Tech Bytes: Improving NPM And Threat Management With Enriched Flow From VIAVI Solutions (Sponsored)

Today's Tech Bytes podcast dives into using enriched flow--that is, flow records enhanced with logs and data from sources such as firewalls and directories--to improve your network performance monitoring and threat management. Our guest is Warren Caron, Sales Engineer at VIAVI Solutions. VIAVI is our sponsor for today's episode.

The post Tech Bytes: Improving NPM And Threat Management With Enriched Flow From VIAVI Solutions (Sponsored) appeared first on Packet Pushers.

What is Network Segmentation?

How to Navigate NSX-T Policy APIs for Network Automation

According to the Gartner blog post, 2019 Network Resolution: Invest in Network Automation, the top network resolution of 2019 was network automation. This isn’t surprising since traditional automation of networking and security has always been a challenge due to the cumbersome processes, lack of governance, and limited or non-existent management tools.

Organizations that automate more than 70% of their network change activities will reduce the number of outages by at least 50% and deliver services to their business constituents 50% faster

VMware NSX-T Data Center solves this by enabling rapid provisioning of network and security resources with layered security and governance. By using various network automation tools, you can quickly and effectively keep up with the demands of your developers and application owners who expect a quick turnaround on resource requests. In this blog post we’ll look at how NSX-T Policy APIs simplifies network automation.

What Are NSX-T Policy APIs?

At the center of NSX network automation lies the single point of entry into NSX via REST APIs. Just like traditional REST APIs, NSX-T APIs support the following API verbs: GET, PATCH, POST, PUT, DELETE. The table below shows the usage:

A New API Object Model

Introduced in Continue reading

Equinix Plots Canadian Expansion With $750M BCE Buy

The deal in Canada follows a flurry of activity for Equinix aimed at bolstering its hyperscale...

Read More »

Using Unison Across Linux, macOS, and Windows

I recently wrapped up an instance where I needed to use the Unison file synchronization application across Linux, macOS, and Windows. While Unison is available for all three platforms and does work across (and among) systems running all three operating systems, I did encounter a few interoperability issues while making it work. Here’s some information on these interoperability issues, and how I worked around them. (Hopefully this information will help someone else.)

The use case here is to keep a subset of directories in sync between a MacBook Air running macOS “Catalina” 10.15.5 and a Surface Pro 6 running Windows 10. A system running Ubuntu 18.04.4 acted as the “server”; each “client” system (the MacBook Air and the Surface Pro) would synchronize with the Ubuntu system. I’ve used a nearly-identical setup for several years to keep my systems synchronized.

One thing to know about Unison before I continue is that you need compatible versions of Unison on both systems in order for it to work. As I understand it, compatibility is not just based on version numbers, but also on the Ocaml version with which it was compiled.

With that in mind, I already had Continue reading

How Blurry Will the Post-Pandemic New Normal Look?

Dell and Nutanix executives say the future of work will be more flexible — and will further blur...

Read More »

TCP Transport control Protocol -PART 1

There was a need of protocol which can sent the data over a medium that is lossy . In simple term lossy is medium where data can be lost or alter.If an error occurs, there are 2 ways it can be taken care:

• Error correction code
• Resent the data again until its properly received

Resent the data need to fulfill 2 condition to make it worth , first whether the receiver has received the packet and and second whether the packet it received was the same one the sender sent.

This method to sent signal by receiver to sender that pack is received is known as Acknowledgement (ACK). So the sender should send a packet , stop and wait until ACK arrives from receiver.Once Ack is received by sender, it sent another packet and wait for Ack and this process continues.

But this process of stop and wait gives us 2 problem to taken care

• How long should the sender wait for an ACK?
• How to recognize duplicate Packets

Lets take each problem one by one starting with second one i.e recognize duplicate packets .

• Question is how do i Recognize duplicate packet
  • Use Sequence Number -Its unique number Continue reading

SDxCentral’s Top 10 Articles — May 2020

IBM reportedly cut thousands of jobs; HPE slashed salaries; Microsoft revamped Its Azure VMware...

Read More »

Installing and using collections on Ansible Tower

Ansible Collections are the new way to distribute and manage content. Ansible content can be modules, roles, plugins and even Ansible Playbooks. In my previous blog I provide a walkthrough of using Ansible Collections from Ansible Galaxy and Automation Hub.  Ansible Galaxy is the upstream community for sharing Ansible Collections.  Any community user can create a namespace and share content with anyone. Access to Automation Hub is included with a Red Hat Ansible Automation Platform subscription. Automation Hub only contains fully supported and certified content from Red Hat and our partners.

In this blog post we'll walk through using Ansible Collections with Ansible Tower, part of the Red Hat Ansible Automation Platform.  There are a few differences between using command-line Ansible for syncing with Ansible Galaxy or the Automation Hub versus using Ansible Tower. However, it is really easy and I will show you how!

Accessing collections content from Automation Hub and Galaxy from Ansible Tower.

If the Ansible Collections are included in your project you do not need to authenticate to Automation Hub. This method is where you are downloading dynamically using a requirements file as outlined in my blog post. In general there are Continue reading

Building a Multi-Vendor Automation Platform

One of the attendees in our Building Network Automation Solutions online course sent me this question:

While building an automation tool using Python for CLI provisioning, is it a good idea to use SDK provided by device vendor, or use simple SSH libraries Netmiko/Paramiko and build all features (like rollback-on-failure, or error handling, or bulk provisioning) yourself.

The golden rule of software development should be “don’t reinvent the wheel”… but then maybe you need tracks to navigate in the mud and all you can get are racing slicks, and it might not make sense to try to force-fit them into your use case, so we’re back to “it depends”.

Guest Shell Built-in Linux Container on Cisco IOS-XE

What is Boolean?

I am watching a George Boole bio on Prime but still don’t get it.

Techgig Kubernetes Webinar

Kubernetes and GKE – Day 2 operations

Juniper Direct vs Local Routes

Juniper routers consider a directly configured IP as a “local” route, except when you use /32 mask. Then it is a “direct” route. This caused me some confusion when creating a policy to redistribute loopback IP addresses into BGP.

Route Protocol Types

A router learns routes from a variety of sources - networks configured on the box, those learned from IS-IS, rumors of prefixes from BGP or RIP, etc. You can see the full list here.

When routes are learned from different sources, Junos uses “Route Preference Values” to decide which route source to prefer. (Cisco refers to this as Administrative Distance). If routes are otherwise identical, the route with the lowest preference will be installed into the FIB.

If you’re looking at the route table, you can narrow down displayed routes to look at a specific type, e.g. show route protocol direct to see locally connected networks:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
vagrant@vqfx> show route protocol direct

inet.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active,  Continue reading

Juniper Direct vs Local Routes

Juniper routers consider a directly configured IP as a “local” route, except when you use /32 mask. Then it is a “direct” route. This caused me some confusion when creating a policy to redistribute loopback IP addresses into BGP.

Route Protocol Types

A router learns routes from a variety of sources - networks configured on the box, those learned from IS-IS, rumors of prefixes from BGP or RIP, etc. You can see the full list here.

When routes are learned from different sources, Junos uses “Route Preference Values” to decide which route source to prefer. (Cisco refers to this as Administrative Distance). If routes are otherwise identical, the route with the lowest preference will be installed into the FIB.

If you’re looking at the route table, you can narrow down displayed routes to look at a specific type, e.g. show route protocol direct to see locally connected networks:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
vagrant@vqfx> show route protocol direct

inet.0: 7 destinations, 7 routes (7 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active,  Continue reading

IBM’s League of Extraordinary Computers Wage War on COVID-19

With 5 million CPU cores, 50,000 GPUs, and 483 petaFLOPs of cumulative performance, IBM claims it's...

Read More »

Worth Reading: The Burning Bag of Dung

Loved the article from Philip Laplante about environmental antipatterns. I’ve seen plenty of founderitis and shoeless children in my life, but it was worshipping the golden calf that made me LOL:

In any environment where there is poor vision or leadership, it is often convenient to lay one’s hopes on a technology or a methodology about which little is known, thereby providing a hope for some miracle. Since no one really understands the technology, methodology, or practice, it is difficult to dismiss. This is an environmental antipattern because it is based on a collective suspension of disbelief and greed, which couldn’t be sustained by one or a few individuals embracing the ridiculous.

That paragraph totally describes the belief in the magical powers of long-distance vMotion, SDN (I published a whole book debunking its magical powers), building networks like Google does it, intent-based whatever, machine learning…

Playing Politics with Section 230 Makes the Internet Weaker, Not Stronger

This opinion piece was originally published in The Hill.

Thursday the president of the United States signed an executive order that aims to address the liability regime of social media companies. A wide variety of reports have highlighted the problems with this move, but there is one problem that we find especially troubling: the danger of politicizing what is fundamentally a legal debate around party lines.

The president needs to stay out of this debate.

The Internet and politics have always had an awkward relationship. There have been numerous attempts to bring the Internet into mainstream politics over the years, most of which have been unsuccessful. The main reason is that the Internet is not a static “thing,” but a model for how networks and computers can interconnect through voluntary collaboration. A key characteristic of this model is that it’s decentralized, which means it doesn’t have a central point of control that dictates how the Internet should evolve. There is no switch that one can turn on and off, and as soon as policymakers or regulators try to impose one they inevitably chip away at the Internet itself. This characteristic has always been its most powerful asset, and the reason it Continue reading

Technology Short Take 127

Welcome to Technology Short Take #127! Let’s see what I’ve managed to collect for you this time around…

Networking

• Banzai Cloud’s Toader Sebastian explains how to write WASM (WebAssembly) filters for Envoy and deploy those filters with Istio. Be forewarned—this is a bit of an advanced topic.
• Ivan Pepelnjak provides a 101-level overview of AWS networking.
• This recent post by Eric Sloof shows how to do BGP neighbor adjacency between GNS3 and NSX-T 3.0.
• Andrew Sy Kim tackles explaining a (somewhat) obscure part of Kubernetes networking: the externalTrafficPolicy setting. Read his write-up here.

Servers/Hardware

Nothing this time around, but I’ll stay alert for items to include next time!

Security

• Ubuntu 20.04 has backported support for WireGuard in its 5.4-based kernel, but for earlier versions some additional work is needed. Here’s a write-up on setting up WireGuard on Ubuntu 18.04.
• Bruce Schneier weighs in on the security and privacy implications of Zoom. (And while we’re on the topic of Zoom, I’d love to hear your thoughts on their acquisition of Keybase.)
• Some security vulnerabilities with Thunderbolt were recently discovered and disclosed. See this website for more details.
• Looking for some security tools? Look no further.

Cloud Continue reading