So I’m trying to get a list together of wholesale distributors and places similar to companies like ADI and Grainger who can get a variety of material and parts for pricing up contracts and quotes for my new venture I’m starting. I have a few accounts with a few manufacturers and one with ADI already that I’ve been using but I was just wondering what other options are out there for small contractors to order parts and materials through.
Monday, March 1, 2021
Loopback testing help
Hi everyone,
I've been working on this problem for a while now, and I've reached the point where I'm going in circles. I posted about this same problem previously, link to old post: https://www.reddit.com/r/networking/comments/kbd215/juniper_network_vrfs_and_loopback_test/
I've updated my configs and setup since that post, but it may help to understand where this started.
Here is the problem description (with some updates):
I'm trying to set up a loopback test that will go through a layer 2 device and be sent back on the same interface. Using iperf, I need to send test traffic from one VM to another VM on a different subnet. The traffic needs to take a specific path through the network and be looped back through a satellite modem. The modem has the ability to receive traffic on an ethernet interface and loop it back out the same interface. For the purposes of setting this up in a lab, I'm using ICMP to verify the traffic path. I've moved my test network from eve-NG to actual hardware. More on the production and test networks below.
Production network description:
The 2 VMs are on an ESXi cluster that connects to two EX4600 switches, which will be in a VC config. The 4600s downlink to multiple EX4300 ToR switches, which connect to the modems. I'm planning to use two VLANs with corresponding L3 interfaces on the 4600s to separate the VMs from each other. I also believe that I'll need to configure separate VRFs in order to prevent the 4600s from routing the traffic internally and not sending it through the modem.
Test network description:
2 Linux VMs running on a single ESXi host. Each VM has it's own dedicated vswitch and portgroup, and each vswitch has a single physical interface assigned to it. The host connects to an EX4500, which is connected to an EX4200. The modem hangs off the EX4200. Each switch has multiple routing instances configured in order to separate the traffic.
I've attempted various configurations of route leaking between instances, FBF placing traffic from a specific source address into a specific routing instance, or a combination of the two. The closest I've gotten is running end-to-end traffic using leaked routes, however that bypasses the modem entirely.
Does anyone know of a way to force traffic out of a specific interface so that it goes through the layer 2 device before being forwarded on?
Diagram:
Configs:
EX4500
interfaces { ge-0/0/0 { unit 0 { description "link to esxi eth2, PERT1 VM"; proxy-arp restricted; family ethernet-switching { port-mode access; vlan { members 2000; } } } } ge-0/0/1 { unit 0 { description "link to esxi eth3, PERT2 VM"; proxy-arp restricted; family ethernet-switching { port-mode access; vlan { members 2001; } } } } ge-0/0/38 { description "downlink to EX4200 ge-0/0/46"; inactive: ether-options { 802.3ad ae0; } unit 0 { family ethernet-switching { port-mode trunk; vlan { members [ 2000 2001 ]; } } } } vlan { unit 2000 { description "PERT LAN 1"; proxy-arp restricted; family inet { no-redirects; address 10.46.253.129/28; } } unit 2001 { description "PERT LAN 2"; proxy-arp restricted; family inet { no-redirects; address 10.46.253.145/28; } } } protocols { igmp-snooping { vlan all; vlan default; } dcbx { interface all; } lldp { interface all; } lldp-med { interface all; } } routing-instances { pert1 { instance-type virtual-router; interface vlan.2000; routing-options { static { route 10.46.253.144/28 next-hop 10.46.253.131; } } } pert2 { instance-type virtual-router; interface vlan.2001; routing-options { static { route 10.46.253.128/28 next-hop 10.46.253.147; } } } } vlans { default { vlan-id 1; } pert-3000 { vlan-id 3000; l3-interface vlan.3000; } pert-3001 { vlan-id 3001; l3-interface vlan.3001; } pert1 { vlan-id 2000; l3-interface vlan.2000; } pert2 { vlan-id 2001; l3-interface vlan.2001; } } EX4200
interfaces { ge-0/0/0 { unit 0 { description "link to EBEM data"; family inet { address 10.0.0.1/24; } inactive: family ethernet-switching; } } ge-0/0/1 { description "link to esxi eth7, wireshark"; unit 0 { family ethernet-switching { port-mode access; vlan { members pert1; } } } } ge-0/0/46 { description "uplink to EX4500 ge-0/0/38"; unit 0 { family ethernet-switching { port-mode trunk; vlan { members 2000-2001; } } } } vlan { unit 2000 { proxy-arp restricted; family inet { inactive: filter { input f1; } address 10.46.253.131/28; } } unit 2001 { proxy-arp restricted; family inet { address 10.46.253.147/28; } } } } protocols { igmp-snooping { vlan all; vlan default; } rstp; lldp { interface all; } lldp-med { interface all; } } policy-options { policy-statement from-ebem1 { term t1 { from { instance ebem1; route-filter 10.0.0.0/24 orlonger; } then accept; } term t2 { then reject; } } policy-statement from-pert1 { term t1 { from { instance pert1; route-filter 10.46.253.128/28 orlonger; } then accept; } term t2 { then next policy; } } policy-statement from-pert2 { term t1 { from { instance pert2; route-filter 10.46.253.144/28 orlonger; } then accept; } term t2 { then reject; } } } firewall { family inet { filter f1 { term t1 { from { source-address { 10.46.253.130/32; } } then { count filter-f1; log; routing-instance ebem1; } } } filter f2 { term t1 { from { source-address { 10.46.253.130/32; } protocol icmp; } then { count filter-f2; log; routing-instance pert2; } } } } family ethernet-switching { filter l2-f1 { term t1 { from { source-address { 10.46.253.130/32; } protocol icmp; } then { log; count filter-f1; interface ge-0/0/0.0; } } } } } routing-instances { ebem1 { instance-type virtual-router; interface ge-0/0/0.0; routing-options { instance-import [ from-pert1 from-pert2 ]; } } pert1 { instance-type virtual-router; interface vlan.2000; routing-options { inactive: instance-import from-ebem1; } } pert2 { instance-type virtual-router; interface vlan.2001; routing-options { instance-import from-ebem1; } } } ethernet-switching-options { inactive: analyzer traffic-mirror { input { ingress { interface ge-0/0/0.0; vlan pert1; } egress { interface ge-0/0/0.0; } } output { vlan { 99 { no-tag; } } } } storm-control { interface all; } } vlans { monitor { vlan-id 99; } pert1 { vlan-id 2000; l3-interface vlan.2000; } pert2 { vlan-id 2001; l3-interface vlan.2001; } } Curious about TLS
Doing some pcaps and some personal study/notes but haven't found a good explanation as to why on EAP-TLS auth or even when talking to a web page covered by a TLS cert the captures show Change Cipher Spec. Usually it's fine, in my recent lab of EAP-TLS its still authenticating fine despite that message. But I was curious why it happens. I thought the ciphers were agreed upon prior to the authentication. And in some cases I've seen the change in ciphers cause the connection to the web page to drop over and over afterwards.
Anyone know much about the particular purpose of that packet?
Thanks
Creating Small ISP
I am interested in creating a small ISP for myself and near by neighbors.
Everyone is within 50 yards of me and am wondering if I would just set up large directional Wifi network coming from my building or if I need to go all out and build a proper wisp network.
Sorry if this is the wrong place for this question. I did not see any rules pined.
Thanks in advance for an advice or direction
How does DHCP and DNS help improve network security?
I understand the basic concept of what these two functions are but how can they improve network security other than restricting certain IPs?
Thanks for the help!
I need some help with a network diagram
I have it mostly sorted, I think. The assignment was for three (3) offices in different cities. Each worker is supported by a LAN in their respective office. The data storage server within each LAN should be accessible to all computers, no matter where they are located.
In the diagram, I have three sets of computers + a server connected to three different switches.
That's where I am stuck. I believe I should make three routers, connect the switches to the routers, routers to themselves(?), then the internet?
I really don't understand and networking wasn't a prerequisite for this class.
SPAN/RSPAN VOIP Recording confusion.
We have a VOIP recorder that uses SPAN to achieve it's goal. It receives all traffic from a few SPAN source ports (Connected to VOIP Phones) and records the RTP stream using source and destination MAC address. The recorder and the phones are on the same switch currently. There are other phones being added to the network that need to be recorded. These phones are on separate switches. The solution here is RSPAN. The limitation is that a switchport can not be the destination for both a SPAN and an RSPAN. However I'm curious as to how the phones currently connected to the same switch as the recorder need to have their configuration modified. It's almost like I'm trying to configure an RSPAN local to one switch.
Can I have source ports with a destination of an RSPAN VLAN, and the destination port of that RSPAN VLAN be on the same switch? I've linked a diagram I slapped together that hopefully helps.
Syntax Highlighting Color Scheme for SecureCRT
Hi guys,
If you remember me, I posted the 230+ color schemes for MobaXterm a few weeks ago. Recently I got to use SecureCRT and looked out for syntax highlighting, as there is no preset. There seems to be a really popular one called "Cisco Words" on their forums, but I found it to be a bit too jarring with the color choices, so I decided to make an edit to change all the colors to be a bit more muted, drawing inspiration from the "Chalkboard" theme from the MobaXterm themes I did.
I didn't create the configuration file myself, simply made changes to the color choices and added some words. If anybody thinks I shouldn't distribute this as it's most of it isn't my work, let me know. I'm including a photo album of how it looks, plus the link to download the .zip file. There's a readme inside for instructions on how to install it.
Enjoy!
2.5G switches and network cards vs gigabit stations
So after a week of trying to figure out how to make our ERP system faster on the users side "server 2008 with intel gigabit network card on a tblink cheap router" i found out that getting a gigabit switch and tweaking some of the settings on the network card cut the time of report preparing by 60%, thats good but still now enough since our customers have really big data.
so i was thinking if i get a 10/100/1000/2.5g switch and network card, would that work since the stations have gigabit ethernet cards with buffers maxed out to 512/128 ? or would it be the same as the already installed gigabit card and switch? i have 5 users using the system btw.
another question, they used wifi and am changing it to ethernet, i have to customer service users in the ground floor almost 100 meters away, maybe more, would it be better to have another switch in between or just the cable from the main switch?
appreciate your support to my naive networking skills.
Cheers
Proxy Servers recommendations
Working for a financial company. We frequently have customers that are hesitant to setup servers in their DMZ that work well with our applications.
One potential solution to this...that I'm not all that fond of nor educated on... is a proxy server.
Do people still use these? If so is there a particular vendor you prefer or do you run these in house? etc?
Just looking to learn abit more about the topic and the "big players" in this arena
Subscribe to:
Posts (Atom)