The Minds Of Men
Do size and speed really matter that much? When you're in IT, they do.
Let’s Focus on Realistic Design Scenarios
An engineer working for a large system integrator sent me this question:
Since you are running a detailed series on leaf-and-spine fabrics these days, could you please suggest if following design scenarios of Facebook and Linkedin Data centers are also covered?
Short answer: No.
Read more ...GETVPN Example
A couple of weeks ago I had the good fortune of attending Jeremy Filliben’s CCDE Bootcamp.
It was a great experience, which I will elaborate on in another post. But one of the technology areas I had a bit of difficult with, was GETVPN.
So in this post a I am going to setup a scenario in which a customer has 3 sites, 2 “normal” sites and a Datacenter site. The customer wants to encrypt traffic from Site 1 to Site 2.
Currently the customer has a regular L3VPN service from a provider (which is beyond the scope of this post). There is full connectivity between the 3 sites through this service.
The topology is as follows:
GETVPN consists of a few components, namely the Key Server (KS) and Group Members (GM’s), which is where it derives its name: Group Encrypted Transport. A single SA (Security Association) is used for the encryption. The Key Server distributes the information to the Group Members through a secure transport, where the Group Members then use this information (basically an ACL) to encrypt/decrypt the data packets.
The routing for the topology is fairly simple. (See Routing Diagram) Each client as well as the KeyServer Continue reading
Cisco ASA packet capture showing bidirectional traffic flow
Recently I had to troubleshoot some communication issues via a Cisco ASA device and the packet capture on the IOS comes in handy for this task.
When you have a lot of traffic over ASA and you’re interested in a particular IP address, the basic packet capture lesson says that you should configure an access-list to limit the captured packets for the interesting traffic only.
Let’s assume that I have a particular interest for the traffic to and from the IP address 10.0.0.10.
I created a standard ACL to match only the traffic related to 10.0.0.10:
access-list TS standard permit host 10.0.0.10
Afterward I attached the created ACL to a packet capture on a particular interface (let’s call it “lan”).
capture TSHOOT access-list TS interface lan
You can find the above lines in almost any how-to regarding packet capture on Cisco ASA.
Checking the capture I noticed that traffic is unidirectional captured:
FW# show capture TSHOOT 4 packets captured 1: 20:15:32.757010 802.1Q vlan#10 P0 192.168.0.10 > 10.0.0.10: icmp: echo request 2: 20:15:33.759283 802.1Q vlan#10 P0 192.168.0.10 > 10. Continue reading
SDxCentral Weekly News Roundup — May 13, 2016
ONUG creates four new open source initiatives.