Always Networks Blog

Design Consideration - The effects of VLAN ID's on Spanning-Tree convergence

Network Switch

When designing a network, consideration should be given to separating traffic into VLANs. This is done for logical separation, security and performance reasons.

This affects the convergence of a Layer 2 Network. Most Cisco switches running STP (Spanning-Tree Protocol) will be running an instance per VLAN. This is called PVST (Per VLAN Spanning-Tree), or RPVST (Rapid Per VLAN Spanning-Tree), depending on whether you are running …

Read whole post...

Always Networks is now Serverless!

Fri 21 December 2018

Powered by AWS Cloud Computing

This blog has now been moved on to AWS using entirely serverless technologies, meaning both reduced cost and better performance.

To do this, a number of technologies have been employed to automate the deployment. As there is really only one Always Networks site, a lot of this was probably a lot more effort than it could have been - it would probably have been easier to …

Read whole post...

Identifying which zone a subnet is in on a Palo Alto firewall - Script

One of the challenges with managing any zone based firewall on a large scale is knowing which zone everything is in. We all know that the network should be well documented, but we also know that routing tables get unwieldy, and it's not uncommon when adding a firewall rule to be wondering exactly which zone that source or destination is in.

There are three ways …

Read whole post...

Scout2 and Security Monkey - AWS Security Auditing

Wed 30 August 2017

I recently had cause to do some auditing of a pre-built AWS environment. The lazy guy in me tried out some free tools to speed things up.

Security Monkey

First up was Security Monkey. This was made by Netflix. It can be found on their github: https://github.com/Netflix/security_monkey. It's actually really well documented, and I just followed their setup guide verbatim - I …

Read whole post...

Automated Deployments of Palo Alto Firewalls in AWS

I've recently been working with a client on magically spinning up entire environments in AWS. This means I've learned a fair bit about AWS on the way!

Without going into too much detail (as it's the clients work), we have been bootstrapping Palo Alto firewalls. This allows you to be able to stand up a fully configured Palo Alto firewall using a CloudFormation script in …

Read whole post...

eBGP - ECMP in depth!

Sat 08 July 2017

My client recently did a fairly big change to the edge network in their data centre, including a migration to 4-byte AS numbers. This wasn't without it's challenges. So here is a (long) post about the challenges we faced, and some explanations of some of the more advanced features of BGP such as local-as no-prepend replace-as, and bestpath as-path multipath-relax.

Here is a very simplified …

Read whole post...

Testing a 1 Gb Internet circuit

Wed 26 April 2017

Have you ever needed to prove a gigabit Internet circuit? It's more of a headache than you'd think. I had to prove one recently - we were seeing some errors which seemed to happen every time the bandwidth went over about 400mbps outbound, so we needed to prove we could push more. We could ask the ISP to run some tests - but I'm an untrusting kinda …

Read whole post...

VCP 6 passed - like the new Fault Tolerance features!

Fri 20 January 2017

I recently updated my VMware certification from 5.5 to 6. My 5.5 was expiring so it made sense to do the delta exam and upgrade, rather than recertify the same level. I realise I've done this just as 6.5 is coming out, but I've been using 6 lately so it made sense to me.

A lot of the maximums in VMware have …

Read whole post...

Off-site backups for Synology NAS - using two raspberry pi's, behind dynamic NAT IP's

Tue 08 November 2016

I recently bought a 4 bay synology NAS (DS416 Play), to move away from Dropbox and OneDrive. The main issue I had before choosing to do this, was off-site backups. It's ok having 4 disks for resilience, but if my house burns down or gets burgled, I still lose everything.

So I started to think up ways of doing an offsite backup, without having to …

Read whole post...

Python Scripting on a Cisco Nexus 7k

A few days ago I stumbled upon the python interpreter on the Nexus platform. It got me to tinkering.

In the past, I have had a requirement to grab a list of all of the interfaces on a box, the IP's, and the masks. The interfaces and IP's can easily be obtained from a show ip int br, and using column select to grab the …

Read whole post...