The Network Stack

August 22, 2017 0 Comments

A couple years ago, Ivan Pepelnjak wrote an interesting blog showing how all you need are two top-of-rack switches. Iwan Rahabok followed up on the systems side, with the perspective that 1000 VM per rack is the new minimum.

Now in mid 2017, I'd like to show you how we can fit 2M network routes, 1PB of storage, and over 1000 VM's in a half rack. Don't worry, I included redundancy as well.

Disclaimer: My examples use specific vendor equipment

August 04, 2017 0 Comments powershell, active-directory, windows

Using this page to keep track of all the useful powershell "mini-scripts" I've used:

Copy users from one security group to another security group

Add-ADGroupMember -Identity destination-group-name -Members (Get-ADGroupMember -Identity source-group-name -Recursive)

Add enabled users from an OU to a security group

Get-ADUser -SearchBase 'OU=Your-OU,DC=corp,DC=company,DC=com' -Filter {Enabled -eq $true} | ForEach-Object {Add-ADGroupMember -Identity 'your-group-name' -Members $_ }

Add users from a CSV file to a security group (username column is called "name"

July 23, 2017 0 Comments ansible

For network automation, I believe the best tool out there right now is Ansible. Ansible is open-source, agentless, has a large community, and is easy to get started quickly. For the major networking vendors, there are already pre-built modules making it simple to interface with their equipment. This post will focus on getting Ansible up and running on a Ubuntu 16.04 server (in three steps), and following posts will show how to use Ansible to automate network configuration.

  1. Assuming

June 27, 2017 0 Comments palo alto networks

Palo Alto firewalls have a neat feature called "DBL" - Dynamic Block List. This feature allows the firewall to grab a list of ip addresses or domains from an http page. You have to format the web page cleanly (https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-and-Limitations/ta-p/58795), but it allows you to update the web page dynamically, and the firewall will update it's policy accordingly.

For my use case, we had some new dynamic dev services being tested in

May 26, 2017 0 Comments adfs, duo, mfa

We wanted to implement MFA (multi-factor authentication) for our ADFS servers when authenticating to Office 365. If you just want basic “MFA for all users” then the AD FS GUI will allow you to select your MFA provider and enable. I needed a more granular policy:

Only enable MFA if the user is a member of a specific security group AND the user is coming from outside the corporate network AND it is a browser based authentication request

The third

May 17, 2017 0 Comments cisco

Found a great blog post on installing a demo license on the CSR router (http://www.burningnode.com/2016/02/08/the-csr1000v-license-and-the-100kbps/), but I came across one additional (and important step below).

TL;DR - Make sure to accept the end user agreement and SAVE before reloading!

ip-10-128-228-209#reload
% Unfortunately EULA is not detected for following feature/features:
% security
% Please configure 'license accept end user agreement' and
% use 'write' command to ensure license configurations take effect
% Continue reload will cause
April 13, 2017 0 Comments adfs, windows

If you use ADFS as your primary IdP, you may have noticed that before your users sign in, they have the option to pick the Relying Party they want to sign into under the "Sign in to one of the following sites" radio button. If ADFS is accessible from the internet (which it mostly likely is if you are using Office 365), this is a giant security concern, as it gives an attacker a view into all the external applications

April 06, 2017 0 Comments ipv6, cisco

I recently deployed a small IPv6 network to support our developers meeting Apple's IPv6 compatibility requirements (https://developer.apple.com/support/ipv6/). This was a good experience to get my feet wet with IPv6 as we have plans to dual-stack our environment in the coming year. Here are my notes:

Since this is a test/dev network, I decided to get a /48 IPv6 block from my internet provider. They routed the /48 to me via a /126 link to