Building an OSPF Network from Scratch with Ansible

Building an OSPF Network from Scratch with Ansible

This post is part of an ongoing series - see all the posts below.

Ansible Course

So far in this series, we've been working with pretty much the same set of devices, core1, core2, access1, access2, and access3. We've used them to configure VLANs, NTP, syslog, and interface descriptions, and to learn the core Ansible concepts along the way.

For this part, we're going to start with a new topology and put everything we've learned into practice with a real-world example. The lab has six Cisco routers, split across three OSPF areas. I created it using Containerlab, and I've included the topology file below, so you should be able to build the same lab and follow along.

name: ospf_lab

mgmt:
  network: mgmt
  ipv4-subnet: 192.168.202.0/24

topology:
  kinds:
    cisco_iol:
      image: cisco-iol-17.12.01

  nodes:
    r1:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.101
    r2:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.102
    r3:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.103
    r4:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.104
    r5:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.105
    r6:
      kind: cisco_iol
      mgmt-ipv4: 192.168.202.106

  links:
    # Area 0
    - endpoints: ["r1:Ethernet0/1", "r2:Ethernet0/1"]   # 10.100.12. Continue reading

Useful Ansible Filters for Network Engineers

Useful Ansible Filters for Network Engineers

This post is part of an ongoing series - see all the posts below.

Ansible Course

In the previous part of this series, we looked at what filters are and covered some of the most commonly used ones, such as selectattr, map, and regex_replace. We also used filters to solve a real problem in the previous part by sharing the same syslog servers between Cisco and Arista.

Ansible has a huge number of filters, and it's impossible to cover all of them. So in this part, I want to focus on a handful that I find especially useful as a network engineer. We'll work with IP addresses and subnets, compare lists to check whether a device's config is what it should be, merge dictionaries together, and sort lists. Along the way, we'll also build a simple compliance check that you can use in your own network right away.

This post is part of a series on Ansible for network engineers. If you're new to the series, I recommend following the parts in order, since each one builds on the previous one. Here's a quick overview of the setup we're using. The lab has five switches, core1, core2 Continue reading

Starbound: Cara Menjelajahi Planet dan Mengembangkan Karakter

Dalam dunia game eksplorasi antariksa saat ini, Starbound menjadi salah satu judul paling diminati yang menawarkan pengalaman menjelajah lintas galaksi dengan kebebasan tak terbatas. Artikel ini akan membahas secara lengkap bagaimana cara menjelajahi planet dan mengembangkan karakter dalam Starbound di periode terbaru, sehingga Anda bisa memaksimalkan petualangan Anda di dunia yang luas dan penuh misteri ini.

Memahami Dunia Starbound dan Relevansinya di Masa Kini

Starbound merupakan game sandbox eksplorasi yang memungkinkan pemain untuk menjelajahi beragam planet secara bebas, mengumpulkan sumber daya, membangun markas, dan mengembangkan kemampuan karakter di luar angkasa. Saat ini, game ini terus mendapatkan pembaruan yang menghadirkan konten-konten baru, menjaga pemain tetap tertarik dengan pengalaman yang dinamis dan terus berkembang. Dalam konteks gaming modern, Starbound mampu bersaing dengan game eksplorasi lain berkat fitur unik dan komunitas yang aktif.

Cara Menjelajahi Planet dalam Starbound

1. Memulai Petualangan di Antariksa

Setelah menyelesaikan tahap tutorial awal, pemain akan mendapatkan pesawat luar angkasa yang menjadi alat utama untuk berpindah antarplanet. Pesawat ini dapat di-upgrade untuk memungkinkan perjalanan lebih jauh dan membawa lebih banyak barang selama eksplorasi. Saat ini, kemampuan upgrade pesawat sangat penting karena bintang-bintang dan galaksi yang tersedia semakin luas dan variatif.

2. Menganalisis Planet dan Memilih Tujuan

Setiap sistem bintang Continue reading

Core Keeper: Cara Efektif Menambang dan Membangun Markas Bawah Tanah

Pendahuluan
Core Keeper saat ini menjadi salah satu game sandbox bawah tanah yang paling diminati oleh para gamer dan penggemar eksplorasi dunia virtual. Dalam permainan ini, kemampuan menambang sumber daya dan membangun markas merupakan kunci utama untuk bertahan hidup dan berkembang. Artikel ini akan membahas secara mendalam bagaimana cara efektif menambang berbagai sumber daya serta membangun markas yang kokoh di dunia bawah tanah Core Keeper, sehingga Anda bisa memaksimalkan pengalaman bermain dan semakin unggul dalam permainan.

Menambang Sumber Daya di Core Keeper
Sumber daya adalah bahan baku utama yang Anda perlukan untuk membuat peralatan, struktur markas, dan item berharga lainnya. Hingga saat ini, Core Keeper menawarkan beragam tipe sumber daya yang bisa ditemukan di berbagai zona bawah tanah dengan tingkat kesulitan yang berbeda.

  1. Memahami Jenis Sumber Daya
    Terdapat beberapa kategori sumber daya yang wajib Anda ketahui, seperti batu, logam (besi, emas), mineral langka, kristal ajaib, dan sumber daya organik seperti rotan dan jamur. Setiap jenis sumber daya biasanya tersebar di kedalaman dan area yang berbeda, sehingga eksplorasi yang cermat sangat disarankan.
  2. Alat Penambangan yang Tepat
    Untuk menambang dengan efisien, memilih alat yang tepat adalah langkah awal yang sangat penting. Pickaxe standar bisa digunakan untuk memulai menambang batu dan sebagian logam, Continue reading

Origin Range Requests: Serving large files without range-request tuning

A video player seeking to the middle of a movie asks for a few megabytes. Under our old range caching, that one request could make Cloudflare pull 128 MiB from the origin and move it between data centers, sometimes after the viewer had already left. Range requests are how large files get delivered, and caching them naively easily leads to wasted network bandwidth and wasted disk operations when running a CDN at scale.

So we rebuilt how our cache handles them. For R2, Cloudflare's object storage, p99 time to first byte dropped by about half, and a follow-up improvement cut tiered cache traffic for R2 and similar workloads by about 6%.

Today, we're making that new implementation available as Origin Range Requests, a self-service feature on all plans. There's no range size to tune and no need to contact support. Turn it on with a Cache Rule, and Cloudflare handles the rest.

A request for part of a file

An HTTP range request asks for part of a resource instead of the whole resource. The client sends a normal GET with a Range header:

GET /movie.mp4 HTTP/1.1
Host: example.com
Range: bytes=1048576-2097151

If the server supports the Continue reading

Bringing post-quantum cryptography to geographically fenced key management

Today, Cloudflare is launching a post-quantum geographically restricted key manager in support of our Data Localization Suite (DLS) in closed beta. This new PQ GeoKey Manager is a cornerstone of Cloudflare’s data sovereignty solutions, making sure that a customer's decryption keys are only accessible in their chosen geography. GeoKey Manager implements this by wrapping each decryption key such that it can only be decrypted by Cloudflare servers that are located in the allowed geography.

While general availability (GA) is planned for Q1 2027, today’s launch is an important milestone on our journey to support our customers’ data sovereignty goals while also migrating all Cloudflare products to post-quantum (PQ) cryptography.

Governments, financial institutions, healthcare providers, and defense organizations process highly sensitive data that can remain sensitive for years or decades after it is produced. Encryption is often required to protect this data. When classical, public-key encryption is used, adversaries do not immediately need a quantum computer today to put that data at risk: they can store the ciphertext and retain them until quantum computers can break the public key cryptography protecting it — an attack strategy known as harvest now, decrypt later.

For organizations with geographic requirements, resisting that threat is Continue reading

Public Videos: Data Center Fabric Architectures

All the videos in the Data Center Fabric Architectures webinar are now available without a valid ipSpace.net account.

The webinar hasn’t been updated in years, so the vendor-specific information is mostly obsolete. However, I’m sure you’ll still find the requirements, architectures, designs, and technology overviews sections relevant.

Explore

To watch more free ipSpace.net videos, browse them here, or click the Access Free Content button in any webinar roadmap.

Would You Notice? Five AI Agent Incidents and Who Actually Caught Them

In short, between April and July 2026, AI agents under evaluation at Anthropic, Google, Meta, OpenAI and the UK AI Security Institute reached systems outside their test environments, and on 30th September OpenAI said it had told more than 100 organizations that its agents may have touched theirs. The incidents have been read as containment failures, and they were. Read the five disclosures for who noticed, though, and they are detection stories first: one operator found out from a transcript review begun after another company’s announcement, two were told by their evaluation partner, one was told by the victim, and one caught its agent with its own monitoring and had the machines isolated within an hour of the alert. None of the five agents announced itself, and none needed to, because an agent’s traffic looks like any other workload’s until something is built to tell the difference. This post lays the five accounts side by side, asks what caught each one and how long it took, maps that onto what agent infrastructure has to provide, then says what a governance layer like Tigera Lynx can and cannot do about it. It is written for the platform and security leaders who Continue reading

Localizing compliance at scale: achieving South Korea’s ISMS certification

For ten days, auditors appointed by the Korea Internet & Security Agency (KISA) sat together with us and worked through 80 controls. That is what it took for a company headquartered in the United States, operating a global network serving Korean users, to be certified in South Korea. Cloudflare has now obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework.

For customers in Korea, this is more than a compliance checkbox. It is evidence that Cloudflare's security and privacy program has been examined not only for whether our controls exist, but for how they operate in the context of Korean law, the Korean language, and the particular expectations of Korean regulators.

What a Korean user sees when they sign up

The most visible result of this work is the Cloudflare account sign-up page. In most parts of the world, the line that sits above the sign-up button reads: "By continuing, I agree to Cloudflare's terms, privacy policy, and cookie policy."

A user signing up from South Korea sees something different. The Korean experience is triggered by the country selected at sign-up and by IP geolocation from within South Korea, and it breaks the same Continue reading

Using External Tools in BGP Labs

After Kazuya Takahashi released his wonderful network-xray tool and added it as an external tool to the open-source BGP configuration labs, I wrote a short document explaining how to start external tools in your BGP labs without changing the lab topology, and how it works in GitHub Codespaces (hint: wonderfully).

I also modified all lab instructions to include a pointer to the optional tool-setup step.

Happy labbing ;)

Attention people who think UB is fine

After my post on undefined behavior in C some people insisted that it’s demonstrably fine, we know what the code will do, and at worst we’ll get a segfault.

This is false.

Here’s an example.

C code

#include<utility>

// Let's pretend this is a memory mapped device controlling
// motors and gears and stuff.
volatile int device_command = 0;

void serve_hot_chocolate() {
        device_command = 42;

        // Oh no, we spilled some hot chocolate, invoking UB.
        //
        // The definition of `std::unreachable()` is:
        //     Invokes undefined behavior at a given point.
        std::unreachable();
}

void explode() {
        device_command = 3;
}

int main() {
        serve_hot_chocolate();
}

Example assembly output

With GCC 16.2 with -O1.

"serve_hot_chocolate()":
        mov     DWORD PTR "device_command"[rip], 42
"explode()":
        mov     DWORD PTR "device_command"[rip], 3
        ret
"main":
        mov     DWORD PTR "device_command"[rip], 42
"device_command":
.zero   4

Ruh roh. Exploding chocolate! The function explode() will be executed, even though it was never called!

Another example: dereferencing a null pointer

Some people insisted that dereferencing a null pointer is fine. It’ll just try to access address zero! And these people supposedly know what happens when you try: if nothing is mapped there, you’ll get a segfault.

Again, not true.

Let’s say we change Continue reading

SONiC in a BGP EVPN Data Center: Errata, Updates and Notes

 



Errata

  • 22 October 2026 (No. 001): Chapter 5: Host Connectivity, Typos in Sub-Titles: Steps 1-3, GONFIG_DB instead of CONFIG_DB. 
  • 23 October 2026 (No. 001): Chapter 7:.BGP EVPN - Intra-Subnet Forwarding: Typo fixed in sub-title APPL_DB - Local Upates > Updates 

Updates

No Updates 

Notes

  •     21 October 2026: First edition published on Leanpub.com
  •     22 October 2026: Higher resolution file Uploaded to Leanpub

Introducing full transaction detection for Cloudflare WAF

Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both "Does this request look malicious?" and "What happened when the application handled it?" Response rules can then block the origin’s response before it reaches the requester.

These are valuable protections because the latest frontier models are uncovering vulnerabilities buried deep in widely used software, giving defenders clarity on what to fix — and attackers new paths to exploit. The recent php2shell vulnerability shows the stakes: a flaw in a common software component can put applications across the Internet at risk. AI agents scanning for vulnerabilities can be extremely persistent, adapting payloads using feedback, and chaining vulnerabilities, credentials, and permissions. An application's response can reveal whether an attempt worked and give an attacker information that helps them go deeper.

Inspecting incoming requests remains essential for stopping recognizable attacks before they reach an application. But some threats become clear only when the request is considered alongside what the origin returns. A suspicious input followed by a response exposing sensitive information tells Continue reading

Cloudflare deploys protections against php2shell vulnerability

Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic.

Cloudflare has been part of a coordinated effort to deploy mitigations to protect the Internet, working with PHP foundation, OpenAI and Wiz among others. Cloudflare has developed and deployed web application firewall (WAF) protections since early October 2026, which were deployed about 9 hours ahead of public disclosure. Starting on October 21 3:02 am UTC, Cloudflare customers using our free or paid WAF were protected by default against php2shell.

Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers. We observed how attackers were mutating the attack payload to try to bypass our protections by tracking the volume of matches and cross-referencing with the rule logic.

Protecting against php2shell required more than standard request-based rules. Request data alone does not always provide enough evidence to distinguish an Continue reading

1 2 3 … 3,915