NetworkingNexus.net

JUNOS | Filter-Based Forwarding

Alright, so Filter-Based Forwarding is nothing new. The technology has been around for a while and is relatively well documented. However, I wanted to share a specific use case where Filter-Based Forwarding can be extremely useful. In this scenario, we’re going to use Filter-Based Forwarding to forward traffic to a dedicated VRF where it is then pushed through a DDOS appliance and back to the router via a different VRF.

This construct is very useful when you only need to pass specific ingress traffic through the DDOS appliance. For example, customer destination prefixes who are paying for a DDOS service. Or traffic from certain source prefixes that are known to be malicious. Return traffic in either scenario is not passed via the appliance and is routed directly back to the source.

Challenge Statement
Specific ingress traffic received from transit & peering providers, via the TRANSIT VRF, must be pushed to the DIRTY VRF. The traffic must then be forwarded back towards the TRANSIT VRF via an appliance for inspection. Once the traffic is received back into the TRANSIT VRF it is onward routed as normal.

Solution
The solution involves defining the prefixes that should be considered within the Filter-Based Forwarding Continue reading

Alibaba On The Bleeding Edge Of RISC-V With XT910

It was just over a year ago that the RISC-V Foundation, the group shepherding the chip architecture in what over the past decade has become an active and crowded processor market, ratified the base instruction set architecture (ISA) and related specifications. …

Alibaba On The Bleeding Edge Of RISC-V With XT910 was written by Jeffrey Burt at The Next Platform.

Mapping Intermediary Liability in Latin America

Thanks to our Chapters in Latin America, we now have a clearer map of the intermediary liability regulatory landscape across the region.

Intermediary liability answers the question, “Should Internet intermediaries (ISPs, web hosting and cloud services, social media platforms, etc.) be liable for content posted or for actions performed by others, such as, for example, their users?”

The success of the Internet depends on intermediary liability regimes that protect Internet providers – by ensuring responsibility for user behavior is on the users themselves, not on the intermediaries upon which they rely (both at the infrastructure and content layers).

The way legal frameworks deal with intermediary liability around the world can impact the Internet way of networking in different ways.

In some countries, intermediary liability legislation is well known: the 1996 US Communications Decency Act (Section 230) and the Brazilian Internet Bill of Rights, for example. But in much of the world it is covered by other more general-purpose regulations, such as tort law, consumer protection law, and child protection law.

We asked our local community to help us map and monitor the current regimes that apply to Internet intermediaries in their countries, so that our work can Continue reading

Technology Short Take 130

Welcome to Technology Short Take #130! I’ve had this blog post sitting in my Drafts folder waiting to be published for almost a month, and I kept forgetting to actually make it live. Sorry! So, here it is—better late than never, right?

Networking

Here’s a walkthrough on using DNS over TLS on Fedora.
Some Twitter followers recently pointed out gnmic, a gNMI CLI client. gNMI, by the way, stands for gRPC Network Management Interface (more information on gNMI can be found here). I haven’t used gnmic, but it certainly looks like an extremely useful tool.

Security

Everyone’s favorite three-letter agency recently released some VPN security guidance, as reported by this InfoSecurity Magazine article. The article also provides some links to said guidance, for those that are interested.
Matt Hamilton takes a closer look at a recent security vulnerability in the Harbor container registry. This vulnerability, known as a Server-Side Request Forgery, allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server’s internal network.
Ivan Pepelnjak discusses the security implications of so-called “Smart NICs.”
Want to use a Yubikey to automatically lock and unlock your Linux system? See here.

Cloud Computing/Cloud Management

Working Collaboratively to Improve Emerging Network Time Security Implementations

Accurate and secure time is essential for the security and trustworthiness of the Internet. Many systems that we regularly interact with rely on accurate time to function properly. Accurate time also provides an essential foundation for online security, and many security mechanisms, such as digital certificates used for Transport Layer Security (TLS), depend on accurate timekeeping. The Network Time Protocol (NTP) provides time synchronization for clocks on computer networks.

NTP’s security mechanisms were designed back in an era when most Internet traffic was trusted, and the risk of attack was unlikely. Due to the continued exponential expansion of the Internet, these mechanisms became outdated and needed to be redesigned. The Internet Engineering Task Force (IETF) has been working on a specification for Network Time Security (NTS) for several years now. This specification was approved by the Internet Engineering Steering Group (IESG) in March of this year and is currently in the RFC editing process for the final publication. Over the course of the last couple of years, there have been a series of NTS projects held as part of the IETF Hackathons. These projects have worked to identify mistakes and ambiguities in the specification and to test and improve interoperability Continue reading

How Cloudflare uses Cloudflare Spectrum: A look into an intern’s project at Cloudflare

Cloudflare extensively uses its own products internally in a process known as dogfooding. As part of my onboarding as an intern on the Spectrum (a layer 4 reverse proxy) team, I learned that many internal services dogfood Spectrum, as they are exposed to the Internet and benefit from layer 4 DDoS protection. One of my first tasks was to update the configuration for an internal service that was using Spectrum. The configuration was managed in Salt (used for configuration management at Cloudflare), which was not particularly user-friendly, and required an engineer on the Spectrum team to handle updating it manually.

This process took about a week. That should instantly raise some questions, as a typical Spectrum customer can create a new Spectrum app in under a minute through Cloudflare Dashboard. So why couldn’t I?

This question formed the basis of my intern project for the summer.

The Process

Cloudflare uses various IP ranges for its products. Some customers also authorize Cloudflare to announce their IP prefixes on their behalf (this is known as BYOIP). Collectively, we can refer to these IPs as managed addresses. To prevent Bad Stuff (defined later) from happening, we prohibit managed addresses from Continue reading

SDN startup Lumina Networks closes shop, citing Covid-19 impact

Lumina Networks, a startup spun-off from the purchase and splintering of Brocade in 2017, is shutting down, citing delays in customer deployments due in part to Covid-19, which starved it for cash. The company had raised $14 million in venture capital, including investments from AT&T and Verizon, but it wasn’t enough.Lumina Networks provided an open source-based SDN controller, called the Lumina SDN Controller, which was formerly the Brocade SDN Controller and power by the OpenDaylight technology. Lumina’s claim to fame was that the SDN Controller could manage both the physical and virtual from the same platform.To read this article in full, please click here

Podcast: Trusting Routing Protocols

The can we trust routing protocols series of blog posts I wrote in April 2020 (part 1, part 2, response from Jeff Tantsura) culminated in an interesting discussion with Russ White and Nick Russo now published as The Hedge Episode 43.

Enjoy

Lessons from load balancers and multicast

In general I dislike operating load balancers and IP multicast: I’m a network engineer. Load balancers and IP multicast are very complicated, have a large amount of state, and they are hard to understand and debug. They lead to a lot of operational issues and outages. They have directly lead...

Docker Desktop & WSL 2 – Backport Update

While we have continued to make improvements to our Windows experience on Docker Desktop for users of HyperV, we are excited to see that M icrosoft has announced the backport of WSL 2 to Windows version 1903 and 1909. This means that as of today, Docker Desktop Edge users will be able to use Docker Desktop with WSL 2 rather than our legacy HyperV based backend. This is available not only for Windows Pro and Windows Enterprise, but also for Windows Home users. This is the first time that Docker has been available on Windows Home versions 1903 and 1909!

This means that these developers will be able to take advantage of WSL 2 and Docker’s integration, allowing developers to store their code within their WSL 2 distro and run the Docker CLI from within this distro. This removes the need to access files stored on the Windows host and provides significant performance improvements for users.

To find out more about using Docker Desktop with WSL 2, check out Simon’s full tips and tricks article. If you want to learn more about how Docker developed the WSL 2 backend you can have a look through our history of the integration Continue reading

IPv6 Buzz 058: Tackling IPv6 Access Challenges

In this week's episode Ed, Scott, and Tom talk to Nico Schottelius, CEO of Ungleiich Glarus, a Swiss IT services company that has developed a VPN IPv6 IoT Router Box (VIIRB), allowing cheap and secure access to the IPv6 Internet from anywhere.

IPv6 Buzz 058: Tackling IPv6 Access Challenges

The post IPv6 Buzz 058: Tackling IPv6 Access Challenges appeared first on Packet Pushers.

Introducing Deploy Buttons

When I first try out new development platforms, the first thing I do is get an OSS (Open Source Software) project I find on Github up and running. I used to start by following tutorials or digging through documentation. It’s a little bit counterintuitive. Let me share with you why. One reason is that Hello, World! examples rarely show the real “magic” of the platform. I want to feel excited and get a sense of how other people are creatively using the platform.

For example, I love it when I can build and deploy an OSS Pokedex app in a few minutes on Flutter to see if the platform actually lives up to the hype. It’s so much easier to do this than to spend a few hours following tutorials and documentation to get through the initial learning curve. You can think of it as shortening the time to first dopamine.

Another reason is that it makes learning the new platform much faster. Building off of an experienced developer’s work shows me which classes and functions are most useful to learn. There’s more nuance to building out full applications than is usually explained in the documentation. I can see how Continue reading

Pluribus bolsters software-defined data center software, Broadcom support

Pluribus Networks has rolled out new software and analytics packages that take aim at customers looking to build and manage software-defined data-center fabrics.The packages include a new release of the company’s core network operating system, Netvisor One, and the accompanying Unum management software as well as a new version of its Insight Analytics platform. They're all designed to simplify the operations of large-scale traditional and distributed edge data centers, the company said.[Get regularly scheduled insights by signing up for Network World newsletters.] Netvisor ONE is a virtualized NOS that provides Layer 2 and Layer 3 networking, distributed fabric intelligence. It virtualizes switch hardware and implements what the company calls an Adaptive Cloud Fabric. Adaptive Cloud Fabric operates without a controller and can be deployed across a single data center, or targeted to specific racks, pods, server farms or hyper-converged infrastructures, the company said. To read this article in full, please click here

Pluribus bolsters software-defined data center software, Broadcom support

Cray-Now-HPE Issues Network Performance Challenge – And Cooperation – With GPCNeT Benchmark

It happens all the time. There is a performance problem, and everyone blames the network. …

Cray-Now-HPE Issues Network Performance Challenge – And Cooperation – With GPCNeT Benchmark was written by Timothy Prickett Morgan at The Next Platform.

Data Center Fabric Webinar

Today is the last day to sign up for my data center fabric tomorrow. Sign up here.

Internet Society and the Association for Progressive Communications Enter into a Memorandum of Understanding

The Internet Society and the Association for Progressive Communications (APC) have entered into a Memorandum of Understanding (MoU) to work together on designing and deploying community networks, ensuring local connectivity initiatives achieve long-term sustainability, and other areas of joint interest.

APC is an international network of civil society organizations founded in 1990 dedicated to empowering and supporting people working for peace, human rights, development, and protection of the environment, through the strategic use of information and communication technologies (ICTs).

Both organizations have vast experience in growing the Internet through capacity building, advocating for ICT and infrastructure policies, and engaging local communities. This MoU updates and replaces a previous version. We are excited to further advance the work we’ve been doing together for nearly ten years.

The MoU lays out two key areas of joint interest:

Developing an enabling environment for communities and local entrepreneurs to solve their own connectivity challenges through design and deployment of community networks, training and capacity building efforts, and highlighting the benefits of connecting the unconnected.
Ensuring that local connectivity initiatives are able to reach long-term sustainability, support development opportunities, and contribute to meeting Sustainable Development Goals (SDGs) in relation to connectivity.

“There remains a profound Continue reading

Require hard key auth with Cloudflare Access

Last month, attackers compromised a Twitter team member’s access to an internal administrative panel in order to take over high-profile accounts. Full details of the breach are still pending, but Twitter has shared that the attackers stole credentials through a coordinated spear phishing attack.

The attackers convinced a team member to share login permissions, giving the attackers the ability to access the Twitter control plane. Once authenticated, they sent password reset flows to email accounts they controlled in order to hijack the Twitter accounts.

Administrative panels like Twitter’s are a rich target for phishing attacks because they give attackers a backdoor to privileged systems. Customer-facing teams at SaaS companies rely on these administrative panels to update end-user data and troubleshoot user account issues. If an attacker can compromise a single team member’s account they can potentially impact thousands of end users.

We have our own administrative panel at Cloudflare and we’ve deployed a number of safeguards over the last several years to keep it secure from phishing attacks. However, we had no way to enforce the security feature we think would most insulate us from phishing attacks: physical hard keys.

With hard keys, users can only login when they use Continue reading

Orange Clouding with Secondary DNS

What is secondary DNS?

In a traditional sense, secondary DNS servers act as a backup to the primary authoritative DNS server. When a change is made to the records on the primary server, a zone transfer occurs, synchronizing the secondary DNS servers with the primary server. The secondary servers can then serve the records as if they were the primary server, however changes can only be made by the primary server, not the secondary servers. This creates redundancy across many different servers that can be distributed as necessary.

There are many common ways to take advantage of Secondary DNS, some of which are:

Secondary DNS as passive backup - The secondary DNS server sits idle until the primary server goes down, at which point a failover can occur and the secondary can start serving records.
Secondary DNS as active backup - The secondary DNS server works alongside the primary server to serve records.
Secondary DNS with a hidden primary - The nameserver records at the registrar point towards the secondary servers only, essentially treating them as the primary nameservers.

What is secondary DNS Override?

Secondary DNS Override builds on the Secondary DNS with a hidden primary model by allowing our Continue reading

« Previous 1 … 904 905 906 907 908 … 3,841 Next »