Securing BGP: A Case Study (4)
In part 1 of this series, I looked at the general problem of securing BGP, and ended by asking three questions. In part 2 and part 3, I considered the third question: what can we actually prove in a packet switched network. For this section, I want to return to the first question:
Should we focus on a centralized solution to this problem, or a distributed one?
There are, as you might expect, actually two different problems within this problem:
- Assuming we’re using some sort of encryption to secure the information used in path validation, where do the keys come from? Should each AS build its own private/public key pairs, have anyone they want to validate the keys, and then advertise them? Or should there be some central authority that countersigns keys, such as the Regional Internet Registries (RIRs) so everyone has a single trust root?
- Should the information used to validate paths be distributed or stored in a somewhat centralized database? At the extreme ends of this answer are two possibilities: every eBGP speaker individually maintains a database of path validation information, just like they maintain reachability information; or there are a few servers (like the root DNS servers) Continue reading
An Exciting Career In IT Awaits You
You, too, can be a highly paid networking consultant. Just follow these simple steps.
Network Testing Gets Easier With DevOps
Networking pros can benefit from drawing parallels to the DevOps world, especially for test automation.
Show 276: Glue Networks, SD-WAN & Network Orchestration (Sponsored)
Ethan and Greg speak with Olivier Huynh Van, CTO and Co-Founder of Glue Networks, and learn about its network orchestration solution, Gluware. Gluware is designed to build and re-use network models to provide abstraction and simplify network provisioning and configuration.
The post Show 276: Glue Networks, SD-WAN & Network Orchestration (Sponsored) appeared first on Packet Pushers.
Show 276: Glue Networks, SD-WAN & Network Orchestration (Sponsored)
Ethan and Greg speak with Olivier Huynh Van, CTO and Co-Founder of Glue Networks, and learn about its network orchestration solution, Gluware. Gluware is designed to build and re-use network models to provide abstraction and simplify network provisioning and configuration.
The post Show 276: Glue Networks, SD-WAN & Network Orchestration (Sponsored) appeared first on Packet Pushers.
OpenDaylight Releases Beryllium, Touts Traction
Open source SDN project launches its fourth platform update with a growing developer and user base.
Why Would You Need BGP-LS and PCEP?
My good friend Tiziano Tofoni (the organizer of wonderful autumn seminars in Rome) sent me these questions after attending the BGP-LS and PCEP Deep Dive webinar, starting with:
Are there real use cases for BGP-LS and PCEP? Are they really useful? Personally I do not think they will ever be used by ISP in their (large) networks.
There are some ISPs that actually care about the network utilization on their expensive long-distance links.
Read more ...“Split and smear” your security policies: Static Unidimensional vs. Dynamic Multi-Dimensional Policies
In my previous post I explained why current security architectures aiming at inspecting all inline traffic via hardware appliances are failing to provide proper segmentation and scale in modern day data centers. As I described, this has nothing to do with the type of security technology being deployed but rather with engineering security services that can answer the requirements of scale, high bandwidth, micro-segmentation and distributed applications.
We have to remind ourselves why we are having these architectural discussions: the application and service landscape has been virtualized, generally in excess of 70%, while entertaining any cloud solution will force you down the path of moving to 100% virtualization. Yes, there are still physical servers and legacy applications to which we will extend security services to. But instead of being the norm, we now have to consider their place in the overall architecture as exceptions and design security and networking services around what makes up the bulk of the workloads, i.e. virtualized applications in the form of VMs and containers.
With this understanding, let’s discuss how years of deploying hardware security architectures have boxed us in a complex unidimensional, sequential approach to security policies and how we can now move beyond this implementation scheme with virtualization and the proper software tools. Continue reading
Pim Sparse Mode
Pim sparse mode – Multicast is used to send the data to the multiple receivers at the same time. Multicast reduces the load on the servers (Senders/Source in multicast term), provides efficient capacity usage on the network links. Figure – 1 Unicast vs Multicast Flows Multicast runs on top of UDP. Multicast uses Class D […]
The post Pim Sparse Mode appeared first on Cisco Network Design and Architecture | CCDE Bootcamp | orhanergun.net.
Pim Sparse Mode
Pim sparse mode – Multicast is used to send the data to the multiple receivers at the same time. Multicast reduces the load on the servers (Senders/Source in multicast term), provides efficient capacity usage on the network links. Figure – 1 Unicast vs Multicast Flows Multicast runs on top of UDP. Multicast uses Class D […]
The post Pim Sparse Mode appeared first on Orhanergun.
Network Redesign: VLANs And Ports
In the second part of this video series, Tony Fortunato begins making changes to a live network.
RedHat And Ansible For Networks
Apparently RedHat Ansible has realised that network devices is a separate market for their product and has created an “Ansible for Networking”. Frankly, I’m surprised that this wasn’t a thing already.
The post RedHat And Ansible For Networks appeared first on Packet Pushers.