VeloCloud & Information Brokerage

VeloCloud was the first presenter at Network Field Day 9. They are one of the new breed of SD-WAN vendors. I’m impressed by what they’re doing, and and the potential it offers for re-thinking the way we do WAN connectivity. But I think the most interesting part is the increased visibility into how networks are performing.

I won’t go into the details of how it all works – Brandon covers some of it here, and you can look through VeloCloud’s site to understand it more. I want to focus on a few details around data analysis, and information brokerage.

Internet Quality Monitoring

In this video, Kangwarn Chinthammit talks about how VeloCloud is using their devices to monitor Internet quality. Because they’re installed in a wide range of locations, with many different WAN connection types, they’re building up some interesting data.

They’ve been able to do some deeper analysis of the data, and break down quality measurements by location, circuit type, hour, and day. Some of the interesting results include:

• A good ISP in one location may not be any good in another. So you can’t just pick one ISP.
• Quality varies during the day, and across the year. It might be Continue reading

UNICEF, Airtel team up in Africa to widen access to free health, data analysis apps

UNICEF, the U.N. Children’s Fund, has made its RapidPro suite of apps available to Airtel customers for free across the 17 African countries in which the telecom company operates.The open-source family of applications is designed to help governments deliver rapid and vital real-time information and connect communities to lifesaving services. The apps offer health, education and youth-focused content.By introducing the apps to Airtel users, UNICEF content will be more accessible and data-gathering across regions made easier. RapidPro makes data related to interactions on the platform available in Excel for analysis.RapidPro also allows organizations to create personalized messages based on information collected from users, which could in turn increase response rates.To read this article in full or to leave a comment, please click here

Openstack Juno – Management interfaces

Openstack Juno – Group based policy

Openstack Juno – Multihost Networking

Openstack Juno services – Swift, Glance, Heat, Ceilometer

Openstack Juno services – Nova, Cinder

Openstack Juno Install using Devstack

ASK your questions and SHARE your opinion

I receive lots of questions from my students, readers, customers, followers on network design. I try to  answer as quickly as possible and in detail. Thanks to all of them ! I receive a lot of kind emails, messages from them to put my effort on this blog as well. But for many reasons, I… Read More »

The post ASK your questions and SHARE your opinion appeared first on Network Design and Architecture.

CLN 2015 Designated VIPs

I wanted to take a moment and give a well-deserved congratulations to the 2015 Cisco Learning Network Designated VIPs. These fine folks spend a ton of time giving back to the community by helping others in their learning process.

New VIPs for 2015

• Aref Alsouqi
• Darren Starr
• Joshua Johnson
• Milan Rai

Returning from Previous Year(s)

• Alain Cadet
• Chandan Singh Takuli
• Daniel Dib
• DelVonte Deary
• Elvin Arias
• Erick
• Jared Hainline
• Jon K. Johnson (Jay)
• Riikka Sihvonen

Again, a very warm welcome and congratulations to this group. Your contribution to the community is much appreciated.

Bios and more information for the 2015 VIPs can be found here–

• About Us – The Cisco Learning Network

Disclaimer: This article includes the independent thoughts, opinions, commentary or technical detail of Paul Stewart. This may or may does not reflect the position of past, present or future employers.

The post CLN 2015 Designated VIPs appeared first on PacketU.

Exploiting the Superfish certificate

The hardware

You need a computer to be the WiFi access-point. Notebook computers are good choices, but for giggles I chose the "Raspberry Pi 2", a tiny computer that fits in the palm of your hand which costs roughly $35. You need two network connections, one to the Internet, and one to your victims. I chose Ethernet to the Internet, and WiFi to the victims.

Using sipcalc The Great and Powerful Subnet Calculator

10 Reasons why the Raspberry Pi 2 Model B is a killer product

Discard Routing for RFC1918 Addresses

While working with firewalls for the last few years, I’ve seen many logs polluted with scanning traffic. Obviously this is the type of thing that I want to see when someone is legitimately scanning, or attempting to scan, through the firewall. However, there are a few cases that seeing this traffic is simply an indication of some other issue in the network.

An example I have seen on several occasions is someone configuring a network management station to discover 192.168.0.0/16, 172.16.0.0/12 or 10.0.0.0/8. If not properly handled in the routed network architecture, the associated traffic could make its way to the firewall or even to the ISP. An ASA might block the traffic due to policy, reroute it back toward the internal network, drop it due to the intra-interface hairpin configuration, or forward it onward. In most cases, this traffic will cause a lot of “noise” in the syslogs produced by the firewall.

To fully understand the problem, the diagram below can be used for discussion–

In this example, R1 has a static default route that points to the IP address of FW1. R1 advertises this via EIGRP to its internal neighbors. If a networked host attempts to reach Continue reading

Kubernetes DNS config on bare metal

One of the ‘newer’ functions of Kubernetes is the ability to register service names in DNS.  More specifically, to register them in a DNS server running in the Kubernetes cluster.  To do this, the clever folks at Google came up with a solution that leverages SkyDNS and another container (called kube2sky) to read the service entries and insert them as DNS entries.  Pretty slick huh?

Beyond the containers to run the DNS service, we also need to tell the pods to use this particular DNS server for DNS resolution.  This is done by adding a couple of lines of config to the kubernetes-kubelet service.  Once that’s done, we can configure the Kubernetes service and the replication controller for the SkyDNS pod.  So let’s start with the kubelet service configuration.  Let’s edit our service definition located here…

/usr/lib/systemd/system/kubernetes-kubelet.service

Our new config will look like this…

[Unit]
Description=Kubernetes Kubelet
After=etcd.service
After=docker.service
Wants=etcd.service
Wants=docker.service

[Service]
ExecStart=/opt/kubernetes/kubelet 
--address=10.20.30.62 
--port=10250 
--hostname_override=10.20.30.62 
--etcd_servers=http://10.20.30.61:4001 
--logtostderr=true 
--cluster_dns=10.100.0.10 
--cluster_domain=kubdomain.local 
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

Notice that Continue reading

Alteon AppShape++ persistency and multiple scripts per service

Lab goal

Setup

I'll use my Loadbalancer Lab Setup.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

/c/slb/real 1
        ena
        ipver v4
        rip 10.136.85.1
/c/slb/real 2
        ena
        ipver v4
        rip 10.136.85.2
/c/slb/real 3
        ena
        ipver v4
        rip 10.136.85.3
/c/slb/group 10
        ipver v4
        add 1
        add 2
        add 3

Alteon configuration

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

/cfg/slb/appshape/script take_10/en/import


attach group 10

when HTTP_REQUEST {
    group select 10
}

-----END

Your Docker schedule at IBM Interconnect 2015

Box buys Airpost, a startup that keeps tabs on cloud app use

Box has acquired Airpost, a startup that helps enterprises detect and manage the use of cloud applications by their employees.Airpost, a two-year-old startup based in Toronto, announced the acquisition in a blog post on Friday. Box confirmed it has bought the company. Terms were not disclosed.Airpost will close operations on March 1. After that, customers won’t be able to use its product, founder and CEO Navid Nathoo said in an email message.But the concept seems sound: Airpost tells IT departments when employees start using cloud-based apps on their own and provides access controls and protections against potential vulnerabilities in those apps. The idea is to let employees keep using the apps they found and get the productivity they want, while keeping the enterprise secure.To read this article in full or to leave a comment, please click here

Superfish security flaw also exists in other apps, non-Lenovo systems

On Thursday security researchers warned that an adware program called Superfish, which was preloaded on some Lenovo consumer laptops, opened computers to attack. However, it seems that the same poorly designed and flawed traffic interception mechanism used by Superfish is also used in other software programs.Superfish uses a man-in-the-middle proxy component to interfere with encrypted HTTPS connections, undermining the trust between users and websites. It does this by installing its own root certificate in Windows and uses that certificate to re-sign SSL certificates presented by legitimate websites.To read this article in full or to leave a comment, please click here

Nomad: Mobile charging gadgets you need

I’ve tested any number of portable backup batteries designed to keep your phone running when you’re not near a power socket and I thought I’d pretty much seen most of the good ideas … until I opened a box that just arrived from Nomad. Nomad NomadKey with Apple Lightning connector Nomad NomadClipTo read this article in full or to leave a comment, please click here