4 Software-Defined Storage Trends
More enterprises are deploying SDS, but they sometimes run into problems related to support and scalability.
VRF Series Article 3 – Creating a Shared Services VRF
For those following the VRF Series, we currently have a topology built that consists of a segmented Layer 3 first hop network and remotely networked by carrying the isolation from the BrWan router to Main. This article covers, shared services, the next step in our journey to understanding VRFs for Segmented Layer 3 Networks.
The configuration focus is solely on the router Main. The shared services VRF that will be created could serve as a place to connect something that all other VRFs must have access to. Organizations should evaluate their requirements closely before deploying this configuration.
An organization that requires stateful inspection between two areas may choose to connect two or more VRFs together using an L4 or Next Generation Firewall (we will cover this in Article 5). The security ramification of having a shared services VRF, as described in this article, is that devices connected in this area could be used as a proxy into other areas. Therefore, careful planning and proper device level security is important prior to deploying this type of architecture.
The technologies covered here include:
- IGP w/ Route Redistribution (EIGRP)
- BGP w/ Route Redistribution
- VRFs with Route Targets/Route Distinguisher vlaues
The logic of Continue reading
Nothing Should Stop You!
As many of you know, I was born in Turkey. And unfortunately, the educational system of that country is very weak. And guess what: If you can’t afford to go to private school in Turkey, you may not be able to learn English in the government school. However, if you are a very diligent student, […]
The post Nothing Should Stop You! appeared first on Cisco Network Design and Architecture | CCDE Bootcamp | orhanergun.net.
Restoring Space 15.2 data to 16.1
The upgrade from Space platform 15.2 to 16.1 is one of the worst procedures I’ve seen in quite a while. It is complicated because the underlying CentOS is being upgraded at the same time, so I guess that’s part of the reason, but still, it could be a lot slicker and better tested.
In summary, you have to apply a couple of patches, the second of which backs your 15.2 data up somewhere else – ideally over SCP to a remote server. You then shut down your 15.2 VM, install a fresh 16.1 VM with the same IP addresses, and restore the data to it.
Sounds easy, but the 16.1 installation part can generally only be done by the customer’s VMware admin because it needs console access. So you’ve got to rely on them following lots of instructions quite well.
Recently a customer experienced some kind of failure in the restoration part, leaving me with a fresh installed 16.1, but no data. I SSHed on to the VM and could see the standard menu, but wasn’t offered any option to attempt another restore. After digging around for a while, I found Continue reading
Response:New Office 365 subscriptions for consumers plunged 62% in 2016 | ITworld
Another “public cloud isn’t for everyone” story:
By charting Office 365’s new subscribers using a trailing 12 months — the latest quarter plus the three previous — to eliminate seasonal spikes, the suite’s waxing and waning over the past four years becomes apparent. From its Q1 2013 debut until Q4 2015, Office 365 subscriber growth was always steady, sometimes spectacular.
Solid approach to charting and yes, Office 365 did well but:
After Q4 2015, however, the trailing 12-month numbers fell, a decline fueled by the plateau of 0.9 million each quarter from the second onward. That resulted in a gain of just 4.3 million subscribers throughout 2016, a reduction of 62% from the year before.
Oh, the path to public cloud isn’t always a growth market? That’s not the story from the clouderati. Oh dear.
New Office 365 subscriptions for consumers plunged 62% in 2016 | ITworld : http://www.itworld.com/article/3162708/enterprise-applications/new-office-365-subscriptions-for-consumers-plunged-62-in-2016.html
The post Response:New Office 365 subscriptions for consumers plunged 62% in 2016 | ITworld appeared first on EtherealMind.
Increasing SDDC Visibility
In Episode 69 of Software Gone Wild we discussed ways of increasing visibility into VXLAN transport fabric. Another thing we badly need is visibility into the virtual edge behavior, and to help you get there Iwan Rahabok created a set of vRealize dashboards that include the virtual edge networking components. Hope you’ll find them useful.
ASIC Programmability from Barefoot Networks
Full disclosure : I was lucky to be among a group of networking influencers invited to Silicon Valley to visit some networking companies and see what they were offering to the market. I was flown out and given accommodations at the expense of Gestalt IT – the company that organized the event. I was given some swag by each company, but I was never paid to write a positive review on the product. Heck, I’m not even expected to write at all.
Think about the fastest switch in your network and why it’s so fast. Traditionally, it’s because the manufacturer has developed a very efficient ASIC that does switching very well (give me some leeway here and forget about routing, encapsulation, etc.), but it really can’t do anything else. Want a new switching feature? Well, your switch can’t do that if the ASIC doesn’t support it. No big deal – the manufacturer just needs to make a new ASIC that supports it, right? This sounds simple, but, generally, this is a many-years process and requires a hardware update on your end. This is not a good solution in a world where new features and technologies Continue reading
VRF Series Article 2 – Extending L3 Segmentation with VRF-lite
In the last article, we took an initial look at L3 segmentation with VRFs. In that case, we created a basic first hop configuration that had isolated pci and data segments. In reality, most networks are far larger and more complex. This article continues down that same path by building proper layer 3 links and IGP adjacency with a Headquarter (Main) location. The starting point from a configuration standpoint is where we left off in Article 1 of this series.
Specifically in this article, we will configure subinterfaces to connect BrWan to Main for each VRF. We will also create a loopback on Main in each VRF to act as a test point that should be reachable from each host. From a routing protocol perspective, we will leverage EIGRP in Named Mode. This mode is a requirement because it is the method that allows the address family command to identify VRFs.
Note: I am working from some VIRL defaults, so I will be including the removal of unnecessary items. Also, I will be shutting down Gigabit 2 since the rest of the topology is out of scope for this article.
Main – HQ Router
//removing unnecessary routing Continue reading
Musing: Google Establishes CA Root Authority.
Google continues to build out its ownership of key Internet infrastructure. Email/Spam filtering, Chrome Browser, DNS
As we look forward to the evolution of both the web and our own products it is clear HTTPS will continue to be a foundational technology. This is why we have made the decision to expand our current Certificate Authority efforts to include the operation of our own Root Certificate Authority. To this end, we have established Google Trust Services (https://pki.goog/), the entity we will rely on to operate these Certificate Authorities on behalf of Google and Alphabet.
Thoughts, in no particular order:
- Bought company with root certificates to shorten lead time to control
- Ownership of and widespread use of Chrome web browser, DNS and trusted root certificates means that Google has unprecedented amount of control over user data regardless encryption.
- Can silently MITM any traffic in browser by combining web browser and certificate configuration
- Data gathering from DNS servers for destinations, source addresses/geolocation, usage profiling
- Chrome already prevents many privacy and usability features available in other browsers e.g. Reading mode,
- Adds to data-gathering possibilities from web services that predict searches, URLs and spelling errors built into browser
One of the base Continue reading
VRF Series Article 1 – Basic L3 Segmentation with VRFs
Network engineers are well aware of the Layer 2 isolation properties of VLANs. Their use is so pervasive that they are second nature to most. This article is the first in a series that outlines specifically how VRFs can be used to provide the same type of end to end isolation for Layer 3 that VLANs provide for Layer 2.
In this example, we will work with a subset of the overall topology that I previously shared. Specifically, we are going to configure a router that I’ll call BrWan, a Layer 2 switch, and 3
routers that I’m using to emulate connected hosts (data-x/pci-x).
BrWan will contain the technology configuration that is the primary focus of the article. The other components are configured somewhat generically and using technologies that most are very familiar with.
At the end of this exercise, the requirement is that anything related to “data” can only reach other parts of the “data” network. Similar requirements exist for “pci”. There will be no ACLs used to prevent communication between pci and data, but the isolation requirement is strict. These concepts will be carried forward throughout the series. Later examples will provide a mechanism for some traffic between Continue reading
Segmenting Layer 3 Networks with VRFs
I am creating a multi-part series that focuses on Layer 3 network segmentation. This post serves as a landing point and aggregation place for these topics. As the series is built out, the individual links will be available below.
Articles in this Series
- Article 1 – Basic L3 Segmentation with VRFs
- Article 2 – Extending L3 Segmentation with VRF-lite
- Article 3 – Creating a Shared Services VRF
- Article 4 – VRF-lite in a DMVPN Network
- Article 5 – Stateful Inter-Vrf connectivity
The basic topology is shown below. Each article will consist of the configuration information and relevant validation. This should serve as a very good starting point for anyone struggling with building out a common network with strict security zones requiring areas of isolation.
Other Articles about VRFs
- VRFing 101, Understing VRF Basics
- VRFing 102, Providing Internet Access With Dynamic PAT
- VRFing 103, Using NAT Virtual Interfaces for Global Reachability
- Using a GRE Tunnel VRF to Separate the Physical Interface
- Combining GRE and IPSec with a Front Side VRF
- ce Gateway and Voice VRF – Caveats