BGP Management with Ansible Validated Content using the network.bgp collection

bcp management blog

At AnsibleFest 2022, we announced a new addition to the content ecosystem offered through the platform which is Ansible validated content. Ansible validated content is use cases-focused automation content that is packaged as Collections that contain Ansible plugins, roles and playbooks that you can use as an automation job through Red Hat Ansible Automation Platform.

Now that we understand what Ansible validated content is, we still have  to see what it brings to  network automation practices. We have already talked about a generic Ansible validated content for network automation which is network.base.

Network Border Gateway Protocol (BGP) is more focused  on very specific use cases –  managing BGP resources and neighborship,  platform-agnostic network automation and enhancing the experience of BGP management by providing production ready -content.

 

Network BGP Use Cases

The network.bgp Collection enables users to manage the BGP resources independent of platforms, as well as performing BGP health checks. It includes the following capabilities: 

  • Build Brownfield Inventory. The `persist` action enables users to be able to get the BGP global and address family facts  and store it as inventory host_vars. The idea is to have this dynamic inventory as a single source of truth for Continue reading

Internet disruptions overview for Q1 2023

Internet disruptions overview for Q1 2023
Internet disruptions overview for Q1 2023

Cloudflare operates in more than 285 cities in over 100 countries, where we interconnect with over 11,500 network providers in order to provide a broad range of services to millions of customers. The breadth of both our network and our customer base provides us with a unique perspective on Internet resilience, enabling us to observe the impact of Internet disruptions.

We entered 2023 with Internet disruptions due to causes that ran the gamut, including several government-directed Internet shutdowns, cyclones, a massive earthquake, power outages, cable cuts, cyberattacks, technical problems, and military action. As we have noted in the past, this post is intended as a summary overview of observed disruptions, and is not an exhaustive or complete list of issues that have occurred during the quarter.

Government directed

Iran

Over the last six-plus months, government-directed Internet shutdowns in Iran have largely been in response to protests over the death of Mahsa Amini while in police custody. While these shutdowns are still occurring in a limited fashion, a notable shutdown observed in January was intended to prevent cheating on academic exams. Internet shutdowns with a similar purpose have been observed across a number of other countries, and have also occurred in Continue reading

Should I Care About RPKI and Internet Routing Security?

One of my subscribers sent me this question:

I’m being asked to enter a working group on RPKI and route origination. I’m doing research, listening to Jeff Tantsura, who seems optimistic about taking steps to improve BGP security vs Geoff Huston, who isn’t as optimistic. Should I recommend to the group that the application security is the better investment?

You need both. RPKI is slowly becoming the baseline of global routing hygiene (like washing hands, only virtual, and done once every blue moon when you get new IP address space or when the certificates expire). More and more Internet Service Providers (including many tier-1 providers) filter RPKI invalids thus preventing the worst cases of unintentional route leaks.

Read more …

Should I Care About RPKI and Internet Routing Security?

One of my subscribers sent me this question:

I’m being asked to enter a working group on RPKI and route origination. I’m doing research, listening to Jeff Tantsura, who seems optimistic about taking steps to improve BGP security vs Geoff Huston, who isn’t as optimistic. Should I recommend to the group that the application security is the better investment?

You need both. RPKI is slowly becoming the baseline of global routing hygiene (like washing hands, only virtual, and done once every blue moon when you get new IP address space or when the certificates expire). More and more Internet Service Providers (including many tier-1 providers) filter RPKI invalids thus preventing the worst cases of unintentional route leaks.

Read more …

Privacy And Networking Part 8: IPv6 Addresses And Privacy

One of the biggest advantages of IPv6 is the ease of renumbering thanks to SLAAC and DHCPv6. Easy renumbering of IPv6 addresses should, in theory, make some privacy protection methods easy to implement. Here's how it works, and and how it doesn't solve all privacy problems.

The post Privacy And Networking Part 8: IPv6 Addresses And Privacy appeared first on Packet Pushers.

What is SOC 2 and how do you achieve SOC 2 compliance for containers and Kubernetes?

SOC 2 is a compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data. SOC 2 is based on five overarching Trust Services Criteria (TSC): security, availability, processing integrity, confidentiality, and privacy. Specifically, the security criteria are broken down into nine sections called common criteria (CC):

  • CC1: Control Environment
  • CC2: Communication and Information
  • CC3: Risk Assessment
  • CC4: Monitoring Activities
  • CC5: Control Activities
  • CC6: Logical and Physical Access Controls
  • CC7: System Operations
  • CC8: Change Management
  • CC9: Risk Mitigation

How does SOC 2 compliance apply to containers and Kubernetes?

Running Kubernetes clusters often presents challenges for CC6 (logical and physical access), CC7 (systems operations), and CC8 (change management) when trying to comply with SOC 2 standards.

In this technical blog, we will dive into how Calico can help you achieve full compliance in achieving all the requirements of CC6. To understand how to achieve compliance with CC7 and CC8, you can review our SOC 2 white paper.

Control # Compliance requirements Calico controls
CC 6.1, 6.6, 6.7, 6.8

 

 Implement logical access security measures to authorized systems only, implement controls to prevent or detect and act upon Continue reading

Using the Linux ncdu command to view your disk usage

The ncdu command provides a fast and very easy-to-use way to see how you are using disk space on your Linux system. It allows you to navigate through your directories and files and review what file content is using up the most disk space. If you’ve never used this command, you’ll likely have to install it before you can take advantage of the insights it can provide with a command like one of these:$ sudo dnf install ncdu $ sudo apt install ncdu The name “ncdu” stands for “NCurses disk usage. .It uses an ncurses interface to provide the disk usage information. “Curses”, as you probably know, has no connection to foul language. Instead, when related to Linux, “curses” is a term related to “cursor” – that little marker on your screen that indicates where you are currently working. Ncurses is a terminal control library that lends itself to constructing text user interfaces.To read this article in full, please click here

Using ncdu to view your disk usage while grasping those TiB, GiB, MiB and KiB file sizes

The ncdu command provides a fast and very easy-to-use way to see how you are using disk space on your Linux system. It allows you to navigate through your directories and files and review what file content is using up the most disk space. If you’ve never used this command, you’ll likely have to install it before you can take advantage of the insights it can provide with a command like one of these:$ sudo dnf install ncdu $ sudo apt install ncdu The name “ncdu” stands for “NCurses disk usage. .It uses an ncurses interface to provide the disk usage information. “Curses”, as you probably know, has no connection to foul language. Instead, when related to Linux, “curses” is a term related to “cursor” – that little marker on your screen that indicates where you are currently working. Ncurses is a terminal control library that lends itself to constructing text user interfaces.To read this article in full, please click here

Using ncdu to view your disk usage while grasping those TiB, GiB, MiB and KiB file sizes

The ncdu command provides a fast and very easy-to-use way to see how you are using disk space on your Linux system. It allows you to navigate through your directories and files and review what file content is using up the most disk space. If you’ve never used this command, you’ll likely have to install it before you can take advantage of the insights it can provide with a command like one of these:$ sudo dnf install ncdu $ sudo apt install ncdu The name “ncdu” stands for “NCurses disk usage. .It uses an ncurses interface to provide the disk usage information. “Curses”, as you probably know, has no connection to foul language. Instead, when related to Linux, “curses” is a term related to “cursor” – that little marker on your screen that indicates where you are currently working. Ncurses is a terminal control library that lends itself to constructing text user interfaces.To read this article in full, please click here

Why is the transition from SD-WAN to SASE so painful?

The transition from software-defined WAN (SD-WAN) to secure access service edge (SASE) is proving to be difficult for many enterprises, according to new research from Enterprise Management Associates (EMA).If you’re a network or security professional, you’re probably familiar with SASE, a new class of solutions that integrates SD-WAN, secure remote access, and cloud-delivered, multi-function network security. Many enterprises are now evolving their SD-WAN implementations into a SASE solution, either by adopting their SD-WAN providers’ SASE capabilities or integrating their SD-WAN with third-party, cloud-based network security solutions.To read this article in full, please click here

Why is the transition from SD-WAN to SASE so painful?

The transition from software-defined WAN (SD-WAN) to secure access service edge (SASE) is proving to be difficult for many enterprises, according to new research from Enterprise Management Associates (EMA).If you’re a network or security professional, you’re probably familiar with SASE, a new class of solutions that integrates SD-WAN, secure remote access, and cloud-delivered, multi-function network security. Many enterprises are now evolving their SD-WAN implementations into a SASE solution, either by adopting their SD-WAN providers’ SASE capabilities or integrating their SD-WAN with third-party, cloud-based network security solutions.To read this article in full, please click here

AMD announces video streaming accelerator

Use of video streaming encoder cards in the data center is on the rise, and AMD is the latest to tackle the demands of high-volume streaming.Even before the pandemic forced everyone to work from home, videoconferencing usage was climbing. Once schools and businesses became dependent on Zoom calls, video streams started clogging data centers and network pipes across the country. Reliance on video among consumers also took off as TikTok, Twitch, and Facebook became broadcast platforms.With users demanding broadcast-quality video – no one wants blurry, blocky, poor resolution – enterprises are left to deal with increased strain on server CPUs.To read this article in full, please click here

1 … 315 316 317 318 319 … 3,841