Cisco Just Killed The CLI

DeadCLI

Gallons of virtual ink have been committed to virtual paper in the last few days with regards to Cisco’s lawsuit against Arista Networks.  Some of it is speculating on the posturing by both companies.  Other writers talk about the old market vs. the new market.  Still others look at SDN as a driver.

I didn’t just want to talk about the lawsuit.  Given that Arista has marketed EOS as a “better IOS than IOS” for a while now, I figured Cisco finally decided to bite back.  They are fiercely protective of IOS and they have to be because of the way the trademark laws in the US work.  If you don’t go after people that infringe you lose your standing to do so and invite others to do it as well.  Is Cisco’s timing suspect? One does have to wonder.  Is this about knocking out a competitor? It’s tough to say.  But one thing is sure to me.  Cisco has effectively killed the command line interface (CLI).

“Industry Standards”

EOS is certainly IOS-like.  While it does introduce some unique features (see the NFD3 video here), the command syntax is very much IOS.  That is purposeful.  There are two Continue reading

Open Networking Has Arrived

“My servers run on Linux. My team knows how to manage Linux servers and networks. It just makes sense for my switches to run on Linux too.” 

What most people don’t know is that many high-end network switches already run on Linux.

Switches from Cisco®, Extreme Networks® and Arista® use Linux to run their switch hardware (the operating system is hidden behind abstractions and APIs). As well, most of these share the same switching silicon products from Broadcom® and Intel®.

We are in the midst of a major transformation in networking. Innovation from companies like Cumulus Networks® and Edge-Core® are leading the way, disrupting the way new networks are deployed and old networks are upgraded.

In my role as head of product engineering at Tuangru, almost every small-to-mid size hosting service provider I talk to is considering open networking. Why? Because it just makes sense.

Open network hardware is more affordable and easy to acquire. The Linux software is familiar and, in most cases, admins prefer it over the next CLI and syntax versions available.

The rise of DevOps and cloud technologies like OpenStack are driving higher levels of automation and uniformity. Continue reading

Compliance and Automation Using Ansible

Compliance is a big deal in many industries, from e-commerce and PCI, to healthcare and HIPAA, to federal government and FedRAMP. At the core, compliance is all about making sure that IT systems are secure. The controls for the various industries will inevitably have some overlap; there are fundamental security controls that (should) apply to all IT systems. However, as technology advances, even the fundamental controls need to be refreshed in order to address the ever increasing advancements in security threats. 

When the need comes for your IT environment to be both compliant and automated, Ansible makes the most sense.

Why? For simple but very powerful reasons; readability, encryption, architecture and transport.

Architecture:
For starters, Ansible requires the smallest architecture. In it’s simplest form, none whatsoever, just its installation on your laptop (presuming linux or OSX). Even in our enterprise offering it is a single server. With Ansible there is no notion of Masters, Slaves, Masters of Masters, etc.

Secondly, you don’t/shouldn’t need to change anything. If you run a linux shop, SSH over port 22 is probably already in place for all servers and if you’ve been doing any sort of Windows automation, you likely already have remote Continue reading

Great Wi-Fi Starts with Proper Design

I’m sure that we have all experienced poorly designed Wi-Fi networks. When a technology is so ubiquitous, so easily accessible, and is increasingly the most relied upon method of Internet access for mobile devices and cloud computing, then there are bound to be some issues. Unfortunately, the prevalence of underperforming Wi-Fi networks is still much too common for my liking.

Great Wi-Fi starts with proper design. There are various approaches to WLAN design that have evolved over time, ranging from providing basic coverage to maximum capacity and situations in-between. 

At one end of the spectrum, we have a basic coverage oriented design. This was the historical way of designing a WLAN that simply involved ensuring adequate signal strength from access points was present in desired locations. At the other end of the spectrum is a design focusing on maximum capacity. This involves careful RF planning in order to integrate the most Wi-Fi cells as possible into a physical area. 

The problem with both of these approaches is that they are the extremes and aren't applicable for many wireless networks. Basic coverage designs may still work for warehouses and some retailers and maximum capacity designs are great for stadiums and Continue reading

Network Access Broker Conceptual Demo

The Network Access Broker Conceptual Demo

by Kris Olander, Sr. Technical Marketing Engineer - December 16, 2014

Talk is cheap when it comes to SDN, but at Packet Design we’ve created a working SDN analytics and orchestration prototype that will enable network engineers to effectively manage hybrid networks. In this new demo, we outline how our Network Access Broker (NAB) – based on our core Route Explorer™ System – analyzes application requests for network resources, assesses their impact on services, and provisions them optimally using a combination of the following (if you’re already familiar with SDN and its management challenges, you can skip the intro and head straight to the demo at the 2:47 mark): 

  1. A layer 3 network topology model maintained in real time (IGP, BGP, and SDN controller-provided topologies like OpenFlow),
  2. A traffic demand matrix,
  3. Predicted network loads from historical baselines, and
  4. Analytics algorithms that compute efficient paths based on link utilizations/end-to-end delays, model new demand, and predict the impact of link/node failures on routing and traffic. Once the optimal paths have been computed, the NAB configures the network to provision them using the SDN controller (OpenDaylight in this example).

In the NAB demo, we use Continue reading

Notes on the CIA light-torture report

I'm reading through the Senate report on the CIA's light-torture program, and I came across this giggly bit:

#10: The CIA coordinated the release of classified information to the media, including inaccurate information concerning the effectiveness of the CIA's enhanced interrogation techniques. The CIA's Office of Public Affairs and senior CIA officials coordinated to share classified information on the CIA's Detention and Interrogation Program to select members of the media to counter public criticism, shape public opinion
Of course they did, but then so did the Senate committee itself. They've been selectively leaking bits of the report for over a year. Their description of the "CIA hacking" scandal was completely inaccurate.

Moreover, this Executive Summary wasn't simply published, but given to select people in the media beforehand in order to shape the message.

There's no doubt that the CIA's brutal treatment of prisoners is evil, a stain on the nation's honor, and something that should be prosecuted. But Senator Feinstein and her colleagues are as guilty of this as anybody else. This report is political garbage designed to shield Feinstein from the blame she shares.



IPv6

Recently, I’ve heard several people suggest that the advent of IPv6 changes the requirements for data-center virtual network solutions. For instance, making the claim that network overlays are no longer necessary. The assumption made is that once an instance has a globally unique IP address that all requirements are met.

In my view, this analysis fails in two dimensions:

  • In the assumption that it is desirable to give instances direct internet access (via a globally routed address);
  • In the assumption that overlay solutions are deployed to solve address translation related problems;

Neither of these assumptions hold when examined in detail.

While there are IaaS use cases of users that just want to be able to fire up a single virtual-machine and use it as a personal server, the most interesting use case for IaaS or PaaS platforms is to deploy applications.

These applications, serve content for a specific virtual IP address registered in the DNS and/or global load-balancers; that doesn’t mean that this virtual IP should be associated with any specific instance. There is layer of load-balancing that maps the virtual IP into the specific instance(s) service the content. Typically this is done with a load-balancer in proxy mode.

As an aside, enabling IPv6 in the load-balancer Continue reading

Stop thief!

The Host-sFlow project recently added added CPU steal to the set of CPU metrics exported.
steal (since Linux 2.6.11)
       (8) Stolen time, which is the time spent in other operating systems
       when running in a virtualized environment
Keeping close track of the stolen time metric is particularly import when running managing virtual machines in a public cloud. For example, Netflix and Stolen Time includes the discussion:
So how does Netflix handle this problem when using Amazon’s Cloud? Adrian admits that they tracked this statistic so closely that when an instance crossed a stolen time threshold the standard operating procedure at Netflix was to kill the VM and start it up on a different hypervisor. What Netflix realized over time was that once a VM was performing poorly because another VM was crashing the party, usually due to a poorly written or compute intensive application hogging the machine, it never really got any better and their best learned approach was to get off that machine.
The following articles describe how to monitor public cloud instances using Host sFlow agents:
The CPU steal metric is particularly relevant to Network Function Virtualization (NFV). Virtual Continue reading

All malware defeats 90% of defenses

When the FBI speaks, you can tell they don't know anything about hacking. An example of this quote by Joseph Demarest, the assistant director of the FBI’s cyberdivision:

"The malware that was used would have slipped, probably would have gotten past 90% of the net defenses that are out there today in private industry, and I would challenge to even say government”

He's trying to show how sophisticated, organized, and unprecedented the hackers were.

This is nonsense. All malware defeats 90% of defenses. Hackers need do nothing terribly sophisticated in order to do what they did to Sony.

Take, for example, a pentest we did of a Fortune 500 financial firm. We had some USB drives made with the logo of the corporation we were pen-testing. We grabbed a flash game off the Internet, changed the graphics so that they were punching the logo of their main competitor, and put text in the Final Score screen suggesting "email this to your friends and see what they get". We then added some malware components to it. We then dropped the USB drives in the parking lot.

This gave us everything in the company as people passed the game around. The CEO and Continue reading

Using bird to pull global BGP route counts

For an electronics project I’m working on I wanted a way to check the current global routing table every five minutes for both IPv4 and IPv6. I did not want to log into anyone else’s router or looking glass as checking every 5 minutes may be considered abuse. So I thought to spin up a […]

The Tale of the Mysterious PIM Prune

Christmas is lurking around the corner and in the spirit of Denise “Fish” Fishburne, I give you the “The Tale of the Mysterious PIM Prune”.

I have been working a lot with multicast lately which is also why I’ve blogged about it. To start off this story, let’s begin with a network topology.

Topology1

The multicast source is located in AS 65000 and contains two routers that are connected to the multicast source. The routers run BFD, OSPF, iBGP, PIM internally and the RP is located on C1. There is a local receiver in AS 65000 and a remote one in AS 64512. The networks 10.0.1.0/24 and 10.0.21.0/24 come off the same physical interface. If you want to replicate this lab, all the configs are provided here.

This network requires fast convergence and I have been troubleshooting a scenario where the active multicast router (R1) has its LAN interface go down, meaning that the traffic from the source must come in on R2. In this scenario I have seen convergence in up to 60 seconds which is not acceptable. The BGP design is for R2 to still exit out via R1 if the link is Continue reading

Network Break 24

It’s time for the Network Break! Sit back, grab a coffee, and join us for an analysis of the latest IT news, vendor moves and new product announcements. We’ll separate the signal from the noise--or at least make some noise of our own.

Author information

Greg Ferro

Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count.

He is a host on the Packet Pushers Podcast, blogger at EtherealMind.com and on Twitter @etherealmind and Google Plus.

TwitterFacebookGoogle+LinkedIn

The post Network Break 24 appeared first on Packet Pushers Podcast and was written by Greg Ferro.

1 … 3,709 3,710 3,711 3,712 3,713 … 3,888