Openstack Juno – Management interfaces

Openstack Juno – Group based policy

Openstack Juno – Multihost Networking

Openstack Juno services – Swift, Glance, Heat, Ceilometer

Openstack Juno services – Nova, Cinder

Openstack Juno Install using Devstack

ASK your questions and SHARE your opinion

I receive lots of questions from my students, readers, customers, followers on network design. I try to  answer as quickly as possible and in detail. Thanks to all of them ! I receive a lot of kind emails, messages from them to put my effort on this blog as well. But for many reasons, I… Read More »

The post ASK your questions and SHARE your opinion appeared first on Network Design and Architecture.

CLN 2015 Designated VIPs

I wanted to take a moment and give a well-deserved congratulations to the 2015 Cisco Learning Network Designated VIPs. These fine folks spend a ton of time giving back to the community by helping others in their learning process.

New VIPs for 2015

• Aref Alsouqi
• Darren Starr
• Joshua Johnson
• Milan Rai

Returning from Previous Year(s)

• Alain Cadet
• Chandan Singh Takuli
• Daniel Dib
• DelVonte Deary
• Elvin Arias
• Erick
• Jared Hainline
• Jon K. Johnson (Jay)
• Riikka Sihvonen

Again, a very warm welcome and congratulations to this group. Your contribution to the community is much appreciated.

Bios and more information for the 2015 VIPs can be found here–

• About Us – The Cisco Learning Network

Disclaimer: This article includes the independent thoughts, opinions, commentary or technical detail of Paul Stewart. This may or may does not reflect the position of past, present or future employers.

The post CLN 2015 Designated VIPs appeared first on PacketU.

Using sipcalc The Great and Powerful Subnet Calculator

10 Reasons why the Raspberry Pi 2 Model B is a killer product

Discard Routing for RFC1918 Addresses

While working with firewalls for the last few years, I’ve seen many logs polluted with scanning traffic. Obviously this is the type of thing that I want to see when someone is legitimately scanning, or attempting to scan, through the firewall. However, there are a few cases that seeing this traffic is simply an indication of some other issue in the network.

An example I have seen on several occasions is someone configuring a network management station to discover 192.168.0.0/16, 172.16.0.0/12 or 10.0.0.0/8. If not properly handled in the routed network architecture, the associated traffic could make its way to the firewall or even to the ISP. An ASA might block the traffic due to policy, reroute it back toward the internal network, drop it due to the intra-interface hairpin configuration, or forward it onward. In most cases, this traffic will cause a lot of “noise” in the syslogs produced by the firewall.

To fully understand the problem, the diagram below can be used for discussion–

In this example, R1 has a static default route that points to the IP address of FW1. R1 advertises this via EIGRP to its internal neighbors. If a networked host attempts to reach Continue reading

Kubernetes DNS config on bare metal

One of the ‘newer’ functions of Kubernetes is the ability to register service names in DNS.  More specifically, to register them in a DNS server running in the Kubernetes cluster.  To do this, the clever folks at Google came up with a solution that leverages SkyDNS and another container (called kube2sky) to read the service entries and insert them as DNS entries.  Pretty slick huh?

Beyond the containers to run the DNS service, we also need to tell the pods to use this particular DNS server for DNS resolution.  This is done by adding a couple of lines of config to the kubernetes-kubelet service.  Once that’s done, we can configure the Kubernetes service and the replication controller for the SkyDNS pod.  So let’s start with the kubelet service configuration.  Let’s edit our service definition located here…

/usr/lib/systemd/system/kubernetes-kubelet.service

Our new config will look like this…

[Unit]
Description=Kubernetes Kubelet
After=etcd.service
After=docker.service
Wants=etcd.service
Wants=docker.service

[Service]
ExecStart=/opt/kubernetes/kubelet 
--address=10.20.30.62 
--port=10250 
--hostname_override=10.20.30.62 
--etcd_servers=http://10.20.30.61:4001 
--logtostderr=true 
--cluster_dns=10.100.0.10 
--cluster_domain=kubdomain.local 
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Notice that Continue reading

Alteon AppShape++ persistency and multiple scripts per service

Lab goal

Setup

I'll use my Loadbalancer Lab Setup.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/c/slb/real 1
        ena
        ipver v4
        rip 10.136.85.1
/c/slb/real 2
        ena
        ipver v4
        rip 10.136.85.2
/c/slb/real 3
        ena
        ipver v4
        rip 10.136.85.3
/c/slb/group 10
        ipver v4
        add 1
        add 2
        add 3

Alteon configuration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

/cfg/slb/appshape/script take_10/en/import


attach group 10

when HTTP_REQUEST {
    group select 10
}

-----END

Box buys Airpost, a startup that keeps tabs on cloud app use

Box has acquired Airpost, a startup that helps enterprises detect and manage the use of cloud applications by their employees.Airpost, a two-year-old startup based in Toronto, announced the acquisition in a blog post on Friday. Box confirmed it has bought the company. Terms were not disclosed.Airpost will close operations on March 1. After that, customers won’t be able to use its product, founder and CEO Navid Nathoo said in an email message.But the concept seems sound: Airpost tells IT departments when employees start using cloud-based apps on their own and provides access controls and protections against potential vulnerabilities in those apps. The idea is to let employees keep using the apps they found and get the productivity they want, while keeping the enterprise secure.To read this article in full or to leave a comment, please click here

Superfish security flaw also exists in other apps, non-Lenovo systems

On Thursday security researchers warned that an adware program called Superfish, which was preloaded on some Lenovo consumer laptops, opened computers to attack. However, it seems that the same poorly designed and flawed traffic interception mechanism used by Superfish is also used in other software programs.Superfish uses a man-in-the-middle proxy component to interfere with encrypted HTTPS connections, undermining the trust between users and websites. It does this by installing its own root certificate in Windows and uses that certificate to re-sign SSL certificates presented by legitimate websites.To read this article in full or to leave a comment, please click here

Nomad: Mobile charging gadgets you need

I’ve tested any number of portable backup batteries designed to keep your phone running when you’re not near a power socket and I thought I’d pretty much seen most of the good ideas … until I opened a box that just arrived from Nomad. Nomad NomadKey with Apple Lightning connector Nomad NomadClipTo read this article in full or to leave a comment, please click here

AppFutura: How to outsource mobile development

If you’re a small company without developers or maybe a group within a large organization that can’t get any love from the corporate development team and you need a mobile app, where are you going to go? The whole process of connecting with third party developers, getting non-disclosure agreements signed, getting bids, correlating bids, and selecting which developers to work with is a daunting and non-trivial workload.Should you be in this particular boat, a service that launched late last year, AppFutura, can help you. AppFutura connects project owners and developers in a systematic way making the mobile app development process potentially less complicated and much more organized.To read this article in full or to leave a comment, please click here

iPexpert’s Newest “CCIE Wall of Fame” Additions 2/20/2015

Please join us in congratulating the following iPexpert client’s who have passed their CCIE lab!

This Week’s CCIE Success Stories

• Florian Brenner, CCIE #46529 (Wireless)
• Kanwal Chawla, CCIE #47128 (Collaboration)
• Ankit Bansal, CCIE #47099 (Data Center)
• Curtis Raams, CCIE #46953 (Collaboration)

This Week’s CCIE Testimonials

Esteban Paniagua, CCIE #46910
“I wanted to say thanks to the iPexpert team, since I contacted sales to book my 5 day lab boot camp the service they provided me was truly world-class!! I attended the Collaboration boot camp with Andy; he was really knowledgeable, willing to go over details during his explanations and had great communication skills. I passed my CCIE Collaboration on the first try, I wouldn’t have been able to do it without your materials and boot camp. Thanks again!”

Curtis Raams, CCIE #46953
“I can certainly confirm that your course was very well structured and combined with your virtual lab over VPN I was able to successfully study and pass the CCIE exam. I studied extensively the 900 page DSG and mock labs provided by Andy Vassar which provided sufficient and detailed learning with extensive explanations and use cases.

I would strongly recommend iPExpert to any person Continue reading

The Longest Match Rule

One of the the concepts that comes up occasionally is that of precedence. For example, one might consider the following routing table entries.

ip route 0.0.0.0 0.0.0.0 1.1.1.1              //default route
ip route 192.168.0.0 255.255.0.0 1.1.1.2      //supernet/cidr route
ip route 192.168.1.0 255.255.255.0 1.1.1.3    //network route
ip route 192.168.1.0 255.255.255.128 1.1.1.4  //subnet route
ip route 192.168.1.20 255.255.255.255 1.1.1.5 //host route

Questions often arise around which path a packet would take when it matches more than one entry. For example, a packet may have a destination address of 192.168.1.20. In this case it matches every single route entry.

The logic is actually simple, even straightforward. A packet will follow the most specific route entry that it matches. So a packet destined to 192.168.1.20 would be routed to a router at 1.1.1.5. If the destination happened to be 192.168.1.21, it would be routed over to 1.1.1.4.

Continue reading

Chip companies working to make Wi-Fi more maker-friendly

Texas Instruments and MediaTek have launched new offerings aimed at making it easier to build IoT (Internet of Things) devices with Wi-Fi connectivity.The chip makers have realized that their future isn't just in selling products to big companies, but also to a growing maker community whose products also need Wi-Fi connectivity.This week TI expanded its SimpleLink portfolio with two new modules, which promise to help add Wi-Fi connectivity without requiring any network experience. A similar promise came from MediaTek earlier this month when it launched a new Wi-Fi development platform.INSIDER: 5 ways to prepare for Internet of Things security threats To jump start Wi-Fi development, TI now offers the CC3100 module BoosterPack and the CC3200 module LaunchPad, which include an SDK and sample boards that can be connected directly to a PC.To read this article in full or to leave a comment, please click here