SONiC Deep Dive: Intra-Switch Inter-VLAN Routing and Packet Forwarding

 

The title of this section might seem a little overwhelming, but it reflects the focus of the chapter. The SONiC Redis database programming pipeline is examined through the configuration of two Layer-2 VLANs, VLAN 10 and VLAN 20, together with their respective Layer-3 routing interfaces.

VLAN 10 and VLAN 20 represent two separate Layer-2 broadcast domains, with each VLAN associated with its own IP subnet. VLAN 10 uses the 10.0.10.0/24 subnet, while VLAN 20 uses the 10.0.20.0/24 subnet. Because the two hosts belong to different broadcast domains and IP subnets, communication between them requires Layer-3 routing. In this example, the routing is performed locally by Leaf-1 through the routing interfaces configured for the two VLANs.

Figure 5-15 depicts the basic building blocks and IP addressing scheme used in this example. PC1, with IP address 10.0.10.101/24, belongs to VLAN 10 and is connected to the Leaf-1 Ethernet0 interface. PC2, with IP address 10.0.20.101/24, belongs to VLAN 20 and is connected to the Leaf-1 Ethernet1 interface. The routing interfaces for VLAN 10 and VLAN 20 use IP addresses 10.0.10.1/24 and 10.0.20.1/24, respectively.

The Continue reading

New Tool – Juniper Protect-RE Filter Generator

Also new on the Network Tools page: a Juniper Protect-RE Filter Generator — builds the lo0.0 input firewall filter every RE-bound packet passes through, regardless of which interface or destination address it actually arrived on.

Check the protocols you run, list trusted sources where it matters, and get a complete, correctly-ordered config — anti-spoofing and fragment discard first, then source-restricted NTP/RADIUS/SNMP/BGP, then OSPF/VRRP, then management access, a blanket TCP SYN/FIN/RST flood policer, type-restricted rate-limited ICMP, dual-style traceroute support (UDP and Windows’ ICMP-based tracert), optional BFD, and a logged, counted catch-all discard at the end.

Worth Reading 081526


I am not a security researcher, and I have never been to Georgia. Yet within a few hours, using AI tools and nothing but public records, I was able to reconstruct the order in which 1.5 million ballots were cast in Georgia’s May 2026 primary–98.9% of the in-person ballots.

 


In profession after profession, GenAI is beginning to perform many of the tasks that traditionally served as training grounds for newcomers.

 


What’s the manifestation of the fallacy in the current case? Thinking that a system that is great at a certain kind of math problem is great at all math, great at science or even quite possibly great at everything.

 


An agent running Anthropic’s Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK’s AI Security Institute.

 


This week, DuckDuckGo is filing an amicus brief in the appeal of a federal court decision that Google unlawfully maintained a monopoly in the general search market in violation of the Sherman Antitrust Act.

SONiC Deep Dive: Binding Interface to Vlan

Step 3: Associate Ethernet0 to VLAN 10

After configuring VLAN 10 and bringing up interface Ethernet0, the next step is to make Ethernet0 an untagged member of VLAN 10.

GONFIG_DB and APPL_DB

Figure 5-11 gives a conceptual view of the Redis database updates resulting from the SONiC command:

sudo config vlan member add 10 Ethernet0 --untagged

The command defines our intent: Ethernet0 should participate in VLAN 10 as an untagged (access) port. For an untagged VLAN member, frames received from the host arrive without an 802.1Q tag and are associated with VLAN 10 based on the port's VLAN membership. In the opposite direction, frames transmitted from VLAN 10 toward Ethernet0 are sent without an 802.1Q tag.

The command updates several related entries in CONFIG_DB. The PORT|Ethernet0 entry contains the port's access VLAN configuration:

PORT|Ethernet0

    access_vlan = 10

 

The VLAN|Vlan10 entry represents the VLAN itself and contains a members@ field that records Ethernet0 as a member:

 

VLAN|Vlan10

   members@ = Ethernet0   

   vlanid = 10

 

The @ character in members@ is part of the SONiC CONFIG_DB schema convention. The members@ value is a configuration representation of the relationship between the VLAN and its members.

The Continue reading

How Cloudflare detects MCP traffic and helps secure it

Most companies designed their resource permissions with a human user in mind. A senior engineer may be able to deploy to production, query a sensitive database, or revoke another user's access. Those privileges come with risk, but that risk has traditionally been bounded by two assumptions: the engineer will use human judgment, and the engineer can only act at human speed.

An engineer who sees an unexpected result will usually stop and reconsider their actions. Any human being can only click, type, and review so much in a single day. The introduction of AI agents changes both thresholds. Their decisions are nondeterministic, and they can take the same action (or invoke the same tool) indefinitely, without getting tired or stopping for lunch. A plausible — but incorrect — decision can become thousands of incorrect actions before a human notices.

Today, we're announcing new Cloudflare One capabilities to identify inspected MCP traffic, show which users and servers are generating it, and control direct connections on managed network paths. Combined with MCP Server Portals, these controls help administrators see whether agents are using an approved path, or somehow bypassing it.

Model Context Protocol (MCP) servers give agents a common way to Continue reading

Secure all your internal vibe-coded applications — in one click

AI has enabled employees across every team to build applications faster than ever before.

But that speed is also what's keeping every CISO up at night: any employee can build an application, deploy it to the public Internet, and accidentally expose internal work or company data.

Today, we're launching new tools to make it easy to keep your applications hosted on Workers private. You can now apply Cloudflare Access directly to a Worker or to every Worker in your account, so that your applications are behind your company login by default, without relying on each developer to set that up themselves.

You can now:

  • Set a policy at the account level to ensure that all preview and production deployments are behind your company login by default.
  • Set a policy on a single application to ensure authentication is enforced on every domain associated with it, no matter how it's deployed.
  • See exactly who visits your application. Get every authenticated user’s email, name, and groups directly in your code — no JWT (JSON Web Token) validation required. 
  • Deploy an internal platform where every deployment is private by default. We've open-sourced an example: an internal static site platform where every Worker Continue reading

Total eclipse of the Internet: traffic impacts in Iceland, Spain, and Portugal

At a time when looking down at our devices is a ritual in daily life, a natural phenomenon that demands our attention communally upward is a welcome event. On Wednesday, August 12, a total solar eclipse swept from the North Atlantic across Europe, moving over Iceland and northern Spain and Portugal, with a deep partial eclipse over the rest of Western Europe, all near local sunset. This was the first total solar eclipse to cross mainland Europe in twenty years, and it drew millions outdoors to witness the moon pass between Earth and the sun. 

As we saw during the 2026 World Cup and the last total eclipse in 2024, online behavior is noticeably affected when an event at this scale takes place. In this blog post, we’ll use data from Cloudflare Radar to examine how Internet traffic shifted alongside the moon and the sun.  

Internet traffic dips align precisely with maximum obscuration

In the figure above, we measured HTTP request volume in five-minute buckets across the affected countries on eclipse day, and compared it to a normal-day baseline. Each row is a country (except for Alaska) and each column is a five-minute slice of August 12, Continue reading

New Tool – IPsec VPN Configuration Generator (Multi-Vendor, Policy vs Route-Based Interop)

Added a new one to the Network Tools page: an IPsec VPN Configuration Generator for Cisco IOS/IOS-XE, ASA, FortiGate, Palo Alto, Juniper SRX, strongSwan/VyOS, UniFi, and pfSense/OPNsense.

The reason I built this instead of just pointing at vendor docs is the case that actually breaks real deployments: pairing a policy-based peer with a route-based one. A route-based side (VTI/tunnel interface) defaults to a catch-all 0.0.0.0/0 ↔ 0.0.0.0/0 selector, since routing decides what enters the tunnel. A policy-based peer negotiates specific proxy-IDs per subnet pair, pulled straight from its ACL. Put those two together unmodified and phase 2 negotiation just fails — no useful error, just a tunnel that won’t come up.

Certificate Transparency Monitoring is now generally available

Since we launched Certificate Transparency Monitoring in public beta in 2019, we've been emailing subscribers whenever a new TLS certificate appears in a public Certificate Transparency (CT) log for one of their domains. Today, it's turned on for more than 650,000 customer domains. It's an early warning that someone, somewhere, has issued a certificate for a hostname in your zone, giving you a chance to spot a mis-issued certificate early.

It's a useful signal, but it had a noise problem, and we felt it ourselves. Cloudflare issues a large volume of certificates on your behalf: Universal SSL renewals, certificates from Advanced Certificate Manager, and backup certificates. All of them are logged to public CT logs by design, because a certificate that isn't logged won't be trusted by major browsers like Google Chrome and Apple's Safari. So the same transparency that lets you monitor for mis-issuance also surfaces every certificate we issue for you.

And issuance isn't a one-time event. Certificates are short-lived and renew automatically: a single Universal SSL certificate can renew as often as every 60 days, up to about six times a year. That cadence is set to increase, with the CA/Browser Forum having voted to cut Continue reading

MTU Path Test — Find Where a Path Silently Fragments, Hop by Hop

MTU problems are some of the most annoying things to troubleshoot in networking, because they’re usually silent. Small packets sail through fine, everything looks healthy, and then someone complains that a specific app is slow or hanging — and it turns out one link in the path, three hops in, has an MTU 8 bytes smaller than everyone assumed. GRE, IPsec, PPPoE, a VPN overlay, a jumbo-frame config that only got applied to half the path, a VLAN tag quietly adding 4 bytes nobody accounted for, or just two vendors defining and displaying “MTU” differently (L2 vs. L3, tagged vs. untagged) — any of these can quietly clip your effective MTU, and standard ping/traceroute won’t tell you where.

Compress netlab Lab Topologies with Dot Notation

netlab is using the Python Box library to make the code easier to read1. When I started the project, I hated the way you fetch values from Python dictionaries with stuff like node['ospf']['area']; Python Box lets you write node.ospf.area. Even better2, you can tell Python Box to create intermediate dictionaries as needed. node.ospf.area = 1 will automatically create the node.ospf dictionary.

But wait, there’s more (yes, we’re getting to the topic of today’s blog post): Box lets you use the same dotted notation in YAML files.

Read more …
1 2 3 … 3,895