Going Further with Ansible and Juniper
This post is part of an ongoing series on Ansible, and you can find all the other posts in the series here.
In the previous part, we backed up the config of our Junos routers in two different ways. First, we used the junos_config module, which saved the config as set commands. Then, to get a copy in the curly bracket format, we ran show configuration with the junos_command module and saved the output to a file. In this section, I'll show you a more direct way to do it, using a module called juniper.device.config, which can retrieve the config and save it in whichever format we like.
Installing the Extra Packages
juniper.device.config is built on Juniper's PyEZ library, and it needs two extra Python packages, on top of the ones we installed in the previous part.
uv add junos-eznc jxmlease
- junos-eznc - Juniper's PyEZ library, which the module uses to connect to the router.
- jxmlease - Another library for working with XML, which PyEZ relies on.
The Playbook
The module doesn't create the directory for the backups, so let's create it first.
mkdir -p backups_native
Next, create a new playbook called backup_native.yml.
Continue readingGetting Started with Ansible and Juniper Junos
This post is part of an ongoing series on Ansible, and you can find all the other posts in the series here.
So far in this Ansible series, we've worked with Cisco and Arista devices. In this part, we're adding a third vendor, Juniper. We'll build a small lab with two Juniper routers, and use Ansible to configure their interfaces, IP addresses, and OSPF from scratch.
Juniper works quite differently from Cisco and Arista in a few areas, and that's really what this part is about. Instead of connecting over SSH and sending CLI commands, Ansible talks to Juniper devices using NETCONF. Every change goes into a candidate config and only takes effect once it's committed. And thanks to the way Junos compares configs, Ansible can show us exactly what it's going to change, in the same format as show | compare on the CLI.
This part is part of a series on Ansible for network engineers, so I won't go into every detail of things we've already covered, such as inventory, host_vars, loops, and check mode. If any of those are new to you, I recommend going through the earlier parts first. The OSPF example in this Continue reading
Revitalisasi Pasar Tradisional Lewat Sistem Digital Lokal
Pasar tradisional selama ini menjadi pusat ekonomi rakyat yang sulit tergantikan. Di sana, interaksi sosial, tawar-menawar, dan perputaran uang berlangsung setiap hari. Namun, di tengah perubahan pola belanja masyarakat, pasar tradisional menghadapi tantangan baru: persaingan dengan minimarket, marketplace daring, dan kebiasaan konsumen yang semakin mengutamakan kecepatan.
Untuk menjawab tantangan itu, banyak daerah mulai melirik revitalisasi pasar tradisional melalui sistem digital lokal. Tujuannya bukan mengubah pasar menjadi serba modern sampai kehilangan jati dirinya, melainkan membantu pedagang beradaptasi dengan kebiasaan belanja masa kini. Digitalisasi bisa menjadi jembatan antara tradisi dan kebutuhan zaman.
Mengapa Pasar Tradisional Perlu Beradaptasi?
Pasar tradisional punya kekuatan besar: kedekatan dengan warga, harga yang fleksibel, dan ragam produk segar. Tetapi, kekuatan itu tidak cukup jika fasilitas kurang nyaman, kebersihan kurang terjaga, atau layanan pembelian masih sangat bergantung pada cara lama. Konsumen masa kini ingin transaksi cepat, informasi harga yang jelas, dan kemudahan pembayaran.
Di banyak kota, pasar yang tidak beradaptasi mulai ditinggalkan pembeli muda. Mereka lebih memilih tempat yang rapi, punya akses digital, dan menyediakan pembayaran non-tunai. Jika tidak ada perubahan, pasar tradisional berisiko kalah bersaing meski sebenarnya memiliki potensi besar untuk tumbuh.
Revitalisasi digital hadir untuk menjawab masalah itu secara bertahap. Dengan pendekatan yang tepat, pasar bisa tetap Continue reading
Hedge 324: NOSTR
Social media services have largely become a marketplace designed to capture and hold your attention, rather than places where people share information and talk to one another. A large part of this is because they are hosted on large-scale platforms that must be paid for by large, centralized companies. NOSTR is taking a different direction, creating a protocol and system that can be hosted by anyone, anywhere, to build a social network. Wouter Constant joins Tom and Russ to explain what NOSTR is, and how it’s different.
You can learn more about NOSTR here.
download
The post-quantum future of web privacy
The highest priorities for the transition to post-quantum cryptography are the basic building blocks of authenticated key-agreement protocols such as TLS. Without these building blocks in place, secure communication on the Internet will not be possible once cryptographically relevant quantum computers come online. However, today we rely on quantum-vulnerable cryptography for much more than TLS.
Privacy Pass is a protocol used by site operators like Cloudflare to help protect applications from abuse. One way we do this is by rate limiting individual clients so that no one client consumes too many of the site's resources. Normally this involves some combination of friction or loss of privacy for users: CAPTCHAs or other challenges to moderate traffic, along with accounts and fingerprinting to identify traffic.Privacy Pass was designed to avoid this tradeoff between friction and privacy. The basic idea is that a client gets issued a number of tokens, which they can redeem in exchange for access to the site. Crucially, each token is unlinkable to the client it was issued to, ensuring the client can use the site as they always had without sacrificing privacy.
With 10 years of deployment experience under our belts — using Privacy Pass for applications Continue reading
Scriptable GeoDNS: leaving AWS for Bunny
To optimize the performance metrics of this blog, I relied on Amazon CloudFront to serve the assets,1 and Route 53 for the geo-aware DNS2 to direct readers to the closest host serving the content. But Route 53 is expensive: US$0.50 per zone per month, US$0.70 per million geolocation queries, and US$0.75 per healthcheck per month, plus US$1 per month for the KMS key needed to sign zones with DNSSEC. When I discovered that Bunny DNS is almost free for up to 500 domains and features scriptable answers, I made the jump! Plus, it's a European company based in Slovenia.
Bunny CDN
Bunny.net started as BunnyCDN in 2015. They added IPv6
support in 2017. Switching was uneventful. I don't bring a custom domain: I
serve the content from the b-cdn.net domain. As I depend on content
negotiation to serve AVIF and WebP images, I configure the CDN to cache
each image format separately.
I disable logging to avoid collecting personal information. While the bunny.net GDPR page promises they anonymize data, it is unclear what CloudFront keeps Continue reading
Worth Having: Octomon
A Packet Pushers newsletter brought me a link to a fantastic CLI tool: octomon by Simon Thorpe. Not only does it look awesome for a CLI tool, but it’s also one of those things always worth having in your toolbox, because you never know when you’ll need it.
Thanks a million, Ethan and Drew, for collecting the nuggets for us.
30-Day AI Security Quick Wins Checklist
AI adoption is moving faster than most security programs can track.Agents aren’t humans (but they kinda are)
AI Agents now act on the web for millions of people. To a Site, an Agent can take many forms. It may be indistinguishable from a human user carrying out a task, or it might look like one visitor carrying many Users. This removes the ability for the Site to recognize, serve, and hold accountable the user or users behind the Agent, and causes the Site to face the costs when something goes wrong. This post argues that in order for Sites to maximize the access they provide to Agents, the ecosystem must develop new mechanisms to preserve the relationship between Sites and Users. Traditionally, in Security and Fraud Prevention, that requires three things: Identity, Reputation, and Accountability, allowing Sites to answer: Is the person acting being truthful about who they are? Is that person trustworthy? And who answers for the action?
“Personal AI Agents” (“Agents” for short) are automations that take instructions from a human (“User”) and pursue a goal by controlling a cloud computer or browser. They are usually hosted and maintained by an “Operator” as part of a managed service or consumer offering. Examples include Muse from Meta and dots from OpenAI, and more are launching all Continue reading
The Control Plane: BGP EVPN/VXLAN for AI Fabrics
This post discusses the application of BGP EVPN/VXLAN in AI data center networking, particularly focusing on back-end GPU fabrics. It emphasizes that single-tenant setups may not require VXLAN overlays, while multi-tenant environments benefit from logical segmentation. Key insights include the preference for Symmetric IRB over Asymmetric and the relevance of Type 5 routes for subnet aggregation.
The post The Control Plane: BGP EVPN/VXLAN for AI Fabrics appeared first on /overlaid.
See the agents, set the terms: new visibility and control for personal agents
Personal agents are the intermediary between humans and the Internet, turning a person’s instructions into requests and actions on websites. A customer might ask a personal agent to compare products across your site, find support articles, or complete a purchase. To a site owner, all three interactions show up as automated traffic — and without a clear view of which agents are visiting and what they are doing, it can be difficult to know whether that traffic is helping your business or creating risk. Blocking agents altogether can feel like the safest choice, but it can mean losing customers. Better visibility into agent activity allows you to decide what access makes sense for your site.
Today, we’re launching new analytics to help you understand how personal agents access your site on behalf of humans, along with more granular access policies to put those decisions into practice. Together, they let you welcome agents on your own terms, and in ways that support your business.
See how agents access your site
Knowing which agent is behind a request turns unexplained automated traffic into traffic you can act on with confidence. Cloudflare maintains the largest verified bot directory in the world, and we are Continue reading
Candidate and Active Configuration on IOS XR
Traditional network devices used a single (active or running) configuration, with a snapshot of it stored in permanent memory (startup configuration). The active configuration was modified with every configuration command, making it a perfect recipe for disaster in the days of in-band configuration1.
The situation improved drastically when Juniper introduced the candidate configuration. You could make changes to a copy of the configuration, and then commit them as a single all-or-nothing transaction. While you could still cut yourself off from the device, at least it was harder to do with a single misordered command.
phpIPAM version 1.9 released
New version of phpipam (1.9) released.Detecting incast congestion of RDMA flows
docker run -p 6343:6343/udp -p 8008:8008 sflow/ai-monitorThe pre-built sflow/ai-monitor image is the quickest way to try out the software. The diagram at the top of this page shows test RDMA flows crossing a 4 leaf / 2 spine test network to generate an incast collision. The flows are displayed using the trace-flow application that is included in the image.
The ai-monitor application uses packet samples to detect when GPU port is oversubscribed:
- Detect when an leaf switch egress port utilization exceeds 80%
- Count the number of sources sending traffic to the port - single flows are ignored
- Trace each of the flows back across the topology to its source GPU
The instant the threshold is crossed, the following incast_congestion event is generated by querying information maintained within the sFlow-RT analytics engine. Real-time elephant flow monitoring in AI / ML fabrics describes how standard sFlow from data center switches streams real-time telemetry that can be used to detect elephant flows with a few milliseconds.
{
"event": Continue reading
Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities
You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished.
AI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure.
To help security teams prepare, today we’re introducing Zero Wire: a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next.
How it works
Zero Wire lives inside Cloudflare Radar under the security section.
Each briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to Continue reading