Hedge 110: Andrew Alston and SRv6 Security

SRv6, a form of source routing, is the new and interesting method being created by the IETF to allow traffic engineering and traffic steering. This is not the first time the networking world has tried source routing, however—and in the spirit of rule 11, we should ask some questions. How and why did source routing fail last time? Have we learned those lessons and changed the way we’re doing things to overcome those limitations? Security seems to be one area where problems arise in the source routing paradigm.

Andrew Alston joins Tom Ammon and Russ White to discuss security in SRv6.

download

Introducing Red Hat Ansible Automation Platform 2.1

We are thrilled to announce the general availability of Red Hat Ansible Automation Platform 2.1. This is the follow-on to the Ansible Automation Platform 2.0 Early Access released this summer, and announced at AnsibleFest 2021. Red Ansible Automation Platform 2.1 introduces major features that allow customers to onboard more easily with even more flexible automation architectures and use cases. Ansible Automation Platform 2.1 is the culmination of many years of reimagining how enterprise automators automate for today and tomorrow.

You can download the latest version directly from the Red Hat Customer Portal, or sign up for a free trial at red.ht/try_ansible. Ansible Automation Platform is the Ansible you know and love, designed for the enterprise. I am going to summarize Andrius Benokraitis’ blog post from September, when Ansible Automation Platform 2 was announced, and expand on some key developments from 2.0 to 2.1.

First, some general information:

  • The Ansible Automation Platform life cycle page has been updated.

  • Moving forward, every Ansible Automation Platform minor release will now have its own unique Red Hat Subscription Management repo, which requires an Ansible Automation Platform subscription.

subscription-manager repos 
--disable=ansible-automation-platform-2.0-early-access-for-rhel-8-x86_64-rpms

subscription-manager repos --enable=ansible-automation-platform-2.1-for-rhel-8-x86_64-rpms

Continue reading

Confluent Platform 7.0: Data Streaming Across Multiclouds

The challenge is clear: How to offer real- or near real-time access to data that is continually refreshed across a number of different distributed environments. With different types of data streaming from various sources such as multicloud and on-premises environments, the data, often in shared digital layers such as so-called digital information hubs (DIHs), must be updated asynchronously. This is necessary in order to maintain a consistent user experience. To that end, data streaming platform provider Apache Kafka, hundreds of different applications and data systems can use it to migrate to the cloud or share data between their data center and the public cloud, Confluent says. Traditionally, syncing data between multiple clouds or between on-premises and the cloud was “like a bad game of telephone,”

LoRa takes a trip to the moon and back, chirping all the way

LoRa is living up to its name, literally.A shortened version of “long range” (ironic!), LoRa is a wide-area wireless modulation technique that encodes information on radio waves. LoRa, which has been around since 2015, is derived from Chirp Spread Spectrum (CSS) technology and uses chirp pulses to transmit small bits of data. It also uses very little power. The proprietary technology is owned by semiconductor supplier Semtech Corp[Get regularly scheduled insights by signing up for Network World newsletters.] LoRa’s value is in transmitting data for sensors and other connected devices that require little power to operate. Not only can LoRa withstand disturbances, it can transmit data at longer ranges than better known wireless technologies such as Wi-Fi and Bluetooth. So long, in fact, that demonstrations of LoRa’s transmission capabilities now must extend into near space.To read this article in full, please click here

Optimal BGP Path Selection with BGP Additional Paths

A month ago I explained how using a BGP route reflector in a large-enough non-symmetrical network could result in suboptimal routing (or loss of path diversity or multipathing). I also promised to explain how Advertisement of Multiple Paths in BGP functionality1 solves that problem. Here we go…

I extended the original lab with another router to get a scenario where one route reflector (RR) client should use equal-cost paths to an external destination while another RR client should select a best path that is different from what the route reflector would select.

Optimal BGP Path Selection with BGP Additional Paths

A month ago I explained how using a BGP route reflector in a large-enough non-symmetrical network could result in suboptimal routing (or loss of path diversity or multipathing). I also promised to explain how Advertisement of Multiple Paths in BGP functionality1 solves that problem. Here we go…

I extended the original lab with another router to get a scenario where one route reflector (RR) client should use equal-cost paths to an external destination while another RR client should select a best path that is different from what the route reflector would select.

Aviatrix’s Modest New Blocking Feature Hints At Greater Ambitions For Multi-Cloud Security

Aviatrix, which makes multi-cloud networking software for public clouds, has introduced a new security feature that can identify and then block customers’ cloud-based workloads from connecting to a malicious IP address or known-bad host on the Internet. The new capability is called ThreatIQ with ThreatGuard. It’s available to customers that already license the Aviatrix Co-Pilot […]

The post Aviatrix’s Modest New Blocking Feature Hints At Greater Ambitions For Multi-Cloud Security appeared first on Packet Pushers.

Some Notes from RIPE 83

The RIPE community held a meeting in November. Like most community meetings in these Covid-blighted times it was a virtual meeting. Here’s my notes from a few presentations that piqued my interest.

Scalable Policy Routing

More than a decade ago (before SD-WAN was even a thing) I wrote an article describing how easy it is to route different applications onto different links (MPLS/VPN versus IPsec tunnels) using a distance vector routing protocol (preferably BGP, although even RIP would work).

You might find it interesting that it’s possible to solve tough problems with good network design instead of proprietary unicorn dust, so I salvaged the article from some dusty archive, cleaned it up, polished it, and published it on ipSpace.net.

Scalable Policy Routing

More than a decade ago (before SD-WAN was even a thing) I wrote an article describing how easy it is to route different applications onto different links (MPLS/VPN versus IPsec tunnels) using a distance vector routing protocol (preferably BGP, although even RIP would work).

You might find it interesting that it’s possible to solve tough problems with good network design instead of proprietary unicorn dust, so I salvaged the article from some dusty archive, cleaned it up, polished it, and published it on ipSpace.net.