Policy versus ACLs, it’s those exposed implementation details again
In a blog week dedicated to the application and the policies that govern them, I wanted to add some detail on a discussion I have with customers quite often. It should be clear that we at Plexxi believe in application policy driven network behaviors. Our Affinities allow you to specify desired behavior between network endpoints, which will evolve with the enormous amount of policy work Mat described in his 3 piece article earlier this week.
ACL
Many times when I discuss Affinities and policies with customers or more generically with network engineering types, the explanation almost always lands at Access Control Lists (ACLs). Cisco created the concept of ACLs (and its many variations used for other policy constructs) way way back as a mechanism to instruct the switching chips inside their routers to accept or drop traffic. It started with a very simple “traffic from this source to this destination is dropped” and has very significantly evolved since then in Cisco’s implementation and many other of the router and switch vendors.
There are 2 basic components in an ACL:
1. what should I match a packet on
2. what is the action I take once I found a match.
Both Continue reading
Quick Guide to my Interop New York Sessions
I’m running or participating in five workshops or sessions during next week’s Interop New York. Three of them build on each other, so you might want to attend all of them in sequence:
Designing Infrastructure for Private Clouds starts with requirements gathering phase and focuses on physical infrastructure design decisions covering compute, storage, physical and virtual networking, and network services. If you plan to build a private (or a reasonable small public) cloud, start here.
Read more ...Musing: Cisco Buys Tail-F and Disrupts Competitor Product Development
It has been a while since Cisco acquired Tail-F but no one seems to have noticed how this acquisition impacts Cisco's competitors by upsetting the software development plans.
The post Musing: Cisco Buys Tail-F and Disrupts Competitor Product Development appeared first on EtherealMind.
Bash vulnerability CVE-2014-6271 patched
This morning, Stephane Chazelas disclosed a vulnerability in the program bash, the GNU Bourne-Again-Shell. This software is widely used, especially on Linux servers, such as the servers used to provide CloudFlare’s performance and security cloud services.
This vulnerability is a serious risk to Internet infrastructure, as it allows remote code execution in many common configurations, and the severity is heightened due to bash being in the default configuration of most Linux servers. While bash is not directly used by remote users, it is used internally by popular software packages such as web, mail, and administration servers. In the case of a web server, a specially formatted web request, when passed by the web server to the bash application, can cause the bash software to run commands on the server for the attacker. More technical information was posted on the oss-sec mailing list.
The security community has assigned this bash vulnerability the ID CVE-2014-6271.
As soon as we became aware of this vulnerability, CloudFlare’s engineering and operations teams tested a patch to protect our servers, and deployed it across our infrastructure. As of now, all CloudFlare servers are protected against CVS-2014-6271.
Everyone who is using the bash software package should upgrade Continue reading
Necessity of Analytics and Monitoring in the SDN Era
Necessity of Monitoring and Analytics in the SDN Era
by Hariharan Ananthakrishnan, Distinguished Engineer - September 24, 2014
A recent SDNCentral article about the Five Habits of Highly Effective SDN Startups asserts that achieving success in the SDN landscape will require creating focused products that solve real-world problems. In addition, the article emphasizes the need to build a sales channel with great partners, market strategically but be lean and mean, and adopt a slow and steady route into the SDN world.
The article quoted the new landscape of SDN as we know it. Take a look at the diagram below. The building blocks range from controllers to network operating systems to monitoring and analytics.
As the above diagram illustrates, monitoring and analytics are key. With SDN, the network self-adapts to the new demands of the application, and without visibility into these changes it’s very hard to say if an SDN application is doing the right things to your network. Understanding the programmable events that happen in real time requires mature analytics technology that can correlate service delivery to physical and virtual resource states.
At Packet Design, we have been working on a solution for SDN analytics Continue reading
Network Troubleshooting with ThousandEyes
My first experience with ThousandEyes was a year ago at Network Field Day 6, where they were kind enough to give us a tour of their office, and introduce us to their products. I’ve been fairly distracted since then, but kept an eye on what other delegates like Bob McCouch were doing with the product since that demo.
A year later, at Network Field Day 8, they presented again. If you’ve never heard of ThousandEyes, and/or would like an overview, watch Mohit’s (CEO) NFD8 introduction:
Debugging the Internet
One of the things that really stuck out a year ago, and was reinforced tenfold this year, was that ThousandEyes was not introducing any new protocols to the industry – at a time when all of the headlines were talking about new protocols (i.e. OpenFlow). Numerous tech startups – especially those in networking – are in existence purely to tackle the big “software-defined opportunity” gold rush.
Instead, ThousandEyes is focused on network monitoring. If you’re like me – you hear those words and immediately conjure up images of all of the…..well, terrible software that exists today to monitor networks. In addition, network monitoring is inherently very fragmented. You can really only Continue reading
Proposed Junos XML Enhancements
I was looking at some Ethernet interface statistics last week when I realized I couldn’t find the output that confirmed the results of Ethernet Autonegotiation, just that autonegotiation had been enabled: john@noisy> show interfaces ge-0/0/0 Physical interface: ge-0/0/0, Enabled, Physical link … Continue reading
If you liked this post, please do click through to the source at Proposed Junos XML Enhancements and give me a share/like. Thank you!
Network Automation & Programmability Survey
Many vendors collect their own data that is more than likely a little skewed and biased. As I prepare for a few upcoming presentations, I thought it would be great to get some REAL data from REAL people doing great things or even those just starting on their automation journey.
If you would be kind enough, there is a link to a survey below that asks a few questions pertaining to network automation and programmability. No personal information is required.
Network Automation & Programmability Survey
If you wish to see the results, please fill the survey out :)
Thanks in advance,
Jason
Twitter: @jedelman8
If you would be kind enough, there is a link to a survey below that asks a few questions pertaining to network automation and programmability. No personal information is required.
Network Automation & Programmability Survey
If you wish to see the results, please fill the survey out :)
Thanks in advance,
Jason
Twitter: @jedelman8
It’s the Applications, Stupid (Part 3 of 3)!
If you missed the first 2 parts of this series, you can catch them here and here. The short version is that there are Enterprise customers that are actively seeking to automate the production deployment of their workloads, which leads them to discover that capturing business policy as part of the process is critical. We’ve arrived here at the point that once policy can be encapsulated in the process of application workload orchestration, it is then necessary to have infrastructure that understands how to enact and enforce that policy. This is largely a networking discussion, and to-date, networking has largely been about any-to-any all equal connectivity (at least in Data Centers), which in many ways means no policy. This post looks at how networking infrastructure can be envisioned differently in the face of applications that can express their own policy.
[As an aside, Rich Fichera over at Forrester researcher wrote a great piece on this topic (which unfortunately is behind a pretty hefty paywall unless you're a Forrester client, but I'll provide a link anyway). Rich coins the term "Systems of Engagement" to describe new models for Enterprise applications that depart from the legacy "Systems of Record." If you have access Continue reading
Network Programmability 101: The Problem
In the first part of the Network Programmability webinar Matt Oswalt described some of the major challenges most networks are facing today:
- Why is everyone claiming that the network is so slow to change?
- Is that really the case? Why?
- Why is the manual configuration culture so widespread in networking?
- How does the holistic thinking in the design phase dissolve into the box mentality of CLI commands?
- How does the box mentality limit the scalability of network deployments?
Network Troubleshooting with ThousandEyes
My first experience with ThousandEyes was a year ago at Network Field Day 6, where they were kind enough to give us a tour of their office, and introduce us to their products. I’ve been fairly distracted since then, but kept an eye on what other delegates like Bob McCouch were doing with the product since that demo. A year later, at Network Field Day 8, they presented again. If you’ve never heard of ThousandEyes, and/or would like an overview, watch Mohit’s (CEO) NFD8 introduction:Network Troubleshooting with ThousandEyes
My first experience with ThousandEyes was a year ago at Network Field Day 6, where they were kind enough to give us a tour of their office, and introduce us to their products. I’ve been fairly distracted since then, but kept an eye on what other delegates like Bob McCouch were doing with the product since that demo. A year later, at Network Field Day 8, they presented again. If you’ve never heard of ThousandEyes, and/or would like an overview, watch Mohit’s (CEO) NFD8 introduction:The Chassis Switch is Dead
The Chassis Switch is Dead. For most networks, chassis-based switches are no longer appropriate due to cost, inflexibility and risk. I see this as similar to servers, in that server blade chassis are no longer appropriate for most organisations. The alternatives are already better for cost & flexibility. The real question is what our management model will look like for those alternatives.
Dead Collector: ‘Ere, he says he’s not dead.
Leaf-Spine: Yes he is.
Chassis: I’m not.
Dead Collector: He isn’t.
Leaf-Spine: Well, he will be soon, he’s very ill.
Chassis: I’m getting better.
Leaf-Spine: No you’re not, you’ll be stone dead in a moment.
(With apologies to Monty Python)
Blade Servers…
In the late 1990s, and early 2000s, server buying patterns changed significantly. Previously we had a few “Big Iron” Unix systems, but cheaper Intel-based systems changed the economics dramatically. This lead to a rapid sprawl in the number of physical servers.
In the second half of the 2000s, server blades appeared as a seductive answer. They promised simpler management of pools of systems, greater density, better efficiencies, and operational cost savings. Vendors promised long term “investment protection”, assuring us that we could keep the chassis, and upgrade blades Continue reading
Internet of Things roundtable: Experts discuss what to look for in IoT platforms
Networking is at the heart of every Internet of Things deployment, connecting sensors and other “Things” to the apps that interpret the data or take action.
But these are still early days. Assembling an IoT network from commercial off-the-shelf components is still, let’s just say, a work in progress. This will change over time, but for now the technical immaturity is being addressed by System Integrators building custom code to connect disparate parts and by a new class of network meta-product known as the IoT Platform.
IoT Platform products are still in their infancy, but there are already more than 20 on the market today. Approaches vary, so when making a build or buy decision, consider these critical areas of IoT Platform tech: security, sensor compatibility, analytics compatibility, APIs and standards.
To read this article in full or to leave a comment, please click here
What is the difference between tunnel | transport mode in IPsec
How does the internet work - We know what is networking
Intro IPsec making VPN connection possible. I enables to basically simulate a leased line across public Internet and thus enable us to get secure connection across unsecured environment. It enables encryption, authentication and protection of our data when sent across insecurity of the world’s biggest internetwork – Internet. It’s the cheap way to simulate a leased […]
What is the difference between tunnel | transport mode in IPsec
Lessons Drawn from the Rise of Server Virtualization
It has become common to draw analogies to the rise of server virtualization during the early-mid 2000’s to attempt to understand how network virtualization will change the way we build data center networks, both virtual and physical.
This is a useful tool, as there are clear similarities.
Server virtualization changed the amount of time it took to get a new compute resource up and running from weeks (order hardware, rack gear, install OS) to hours or even minutes. It allowed location independence, so admins could start VMs wherever capacity was available, and move them around at will.
Network virtualization is starting to provide similar benefits to the network. Creating a new virtual network can be done in minutes, compared to hours if we have to file a ticket with the networking team to provision a new VLAN and plumb it across a the physical network. And the scope of VM mobility can be increased radically, as VMs are no longer bound by size-limited physical L2 domains.
But there is one place the analogy breaks down, at least with networking from OEMs with the traditional proprietary appliance approach.
First, let’s back up briefly and examine something I glossed over when talking Continue reading
SDN Use Case: Content Filtering
K-12 schools face unique challenges with their IT infrastructure. Their user base needs access to a large amount of information while at the same time facing restrictions. While it does sound like some corporate network policies, the restrictions in the education environment are legal in nature. Schools must find new ways to provide the assurance of restricting content without destroying their network in the process. Which lead me to ask: Can SDN Help?
Online Protection
The government E-Rate program gives schools money each year under Priority 1 funding for Internet access. Indeed, the whole point of the E-Rate program is to get schools connected to the Internet. But we all know the Internet comes with a bevy of distractions. Many of those distractions are graphic in nature and must be eliminated in a school. Because it’s the law.
The Children’s Internet Protection Act (CIPA) mandates that schools and libraries receiving E-Rate funding for high speed broadband Internet connections must filter those connections to remove questionable content. Otherwise they risk losing funding for all E-Rate services. That makes content filters very popular devices in schools, even if they aren’t funded by E-Rate (which they aren’t).
Content filters Continue reading
New fiber connector is nifty
Corning has recently teamed up with Intel in introducing some new optical equipment. Corning's contribution (fibers, connectors) likely mean there will be some unfamiliar looking optical infrastructure in your data center soon.The fiber is a new 1310nm singlemode variety that Corning touts as "bend-insensitive". The minimum allowable bend radius of this fiber is 7.5mm. This is impressive, but expected under ITU-T G.657.B.
More interesting is the MXC connector. This is a push-on connector with a locking tab like the 8P8C connectors used for twisted pair Ethernet. It supports up to 64 fiber strands, each running at 25Gb/s.
 |
| MXC connector. Image from Corning-Intel Whitepaper. |
The only place I've seen this fiber or connector in use is on a prototype 100G CLR4 transceiver shot by Greg Ferro at the Intel Developer Forum a couple of weeks ago.
 |
| Greg's shot of CLR4 transceivers with MXC connectors. |
It seems the MXC connector will be used not Continue reading
Do You Really Need Investment Protection for Your Network ?
When the sales grunt talks about investment protection, its sure sign that they have run out of features, functions or value propositions to sell you. But do you really need investment protection or is it just another revenue stream for vendors (and a cost for you).
The post Do You Really Need Investment Protection for Your Network ? appeared first on EtherealMind.
Protecting Junos config
In the middle of a migration, and I just discovered the ability to protect parts of the Junos configuration from modification by other users. Could be quite useful!
[edit]
root@VMX1# show system services
[edit]
root@VMX1# protect interfaces
[edit]
root@VMX1# show interfaces
##
## protect: interfaces
##
ge-0/0/0 {
description "LINK TO VMX0";
vlan-tagging;
mtu 2000;
encapsulation flexible-ethernet-services;
unit 10 {
vlan-id 10;
family inet {
address 10.1.1.2/30;
}
}
}
[edit]
root@VMX1# set interfaces ge-0/0/1 description "LINK TO NOWHERE"
warning: [interfaces] is protected, 'interfaces ge-0/0/1' cannot be created
[edit]
root@VMX1#
