Network Automation with Cisco Nexus Switches & Ansible

Over the past few years, I’ve written quite a bit about SDN and more recently more about what can be done today with existing products, APIs, and tools in terms of improving operational efficiencies. Most of the examples have leveraged modern network devices that have some type of API because it streamlines how to integrate with 3rd party systems be it a custom application or a platform like Ansible (a platform that I’ve written about frequently). I’ve posted examples here and there on GitHub on these topics, but nothing that starts from the ground up.

With that in mind, I’ve recently created a new GitHub project that walks through step by step on how to get Ansible installed and specifically up and running ready to automate Cisco Nexus switches. Note: In full transparency, I was compensated by Cisco for this particular project. It was a no-brainer since I was already doing similar work over the past several months. That said, going forward it would be great to get others involved in any capacity from writing docs to writing code.

Network Automation with Cisco Nexus & Ansible

The README in the GitHub project repository outlines exactly how to get started. There Continue reading

Getting started with Ansible

The easiest way to describe Ansible is that it’s a simple but powerful it-automation tool. In the words of its creator Michael DeHaan “I wanted a tool that I could not use for 6 months, come back later, and still remember how it worked.” and it really feels like riding a bike. Even years from now when I take a look at an Ansible Playbook I’m sure I will immediately see what it does. Playbooks, which allows you to run several tasks together, are writting in YAML making them easy to read.

This guide is too short to teach you everything about Ansible. Instead the aim is to give you an idea of how you can use Ansible, and how it can help you manage your IT environment. Even if you don’t end up using Ansible, learning tools like it as Chef or Puppet can help you to think differently about how you operate your network.

Life is busy

Getting started with Ansible

The easiest way to describe Ansible is that it’s a simple but powerful it-automation tool. In the words of its creator Michael DeHaan “I wanted a tool that I could not use for 6 months, come back later, and still remember how it worked.” and it really feels like riding a bike. Even years from now when I take a look at an Ansible Playbook I’m sure I will immediately see what it does. Playbooks, which allows you to run several tasks together, are writting in YAML making them easy to read.

This guide is too short to teach you everything about Ansible. Instead the aim is to give you an idea of how you can use Ansible, and how it can help you manage your IT environment. Even if you don’t end up using Ansible, learning tools like it as Chef or Puppet can help you to think differently about how you operate your network.
Continue reading

Solicited-node multicast address

How does Internet work - We know what is networking

Some time ago I was working on IPv6 implementation and in that period I written an article about NDP (you can read it here). After a while I received some comments that is not written well so I reviewed a huge part of it. It looks my english was far worst two years ago that I was really aware of In the reviewing process I realised that NDP usage of Solicited-Node multicast addresses was not clearly explained. This is the follow-up article which should explain how and why Solicited-Node multicast address are used in NDP. Let’s go! Solicited-node multicast address is IPv6 multicast address used on the local L2

Solicited-node multicast address

VeloCloud & Information Brokerage

VeloCloud was the first presenter at Network Field Day 9. They are one of the new breed of SD-WAN vendors. I’m impressed by what they’re doing, and and the potential it offers for re-thinking the way we do WAN connectivity. But I think the most interesting part is the increased visibility into how networks are performing.

I won’t go into the details of how it all works – Brandon covers some of it here, and you can look through VeloCloud’s site to understand it more. I want to focus on a few details around data analysis, and information brokerage.

Internet Quality Monitoring

In this video, Kangwarn Chinthammit talks about how VeloCloud is using their devices to monitor Internet quality. Because they’re installed in a wide range of locations, with many different WAN connection types, they’re building up some interesting data.

They’ve been able to do some deeper analysis of the data, and break down quality measurements by location, circuit type, hour, and day. Some of the interesting results include:

• A good ISP in one location may not be any good in another. So you can’t just pick one ISP.
• Quality varies during the day, and across the year. It might be Continue reading

UNICEF, Airtel team up in Africa to widen access to free health, data analysis apps

UNICEF, the U.N. Children’s Fund, has made its RapidPro suite of apps available to Airtel customers for free across the 17 African countries in which the telecom company operates.The open-source family of applications is designed to help governments deliver rapid and vital real-time information and connect communities to lifesaving services. The apps offer health, education and youth-focused content.By introducing the apps to Airtel users, UNICEF content will be more accessible and data-gathering across regions made easier. RapidPro makes data related to interactions on the platform available in Excel for analysis.RapidPro also allows organizations to create personalized messages based on information collected from users, which could in turn increase response rates.To read this article in full or to leave a comment, please click here

Openstack Juno – Management interfaces

Openstack Juno – Group based policy

Openstack Juno – Multihost Networking

Openstack Juno services – Swift, Glance, Heat, Ceilometer

Openstack Juno services – Nova, Cinder

Openstack Juno Install using Devstack

ASK your questions and SHARE your opinion

I receive lots of questions from my students, readers, customers, followers on network design. I try to  answer as quickly as possible and in detail. Thanks to all of them ! I receive a lot of kind emails, messages from them to put my effort on this blog as well. But for many reasons, I… Read More »

The post ASK your questions and SHARE your opinion appeared first on Network Design and Architecture.

CLN 2015 Designated VIPs

I wanted to take a moment and give a well-deserved congratulations to the 2015 Cisco Learning Network Designated VIPs. These fine folks spend a ton of time giving back to the community by helping others in their learning process.

New VIPs for 2015

• Aref Alsouqi
• Darren Starr
• Joshua Johnson
• Milan Rai

Returning from Previous Year(s)

• Alain Cadet
• Chandan Singh Takuli
• Daniel Dib
• DelVonte Deary
• Elvin Arias
• Erick
• Jared Hainline
• Jon K. Johnson (Jay)
• Riikka Sihvonen

Again, a very warm welcome and congratulations to this group. Your contribution to the community is much appreciated.

Bios and more information for the 2015 VIPs can be found here–

• About Us – The Cisco Learning Network

Disclaimer: This article includes the independent thoughts, opinions, commentary or technical detail of Paul Stewart. This may or may does not reflect the position of past, present or future employers.

The post CLN 2015 Designated VIPs appeared first on PacketU.

Exploiting the Superfish certificate

The hardware

You need a computer to be the WiFi access-point. Notebook computers are good choices, but for giggles I chose the "Raspberry Pi 2", a tiny computer that fits in the palm of your hand which costs roughly $35. You need two network connections, one to the Internet, and one to your victims. I chose Ethernet to the Internet, and WiFi to the victims.

Using sipcalc The Great and Powerful Subnet Calculator

10 Reasons why the Raspberry Pi 2 Model B is a killer product

Discard Routing for RFC1918 Addresses

While working with firewalls for the last few years, I’ve seen many logs polluted with scanning traffic. Obviously this is the type of thing that I want to see when someone is legitimately scanning, or attempting to scan, through the firewall. However, there are a few cases that seeing this traffic is simply an indication of some other issue in the network.

An example I have seen on several occasions is someone configuring a network management station to discover 192.168.0.0/16, 172.16.0.0/12 or 10.0.0.0/8. If not properly handled in the routed network architecture, the associated traffic could make its way to the firewall or even to the ISP. An ASA might block the traffic due to policy, reroute it back toward the internal network, drop it due to the intra-interface hairpin configuration, or forward it onward. In most cases, this traffic will cause a lot of “noise” in the syslogs produced by the firewall.

To fully understand the problem, the diagram below can be used for discussion–

In this example, R1 has a static default route that points to the IP address of FW1. R1 advertises this via EIGRP to its internal neighbors. If a networked host attempts to reach Continue reading

Kubernetes DNS config on bare metal

One of the ‘newer’ functions of Kubernetes is the ability to register service names in DNS.  More specifically, to register them in a DNS server running in the Kubernetes cluster.  To do this, the clever folks at Google came up with a solution that leverages SkyDNS and another container (called kube2sky) to read the service entries and insert them as DNS entries.  Pretty slick huh?

Beyond the containers to run the DNS service, we also need to tell the pods to use this particular DNS server for DNS resolution.  This is done by adding a couple of lines of config to the kubernetes-kubelet service.  Once that’s done, we can configure the Kubernetes service and the replication controller for the SkyDNS pod.  So let’s start with the kubelet service configuration.  Let’s edit our service definition located here…

/usr/lib/systemd/system/kubernetes-kubelet.service

Our new config will look like this…

[Unit]
Description=Kubernetes Kubelet
After=etcd.service
After=docker.service
Wants=etcd.service
Wants=docker.service

[Service]
ExecStart=/opt/kubernetes/kubelet 
--address=10.20.30.62 
--port=10250 
--hostname_override=10.20.30.62 
--etcd_servers=http://10.20.30.61:4001 
--logtostderr=true 
--cluster_dns=10.100.0.10 
--cluster_domain=kubdomain.local 
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Notice that Continue reading