Integrating SRX in Svc Provider Network (Routing and Multi-tenancy Considerations)

Service Providers networks are always have complex requirements of multi-tenancy, routing & security and pose challenges to network architects.  In this blog I will write about SRX integration in Svc Provider Network while highlighting methodologies how to handle challenges of implementing security features with multi-tenancy and routing consideration.srx-in-sp

                                                                               REFERENCE TOPOLOGY

Devices have been classified into following segments based on their role:-

  •  Remote Customer Network (consist of Customer PCs connected to Provide Edge through Customer Edge).
  • Provider Network (Consist of Provider Edge Routers and Provider Back Bone Rout
  • Data Center Network (Consist of Internet Firewall and Server inside Data Center directly connected with Internet Firewall).
  •   Internet Edge (Consist of Internet Router connected with Internet Firewall hence providing internet access to Customer Networks connected with Data Center through provider network).

Traffic flow and security requirements are as under:-

  • Customer 1 Network (PC-1) requires access to Server-1 installed in Data Center and to Public DNS Server reachable via Internet Edge Router.
  • Continue reading

FBI urges ransomware victims to step forward

The FBI has issued a plea for those who have been hit by ransomware to report this to federal law enforcement so that the country can get a better sense of just how bad this problem really is.Ransomware refers to malware that encrypts files on computers or locks users out of their computers, and requests ransom be paid to set files free or allow users to regain access. Such malware, often going by spooky names like Cryptolocker or TeslaCrypt, can be activated by clicking on a web link or even visiting a compromised website, or opening an file in email. One nasty variant even takes your money and still deletes your files.To read this article in full or to leave a comment, please click here

DevOps and the Infrastructure Dumpster Fire

dumpsterfire2

We had a rousing discussion about DevOps at Cloud Field Day this week. The delegates talked about how DevOps was totally a thing and it was the way to go. Being the infrastructure guy, I had to take a bit of umbrage at their conclusions and go on a bit of a crusade myself to defend infrastructure from the predations of developers.

Stable, Boy

DevOps folks want to talk about continuous improvement and continuous development (CI/CD) all the time. They want the freedom to make changes as needed to increase bandwidth, provision ports, and rearrange things to fit development timelines and such. It’s great that they have they thoughts and feelings about how responsive the network should be to their whims, but the truth of infrastructure today is that it’s on the verge of collapse every day of the week.

Networking is often a “best effort” type of configuration. We monkey around with something until it works, then roll it into production and hope it holds. As we keep building more patches on to of patches or try to implement new features that require something to be disabled or bypassed, that creates a house of cards that is only as Continue reading

US bans using Galaxy Note7 phones on planes

The U.S. Department of Transportation has ordered that Samsung Galaxy Note7 smartphones can only be carried by crew and passengers on planes if the phones are switched off and are not connected to charging equipment.The order follows an official recall announced Thursday of 1 million Note7 smartphones by the U.S. Consumer Product Safety Commission, following concerns about faulty batteries in the devices which could overheat and even explode.People can now travel with the smartphones on aircraft only if they disable all applications like alarm clocks that could accidentally activate the phone, protect the power switch to prevent the phone from being inadvertently activated or turned on, and store the device in carry-on baggage or on their person, and not in checked baggage.To read this article in full or to leave a comment, please click here

Buying an iPhone 7 or iPhone 7 Plus may be impossible today

The iPhone 7 is already off to a booming start. Shortly after pre-orders began, Apple's carrier partners were blown away by unprecedented demand. Most notably, T-Mobile said that pre-orders were up 400% relative to the iPhone 6. Just yesterday, T-Mobile CEO John Legere added that the iPhone 7 is now the most pre-ordered device in T-Mobile history. On top of that, Sprint relayed that iPhone 7 pre-orders this year are up an astonishing 375% compared to last year. Suffice it to say, the iPhone 7 may very well set a new weekend sales record, though as we covered earlier, Apple won't be releasing specific sales figures this year.Speaking to the popularity of the iPhone 7, most prospective buyers hoping to walk into an Apple retail store and pick up the iPhone 7 model of their choice may be in for a rude awakening. According to a statement from Apple, all in-store stock of the iPhone 7 Plus and the Jet Black iPhone 7 are already sold out.To read this article in full or to leave a comment, please click here

Don’t pardon Snowden, lawmakers tell Obama

U.S. lawmakers are trying to stifle any hope that National Security Agency leaker Edward Snowden will receive a pardon. On Thursday, the House intelligence committee sent a letter to President Obama urging him to treat Snowden as a criminal.“Mr. Snowden is not a patriot. He is not a whistleblower,” the letter said.The letter was sent amid calls from tech leaders and liberal activists for Obama to pardon Snowden. The campaign, supported by Apple co-founder Steve Wozniak and celebrities including actor Daniel Radcliffe, argues that Snowden sparked an important debate about government mass surveillance.To read this article in full or to leave a comment, please click here

Don’t pardon Snowden, lawmakers tell Obama

U.S. lawmakers are trying to stifle any hope that National Security Agency leaker Edward Snowden will receive a pardon. On Thursday, the House intelligence committee sent a letter to President Obama urging him to treat Snowden as a criminal.“Mr. Snowden is not a patriot. He is not a whistleblower,” the letter said.The letter was sent amid calls from tech leaders and liberal activists for Obama to pardon Snowden. The campaign, supported by Apple co-founder Steve Wozniak and celebrities including actor Daniel Radcliffe, argues that Snowden sparked an important debate about government mass surveillance.To read this article in full or to leave a comment, please click here

Multi-Chassis-Link Aggregation (MC-LAG)

In my earlier blog (Junos High Availability Design Guide) it was discussed how to make use of redundant routing engines by configuring features like (GRES, NSR, NSB)  for reduction of downtime to minimum possible level.

The real problem is that one RE is active at one time and all PFEs must be connected with active RE . In case of failure of primary Routing Engine (RE) the backup RE will take over  and all PFEs now, needs to connect to new primary RE. This scenario can cause momentary disruption of services.

MC-LAG (Active-Active) is correct solution to above described problem as it offers 2 active REs in 2 different devices/ chassis. Important concepts for MC-LAG proper configuration / functionality  are as under:-

  • Inter Chassis Control Protocol. The MC-LAG peers use the Inter-Chassis Control Protocol (ICCP) to exchange control information and coordinate with each other to ensure that data traffic is forwarded properly. ICCP replicates control traffic and forwarding states across the MC-LAG peers and communicates the operational state of the MC-LAG members. It uses TCP as a transport protocol and requires Bidirectional Forwarding Detection (BFD) for fast convergence. Because ICCP uses TCP/IP to communicate between the peers, the two peers must be connected to Continue reading

Time to move away from HPE Software

If you are still using HPE Software, you should actively plan to migrate away. The recent divestiture does not look good to me – I think existing customers are going to get soaked. Plan your migration now.

I’ve said it before, that I retain a soft spot for Hewlett-Packard. They gave me my first professional job out of university. I served my sentence doing HP OpenView consulting, and HP-UX Administration, but still: it got me started. Once you have some professional experience, it’s much easier to move to the next role.

It saddens me to watch HP’s ongoing struggles. It’s sad to watch a big ship get broken up for parts. But things had to change. They need to do something to adapt to the realities of modern IT demands.

There was one line in the recent announcement about divesting HPE’s software assets that stood out to me:

Micro Focus expects to improve the margin on HPE’s software assets by approximately 20 percentage points by the end of the third full financial year following the closing of the transaction

(Emphasis added).

It has been clear for a while that HP Software was no longer a core asset for HPE. It Continue reading

U.S. consumer agency issues official Samsung Galaxy Note 7 recall

The U.S. Consumer Product Safety Commission (CSPC) late Thursday issued an official recall of 1 million Samsung Galaxy Note 7 smartphones. Samsung had issued its own recall Sept. 2, but there was no formal recall in cooperation with the CPSC until now. The recall is necessary because the Note 7 "presents such a fire hazard," Elliot Kaye, the CPSC chairman, said in a news conference. Kaye said customers subject to the recall have two options: either to seek a replacement or a refund, "which is the choice of the customer and the customer alone."To read this article in full or to leave a comment, please click here

Junos High Availability Design Guide

High availability is one of the important consideration during network design and deployment stage and all most all the network vendors support various high availability features.

The objective of this article is to describe Junos best practices required to achieve minimum downtime in case of fail-over scenarios.

The Routing Engine or Control Plan is the brain in Junos based devices to run and execute all the management functions. Most of the  Junos based devices offers redundant routing engines (either through default configuration or through explicit configuration virtual chassis ). At one time only one Routing engine can be active (exception of Active-Active MC-LAG which is beyond the scope of this blog).  The mere presence of 2nd routing engine in the Junos device will not add any advantage with respect to high availability until certain features are not configured.

  •  Grace-full Routing Engine Switch Over  (GRES). GRES enables synchronization of kernel and chassis demon between mater routing engine and backup routing engines and in case of failure of master routing Packet Forwarding Engine (PFE) will simply join to new master routing engine (which was backup routing before fail-over).

Preparing for a Graceful Routing Engine Switchover

 

Graceful Routing Engine Switchover Process

GRES can be configured by following configuration command:-

set chassis redundancy graceful-switchover

Effects of Continue reading

Windows 10 haters: Try Linux on Kaby Lake chips with Dell’s new XPS 13

Rejoice Linux fans; the OS will work on laptops with Intel's Kaby Lake chips.Three new models of Dell's slick XPS 13 Developer Edition will be available with Ubuntu OS and 7th Generation Core processors in the U.S. and Canada starting on Oct. 10.Prices for XPS 13 DE will start at US $949. Dell also announced the XPS 13 model with Kaby Lake and Windows 10, which will ship on Oct. 4 starting at $799.Dell didn't share details on what version of Ubuntu desktop OS will be preloaded. It officially supports Ubuntu 14.04 in existing laptops, but could pre-load version 16.04 on the new XPS 13 DE.Dell has remained committed to Linux while major PC vendors shift to Windows 10 on PCs. Intel made a major commitment to supporting Windows 10 with its new Kaby Lake chips but hasn't talked much about Linux support.To read this article in full or to leave a comment, please click here

Infocyte HUNT sets out to answer the question, “Have we been hacked?”

This column is available in a weekly newsletter called IT Best Practices.  Click here to subscribe.  Your company's senior executives are discussing cyber security and the possibility of suffering a data breach. The CEO read that if a company has valuable data, then a breach is statistically inevitable. Thankfully your company hasn't discovered a breach, but that means very little. FireEye says that a breach can go undetected for as long as 200 days. The worried CEO picks up the phone, calls you and asks, "Has our enterprise network been hacked?" He wants a definitive yes or no answer, right then and there. What do you tell him?To read this article in full or to leave a comment, please click here

Infocyte HUNT sets out to answer the question, “Have we been hacked?”

This column is available in a weekly newsletter called IT Best Practices.  Click here to subscribe.  Your company's senior executives are discussing cyber security and the possibility of suffering a data breach. The CEO read that if a company has valuable data, then a breach is statistically inevitable. Thankfully your company hasn't discovered a breach, but that means very little. FireEye says that a breach can go undetected for as long as 200 days. The worried CEO picks up the phone, calls you and asks, "Has our enterprise network been hacked?" He wants a definitive yes or no answer, right then and there. What do you tell him?To read this article in full or to leave a comment, please click here

The FBI could have saved money with this iPhone 5c hack

The FBI may have paid a small fortune to unlock an iPhone 5c used by the San Bernardino shooter. But a security researcher has demonstrated a way to do it for less than US $100. Sergei Skorobogatov at the University of Cambridge used a technique known as NAND mirroring to bypass the passcode retry limit on an iPhone 5c. Using store-bought equipment, he created copies of the phone’s flash memory to generate more tries to guess the passcode.   Skorobogatov detailed the whole process in a new paper that disputes the FBI’s assertion that the San Bernardino shooter’s iPhone couldn’t be accessed with the NAND mirroring technique.  To read this article in full or to leave a comment, please click here

1 … 2,522 2,523 2,524 2,525 2,526 … 3,697