Juniper RADIUS-delivered switching filters

I’ve been experimenting with getting RADIUS to deploy switching filters to Juniper switches recently, as part of a reference architecture demo.  The concept is called REACH2020 and combines network virtualisation with the ability to identify network users and devices so that categories of user can be put into different virtual networks.   This leaves the firewall that connects the virtual networks together as a convenient single point of control.

Anyway, back to the matter in hand.  It turns out there’s a limit to the length of switching filter you can send a Juniper EX.

In this case, I am using Aruba Clearpass 6.6 to send some RADIUS attributes to a Juniper EX4300 switch using Junos 17.4.     What I need to do is send a web portal address that a connecting client will be redirected to, and a switching filter so that they can’t go anywhere other than the portal. The switching filter is required as far as I can tell – if you just send the portal address, Junos ignores the RADIUS attribute.

An alternative way of achieving this is to configure your centralised web authentication (CWA) web portal on every edge switch, but since RADIUS Continue reading

Upcoming Webinars and Events: November 2018

The last two months of 2018 will be jam-packed with webinars and on-site events:

• Dinesh Dutt will talk about network observability, how it’s different from monitoring and why it matters on November 8^th;
• I’ll continue the Amazon Web Services networking saga with the third live session on November 15^th. We already covered VPCs, interfaces and addresses, network security, route tables, and Internet connectivity. Now it’s time for VPNs, Direct Connect and VPC peering;
• The annual Data Center Fabric Architectures update will take place on November 22^nd. I’ll cover the changes in data center switching market, and new hardware launched by major vendors;
• The Network Connectivity and Graph Theory webinar was a huge hit, so we agreed with Rachel Traylor to do a whole series of similar webinars. On November 29^th she’ll cover Reliability Theory: Networking through a Systems Analysis Lens;

December will be a storage, EVPN and SDN month:

TriggerMesh Taps Knative for Serverless Management Platform

Developers are able to manage their serverless and FaaS deployments from the platform to work across different infrastructure environments.

Intel Quietly Previews Next-Gen Cascade Lake Processors

The chipmaker expects to release the new class of Intel Xeon Scalable processors in the first half of 2019.

IETF 103, Day 2: IPv6, NTP, Routing Security & IoT

This week is IETF 103 in Bangkok, Thailand, and we’re bringing you daily blog posts highlighting the topics of interest to us in the ISOC Internet Technology Team. And following on from the previous day, Tuesday also features a packed agenda.

LPWAN will be discussing whether to move to a Working Group Last Call on the Static Context Header Compression (SCHC) framework for IPv6 and UDP, that provides both header compression and fragmentation functionalities. Three other drafts describe similar schemes for SigFox,LoRaWAN and IEEE 802.15.4 type networks.

NOTE: If you are unable to attend IETF 103 in person, there are multiple ways to participate remotely.

Then at 11.20 UTC+7, IPWAVE will be focusing on updates to the specification for transmitting IPv6 Packets over IEEE 802.11 Networks in Vehicular communications, and the use cases for IP-based vehicular networks. There have also been a couple of updates to DNS Name Autoconfiguration for Internet of Things Devices and IPv6 Neighbor Discovery for Prefix and Service Discovery in Vehicular Networks, so these may also be discussed.

6MAN will be meeting at 13.50 UTC+7 and has nine drafts up for discussion. The couple of working group Continue reading

A Tale of Two DCs for Supply Chains: Distribution and Data Centers

China Telecom’s Internet Traffic Misdirection

The Youth Internet Governance Forum India: Our Experience

On 12 October, the Internet Society’s India Delhi Chapter (ISOC-Delhi) hosted the Youth Internet Governance Forum (YIGF) in New Delhi, India. Adarsh Umesh and Praneet Kaur share their thoughts on the event.

Hello everyone! A special “Hi!” from our side to the youth because this blog is specially dedicated to the youth of India.

We’re very much inspired to write this blog due to the wonderful experience with the India Youth Internet Governance Forum (YIGF 2018). It was amazing to be a part of the multistakeholder advisory group and the event overall was a grand success. This would not have been possible without the consistent support from inSIG, ICANN, APNIC and the Internet Society.

The YIGF 2018 was organized as day 0 event on the 12th October 2018, a day before the India School on Internet Governance 2018 (inSIG-2018) at Indira Gandhi Delhi Technical University for Women (IGDTUW). The event was well-designed and planned with a lot of technical exposure as well as fun. It extended support to youth from all over the country to attend the event. We provided fellowships to 15 delegates from different parts across India. The fellowship covered both travel and accommodation expenses for five Continue reading

Latest supercomputer runs Red Hat Enterprise Linux (RHEL)

On Oct. 26, the National Nuclear Security Administration (NNSA) — part of the Department of Energy — unveiled the latest supercomputer. It's named Sierra and is now the third-fastest supercomputer in the world.Sierra runs at 125 petaflops (peak performance) and will primarily be used by the NNSA for modeling and simulations as part of its core mission of ensuring the safety, security, and effectiveness of the U.S.'s nuclear stockpile. It will be used by three separate nuclear security labs — Lawrence Livermore National Labs, Sandia National Laboratories, and Los Alamos National Laboratory. And it's running none other than Red Hat Enterprise Linux (RHEL).To read this article in full, please click here

Latest supercomputer runs Red Hat Enterprise Linux (RHEL)

On Oct. 26, the National Nuclear Security Administration (NNSA) — part of the Department of Energy — unveiled the latest supercomputer. It's named Sierra and is now the third-fastest supercomputer in the world.Sierra runs at 125 petaflops (peak performance) and will primarily be used by the NNSA for modeling and simulations as part of its core mission of ensuring the safety, security, and effectiveness of the U.S.'s nuclear stockpile. It will be used by three separate nuclear security labs — Lawrence Livermore National Labs, Sandia National Laboratories, and Los Alamos National Laboratory. And it's running none other than Red Hat Enterprise Linux (RHEL).To read this article in full, please click here

T-Mobile, Sprint Merger Foes Raise Security Concerns Related to Huawei, ZTE

It's no surprise that groups representing wireless workers claim the merger will cost American jobs. But connecting T-Mobile and Sprint to possible security risks related to China is a new angle that could have an impact on the deal.

Vestberg Revamps Verizon to Focus on Consumers, Enterprise, and Media

Calling the initiative Verizon 2.0, the new operating structure is intended streamline the company. This latest move builds on Verizon’s promise to cut $10 billion in costs.

Symantec Buys Appthority, Javelin Networks to Strengthen Endpoint Security

The two acquisitions will boost the company's mobile and enterprise credentials, particularly with regard to Active Directory and mobile application security.

Extreme Networks Busts Into Agile Data Center Networking

The bundled hardware and software includes data center switching and routing hardware acquired from Brocade.

IDG Contributor Network: The future of cloud interconnects

There are three types of applications; applications that manage the business, applications that run the business and miscellaneous apps.A security breach or performance related issue for an application that runs the business would undoubtedly impact the top-line revenue. For example, an issue in a hotel booking system would directly affect the top-line revenue as opposed to an outage in Office 365.It is a general assumption that cloud deployments would suffer from business-impacting performance issues due to the network. The objective is to have applications within 25ms (one-way) of the users who use them. However, too many network architectures backhaul the traffic to traverse from a private to the public internetwork.To read this article in full, please click here

IDG Contributor Network: The future of cloud interconnects

There are three types of applications; applications that manage the business, applications that run the business and miscellaneous apps.A security breach or performance related issue for an application that runs the business would undoubtedly impact the top-line revenue. For example, an issue in a hotel booking system would directly affect the top-line revenue as opposed to an outage in Office 365.It is a general assumption that cloud deployments would suffer from business-impacting performance issues due to the network. The objective is to have applications within 25ms (one-way) of the users who use them. However, too many network architectures backhaul the traffic to traverse from a private to the public internetwork.To read this article in full, please click here

BGP Hijacks: Two more papers consider the problem

The security of the global Default Free Zone DFZ) has been a topic of much debate and concern for the last twenty years (or more). Two recent papers have brought this issue to the surface once again—it is worth looking at what these two papers add to the mix of what is known, and what solutions might be available. The first of these—

Demchak, Chris, and Yuval Shavitt. 2018. “China’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’s BGP Hijacking.” Military Cyber Affairs 3 (1). https://doi.org/10.5038/2378-0789.3.1.1050.

—traces the impact of Chinese “state actor” effects on BGP routing in recent years. Whether these are actual attacks, or mistakes from human error for various reasons generally cannot be known, but the potential, at least, for serious damage to companies and institutions relying on the DFZ is hard to overestimate. This paper lays out the basic problem, and the works through a number of BGP hijacks in recent years, showing how they misdirected traffic in ways that could have facilitated attacks, whether by mistake or intentionally. For instance, quoting from the paper—

• Starting from February 2016 and for about 6 months, routes Continue reading

Google Launches $25 Million Fund, Doubles Down on AI for Social Good  

The new fund follows Google’s decision not to bid for the Pentagon’s $10 billion JEDI contract because the work may not support its principles.

The Push to Modernize at William & Mary

At William & Mary, our IT infrastructure team needs to be nimble enough to support a leading-edge research university — and deliver the stability expected of a 325 year old institution. We’re not a large school, but we have a long history. We’re a public university located in Williamsburg, Virginia, and founded in 1693, making us the second-oldest institution of higher education in America. Our alumni range from three U.S. presidents to Jon Stewart.

The Linux team in the university’s central IT department is made up of 5 engineers. We run web servers, DNS, LDAP, the backend for our ERP system, components of the content management system, applications for administrative computing, some academic computing, plus a long list of niche applications and middleware. In a university environment with limited IT resources, legacy applications and infrastructure are expensive and time-consuming to keep going.

Some niche applications are tools built by developers in university departments outside of IT. Others are academic projects. We provide infrastructure for all of them, and sometimes demand can ramp up quickly. For instance, an experimental online course catalog was discovered by our students during a registration period. Many students decided they liked the experimental version Continue reading

The Week in Internet News: Companies Fear AI Will Destroy Business Models

AI against businesses: More than 40 percent of U.K. companies believe Artificial Intelligence will destroy their business models within five years, according to a Microsoft survey featured on CNBC.com. Still, more than half of businesses in the U.K. have no AI strategy. And while 45 percent workers are concerned their job could be replaced by AI, 51 percent are not learning skills to prepare for the changes.

Government AI board: Meanwhile, Public Knowledge, a digital rights advocacy group, has called on the U.S. government to create a new federal authority to develop AI expertise, as a way to effectively regulate and govern the technology, reports IP-watch.org. “The rapid and pervasive rise of artificial intelligence risks exploiting the most marginalized and vulnerable in our society,” the group argues.

Math against fake news: Professors from the U.K. and Switzerland have released a mathematical definition of fake news, in the hope that it will give lawmakers ideas on how to combat it, Phys.org says. The researchers have also introduced a model for fake news that can be used to study the phenomenon.

Vietnam against fake news: A new cybersecurity law in Vietnam is intended to combat Continue reading