How It Started I screwed up a vCenter instance. Actually it is pretty easy to screw up the state-of-the-art hypervisor controller from its beautifully designed web UI, using the appealing buttons that always have been there. The process only requires 2 simple steps: Enable vCenter HA Replace the machine SSL certificate The vCenter HA documentation do state “if you want to use custom certificates, you have to remove the vCenter HA configuration” using the smallest font size possible, but the warning is nowhere mentioned in the documentation related to replacing SSL certificates where it should be.
vSAN 7.0U1 Cluster Rebuild: A Firsthand Experience
How It Started I screwed up a vCenter instance. Actually it is pretty easy to screw up the state-of-the-art hypervisor controller from its beautifully designed web UI, using the appealing buttons that always have been there. The process only requires 2 simple steps: Enable vCenter HA Replace the machine SSL certificate The vCenter HA documentation do state “if you want to use custom certificates, you have to remove the vCenter HA configuration” using the smallest font size possible, but the warning is nowhere mentioned in the documentation related to replacing SSL certificates where it should be.
What the Flow: Reverse Route Modes on Juniper SRX
A SRX is a “security device”, or as we call it conventionally, a firewall. Modern layer-3 firewalls route packets just like a router, but unlike a router, a firewall can organize packets into connections (flows) and run ACLs on the entire flow. This unique functionality is the fundamental building block of every “advanced” security feature offered by a firewall: dynamic NAT (PAT/NPT), zone-based firewall (ZBFW), ACLs for in or out connections only, L7 filtering, etc.
What the Flow: Reverse Route Modes on Juniper SRX
A SRX is a “security device”, or as we call it conventionally, a firewall. Modern layer-3 firewalls route packets just like a router, but unlike a router, a firewall can organize packets into connections (flows) and run ACLs on the entire flow. This unique functionality is the fundamental building block of every “advanced” security feature offered by a firewall: dynamic NAT (PAT/NPT), zone-based firewall (ZBFW), ACLs for in or out connections only, L7 filtering, etc.
Cisco Aironet 1800i: Hardware Detail
Cisco Aironet 1800i is a cute little device that is just a little smaller than my hand. They are light in weight, not very hot (not a good replacement of the old 3502i model if you also have a cat around your home) and require less power to operate. I recently got one 1800i in my room, so I’d like to write a little about this model since it is so different from the old PowerPC-based ones.
Multicast VXLAN for Routers
VXLAN has been around for a while, so how do router vendors support it? Well, let’s use a dead simple topology to test them out. Our setup today: All routers connected to the same dumb switch using IP range 169.254.0.0/24 Multicast signaling on address 239.0.0.1, No PIM VXLAN UDP port 4789 Network 10.0.0.0/24 on VNI 5000 (layer 3 termination / inter-VXLAN routing) Generic Linux Tested version: Debian 10, Linux kernel 4.
Setting up an ESXi Cluster
So you have a handful of brand new ESXi servers, and want VMs to automagically move here and there based on host availability and resource usage; vCenter have you covered with the DRS and HA but obviously you need to put all the hosts into a cluster for these thing to work. What you might not know is that there are 3 ways of creating a cluster which differs in certain things, and you will regret it if you choose the wrong one.
MOP: The Unknown "MAC Telnet" Protocol on Cisco Routers
When I was replacing all my buggy little MikroTik RouterOS boxes and VMs with some new shiny (and also buggy) Cisco ISR1000s and CSR1000vs a few years ago, there were several things that I missed so much that existed on the former but not on the latter. One of them was the “MAC Winbox” and “MAC Telnet” capability with which you can plug your maintenance workstation into the router with an Ethernet cable, fire up a Winbox, and it will let you configure the router through a layer 2 connection.
Configure OpenVPN Server with RouterOS 6.x compatibility
RouterOS has nothing to do with security, so this article will focus on usability rather than security. All configurations related to security will be marked as optional. First of all, let’s review all the limitations we have on the OpenVPN client on RouterOS 6.x: Supported protocol: TCP (TLS mode) only, no UDP, no static key Supported ciphers: none BF-CBC AES-128-CBC AES-192-CBC AES-256-CBC Supported digest algorithms: none MD5 SHA1 Supported authentication methods: username, password and optional client certificate Does not support MPLS even if running in TAP mode Server Configuration We use Debian 10 as an example here.
Use Linux as an MPLS Router
Two things happened in 2017: FRRouting came into existence, which mainlined the Quagga ldpd patch Cumulus contributed its VRF implementation to mainline Linux Linux finally got native, working MPLS (L3VPN) and VRF support. 3 years later, a thorough documentation of MPLS configuration on Linux is still largely missing. Recently, after digging into all kinds of codes and documentation, I had a standard MPLS core network up and running in my lab.