The Network Stack

June 27, 2017 0 Comments palo alto networks

Palo Alto firewalls have a neat feature called "DBL" - Dynamic Block List. This feature allows the firewall to grab a list of ip addresses or domains from an http page. You have to format the web page cleanly (https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-and-Limitations/ta-p/58795), but it allows you to update the web page dynamically, and the firewall will update it's policy accordingly.

For my use case, we had some new dynamic dev services being tested in

May 26, 2017 0 Comments adfs, duo, mfa

We wanted to implement MFA (multi-factor authentication) for our ADFS servers when authenticating to Office 365. If you just want basic “MFA for all users” then the AD FS GUI will allow you to select your MFA provider and enable. I needed a more granular policy:

Only enable MFA if the user is a member of a specific security group AND the user is coming from outside the corporate network AND it is a browser based authentication request

The third

May 17, 2017 0 Comments cisco

Found a great blog post on installing a demo license on the CSR router (http://www.burningnode.com/2016/02/08/the-csr1000v-license-and-the-100kbps/), but I came across one additional (and important step below).

TL;DR - Make sure to accept the end user agreement and SAVE before reloading!

ip-10-128-228-209#reload
% Unfortunately EULA is not detected for following feature/features:
% security
% Please configure 'license accept end user agreement' and
% use 'write' command to ensure license configurations take effect
% Continue reload will cause
April 13, 2017 0 Comments adfs, windows

If you use ADFS as your primary IdP, you may have noticed that before your users sign in, they have the option to pick the Relying Party they want to sign into under the "Sign in to one of the following sites" radio button. If ADFS is accessible from the internet (which it mostly likely is if you are using Office 365), this is a giant security concern, as it gives an attacker a view into all the external applications

April 06, 2017 0 Comments ipv6, cisco

I recently deployed a small IPv6 network to support our developers meeting Apple's IPv6 compatibility requirements (https://developer.apple.com/support/ipv6/). This was a good experience to get my feet wet with IPv6 as we have plans to dual-stack our environment in the coming year. Here are my notes:

Since this is a test/dev network, I decided to get a /48 IPv6 block from my internet provider. They routed the /48 to me via a /126 link to

April 06, 2017 0 Comments ipv6

I'm very comfortable developing an IPv4 address plan that accounts for summarization and ease of use. There are new design rules for IPv6, which I am posting here (will update this page as I go):

General Rules to Follow:

  • Allocate every site a /48 block
  • Allocate each vlan in the site a /64 (from the above /48)
  • P2P links can either be a /64 or /126 - depends if you want to keep it simple or conserve address space
  • You
February 06, 2017 0 Comments windows

Our 2012R2 DC's do DHCP and DNS for our environment, but I found that our client's DNS addresses were frequently incorrect, even though DHCP is supposed to update DNS with the correct entry.  Found this blog post that solved our problems:

http://blogs.msmvps.com/acefekay/2009/08/20/dhcp-dynamic-dns-updates-scavenging-static-entries-amp-timestamps-and-the-dnsproxyupdate-group/

Note: If you are unsure about running the dnscmd shown in the blog post, I found the commands to verify the setting before you change it, and how to revert:

June 03, 2016 0 Comments vmware, vcenter

After a power outage, we powered on our VMware infrastructure, and as we went through the process, we quickly realized that vCenter was not coming back online. vCenter was not reachable via icmp or http/https. Logging into the ESXi console showed the VCSA booting very slowly, but eventually it booted up.  Still no network connectivity. After enabling bash and doing an "ifconfig", I noticed the eth0 interface was missing. The "ip link show" confirmed that the VM did not