it taste better then the real thing. You get the familiar Dole Whip taste, but there is an undertone of vanilla that just takes it to the next level. 10 out of 10 must try!

(Adult Dole Whip)
This is the closest i could find courtesy of mirlandraskitchen.com
Adult Dole Whip
1 shot whipped vodka
4 oz pineapple juice
vanilla ice cream optional
strawberry and lemon for garnish if desired
Fill a cocktail shaker half full with ice. 
Add vodka and pineapple juice. Shake.
Pour into chilled glass and serve with ice cream or desired garnish.

4. Finally the coconut cake, again not on the menu but it is a must have at least once every Disney trip. It is the most Moist! Ya I said moist cake you'll ever have. The cake is infused with a coconut custard and the icing is a light whip cream and coconut topping. 11 out of 10 if you like coconut. 

(coconut cake)
Sad to Say the cake is no longer available. :(



Most of the people who have found this post on the internet are already familiar with Palo Alto Firewalls and everything they can do. One of the features I really like is the IPS functionality built into the firewall, but - and its a BIG BUT - if you're terminating SSL after the traffic ingresses your untrusted security zone you're loosing a lot of the PAN's IPS functionality because the traffic is encrypted.

Here is a reference diagram of what I am talking about:

So how do we fix it? PAN has a feature called SSL Inbound Inspection. This feature as of 7.1.x code does not terminate the SSL session or work as a proxy, but at a high-level takes a copy of the traffic and uses your imported certificate and key to inspect the traffic against the policies that have been configured. It's really easy to setup, but there are a couple caveats that I wanted to outline in this post.

SSL and Supported Ciphers: As many of you know the SSL negotiation is determined between the client and the server during the SSL handshake.  Because the firewall does not work as a SSL proxy, or "man in the middle", you have to insure that the client and server negotiate a cipher that the firewall is able to decrypt. This is where we ran into a little confusion.  Much of the documentation on the PAN site is focused around outbound SSL decryption.  This gets confusing when PAN doesn't document what feature they are discussing in an article. For example they have an article of supported decryption ciphers and they did not specify on the document if these were the ciphers used in outbound decryption or inbound inspection.  Then, when I asked for documentation of supported inbound SSL inspection ciphers, they could not point me to a document. FYI if you look at an SSL decryption profile there is a disclaimer in small print that only the listed RSA ciphers are supported for inbound inspection. I was told this was going to fixed.


So to help you out here is what is supported for inbound SSL inspection:

To ensure your firewall can decrypt all inbound SSL traffic it is important you configure your servers or load balancers to only offer ciphers supported by your firewall. If you're using an F5 to terminate SSL here is the string you can define in the cipher list within your SSL client profile.

!DES:!3DES:!SSLv3:!RC4:!EXP:RSA

APP-ID and Application Default Services: Many of you out here have enabled APP-ID on your firewalls and probably leveraged the application default service setting to let the firewall determine the port to allow traffic on.  I have been told application default setting in the services section of a security policy is best practice and, to be honest, I actually like it and use it; but it can break SSL Inbound Inspection. To understand where it breaks we first need to understand how a firewall processes a packet when you have enabled inbound SSL Inspection:

  1. The firewall looks to see if the packet is allowed by the security policy.
  2. The firewall identifies the traffic as SSL
  3. The firewall looks to see if the destination is configured with a SSL decryption policy
  4. If the destination address matches a protected IP address, it is decrypted and processed through the security policies once again as web-browsing still on port 443. 
  5. Bang! Connection is broken.

When you have application default set it is expecting specific ports based on the application that has been identified by APP-ID.  So if you have SSL and web-browsing configured in the APP-ID portion and application default configured in the services portion of your security policy...once the firewall decrypts the packets and runs it back through the security polices as web-browsing traffic on port 443 the firewall drops or resets the connection.

To resolve this issue you can still use APP-ID but you will need to explicitly list the ports the firewall will allow traffic on. This will allow any application, in this case web-browsing traffic on TCP port 443, to be allowed on any of the listed ports.

Configure SSL Inbound Inspection: You can click here to go to the Palo Alto Networks website and they will walk you though the SSL Inbound Inspection configuration.