I can make you happy, I can give you everything you dreamed of. You already know that right? I’ve tried to make you understand this again and again; I’ll fall at your feet at a moments notice, but somehow I’m always here in the background, a shadow. No matter your heart, somehow I’m always put […]
The post Your Weak and Broken Heart appeared first on Packet Pushers Podcast and was written by Steven Iveson.
Cisco FabricPath is a TRILL-based layer 2 forwarding technology that can take the place of spanning-tree. Allowing a fully-meshed layer 2 network to forward traffic across all links, FabricPath helps customers to make the most of their expensive 10GbE and 40GbE interconnects. In this show, Jamie Caesar, Colby Glass, and Ed Diaz discuss real-world FabricPath […]
The post Show 169 – Cisco FabricPath Deep Dive Part 1 appeared first on Packet Pushers Podcast and was written by Ethan Banks.
Not long after getting my TPM chip to protect SSH keys in a recent blog post, it started to become obvious that OpenCryptoKi was not the best solution. It's large, complicated, and, frankly, insecure. I dug in to see if I could fix it, but there was too much I wanted to fix, and too many features I didn't need.
So I wrote my own. It's smaller, simpler, and more secure. This post is about this new solution.
A Hardware Security Module (HSM) is any hardware that you can use for crypto operations without revealing the crypto keys. Specifically I'm referring to the Yubikey NEO and TPM chips, but it should apply to other kinds of special hardware that does crypto operations. I'll refer to this hardware as the "device" as the general term, below.
When describing the Yubikey NEO I'm specifically referring to its public key crypto features that I've previously blogged about, that enable using Yubikey NEO for GPG and SSH, not its OTP generating features.
To generate keys for these devices you have two options. Either you tell the device to generate a key using a built in random number generator, or generate the key yourself and "import" it to the device. In either case you end up with some handle to the key, so that you command the device to do a crypto operation using the key with a given handle.
This "handle" is often the key itself, but encrypted with a key that has never existed outside the device, and never will. For TPMs they are encrypted (wrapped) with the SRK key. The SRK is always generated inside Continue reading
When I read the latest posts about Fast ReRoute from Russ White and as I had an introduction from a coworker contributing to some drafts, I thought it was the right time to write my first article on PacketPushers. And here it is the Introduction to Segment Routing! What is it? It is a new […]
The post Introduction to Segment Routing appeared first on Packet Pushers Podcast and was written by Youssef El Fathi.
I was prompted to write this when I observed someone the other day who was sitting in the same training as me taking notes in a self-addressed email. No offense to people who do this, but W. T. F. How are you going to keep track of that email among the dozens/hundreds you receive every single day?
I take a lot of notes for research, certification study, and training. I use MediaWiki for almost all of these notes. Here’s why.
First off, MediaWiki is not a text editor. This may seem strange but after reading this whole article, I hope you’ll understand why that doesn’t matter and in fact, why that makes it more powerful. As the name implies, MediaWiki is actually software for running a wiki. In fact, it’s the same software that runs the most famous wiki, Wikipedia.
MediaWiki runs on UNIX (including OS X) and Windows machines. It’s written in PHP and runs under almost any web server (Apache, lighttpd, nginx, IIS). By its very nature, it’s web-based, which plays nicely into one of the reasons I like using it so much.
When I’m taking study notes or Continue reading
I was prompted to write this when I observed someone the other day who was sitting in the same training as me taking notes in a self-addressed email. No offense to people who do this, but W. T. F. How are you going to keep track of that email among the dozens/hundreds you receive every single day?
I take a lot of notes for research, certification study, and training. I use MediaWiki for almost all of these notes. Here's why.
Just spent a half hour sorting out some irritating search toolbar and browser hijack that my mum’s Mac seemed to have got from somewhere. Most of what I read on the internet seemed to be out of date or inaccurate maybe, so I’m posting my steps to getting rid of this here in case it is of use.
Environment: OSX 10.6.8 with Firefox 25.0.1
Symptoms: Normal home page has been replaced by some odd search engine. URL box shows “search.conduit.com/?ctid=CT3299872&SearchSource=13″.
The search box to the right of the URL box is showing “Installl [sic] converter customized web search” instead of Google.
Setting home page back to normal is overridden next time Firefox starts.
Resolution steps: Clicked Tools | Add-Ons and removed something not expected called “Youtube video downloader”. Clicked the top-right box’s dropdown and removed the search provider, setting it back to Google.
Home page was reset back to conduit.com on restarting Firefox still, so this needed further investigation. In the end, I removed the following two directories (the path may not be quite the same on your Mac):
Users/<user>/Library/Application Support/Firefox/Profiles/4ka1hno1.default/conduitCommon
Users/<user>/Library/Application Support/Firefox/Profiles/4ka1hno1.default/CT3299872
Restarted Firefox Continue reading
This post is intended to be a primer on the distributed routing in VMware NSX for vSphere, using a basic scenario of L3 forwarding between both virtual and physical subnets. I’m not going to bore you with all of the laborious details, just the stuff that matters for the purpose of this discussion.
In VMware NSX for vSphere there are two different types of NSX routers you can deploy in your virtual network.
Both the ESR and DLR can run dynamic routing protocols, or not. They can just have static/default routes if you like. The ESR is a router in a VM (it also does other L4-L7 services like FW, LB, NAT, VPN, if you want). Both the control and data plane of the ESR router are in the VM. This VM establishes routing protocol sessions with other routers and all of the traffic flows through this VM. It’s like a router, but in a VM. This should be straight forward, not requiring much explanation.
The ESR is unique because it’s more than a just router. It’s also a feature rich firewall, load balancer, Continue reading
This post is intended to be a primer on the distributed routing in VMware NSX for vSphere, using a basic scenario of L3 forwarding between both virtual and physical subnets. I’m not going to bore you with all of the laborious details, just the stuff that matters for the purpose of this discussion.
In VMware NSX for vSphere there are two different types of NSX routers you can deploy in your virtual network.
Both the ESR and DLR can run dynamic routing protocols, or not. They can just have static/default routes if you like. The ESR is a router in a VM (it also does other L4-L7 services like FW, LB, NAT, VPN, if you want). Both the control and data plane of the ESR router are in the VM. This VM establishes routing protocol sessions with other routers and all of the traffic flows through this VM. It’s like a router, but in a VM. This should be straight forward, not requiring much explanation.
The ESR is unique because it’s more than a just router. It’s also a feature rich firewall, load balancer, Continue reading
This post is intended to be a primer on the distributed routing in VMware NSX for vSphere, using a basic scenario of L3 forwarding between both virtual and physical subnets. I’m not going to bore you with all of the laborious details, just the stuff that matters for the purpose of this discussion.
In VMware NSX for vSphere there are two different types of NSX routers you can deploy in your virtual network.
Both the ESR and DLR can run dynamic routing protocols, or not. They can just have static/default routes if you like. The ESR is a router in a VM (it also does other L4-L7 services like FW, LB, NAT, VPN, if you want). Both the control and data plane of the ESR router are in the VM. This VM establishes routing protocol sessions with other routers and all of the traffic flows through this VM. It’s like a router, but in a VM. This should be straight forward, not requiring much explanation.
The ESR is unique because it’s more than a just router. It’s also a feature rich firewall, load balancer, Continue reading
This post represents the solution and explanation for quiz-17. For some temporary period of time, during network transition, your network consists both on Cisco and Juniper routers for the same role. You will see that they behave differently when it comes to advertising inactive BGP Routes.
