Getting to Know Robyn Bergeron, Community Architect at Ansible

robyn-bullKnowing the members of our Ansible community is important to us, and we want you to get to know the members of our team in (and outside of!) the Ansible office. Stay tuned to the blog to learn more about the people who are helping to bring Ansible to life.

This week we're happy to introduce you to Robyn Bergeron, who recently joined Ansible as a Community Architect. Her prior role was as a Developer Advocate at Elastic, where she worked closely with the ELK stack community. And many of us at Ansible know her from her days at Red Hat, where she was the Fedora Project Leader -- a role that her illustrious boss once himself had.

What’s your role at Ansible?

Open source communities work best when contributors are empowered and enabled to make things happen; the easier it is to contribute, the more likely they’ll continue to do so, and enjoy doing it. As a community architect, it’s my job to ensure that contributors, both long-time and new, are connected with the opportunities, ideas, tools, and people to make great things happen in the Ansible community, with minimal bureaucracy.

A good deal of my focus will Continue reading

Announcing Docker Toolbox

The fastest way to get Docker running in development written by Michael Chiang, Product Manager at Docker Inc. Today we’re announcing a new installer for Mac OS X and Windows called Docker Toolbox. We’ve been hearing again and again that … Continued

SDN and the Trough Of Understanding

gartner_net_hype_2015

An article published this week referenced a recent Hype Cycle diagram (pictured above) from the oracle of IT – Gartner. While the lede talked a lot about the apparent “death” of Fibre Channel over Ethernet (FCoE), there was also a lot of time devoted to discussing SDN’s arrival at the Trough of Disillusionment. Quoting directly from the oracle:

Interest wanes as experiments and implementations fail to deliver. Producers of the technology shake out or fail. Investments continue only if the surviving providers improve their products to the satisfaction of early adopters.

As SDN approaches this dip in the Hype Cycle it would seem that the steam is finally being let out of the Software Defined Bubble. The Register article mentions how people are going to leave SDN by the wayside and jump on the next hype-filled networking idea, likely SD-WAN given the amount of discussion it has been getting recently. Do you know what this means for SDN? Nothing but good things.

Software Defined Hammers

Engineers have a chronic case of Software Defined Overload. SD-anything ranks right up there with Fat Free and New And Improved as the Most Overused Marketing Terms. Every solution release in the last two years Continue reading

Another useful SRX command for looking at IPSec tunnels

This is a new one on me – obviously I’ve not been paying much attention since it has been around since 10.2!

On 12.1X45-D15.5 the counters for packets/bytes all show zero, but at least you can see that your tunnel is up and what the various parameters in use are…  See below:

imtech@srx650-1-POD1> show security flow session tunnel extensive 
Session ID: 38046, Status: Normal
Flag: 0x10000
Policy name: N/A
Source NAT pool: Null
Dynamic application: junos:UNKNOWN, 
Maximum timeout: N/A, Current timeout: N/A
Session State: Valid
Start time: 105905, Duration: 52592
 In: 10.1.0.9/49698 --> 10.1.0.1/27622;esp, 
 Interface: ge-2/0/13.0, 
 Session token: 0xa, Flag: 0x100621
 Route: 0x110010, Gateway: 10.1.0.2, Tunnel: 0
 Port sequence: 0, FIN sequence: 0, 
 FIN state: 0, 
 Pkts: 0, Bytes: 0

Session ID: 38047, Status: Normal
Flag: 0x10000
Policy name: N/A
Source NAT pool: Null
Dynamic application: junos:UNKNOWN, 
Maximum timeout: N/A, Current timeout: N/A
Session State: Valid
Start time: 105905, Duration: 52592
 In: 10.1.0.9/0 --> 10.1.0.1/0;esp, 
 Interface: ge-2/0/13.0, 
 Session token: 0xa, Flag: 0x621
 Route: 0x110010, Gateway: 10.1.0.2, Tunnel: 0
 Port sequence: 0, FIN sequence: 0, 
 FIN state: 0, 
 Pkts: 0, Bytes: 0
Total sessions: 2

Another useful SRX command for looking at IPSec tunnels

This is a new one on me – obviously I’ve not been paying much attention since it has been around since 10.2!

On 12.1X45-D15.5 the counters for packets/bytes all show zero, but at least you can see that your tunnel is up and what the various parameters in use are…  See below:

imtech@srx650-1-POD1> show security flow session tunnel extensive 
Session ID: 38046, Status: Normal
Flag: 0x10000
Policy name: N/A
Source NAT pool: Null
Dynamic application: junos:UNKNOWN, 
Maximum timeout: N/A, Current timeout: N/A
Session State: Valid
Start time: 105905, Duration: 52592
 In: 10.1.0.9/49698 --> 10.1.0.1/27622;esp, 
 Interface: ge-2/0/13.0, 
 Session token: 0xa, Flag: 0x100621
 Route: 0x110010, Gateway: 10.1.0.2, Tunnel: 0
 Port sequence: 0, FIN sequence: 0, 
 FIN state: 0, 
 Pkts: 0, Bytes: 0

Session ID: 38047, Status: Normal
Flag: 0x10000
Policy name: N/A
Source NAT pool: Null
Dynamic application: junos:UNKNOWN, 
Maximum timeout: N/A, Current timeout: N/A
Session State: Valid
Start time: 105905, Duration: 52592
 In: 10.1.0.9/0 --> 10.1.0.1/0;esp, 
 Interface: ge-2/0/13.0, 
 Session token: 0xa, Flag: 0x621
 Route: 0x110010, Gateway: 10.1.0.2, Tunnel: 0
 Port sequence: 0, FIN sequence: 0, 
 FIN state: 0, 
 Pkts: 0, Bytes: 0
Total sessions: 2

Useful SRX debugging blog

Just came across a useful debugging guide for site-to-site IPSec VPNs on Juniper SRX. It is a bit confusing because in steps 2 and 3, where it says [LOCAL PEER IP] it should actually say [REMOTE PEER IP].   But otherwise, this is a very useful set of instructions.

It doesn’t mention that you should observe the lifetime of the IKE and IPSec security associations, and also keep an eye on the SA index or ID.  If the index number keeps changing, it means your tunnel is going down and coming back up all the time.   If the lifetime regularly starts again at the maximum value and does not count down to zero steadily, this indicates the same thing.

Particularly interesting is the way the author splits out the sections on troubleshooting the packet flow within the VPN, versus the packet flow of the VPN crypto itself.  I’ve not used packet-filters in flow debug before, so will definitely be trying that out.

Link to SRX debug article at fir3net.com


Useful SRX debugging blog

Just came across a useful debugging guide for site-to-site IPSec VPNs on Juniper SRX. It is a bit confusing because in steps 2 and 3, where it says [LOCAL PEER IP] it should actually say [REMOTE PEER IP].   But otherwise, this is a very useful set of instructions.

It doesn’t mention that you should observe the lifetime of the IKE and IPSec security associations, and also keep an eye on the SA index or ID.  If the index number keeps changing, it means your tunnel is going down and coming back up all the time.   If the lifetime regularly starts again at the maximum value and does not count down to zero steadily, this indicates the same thing.

Particularly interesting is the way the author splits out the sections on troubleshooting the packet flow within the VPN, versus the packet flow of the VPN crypto itself.  I’ve not used packet-filters in flow debug before, so will definitely be trying that out.

Link to SRX debug article at fir3net.com


How texting a Corvette could stop it in its tracks

As if recent research on car hacking wasn’t frightening enough, a new study shows yet another danger to increasingly networked vehicles.This time around, academics with the University of California analyzed small, third-party devices that are sometimes plugged into a car’s dashboard, known as telematic control units (TCUs).Insurance companies issue the devices to monitor driving metrics in order to meter polices. Other uses include fleet management, automatic crash reporting and tracking stolen vehicles.In order to collect vehicle data, TCUs have access to the electronic brain of an automobile, the CAN (Controller Area Network) bus, which transmits and receives messages from many vehicle systems. The TCUs also have SIM cards, which give them cellular network connectivity in order to send information.To read this article in full or to leave a comment, please click here

Twitter sees surge in government requests for account information

Twitter has seen an increase in government demands for account information in the first half of this year, with the U.S. followed by Japan topping the list for such requests.The increase is the largest ever seen between reporting periods by Twitter, wrote Jeremy Kessel, Twitter’s senior manager for global legal policy, in a blog post Tuesday.The Transparency Report from the company indicated that government requests for account information in the first half were 52 percent more and affected 78 percent more account holders than in the second half of last year.The scope of the report has been expanded to include information on notices of alleged trademark violations and a section where users can check how different email providers handle the privacy and encryption of email messages from Twitter.To read this article in full or to leave a comment, please click here

A Second Look at APNIC and IPv4 Address Exhaustion

It has been said often enough that its easy to make predictions; the tough part is getting them right! And in trying to predict the manner that APNIC will exhaust its remaining supply of IPv4 addresses I’m pretty sure that I did not get it right in the most recent article on this topic. So I’ll try and correct that in a more detailed look at the situation.

More PIM-BiDir Considerations

Introduction

From my last post on PIM BiDir I got some great comments from my friend Peter Palúch. I still had some concepts that weren’t totally clear to me and I don’t like to leave unfinished business. There is also a lack of resources properly explaining the behavior of PIM BiDir. For that reason I would like to clarify some concepts and write some more about the potential gains of PIM BiDir is. First we must be clear on the terminology used in PIM BiDir.

Terminology

Rendezvous Point Address (RPA) – The RPA is an address that is used as the root of the distribution tree for a range of multicast groups. This address must be routable in the PIM domain but does not have to reside on a physical interface or device.

Rendezvous Point Link (RPL) – It is the physical link to which the RPA belongs. The RPL is the only link where DF election does not take place. The RFC also says “In BIDIR-PIM, all multicast traffic to groups mapping to a specific RPA is forwarded on the RPL of that RPA.” In some scenarios where the RPA is virtual, there may not be an RPL though.

Continue reading

1 … 3,413 3,414 3,415 3,416 3,417 … 3,894