IPv6 Proxies

Tuesday, June 8, 2021

Network Access Control for wifi, segregating employee, byod, guest, iot, etc.

We need to implement NAC on our wifi networks. Still using a shared key and changing it every 3 - 12 months or after a lot of people quit. But would love to get NAC working before COVID ends and people return to the office.

We bought Ruckus Cloudpath over a year ago and never got it working. Tried working with support and our vendor but can't get enough instructions to have it actually function. And then a few days ago I tried to upgrade it and the VM died. It looks like it's booted but can't login or access management page, etc. Tried restoring snapshots and backups, same prob.

So if I have to rebuild might as well start new.

We have two offices. Pre-covid populations had about 40 people in one and 80 - 120 in the other.

We want to segregate company-owned laptops & devices from employee phones/BYOD, guest access, and IOT. All APs are Ruckus.

What are your favorite, functional NACs?

Networking pros and cons

What are the pros and cons of making a network completely uniform in the choice of hardware and software?

P4 Barefoot Tofino

Hello there,

I want to write P4 code for Intels Barefoot Tofino switches but don't really know where to start learning the differences, on which page I can learn about it best, respectively. Hope you guys can help me. Thanks!

Super Simple Maps

Hello folks,

Many (many) moons ago, I used to have a really useful bit of software called WS-Watch. I’m pretty sure it got bought up by Ipswich to become WhatsUp Gold, but might be wrong.

I was a really simple bit of software for drawing out a network and you could click on a device and launch an ssh client.

We do lots of labbing of new networks for customers and it would be really handy to have a similar bit of software - does anyone know if anything like it exists?

I’m after something super simple that can draw a map and ssh on a click. It would also ping all the devices every 60 seconds and set of a horrific alarm noise if something went down.

Here’s a link to WS-Watch: http://www.cyto.purdue.edu/cdroms/cyto4/8_websit/valet/ws_wat1.htm

Best, Leigh

Route reflect newb - iBGP question

Hello all,

I'm looking to deploy iBGP with multiple route reflectors for redundancy. One thing I'm not quite understanding is exactly how the multiple RR works. Example: If i use 3 route reflectors will three copies of the routes be shared? I'm trying to determine what behavior to expect and how to set "primary RR's vs backup"

Sorry for the newb question just a little hung up on this.. Any input would be appreciated.

Multiple Subnets Single Cisco ASA Internet Packet Tracer

I was wondering if someone can help me with my packet tracer config.

I am trying to configure the following

Site 1 10.30.x.x >Directly Connected to Site 3 (Using EIGRP)

Site 2 10.31.x.x >Directly Connected to Site 3 (Using EIGRP)

Site 3 10.32x.x >Directly Connected to Site 1 + 2 (Using EIGRP)

Default Route for Site 3 Pointing to Cisco ASA

I can ping from Site 1 to Inside interface of ASA and vice versa

I can ping from Site 3 L3 switch to Internet (8.8.8.8)

I cannot ping from Site 1 to outside interface of ASA or 8.8.8.8 (web server)

Any help is greatly appreciated

Packet Tracer file at this link https://file.io/Uz1rj0UPkmYi

Online IPv4 NAT Service?

I've to run 13 instances of a service which can only handle IPv4. Each service must be reachable via the exact same port from the internet. This is a limitation which I cannot get around because I do not have control over the other side of this service. Thus I need 13 public IPs. Unfortunately my provider is not willing to provide me with a /28 IPv4 subnet.

Now I was wondering if I could get around that by running a firewall in the cloud, setup a VPN and book the needed IPs in the cloud and expose the services via the VPN to the internet. Has anyone done something similar or got a better idea?

Fastly CDN Outage, many sites offline (Reddit, Twitch, GitHub)

Since the Americans are asleep and nothing has been posted, I'll start a thread on the big news of today: large parts of internet become unreachable due to Fastly CDN outage.

https://status.fastly.com/

https://techcrunch.com/2021/06/08/numerous-popular-websites-are-facing-an-outage/?guccounter=1

https://www.theguardian.com/technology/2021/jun/08/massive-internet-outage-hits-websites-including-amazon-govuk-and-guardian-fastly

At the moment there's not much info, apart from a "service configuration event" caused an outage of the CDN Edge services that Fastly provide for these various websites.

Everything is back online as of 10:57 UTC, but websites may experience load issues as they back ramp up to normal levels.

Fiber redundancy network design

Hi guys,

i'm a little stuck with a fiber redundancy network design, it's kinda hard to explain, but i'll try.

Imagine:
-2 sites, with 2 firewalls on each side (VRRP clusters)
-Multiple direct fiber connections between both sites
-Currently, only 1x fiber is connected via a single fiber2copper converter
-On site A, the currently active fiber is directly connected to the local core switch (fiber converter A)
-On site B, the currently active fiber is connected to the firewall VRRP master (fiber converter B)

What i'd like to do:
1) Connect all fibers (current and new), from firewall cluster A to firewall cluster B
2) Create fully crossed redundant paths with all existing fibers between both sites

Now, you could create a new VRRP pair on both firewall clusters and simply connect site-A and site-B with all available fiber connections, but VRRP would probably not work, since master and backup can't see each other over the fiber links.

A workaround would be to drop the VRRP idea and work with watchdogs and routes, but that doesn't feel right.

Another idea i came up with, is the following:
-Each site gets a fiber switch stack, with SFP LACP LAGs (master and backup) for all fiber connections,hence creating a redundant layer 2 broadcast domain between both sites.
-Site-A firewall cluster will be cross-connected to the fiber switch stack A
-Site-B firewall cluster will be cross-connected to the fiber switch stack B
-Create VLAN(s) and STP on both fiber switch stacks
-Finally setup new VRRP, subnet, routings, inbound/outbound filtering on both firewall stacks

I don't know how you would call something like that, i would call it a "transit network" (?), yeah, i just made that up. Not sure if the fiber switch idea is cool, stupid, or reasonable but overly complicated.

I'm not looking for a solution in particular, but rather a best-practice or a hint on how multiple redundant fiber connections between remote sites is usually done by the network pros?

Any inside is much appreciated.

Strange Cat5 cable speed issues

We have a client who was not getting the full 400Mbps speed from their internet connection. Upon investigation, we found their Unifi Secure Gateway was auto-negotiating the WAN connection to the ISP router @ 100Mbps.

We put this down to a poor cable so attended the site to replace the cable.

I initially tested the ISP's router with just a short pre-made cable and whilst I wasnt getting the advertised 400Mbps we were getting 200+ Mbps.

So I made a 30-metre cable round to where our USG was and before connecting to our USG I tested with just my laptop to ensure I was still getting the 200+ Mbps. Nope, it was hard capped @ 94Mbps.

Went back to the ISP router with the pre-made and tested and sure enough, 200Mbps again.

Thinking it could be the quality of cable I was using I made a shorter 2m length of cable and tested just into the ISP router and again 200Mbps

Ok now that's weird

So I then thought the length of the cable, or something I have run it next to is causing issues, so I pulled the cable back, laid it across the floor and chopped about 10m off it, tested and again hard-capped @ 90Mbps.

Any thoughts as to what could explain this?

Just to rule them out:

I tested on 3 different speed testing sites each time and all showed the same results
It was the same port on the ISP router each time
The ISP router is a high-quality Cisco router