BGP Labeled Unicast on Cisco IOS
While researching the BGP RFCs for the Three Dimensions of BGP Address Family Nerd Knobs, I figured out that the BGP Labeled Unicast (BGP-LU, advertising MPLS labels together with BGP prefixes) uses a different address family. So far so good.
Now for the intricate bit: a BGP router might negotiate IPv4 and IPv4-LU address families with a neighbor. Does that mean that it’s advertising every IPv4 prefix twice, once without a label, and once with a label? Should that be the case, how are those prefixes originated and how are they stored in the BGP table?
As always, the correct answer is “it depends”, this time on the network operating system implementation. This blog post describes Cisco IOS behavior, a follow-up one will focus on Arista EOS.
BGP Labeled Unicast on Cisco IOS
While researching the BGP RFCs for the Three Dimensions of BGP Address Family Nerd Knobs, I figured out that the BGP Labeled Unicast (BGP-LU, advertising MPLS labels together with BGP prefixes) uses a different address family. So far so good.
Now for the intricate bit: a BGP router might negotiate IPv4 and IPv4-LU address families with a neighbor. Does that mean that it’s advertising every IPv4 prefix twice, once without a label, and once with a label? Should that be the case, how are those prefixes originated and how are they stored in the BGP table?
As always, the correct answer is “it depends”, this time on the network operating system implementation. This blog post describes Cisco IOS behavior, a follow-up one will focus on Arista EOS.
VSCode Settings Per-Language
This is just a quick post to share something that I found which is a really nice quality of life tip for VSCode. In this post, I will show you how to configure per-language settings in VSCode so that for example in Python files you can set to indent with 4 spaces and in Javascript you...continue reading
Aruba Seeks To Entice Resellers With Modular ‘Network-In-A-Box’ Approach
Aruba hopes to entice the channel to resell Aruba gear with a new purchasing model. Aruba is packaging network equipment and software into pre-sized bundles designed around outcomes. You want an outdoor WLAN? Select option 1. You want a wired campus? Choose option 2. Based on customer requirements, the reseller buys and installs pre-defined service […]
The post Aruba Seeks To Entice Resellers With Modular ‘Network-In-A-Box’ Approach appeared first on Packet Pushers.
Fast-Track Enterprise Digital Transformation With Managed Prisma SASE
This blog provides an in-depth overview of Palo Alto Networks recently introduced Prisma SASE for MSPs, a scalable multi-tenant cloud management portal solution for managed service providers (MSPs) to fast track enterprise digital transformation with managed SASE services.
The post Fast-Track Enterprise Digital Transformation With Managed Prisma SASE appeared first on Packet Pushers.
Cloudflare’s investigation of the January 2022 Okta compromise
Today, March 22, 2022 at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result. We do not use Okta for customer accounts; customers do not need to take any action unless they themselves use Okta.
Investigation and actions
Our understanding is that during January 2022, hackers outside Okta had access to an Okta support employee’s account and were able to take actions as if they were that employee. In a screenshot shared on social media, a Cloudflare employee’s email address was visible, along with a popup indicating the hacker was posing as an Okta employee and could have initiated a password reset.
We learnt of this incident via Cloudflare’s internal SIRT. SIRT is our Security Incident Response Team and any employee at Cloudflare can alert SIRT to a potential problem. At exactly 03:30 UTC, a Cloudflare employee emailed SIRT with a link to a tweet that had been sent at 03:22 UTC. The tweet indicated that Okta had potentially been breached. Multiple other Cloudflare employees contacted SIRT over the following Continue reading
Device Management From The Ground Up: Part 4 – Viewing Operational State
In this article I cover some common "show" commands to view information about our devices as well as tools to refine the commands’ outputs to get exactly the information we require.
The post Device Management From The Ground Up: Part 4 – Viewing Operational State appeared first on Packet Pushers.
How To Fix Ubuntu 18.04 ‘apt update’ Throwing An NGINX Repository i386 Package Error
When running ‘apt update’ on Ubuntu 18.04 to prepare for routine system patching, the system kicked back the following error.
N: Skipping acquire of configured file 'nginx/binary-i386/Packages' as repository
'http://nginx.org/packages/ubuntu bionic InRelease' doesn't support architecture 'i386'The issue is that the existing sources list file for NGINX has gone stale, and appears to be requesting the i386 package. NGINX does not support i386 on Ubuntu 18.04 (Bionic). The solution is to update the sources list file for NGINX.
OLD /etc/apt/sources.list.d/nginx.list
deb http://nginx.org/packages/ubuntu bionic nginxNEW /etc/apt/sources.list.d/nginx.list
deb [arch=amd64] http://nginx.org/packages/mainline/ubuntu/ bionic nginxAfter this change, the error should be gone when running ‘apt update’.
For More Information
NGINX update issue (Ubuntu 18.04 Bionic) – Vesta Control Panel Forum
Ubuntu Server 18.04 Nginx i386 – StackOverflow
Get updates on the health of your origin where you need them
We are thrilled to announce the availability of Health Checks in the Cloudflare Dashboard’s Notifications tab, available to all Pro, Business, and Enterprise customers. Now, you can get critical alerts on the health of your origin without checking your inbox! Keep reading to learn more about how this update streamlines notification management and unlocks countless ways to stay informed on the health of your servers.
Keeping your site reliable
We first announced Health Checks when we realized some customers were setting up Load Balancers for their origins to monitor the origins’ availability and responsiveness. The Health Checks product provides a similarly powerful interface to Load Balancing, offering users the ability to ensure their origins meet criteria such as reachability, responsiveness, correct HTTP status codes, and correct HTTP body content. Customers can also receive email alerts when a Health Check finds their origin is unhealthy based on their custom criteria. In building a more focused product, we’ve added a slimmer, monitoring-based configuration, Health Check Analytics, and made it available for all paid customers. Health Checks run in multiple locations within Cloudflare’s edge network, meaning customers can monitor site performance across geographic locations.
What’s new with Health Checks Notifications
Health Checks email Continue reading
Understanding Data Center Fabrics 02: Clos Fabric History – Video
In the second part of this 9-video series, Russ White describes crossbar fabrics and how they interconnect, using historical telephone networks as an example. He jumps from this to help you understand what’s going on inside of data center fabrics, including Clos architectures. Other details Russ touches on include non-blocking fabrics, how an undertaker impacted […]
The post Understanding Data Center Fabrics 02: Clos Fabric History – Video appeared first on Packet Pushers.
Cloud Engineering For The Network Pro: Part 5 – Cloud Firewalls And Security Groups In Azure And AWS (Video)
Michael Levan reviews the differences between firewalling on premises and in the public cloud and how to set basic rules in AWS and Azure. You can subscribe to the Packet Pushers’ YouTube channel for more videos as they are published. It’s a diverse a mix of content from Ethan and Greg, plus selected videos from […]
The post Cloud Engineering For The Network Pro: Part 5 – Cloud Firewalls And Security Groups In Azure And AWS (Video) appeared first on Packet Pushers.
DDoS attacks and BGP Flowspec responses
This article describes how to use the Containerlab DDoS testbed to simulate variety of flood attacks and observe the automated mitigation action designed to eliminate the attack traffic.
docker run --rm -it --privileged --network host --pid="host" \Start Containerlab.
-v /var/run/docker.sock:/var/run/docker.sock -v /run/netns:/run/netns \
-v ~/clab:/home/clab -w /home/clab \
ghcr.io/srl-labs/clab bash
curl -O https://raw.githubusercontent.com/sflow-rt/containerlab/master/ddos.ymlDownload the Containerlab topology file.
containerlab deploy -t ddos.ymlDeploy the topology and access the DDoS Protect screen at http://localhost:8008/app/ddos-protect/html/.
docker exec -it clab-ddos-sp-router vtysh -c "show bgp ipv4 flowspec detail"
At any time, run the command above to see the BGP Flowspec rules installed on the sp-router. Simulate the volumetric attacks using hping3.
Note: While the hping3 --rand-source option to generate packets with random source addresses would create a more authentic DDoS attack simulation, the option is not used in these examples because the victims responses to the attack packets (ICMP Port Unreachable) will be sent back to the random addresses and may leak out of the Containerlab test network. Instead varying source / destination ports are used to create entropy in the attacks.
When you are finished trying the examples below, run the following command Continue reading