Demonstrating reduction of vulnerability classes: a key step in CISA’s “Secure by Design” pledge

In today’s rapidly evolving digital landscape, securing software systems has never been more critical. Cyber threats continue to exploit systemic vulnerabilities in widely used technologies, leading to widespread damage and disruption. That said, the United States Cybersecurity and Infrastructure Agency (CISA) helped shape best practices for the technology industry with their Secure-by-Design pledge. Cloudflare signed this pledge on May 8, 2024, reinforcing our commitment to creating resilient systems where security is not just a feature, but a foundational principle.

We’re excited to share an update aligned with one of CISA’s goals in the pledge: To reduce entire classes of vulnerabilities. This goal aligns with the Cloudflare Product Security program’s initiatives to continuously automate proactive detection and vigorously prevent vulnerabilities at scale.   

Cloudflare’s commitment to the CISA pledge reflects our dedication to transparency and accountability to our customers. This blog post outlines why we prioritized certain vulnerability classes, the steps we took to further eliminate vulnerabilities, and the measurable outcomes of our work.

The core philosophy that continues: prevent, not patch

Cloudflare’s core security philosophy is to prevent security vulnerabilities from entering production environments. One of the goals for Cloudflare’s Product Security team is to champion this philosophy and ensure Continue reading

Weird Junos IS-IS Metrics

As part of the netlab development process, I run almost 200 integration tests on more than 20 platforms (over a dozen operating systems), and the amount of weirdness I discover is unbelievable.

Today’s special: Junos is failing the IS-IS metrics test.

The test is trivial:

  • The device under test is connected to two IS-IS routers (X1 and X2)
  • It has a low metric configured on the link with X1 and a high metric configured on the link with X2

The validation process is equally trivial:

Read more …

netlab: Multi-Site VLANs

Imagine you want to create a simple multi-site network with netlab:

  • The lab should have two sites (A and B).
  • Each site has a layer-3 switch, a single VLAN (VLAN 100), and two hosts connected to that VLAN.
  • As you don’t believe in the magic powers of stretched VLANs, you have a layer-3 (IPv4) link between sites.
Network diagram

Network diagram

Read more …

From Python to Go 010. Dealing With Text Files. And Tiny Bit On Regexp.

Hello my friend,

So far the only way to provide user input to your Python and Go (Golang) applications we’ve shared with you in these blog series was the environment. Whilst it is a powerful way, which is heavily used especially in cloud native world, where we utilize Kubernetes, it is not the only way to provide user input. Today we’ll review another mechanism, which is text files.

Is Software Development Not Valuable Job Anymore?

Lately I’ve seen more and more posts on LinkedIn that AI is taking software development jobs away and/or making them less profitable. I’m myself use various AIs as code assistants, so I can see massive massive boost in productivity. At the same time, often AI generates code, which simply doesn’t work regardless the amount of iterations you try it with different prompts. Or it does generates working code, which is far less performance optimized that it can be. Therefore, I’m convinced that software engineers are here to stay for quite a bit. Moreover, network and IT infrastructure automation is a specific domain, which knowledge is even less acquirable by AI now due to lack of structured data for models training. Which means, you shall Continue reading

AI for Network Engineers: LSTM-Based RNN


Recap of the Operation of an LSTM Cell

The previous section introduced the construction and operation of a single Long Short-Term Memory (LSTM) cell. This section briefly discusses an LSTM-based Recurrent Neural Network (RNN). Before diving into the details, let’s recap how an individual LSTM cell operates with a theoretical, non-mathematical example.

Suppose we want our model to produce the sentence: “It was cloudy, but it is raining now.” The first part of it refers to the past, and one of the LSTM cells has stored the tense “was” in its internal cell state. However, the last portion of the sentence refers to the present. Naturally, we want the model to forget the previous tense “was” and update its state to reflect the current tense “is.”

The Forget Gate plays a role in discarding unnecessary information. In this case, the forget gate suppresses the word “was” by closing its gate (outputting 0). The Input Gate  is responsible for providing a new candidate cell state, which in this example is the word “is.” The input gate is fully open (outputting 1) to allow the latest information to be introduced.

The Identification function computes the updated cell state by Continue reading

IP Addresses in 2024

Time for another annual roundup from the world of IP addresses. Let's see what has changed in the past 12 months in addressing the Internet and look at how IP address allocation information can inform us of the changing nature of the network itself.

Palo Alto URL Filtering and SSL Decryption

Palo Alto URL Filtering and SSL Decryption

In my previous blog posts (linked below), we looked at how to allow or block specific websites using URL filtering. In this post, we'll look into how to use URL filtering with SSL decryption for more granular control.

Palo Alto Allow Access To Certain URLs Matching A Blocked URL Category
If you use URL filtering on your Palo Alto firewalls, you may come across situations where a specific URL category is set to block, but you need to allow certain sites.
Palo Alto URL Filtering and SSL DecryptionPacketswitchSuresh Vina
Palo Alto URL Filtering and SSL Decryption
Palo Alto How to Block Specific URLs?
In this blog post, we’ll explore how to block specific sites using a Palo Alto firewall. There are two ways to achieve this, and we’ll cover both options.
Palo Alto URL Filtering and SSL DecryptionPacketswitchSuresh Vina
Palo Alto URL Filtering and SSL Decryption

Why Do We Need SSL Decryption?

Previously, we saw how to block sites like facebook.com or cnn.com, or allow specific websites blocked by a URL Filtering profile. However, these methods fall short when more granular access is required. Most website traffic today is encrypted with HTTPS, meaning the firewall cannot inspect what's happening within those sessions.

Without SSL decryption, the Palo Alto firewall (or any NGFW) relies on the SNI or CN of the certificate Continue reading

Palo Alto How to Block Specific URLs?

Palo Alto How to Block Specific URLs?

When working with Next-Generation Firewalls (NGFWs), you may come across situations where you need to block specific websites. In this blog post, we'll explore how to block specific sites using a Palo Alto firewall. There are two ways to achieve this, and we'll cover both options.

Palo Alto Allow Access To Certain URLs Matching A Blocked URL Category
If you use URL filtering on your Palo Alto firewalls, you may come across situations where a specific URL category is set to block, but you need to allow certain sites.
Palo Alto How to Block Specific URLs?PacketswitchSuresh Vina
Palo Alto How to Block Specific URLs?

A Quick Recap on URL Filtering

This blog post assumes you have some familiarity with URL filtering. In a typical setup, you create a URL Filtering profile, configure the categories to allow or block, and attach this profile to your security policies.

Depending on your security requirements, you might block entire categories such as gambling, terrorism, or proxy sites. However, there are times when you only need to block specific sites rather than an entire category.

In this blog post, we'll use cnn.com and samsung.com as examples (no hard feelings toward them, these were just the first sites that came to mind, haha 🙂).

💡
Please Continue reading

New IPv6 Documentation Prefix

After three and a half years of haggling (the IETF draft that became the RFC was written in May 2021; the original discussions go back to 2013), Nick Buraglio & co managed to persuade pontificators bikeshedding in the v6ops working group that we might need an IPv6 documentation prefix larger than the existing 2001:db8::/32.

With the new documentation prefix (3fff::/20) (defined in RFC 9637), there’s absolutely no excuse to use public IPv6 address space in examples anymore.

HN763: You Too Can Say ‘Yes’ to Packet Analysis

Packet capture and packet analysis is incredibly useful for problem-solving and troubleshooting. Analyzing packets is also a difficult skill to master. With the incredible array of network troubleshooting tools at our disposal, including emerging networking models for artificial intelligence, do we still need to fuss around with Wireshark in 2025? Our guest Chris Greer says... Read more »

Weekend Reads 011025


Wi-Fi 8 is coming, but it looks set to focus on greater reliability rather than on pushing the bandwidth ever higher, as the most recent updates to the venerable wireless local network technology have done.


Policymakers need to carefully guide the future consumption of electricity by AI datacenters, according to a report that considers four potential scenarios and suggests a number of guiding principles to prevent it from spiraling out of control.


In one of the quiet announcements that might eventually be a huge deal, the FCC voted to open the entire 6 GHz WiFi frequency band to very low-power devices (VLP – just in case you needed another new acronym to remember).


Gaining a clear view of the DDoS landscape is vital for developing effective countermeasures against this prolific form of attack. A new study, carried out through collaboration between researchers from several institutions, helps bring DDoS into perspective.


Salt Typhoon’s latest victims include Charter, Consolidated, and Windstream, underscoring the widening scope of China’s cyberespionage campaign against critical US infrastructure.

TNO012: From Hardware to Cloud: Evolving Roles for Network Operators

Cloud networking is still networking, but there are differences. In this special collaboration episode between the Total Network Operations and Cloud Gambit podcasts, Scott Robohn, Eyvonne Sharp, and William Collins dive into the contrasts between traditional and cloud networking, and how network engineers raised on hardware and the CLI can flourish in cloudy environments. In... Read more »

Technology Short Take 185

Welcome to Technology Short Take #185, the first of 2025! I’m excited for the opportunity to continue to bring readers articles and links of interest across data center- and cloud-related technologies (along with some original content along the way). I had originally intended for this post to be my last post of 2024, but personal challenges got in the way. Enough of that, though—on to the content!

Networking

Servers/Hardware

Security

Palo Alto Allow Access To Certain URLs Matching A Blocked URL Category

Palo Alto Allow Access To Certain URLs Matching A Blocked URL Category

If you use URL filtering on your Palo Alto firewalls, you may come across situations where a specific URL category is set to block, but you need to allow certain sites. For example, you might block the 'social networking' category but still want to allow access to Facebook. Similarly, you may block 'newly registered domains,' but need immediate access to a site categorized as such. While you can request Palo Alto to re-categorize the site, sometimes you need a quicker solution.

In this blog post, we'll look at how to allow access to specific URLs that match a blocked URL category. There are two ways to achieve this, and I’ll cover both.

A Quick Recap on URL Filtering

This blog post assumes you have some familiarity with URL filtering. In a typical setup, you create a URL Filtering profile, configure the categories to allow or block, and attach this profile to your security policies. For instance, if you block the 'proxy-avoidance' category and try to access a site like expressvpn.com, the traffic will be blocked.

Palo Alto Allow Access To Certain URLs Matching A Blocked URL Category

To demonstrate this, I'll set the 'proxy-avoidance' category to block. This means that if I try to access expressvpn.com, it will be blocked. Continue reading

XtendISE Key Features – Simplifying Cisco ISE Management

XtendISE Key Features - Simplifying Cisco ISE Management

XtendISE is a user-friendly web application integrated with Cisco ISE and designed to simplify daily tasks and common challenges related to 802.1X without requiring extensive training on Cisco ISE. XtendISE helps manage MAC addresses, troubleshoot 802.1X authentication issues, and simplify the management of switch 802.1X configurations. It also validates configurations to ensure they are set up correctly and as intended.

We covered the basics of XtendISE in a previous article linked below. In this blog post, we will explore in detail three key features that XtendISE offers.

  • MAC address management
  • Enhanced Troubleshooting Capabilities
  • Configuration and Auditing of the network access devices
How XtendISE Helps with 802.1X Management in ISE?
XtendISE is a simple web application connected to your Cisco ISE, which helps with everyday routine tasks and common challenges related to 802.1X without the need to train everyone in Cisco ISE.
XtendISE Key Features - Simplifying Cisco ISE ManagementPacketswitchSuresh Vina
XtendISE Key Features - Simplifying Cisco ISE Management
💡
Disclaimer - XtendISE sponsors my blog, and this is a sponsored post. However, I had the final say on the content and personally liked their product.

Mac Address Management

Typically, when a device doesn’t support 802.1X, we collect its MAC address and add it to a specific group in Continue reading

netlab 1.9.3: MLAG, Static Routes, Node Cloning

netlab release 1.9.3 brings these new features:

Other new features include:

Read more …
1 2 3 … 3,755