The Network Stack

AWS Session Manager - Zero Trust Access

When working with AWS, there are plenty of features that make your life easier, but it's rare to find a feature that feels like magic... Before we dive into the magic, what's the problem we're trying to solve? When working with servers anywhere, usually there needs to be some sort

aws

AWS Transit Gateway

At re:Invent 2018, AWS announced the Transit Gateway, finally giving us a native solution to provide scalable transit connectivity. After attending sessions and deploying Transit Gateway, I wanted to dive into the solution and see what is possible. Tech Specs In case you haven't read the official docs, the

aws

AWS Certified Advanced Networking in 20 Days

Can the AWS Certified Advanced Networking Specialty exam be legitemately passed with only a few weeks of studying? Yes. Is there a secret shortcut? No. Although there is no shortcut, I will discuss my previous experience, study materials, and general impressions of the exam. If you have already been working

ansible

Ansible 2.5 - New Network Modules

Ansible 2.5 just came out, and with it comes new network modules (and the network_cli and netconf connectivity methods). The new modules allow us to manage certain IOS configurations without always depending on the "ios_config" module, while the network_cli connectivity method means we don't always need

ruckus

Optimize Ruckus Configuration - Part 2

A couple years ago I posted how to Optimize Ruckus Configuration, and since then I've been continually tweaking so that my dense, multi-story WiFi environment performs well with Windows, Mac OSX, and mobile devices. Here are my current optimizations: Note: This is based on Ruckus ZoneDirector 10.0.1.0

aws

AWS - CloudFormation - Create VPC

If you have worked with AWS networking, you know there is a laundry list of items that need to be initally configured so the environment is ready for use: * VPC * Internet Gateway * VPN Gateway * Public Subnets * Private Subnets * Public Route Tables * Private Route Tables * NAT Gateways * and more depending on

ansible

Ansible - BadHostKeyException

When executing an ansible playbook, you may get the following error: An exception occurred during task execution. To see the full traceback, use -vvv. The error was: paramiko.BadHostKeyException: Host key for server switch-name does not match! This probably happened after you changed the name of your network device, and

nfd16

Pluribus Networks - Whitebox Fabric #NFD16

On day two of Networking Field Day, Pluribus Networks gave us a rundown on what is possible with their Netvisor OS, whitebox hardware, and a distributed architecture. I was impressed with the flexibility of the solution, but like any design choice, there are some limitations to be aware of. As

ubuntu

Troubleshooting Disk Space Usage

A couple years ago, my coworker wrote a great post on finding disk space issues in Linux and how to resolve them. Helped me out this weekend when a critical server was having issues, so wanted to post it here: http://www.randomlyexpressed.com/diagnosing-linux-disk-usage/ For future reference (after reading

ansible

Ansible - VLAN Provisioning

Note: There is a newer guide for VLAN provisioning with Ansible 2.5 Ansible is such a powerfull tool that it can be easy to get lost in all the possibilities. Running your "network infrastructure as code" with full configs auto-generated and checked into git is the dream, but we

cisco

Cisco Config Basics - User Port

This is my first post in a series I'm calling Cisco Config Basics. These posts will serve as a reference for anyone new to Cisco, or those of you just looking to compare your current configs. After the full config, I will explain each config item line-by-line. In a campus

nfd16

Veriflow - The Formal Future #NFD16

Formal verification. Two words unfamiliar to me before Networking Field Day. To provide a brief summary, formal verification uses mathematical proofs to verify a system is working as designed – the same process used to create hacker-proof code. Veriflow has taken this method and applied it to networking to verify the

duo

SSH with Duo MFA and Active Directory

Duo has thorough documentation for adding MFA to your SSH sessions, but there are a couple additional steps needed to also integrate with Active Directory. This post will go through the installation for both Duo and Active Directory for Ubuntu 16.04. For other Linux distros, the Duo documentation linked

The Half Rack Datacenter

A couple years ago, Ivan Pepelnjak wrote an interesting blog showing how all you need are two top-of-rack switches. Iwan Rahabok followed up on the systems side, with the perspective that 1000 VM per rack is the new minimum. Now in mid 2017, I'd like to show you how we

powershell

Active Directory Powershell

Using this page to keep track of all the useful powershell "mini-scripts" I've used: Copy users from one security group to another security group Add-ADGroupMember -Identity destination-group-name -Members (Get-ADGroupMember -Identity source-group-name -Recursive) Add enabled users from an OU to a security group Get-ADUser -SearchBase 'OU=Your-OU,DC=corp,DC=company,

ansible

Ansible Installation - Ubuntu 16.04

For network automation, I believe the best tool out there right now is Ansible. Ansible is open-source, agentless, has a large community, and is easy to get started quickly. For the major networking vendors, there are already pre-built modules making it simple to interface with their equipment. This post will

palo alto networks

Palo Alto Dynamic Block List and AWS

Palo Alto firewalls have a neat feature called "DBL" - Dynamic Block List. This feature allows the firewall to grab a list of ip addresses or domains from an http page. You have to format the web page cleanly (https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-and-Limitations/ta-p/58795), but it

adfs

ADFS MFA with Office 365

We wanted to implement MFA (multi-factor authentication) for our ADFS servers when authenticating to Office 365. If you just want basic “MFA for all users” then the AD FS GUI will allow you to select your MFA provider and enable. I needed a more granular policy: Only enable MFA if

cisco

Cisco CSR License Install

Found a great blog post on installing a demo license on the CSR router (http://www.burningnode.com/2016/02/08/the-csr1000v-license-and-the-100kbps/), but I came across one additional (and important step below). TL;DR - Make sure to accept the end user agreement and SAVE before reloading! ip-10-128-228-209#reload % Unfortunately

cisco

Copy File to IOS Router via SCP

Enable SCP on the Cisco router: cisco-csr(config)#ip scp server enable Copy file from linux server to router with the following syntax: scp filename admin@10.0.0.1:flash:/filename

adfs

ADFS Sign-In Page Customization

If you use ADFS as your primary IdP, you may have noticed that before your users sign in, they have the option to pick the Relying Party they want to sign into under the "Sign in to one of the following sites" radio button. If ADFS is accessible from the

ipv6

IPv6 Cisco Deployment

I recently deployed a small IPv6 network to support our developers meeting Apple's IPv6 compatibility requirements (https://developer.apple.com/support/ipv6/). This was a good experience to get my feet wet with IPv6 as we have plans to dual-stack our environment in the coming year. Here are my notes:

ipv6

IPv6 Design

I'm very comfortable developing an IPv4 address plan that accounts for summarization and ease of use. There are new design rules for IPv6, which I am posting here (will update this page as I go): General Rules to Follow: * Allocate every site a /48 block * Allocate each vlan in the

windows

Windows DHCP not Updating DNS

Our 2012R2 DC's do DHCP and DNS for our environment, but I found that our client's DNS addresses were frequently incorrect, even though DHCP is supposed to update DNS with the correct entry. Found this blog post that solved our problems: http://blogs.msmvps.com/acefekay/2009/08/20/dhcp-dynamic-dns-updates-scavenging-static-entries-amp-timestamps-and-the-dnsproxyupdate-group/

vmware

vCenter No Longer Reachable

After a power outage, we powered on our VMware infrastructure, and as we went through the process, we quickly realized that vCenter was not coming back online. vCenter was not reachable via icmp or http/https. Logging into the ESXi console showed the VCSA booting very slowly, but eventually it