HITL for autonomous agents: Where does the human go?
Human approval is easy when you are sitting in front of the agent. For an agent running by itself in a cluster, almost none of that holds.
You’re in a meeting and your agent is running in a cluster. It has a service account, it has been asked to keep a service healthy, and it has just worked out that the right fix is to roll back a database migration. Nobody is watching it. That was rather the point of deploying it. You want to get notified to approve such an important action.
This is a different problem from the one most people picture when they hear human in the loop. If you use a coding assistant, you already have human oversight and it costs almost nothing: the agent shows you a diff, you read it, you approve. That works because you are already there — at a keyboard, with the context in front of you, in the same second the agent needs an answer.
An autonomous agent has none of that. There is no session to interrupt. The person who should decide is asleep, or in a meeting, or on a plane. The approval has to travel out of Continue reading
D2DO313: Operations is a Reconciliation Loop (Sponsored)
In this sponsored episode, Paul Delory of Gartner joins Kyler and Ned to discuss the reconciler pattern for operations and the shift toward continuous operations. Together they discuss how immutable infrastructure, policy as code, and platform engineering help bridge the gap between traditional IT and modern automation. They also highlight Gartner’s upcoming Infrastructure, Operations &... Read more »Strata Cloud Manager – Worth the Hype?
If you use Palo Alto firewalls, typically you manage them in one of two ways. You either log into each firewall directly and manage it on its own, or you use Panorama, which lets you manage multiple firewalls from a single place.
Most of us were used to this setup, myself included. If you had a handful of firewalls, logging into each one individually is okay. But once you started scaling up to tens or hundreds of firewalls across different sites, Panorama became the go-to option. It let you centrally manage the configurations and monitor logs centrally instead of touching every single firewall by hand.
Strata Cloud Manager (SCM)
However, Palo Alto released yet another option called Strata Cloud Manager (SCM) in 2023, which is hosted by Palo Alto themselves, unlike Panorama, which you manage internally. The idea at a very high level is that the firewalls connect to Strata Cloud Manager (outbound only) through the Internet, and you log into SCM to manage the configurations and push them to the firewalls.
From my experience and speaking to other people, Palo Alto is pushing SCM to customers and adding new features to it. So the unspoken assumption is that any Continue reading
TCG084: Is AI Going to Kill Us All? Separating Frontier Risk From Frontier Theater
Is AI going to kill us all? Frontier systems are producing real security failures, but extinction forecasts are being used to support policies that could consolidate control over AI. Eyvonne and William discuss Jacob Coxon’s high-profile resignation from Anthropic, the gap between real technical risks and speculative extinction narratives, and the commercial incentives driving calls... Read more »NAN131: Routing Through Space: The Reality of Low-Earth Orbit (LEO) Satellite Networks
Eric is joined by Sid Mathur, founder of Fastah Inc., to unpack the real-world implications of Low-Earth Orbit (LEO) internet. Sid has built a career obsessing over data networks, system performance, and the operational challenges facing ISPs and satellite operators. Together they dive into the complexities of in-motion geolocation and explore the traffic routing implications... Read more »How vagrant-libvirt Plugin Deals with Duplicate Subnets
TL&DR: Badly. The vagrant-libvirt plugin mysteriously crashes when an existing virtual network (with a different libvirt name) uses the same IP subnet as the desired management network.
Background: netlab is using the vagrant-libvirt plugin to manage libvirt/KVM virtual machines with Vagrant. As I already have that infrastructure, I use it to start standalone virtual machines (usually to test various Ubuntu releases) on my Linux server. Things work great… until they don’t.
Here’s how I managed to waste half a day chasing imaginary gremlins caused by a simple error.
Kendaraan Robot Otonom untuk Sistem Jalan Berpori Otomotif Perkotaan
Dalam beberapa tahun terakhir, inovasi otomotif tidak hanya berfokus pada kendaraan pribadi atau transportasi umum, tetapi juga berkembang ke ranah teknologi perkotaan yang berkelanjutan. Salah satu terobosan mutakhir saat ini adalah pengembangan kendaraan robot otonom pengangkut sistem perakitan jalan berpori yang berfungsi sebagai solusi efektif untuk mengatasi masalah banjir di wilayah perkotaan. Konsep jalan berpori yang kini semakin populer menjadi bagian integral dalam mendukung visi kota hijau dan manajemen air yang efisien, sementara teknologi otomotif otonom memberikan kemudahan dan efisiensi dalam proses instalasi dan perawatan sistem tersebut.
Memahami Konsep Jalan Berpori dan Peranannya dalam Solusi Perkotaan
Jalan berpori, atau porous pavement, merupakan teknologi infrastruktur yang dirancang untuk memungkinkan air hujan meresap secara langsung ke tanah melalui permukaan jalan, sehingga mengurangi genangan dan risiko banjir. Saat ini, penggunaan jalan berpori semakin meluas karena dampaknya yang signifikan dalam mengelola limpasan air hujan di daerah perkotaan yang padat dan minim ruang resapan alami.
Keunggulan jalan berpori tidak hanya dari segi penyerapan air, tetapi juga pada kemampuannya menjaga kualitas air dengan memfilter kotoran dan polutan sebelum air kembali ke tanah. Ini sangat relevan dengan kondisi perkotaan yang semakin berkembang dan menghadapi tantangan penataan ruang hijau dan drainase tradisional yang mulai tidak memadai. Oleh karena Continue reading
Hornussen: Olahraga Tradisional Swiss dengan Refleks dan Kecepatan Tinggi
Hornussen, olahraga tradisional Swiss yang mulai dikenal luas kembali dalam periode terbaru, telah merebut perhatian banyak pecinta olahraga karena kombinasi unik antara kecepatan proyektil dan refleks ekstrem yang dibutuhkan para pemainnya. Saat ini, hornussen bukan hanya sebagai warisan budaya, tetapi juga sebagai bentuk olahraga kompetitif yang menuntut keterampilan fisik dan mental tingkat tinggi. Artikel ini mengulas mengapa olahraga hornussen begitu menarik dari sisi teknis dan apa yang membuat perpaduan refleks ekstrem serta kecepatan proyektil menjadi inti dari permainan ini.
Pengenalan Olahraga Hornussen: Tradisi dan Perkembangan Terkini
Hornussen merupakan olahraga yang berasal dari pedesaan Swiss dan selama beberapa dekade terakhir bertransformasi dari hiburan tradisional menjadi aktivitas kompetitif dengan standar aturan yang makin ketat. Saat ini, hornussen dimainkan secara aktif di berbagai wilayah Swiss dan beberapa komunitas di kawasan Eropa lainnya yang ingin melestarikan budaya serta mengembangkan potensi olahraga unik ini. Hornussen sering disebut sebagai olahraga yang memadukan unsur cricket, golf, dan bisbol, karena pelaksanaan pukulan dan permainan tim yang dinamis.
Esensi dari hornussen adalah memukul sebuah proyektil kecil bernama “Nouss” dengan alat khusus yang disebut “Hornussstock.” Proyektil ini meluncur dengan kecepatan luar biasa, bahkan bisa mencapai ratusan kilometer per jam, sehingga menarik dan menantang para pemain lawan untuk menangkis Continue reading
PP126: Trying (and Failing) the CCIE Security Exam
Today we talk about trying and failing. More specifically, guest Keith Tokash wrote a pair of blogs on Packet Pushers about taking, but not passing, the CCIE Security written exam. Failure’s a hard thing to talk about, particularly in this age where every public utterance on LinkedIn feels like it has to document one’s ever-upward... Read more »HW088: Scaling Your Wireless Team with Ekahau SaaS (Sponsored)
In this sponsored episode, Keith is joined by Matt Starling and Troy Martin of Ekahau to announce their new Software as a Service (SaaS) licensing model. Together they explain the different flexible subscription options and how they complement traditional perpetual licenses. They also breakdown the hardware capabilities of the Sidekick 2 and the Speedtest Pulse.... Read more »HS142: The Blueprint for Automated Network Operations (Sponsored)
In this sponsored episode, Ronny Wolf of BlueCat Networks joins Johna and John to explore the importance of API-first architecture. They also discuss how BlueCat expanded beyond core DDI into intelligent network operations, the key differences between having APIs versus being built API-first, and how guardrails such as rate limiting and human in the loop... Read more »
MPLS/VPN with SR-MPLS Core
As we discussed in the BGP-Free Core with SR-MPLS blog post, SR-MPLS works as a drop-in replacement for the traditional MPLS control plane. No wonder it works well (when properly implemented) with MPLS/VPN services – the second “fun” scenario in my ITNOG10 Segment Routing workshop. It uses the same topology as the BGP-Free Core scenario:
Simplest possible MPLS/VPN network with SR-MPLS core
One or Two Nameservers?
The answer to the question of just how many DNS nameservers should you use to serve a zone seems to be buried more in folklore than data! Let's see if there is a measurable difference between serving a zone with one or two nameservers.NB591: Altera Adds PQC to FPGAs; Europe Spend Billions to Boost Satellite Broadband
Take a Network Break! Ivanti takes center stage with a red alert on four critical CVEs in its Neuron platform, and MikroTik also gets a mention for an actively exploited flaw in its OS. On the news front, BackBox announces new AI capabilities for its OS backup and config management platform, Amazon selects from Qualcomm’s... Read more »Configuring Management IP Addresses to Virtual Network Devices
It goes without saying that if you want to configure (virtual) network devices with any semi-sane configuration mechanism1, the device must have a working IP address. Here’s the time-honored method2 to assign an IP address to a virtual network device:
- Start the virtual machine (using a GUI)3
- Open a new window: either a telnet session to the virtual console port or a full-blown virtual console (GUI) session.
- Manually configure the IP address, the SSH server, and the user credentials on the first interface.
Automating Let’s Encrypt Certificate Renewal for Palo Alto GlobalProtect
If you manage GlobalProtect VPN certificates on Palo Alto and use Let's Encrypt, at some point you will start thinking about automation. Let's Encrypt certificates have a short lifespan, so renewing them manually every few months isn't really practical. In this post, we will look at automating this process using Ansible, Cloudflare DNS, and the PAN-OS Ansible collection to renew certificates and push them to the firewall.
Prerequisite
Let's say your domain is mydomain.com and it's managed through Cloudflare. You want to generate a certificate for vpn.mydomain.com and have it automatically installed on your Palo Alto firewall as the GlobalProtect portal or gateway certificate, without logging in manually every time it's close to expiry. To do this, you will need:
- Python/Ansible installed
- A domain managed through Cloudflare, so
certbotcan complete the DNS-01 challenge. This doesn't have to be Cloudflare specifically, certbot supports several other DNS providers as well, but this post assumes Cloudflare since that's what we're using here. - A Cloudflare API token with permission to edit DNS records for that zone
- Certbot installed along with the Cloudflare DNS plugin
- Ansible with the
paloaltonetworks.panoscollection installed - An API key from your Palo Alto firewall so Continue reading
TNO072: Connectivity and Community with Jason Gintert
Jason Gintert, Co-Founder of the US Networking User Association, returns to the show to discuss his key elements and events in his professional career. Jason shares valuable lessons learned from his early days in the 90’s ISP boom, the challenges of failing at scale, and his dedication to creating regional networking communities that foster genuine... Read more »HN841: HPE Melds Apstra and Mist for Self-Driving Data Center Networks (Sponsored)
In this sponsored episode, Kyle Baxter and Sridhar Katere from HPE join Drew to talk about automating enterprise data center networks. They discuss how HPE integrates its Apstra and Mist products to bring AI ops and self-driving capabilities into data center operations. They also break down how HPE leverages the different strengths of each platform,... Read more »Hedge 318: Parkinson’s Law (and Bastiat)
It’s time for Eyvonne, Tom, and Russ to gather round the hedge and talk about various items of interest. In this roundtable, we consider what we can learn about product development from Bastiat, and the various ins and outs of Parkinson’s Law.
download