Packet Pushers - Priority Queue

The latest entry in our Design & Build series digs deeper into DMVPN. Today’s focus is on using certificates for endpoint authentication.

Our guest for this conversation is Nick Moody, a network and security engineer with experience in the enterprise, the public and financial sectors, and service providers.

We discuss the use of pre-shared keys to authenticate endpoints, which is one deployment method, and examine the security drawbacks of this option.

We explore the advantages of certificate authentication (security and scalability), address the challenges of working with a public-key infrastructure (PKI), and get into details on certificate management.

Nick Moody blogs at NetAssured.

For more on DMVPN and to find the other podcasts in this series, check out our Design & Build page.

The Packet Pushers Design & Build series continues with DMVPN. DMVPN is a proprietary technology from Cisco for hub-and-spoke connectivity using multipoint VPNs.

Our guest is Eugene Khabarov, a network engineer and CCIE. We talk with Eugene about the basics of DMVPN, including GRE and the Next Hop Resolution Protocol (NHRP), and explore features for dynamic routing and IPSec encryption.

We also drill into deployments and use cases, and examine routing considerations and the pros and cons of using various routing protocols with DMVPN. Eugene also gets into scalability issues, shares experiences (failures and successes) from a real-world project, and discusses alternatives.

Eugene also joined us for our inaugural Design & Build show, episode 234 on network mergers.

Show Links:

suiCCIEde –  Eugene Khabarov’s Blog

BRKSEC-3052 – Advanced DMVPN Designs (2013 London) – Cisco Live

DMVPN Explained – INE

DMVPN Phase 3 – INE

Cisco FlexVPN DMVPN, Part 1 – Overview and Design – Michael Kashin

FlexVPN QoS – Michael Kashin

FlexVPN Configuration – Michael Kashin

Designing A Multi-Region, Multi-Hub Phase 3 DMVPN With BGP – Matt Love

Show 234 – Design & Build #1 – Network Mergers – Packet Pushers

Today on Packet Pushers, a cloud migration you might not have considered before — your PBX.  PBX in the cloud? “Risky,” you think. “Complicated,” you think. “Voice quality,” you think. Those are reasonable thoughts popping into your head.

To help us talk through the risks and rewards of putting your PBX in the cloud is Richard DeFabritus, Senior Product Marketing Manager at Sonus Networks, our sponsor for today’s show. In this discussion, we’ll focus on Microsoft’s Office 365 Cloud PBX.

We talk about the reasons companies are moving the PBX to the cloud, including quicker provisioning, lower capital expense, and ease of management. We also address risks such as poor call quality and users’ fear of change.

The discussion also drills into the critical elements of a cloud PBX plan, the pros and cons of hard cutovers vs. gradual migration, and how Session Border Controllers (SBCs) can help.

Our show today is with Avi Freedman, a Packet Pushers favorite and returning guest. He’s the CEO and co-founder of Kentik, which has sponsored today’s show. We’ve met Avi in meatspace a few times, and we can assure you he’s a fellow nerd.

Kentik collects and analyzes network data, including all major flow types, as well as BGP route data and SNMP information, to provide visibility into network performance and enable infrastructure optimization.

Avi joins us to talk about new capabilities in the Kentik platform, including network performance monitoring for the cloud, as well as DDoS and anomaly detection.

Kentik’s service is available for enterprises and service providers. You can try Kentik for free by signing up here.

As mentioned, we’ve had Avi on the show before on sponsored and unsponsored shows, so if want to hear more, here are the links:

PQ Show 75: Talking Network Analytics And Telemetry

PQ Show 71: Kentik & Real-Time Network Visibility (Sponsored)

Today’s Priority Queue is the second round of the Engineers At The Bar series, where networking pros gather for drinks and conversation about life in technology. (Listen to the first episode here.)

This episode was recorded live in Las Vegas during VMworld 2016. Greg Ferro hosts, and his guests are Tommy McNicholas, E.J. Spry, and Doug Youd.

The conversation starts with a debate about training and specialization, and whether there’s a lack of fundamental knowledge in the industry.

They also talk about what drew them to networking as a discipline, the prospects for open networking and disaggregation, the fear of not knowing things, vendor gripes, why 2017 will be the year of visibility and telemetry, and more.

Join us for a candid and casual discussion.

Today on the Packet Pushers Priority Queue, network automation tooling you can use today with the equipment you already have, and which costs you nothing.

Our guest today is Kirk Byers, creator of the Netmiko library for Python. Kirk works with the NAPALM (Network Automation and Programmability Abstraction Layer with Multivendor support) Python library as well. We’ll discuss both of these tools today.

Kirk is all about network automation and teaching it to others. I can recommend his Python for network engineers free and paid courses.

On today’s show we talk about what Netmiko is and why it was created, and what’s new in the latest version.

We also explore the Netmiko tool NAPALM, and what it does well.

Show Links:

Python for Network Engineers – Kirk Byers’ blog

Kirk Byers on LinkedIn

Email-list for free Learning Python course

Netmiko Library

Netmiko Tools

NAPALM Documentation

Network to Code Slack Channel sign up page

San Francisco Network Automation Meetup

Today on the Packet Pushers’ Priority Queue, we catch up with GNS3. What’s GNS3? It is a free and open source network simulator, sponsored by SolarWinds, that’s incredibly useful if you’re trying to lab and learn without all that pesky physical equipment.

If you’ve not heard of GNS3, you’re in for a treat. If you’ve heard of GNS3, but haven’t used it in a few years, listen in to discover just how far the platform has come.

Joining the Priority Queue from GNS3 is Instructor David Bombal, Principal Developer Jeremy Grossmann, and Developer Julien Duponchelle.

We discuss GNS3’s origins as a certification practice tool and its open source status and relationship with SolarWinds. We also discuss the capabilities of GNS3, the routing, switching, and middlebox technologies supported (not just Cisco), and how GNS3 compares to other network simulation platforms.

Special Offer:

SolarWinds has a special offer for Packet Pushers listeners. Get the SolarWinds Standard Toolset for free! The Toolset includes network monitoring, performance monitoring, and remote management. Just visit tinyurl.com/packetpushers to get your free license key.

Links:

GNS3 Academy Courses

GNS3 on Twitter

David Bombal on Twitter

Julien Duponchelle on Twitter

Julien Duponchelle on GitHub

Recorded live in New York, network engineers talk candidly about their process of deciding to buy and deploy a Viptela SD-WAN solution. This live, face-to-face discussion, sponsored by Viptela, gave us one of best podcasts of 2016. We were joined by:

* Eric Murray and Kyle Alexander from Kindred Health Group

* Gant Estes and Jarin Dykstra from 77 Energy

* Nick Phelps from FreedomPay

Here’s a few key points that grabbed my attention. We kick off talking about features that mattered most to our guests. Getting “free” from the telcos and carriers was a fun concept, and being able to negotiate from a position of strength puts smiles on peoples’ faces. The ability to identify and isolate traffic flows as “micro-segmentation” and the use of traffic engineering for both SLA and encryption really do solve business problems.

For Kindred Healthcare, IT is a shared service and locations may or not be fully under their control. SD-WAN means moving the trust boundary closer to the network edge (not normally possible for a WAN).  Importantly, they were able to implement traffic steering without implementing MPLS and to use a centralized point of control to reduce configuration time.

For 77 Energy, a key feature is that just two people can operate their 500 WAN locations, and they don’t expect that number to increase as they roll out more sites during planned expansion. As a recent spin-out from a larger company, the ability to scale up/down their exploration sites on short notice has been a success.

FreedomPay has unique requirements as a payment provider. Encryption and device security are critical, but a surprise was the Viptela SEN feature, which let them build arbitrary network topologies in partial or full mesh depending on the application.

One more thing that I haven’t heard previously is that operation of Viptela devices using a CLI can be reassuring, especially when configuring IP routing protocols for integration with the legacy WAN.

A final standout was hybrid cloud connectivity, where it turns out that AWS and Azure don’t have enough features for connecting your SD-WAN. Both 77 Energy and FreedomPay built unique solutions that deliver much more flexible outcomes while still connecting the WAN directly to public cloud.

Thanks to Viptela for sponsoring this show and making a live podcast possible in New York.

Wireless. It’s what’s carrying your data. And today, Cambium Networks sponsors the Packet Pushers for a discussion about WiFi in your enterprise as well as a new solution they recently announced that offers 14×14 MIMO. Enough with your piddly 3×3, 4×4, or 8×8. Cambium’s got 14×14.

Joining us for today’s conversation from Cambium are Puneet Batta, director of engineering for WiFi; Chetan Hebbalae, senior director, product management; and Trevor Miranda, software architect.

We discuss Cambium’s products, including cnPilot, cnMaestro, and its newest AP cnMedusa (that’s the 14×14 MIMO). We also talk about the ins and outs of wireless broadband and recent developments in enterprise WiFi.

Cambium will offer a 30% discount for listeners who register at www.cambiumnetworks.com/packetpushers and evaluate their cnPilot E400 and E500 access points.

To learn more about Cambium, check out our previous podcast, PQ Show 74: Cambium Networks – Affordable PTP Wireless (Sponsored).

Containers are a hot topic. While most people are focused on microservices, the Packet Pushers are thinking about how containers connect to a network.

What if you have containers in your private cloud and you want to use the same provisioning and monitoring tools in the public cloud? How do you set and monitor policies and performance? What does network operations look like when you don’t have a switch to configure?

Nuage Networks, maker of the Virtualized Services Platform and sponsor of today’s show, is here to address these and other questions.

Joining us are Harmeet Sahni, Director of Product Management at Nuage Networks; and Rajat Chopra, Senior Software Engineer at Red Hat.

We discuss container networking requirements for a variety of scenarios, including connecting containers on the same host, host-to-host networking, and host-to-outside world, and dig into the use of orchestration tools like Kubernetes.

We also explore the role of overlays in a container environment, look at service insertion, and more.

To get more details about Nuage Networks and containers, you can download this solutions brief from Nuage.