Heavy Networking

On today’s Heavy Networking our topic is Web application firewalls (WAFs). Which, in the traditional sense, are neither web applications nor firewalls.

So what are these strange creatures? If my company doesn’t have one, should I go to the pet store and get one? Will they bite me if I’m not careful? What does a web application firewall eat?

Helping us understand how to feed and care for our very own web application firewall is Scott Hogg, who you might know from the IPv6 Buzz podcast, part of the Packet Pushers podcast network.

We discuss:

* How a WAF differs from typical firewalls

* The security problems WAFs try to solve (protecting vulnerable Web apps)

* How WAFs are deployed

* The architecture of a typical WAF

* Operational challenges

* How attackers bypass WAFs

* The role of WAFs in cloud applications

* More

Sponsor: ITProTV

Get over 65 hours of free technical training from ITProTV. ITProTV offers online instruction in CompTIA, Cisco, VMWare, Microsoft and more. You can stream courses live and on demand on your favorite device. Sign up for a free membership at itpro.tv/packet-pushers and try it with no obligation.

Sponsor: Cumulus Networks

If you’re future-proofing your network, why go with legacy infrastructure? Cumulus Networks offers networking software for the open, modern data center, giving you the option to choose the new way every time. Find out more at cumulusnetworks.com/modernize.

Show Links:

Scott Hogg on Twitter

Hexabuild

IPv6 Buzz Podcast

Scott’s Network World author page

Scott’s Infoblox author page

Web Application Firewalls and IPv6, Scott Hogg – Network World

The Open Web Application Security Project (OWASP)

The Web Application Security Consortium (WASC)

Web Application Firewall Evaluation Criteria (WAFEC)

WAF Criteria – ICSA Labs (PDF)

In today’s sponsored Heavy Networking episode, Juniper Networks’ Contrail SD-WAN is on the agenda.

We get a detailed look at how Contrail SD-WAN operates, examine key security features and capabilities, and explore new options including Contrail SD-WAN as a cloud service managed by Juniper.

We also examine Juniper’s competing differentiators, including scale, a focus on app Quality of Experience (QoE), the ability to customize the solution, and how Contrail SD-WAN can extend into the branch LAN and Wi-Fi networks for management and security.

Our guest is Tony Sarathchandra, Director of Product Management at Juniper.

We discuss:

* How Juniper’s SRX and NFX fit into the solution

* The role of Contrail Service Orchestration

* Investment protection in the solution

* Juniper’s ability to scale to more than 10,000 endpoints with a single SD-WAN controller

* Built-in security features and the ability to integrate third-party security software and services

* Juniper’s new cloud-hosted solution

* Integration with Mist APs and the Mist Cloud for operational visibility in the branch

* More

Show Links:

Contrail SD-WAN – Juniper Networks

Contrail SD-WAN: 15 Features In 15 Minutes – Juniper Networks via YouTube

Contrail Juniper SD-WAN Solution – EANTC (report)

Contrail Service Orchestration (CSO) Deployment Guide – Juniper Networks (PDF)

Building a networking career is challenging under the best of circumstances.

Between keeping the packets flowing and lights on, there are certifications to pursue, problems to troubleshoot, and emerging technologies to grok.

Those challenges can be compounded by your location. If you live in a small city or outside a major population hub, jobs may be scarce. Mentors and colleagues might be hard to come by. Opportunities to get your hands on new or different technologies and equipment could be limited.

We’ve assembled a roundtable of engineers to talk about the challenges of developing a networking career and growing your expertise outside of the bright lights of the big city.

Our guests are Phil Gervasi, Ryan Booth, and Eric Stover.

We discuss:

* How to cope with limited job options

* How to make travel or telecommuting work for you

* Where to find mentors, training, and community

* How community engagement can get you that new opportunity

* Potential upsides, including better quality of life, lower cost of living, and opportunities to wear many hats

Sponsor: ExtraHop

ExtraHop is the enterprise cyber analytics company delivering performance and security from the inside out. ExtraHop offers complete visibility with machine learning to help you make quick, confident decisions about your IT environment. Explore the ExtraHop Performance Platform at extrahop.com/packetpushers.

Sponsor: ITProTV

Get over 65 hours of free technical training from ITProTV. ITProTV offers online instruction in CompTIA, Cisco, VMWare, Microsoft and more. You can stream courses live and on demand on your favorite device. Sign up for a free membership at itpro.tv/packet-pushers and try it with no obligation.

Show Links:

Phil Gervasi on Twitter

Networkphil – Phil Gervasi’s blog

Ryan Booth on Twitter

Moving Ones and Zeros – Ryan Booth’s blog

Eric Stover on Twitter

FF:FF:FF:FF:FF:FF – Eric Stover’s blog

Today on Heavy Networking, we welcome Open Systems, a new SD-WAN sponsor to the show.

Open Systems is among the new breed of SD-WAN solutions emphasizing integrated security and SD-WAN as a service.

We’re going to talk about what the Open Systems solution is all about, so that you walk away knowing why they should be part of your upcoming SD-WAN proof of concept.

Our guest is Moritz Mann, Head of Product Management at Open Systems.

We discuss:

* Open Systems’ origins as an MSP and security provider

* Its SD-WAN-as-a-service approach

* The company’s architecture, including a controller, intelligent edge devices, and the overlay

* Security capabilities, including a next-gen firewall, a Web gateway, and monitoring

* The service’s threat-hunting capabilities

* How Open Systems differentiates itself through customer service and security

* Its support for routing protocols

To see Open Systems for yourself, request a free assessment at https://www.open-systems.com/packetpushers. You can also get an Open Systems beanie and download a Gartner report on the economics of SD-WAN.

Show Links:

Open Systems

Open Systems on Twitter

Open Systems on LinkedIn

Moritz Mann on LinkedIn

Today’s Heavy Networking introduces Nornir, an automation framework written in Python. Nornir provides a system to manage inventory and data, and provides glue code to tool such as Netmiko and Napalm.

We chat with three Nornir developers to explain to us what the heck a framework is, what I’m supposed to do with the Nornir framework, and how Nornir fits in with my other automation tools like Ansible, among other things.

Our guests today are David Barroso, a Principal Engineer at Fastly; Kirk Byers, Founder of Twin Bridges Technology; and Dmitry Figol, a Systems Engineer at Cisco. All three guests help maintain Nornir.

We discuss:

* What the Nornir name means

* Nornir’s capabilities

* The difference between a framework and a library

* What problems it helps solve

* How it works with Netmiko and Napalm

* How it compares to Ansible

* Installation and Nornir basics

Sponsor: ITProTV

Get over 65 hours of free technical training from ITProTV. ITProTV offers online instruction in CompTIA, Cisco, VMWare, Microsoft and more. You can stream courses live and on demand on your favorite device. Sign up for a free membership at itpro.tv/packet-pushers and try it with no obligation.

Sponsor: Cumulus Networks

Cumulus Linux allows you to affordably build and efficiently operate your network like the world’s largest data center operators, unlocking vertical network stacks. Combined with Cumulus NetQ, an operational management tool, organizations can take advantage of deeper analytics and advanced telemetry to increase visibility across the network and reduce mean time to resolution. Find out more at cumulusnetworks.com/epicpushers.

Show Links:

Nornir

Today’s sponsored Heavy Networking episode is a two-part conversation about SD-WAN and security; namely, how SD-WAN vendor Silver Peak has partnered with Zscaler, which operates a cloud-based security service, to give customers more options to inspect their WAN traffic without having to backhaul to a data center.

In part one, we talk with Nuffield Health, a U.K.-based healthcare company to get a real-world perspective on how this Silver Peak and Zscaler partnership works in production.

We discuss the business drivers for cloud-based security inspection, which traffic gets sent to Zscaler, whether the scanning affects performance, and why Silver Peak’s service chaining and app ID capabilities were key. Our guest is Dan Morgan, IT Infrastructure & Services Director at Nuffield.

In part two, we go deeper into the networking and operational impacts of using Silver Peak and Zscaler together, including how the two systems handle encryption, potential latency impacts, where and how incident response happens, and day-to-day management.

Our guests for this section are Damon Ennis, SVP of Products at Silver Peak; and Steve House, Vice President of Product Management at Zscaler.

Show Links:

SD-WAN Demo – Silver Peak

Silver Peak on Twitter

Today’s Heavy Networking is the result of a listener request. We discuss the differences between network architects and network engineers.

What’s different about each role? Where is the overlap? If you are an architect and find yourself doing engineering, is that a bad thing?

Should an engineer aspire to be an architect? Are architects so out of touch with reality that engineers rightfully hate them?

If an architect and an engineer pass each other in the hall, does the engineer have to kiss the architect’s ring every time, or just the first time?

To answer these questions, we’ve gathered guests who’ve held both roles in their careers (as has your host).

Our guests are Robin Gilijamse, IT Infrastructure Architect; Oli Elliott, Network Architect at the University of Bristol; and Tom Ammon, Sr. Network Architect at a regional service provider in the United States.

We talk about:

* The definitions of an engineer and an architect

* The path to becoming an architect

* The perspective of tactics vs. strategy

* Whether you have to give up hand-on networking

* Why architects have to get more deeply involved with business requirements and nurture personal relationships

* Advice for folks new to the architect role

Sponsor: INE

If you’re looking for training, consider INE.com. INE is a training resource for networking and a whole lot more. Visit ine.com/packetpushers to get a free 3-day trial. INE–experts at making you an expert.

Sponsor: Open Systems

Open Systems brings security, automation, and expert management to SD-WAN. Get visibility, flexibility, and control combined with performance, simplicity and security with SD-WAN from Open Systems. To find out more, go to Open-systems.com/packetpushers and get a free beanie and a Gartner report on the economics of SD-WAN.

Show Links:

Robin Gilijamse’s blog “Interesting Traffic”

Tom Ammon’s blog

Today’s Heavy Networking guests make the case that you can’t successfully automate your network unless you start with a source of truth.

When embarking on an automation project you can get caught up in tool selection, frameworks, orchestration platforms, product reviews, and organizational responsibilities and nomenclatures.

But without a source of truth for the devices you want to automate, you’ll find it hard to get very far.

We have two guests to talk about how they built, populated, and manage their own source of truth to underpin a major automation project: Damien Garros, Network Reliability Engineer; and Adam Mills, Principal Engineer. Both work at the gaming platform Roblox.

We start by defining a source of truth and how it relates to key device properties including naming conventions, IP addresses, cabling information, VLANs, BGP peering, and more.

Our guests share lessons learned, including why you can’t assume homogeneity, why you’ll need to be prepared to manage multiple sources of truth, and the koan-like principle that “you always follow the rule, except when there is an exception, in which case you follow a new rule based on that exception.”

Damien and Adam also talk about how to manage network device properties as code, and why they chose the open-source tools Netbox and Git as key repositories.

Sponsor: ITProTV

Get over 65 hours of free technical training from ITProTV. ITProTV offers online instruction in CompTIA, Cisco, VMWare, Microsoft and more. You can stream courses live and on demand on your favorite device. Sign up for a free membership at itpro.tv/packet-pushers and try it with no obligation.

Sponsor: Cumulus Networks

Cumulus Linux allows you to affordably build and efficiently operate your network like the world’s largest data center operators, unlocking vertical network stacks. Combined with Cumulus NetQ, an operational management tool, organizations can take advantage of deeper analytics and advanced telemetry to increase visibility across the network and reduce mean time to resolution. Find out more at cumulusnetworks.com/epicpushers.

Show Links:

Network Device Properties As Code – Slideshare

Network Device Properties As Code – PDF

Managing Network Device Properties as Code – Damien Garros (YouTube)

Ansiblefest 2018 Network automation journey at roblox – Slideshare

Netbox – GitHub

The expression “There’s more than one way to skin a cat” is a colloquial reminder that there are many ways to solve a problem.

That’s demonstrably true when it comes to monitoring networks and network services. From SNMP to flow records to packet capture, engineers have a multitude of choices.

On today’s Heavy Networking we talk with sponsor Netrounds about another approach: that of active testing and service assurance.

Rather than passively collect metrics, Netrounds software generates synthetic traffic to measure actual performance of critical services. It helps network engineers ensure that key performance indicators are being met, and identify where problems occur.

Joining us to talk about active testing and the concept of service assurance are Mats Nordlund, CEO and co-founder of Netrounds; and Stefan Vallin, Director of Product Strategy.

We discuss:

* The concept of service assurance for measuring network performance and user experience

* How active testing differs from traditional monitoring methods such as SNMP or packet capture

* Netrounds’ software-driven approach, including its controller and agents

* How Netrounds testing informs SLA measurements, KPIs, and troubleshooting

* Customer use cases

Show Links:

Netrounds information resources and free t-shirt offer

Netrounds on Twitter

Netrounds Blog

Netrounds on Facebook

Netrounds on LinkedIn

Netrounds on YouTube

Netrounds presentations at Networking Field Day 20

You know your frame from your packet. You can explain how bridging tables are populated. Ethernet is your friend from as far back as 100 meg half duplex regularly plagued your life.

Wireless? Not so much. You know some stuff, but maybe a big wireless project just landed in your lap and you’re feeling a little overwhelmed. What you need is a crash course. A primer.

On today’s episode, we explore how to do a new wireless deployment when you’re a wired, not a wireless, expert.

Our guest is Robert Boardman, a solution and sales engineer for Mist Systems. This is not a sponsored podcast, we’re just tapping Robert’s expertise.

We roam through a variety of topics including:

* Gathering user and technical requirements, including the physical location and clients

* Understanding the RF environment

* Channel management

* How to choose the right APs and whether all your APs should come from the same vendor

* Controller and cloud architectures

* Post-installation validation and operation

Sponsor: Cumulus Networks

Cumulus Networks wants you to build something epic. Whether you’re scaling your data center network or designing the next “big thing,” you have your sights set on building something that matters. To do that, you’ll need the best resources. Cumulus offers modern networking software for people like you — who have the vision and plans to build something epic. Get more information at cumulusnetworks.com/epicpushers.

Show Links:

Robert Boardman on Twitter

Robert Boardman’s blog

Upgrade Now Or Wait? The Business Case For Wi-Fi 6 – Packet Pushers

The Technology Case For Wi-Fi 6 – Packet Pushers

Show 381: Inside The Pros & Cons Of 802.11ax – Packet Pushers