Posted on

The Packet Wizard : VPN Split-Tunneling

Split-tunneling is a networking approach that lets a remote user using Remote Access Virtual Private Network (RAVPN) to have specific traffic sent to the internet instead of being sent over the encrypted VPN tunnel.

E.g. – A remote user is using a home network, hotel network or coffee shop to Remote Access VPN  (RAVPN) to connect to their works corporate network . The user or VPN subnet with split tunneling enabled can allow the user to send specific traffic such as; access to company file stores, company database servers, company mail servers and other servers on the corporate resources through the RAVPN connection. When the user connects to Internet resources such as Web sites, Personal Webmail, Voice or Video calls, etc.), the connection request can be sent directly out the local gateway provided by the home network, hotel network or coffee shop, thus preventing the traffic from being sent to the corporate network to be redirected to the internet, instead just going directly to the internet.

There are some Advantages of Split-Tunneling can be preventing bottlenecks especially if the user uses Voice/Video calls, where the calls can be severely depredated due to having to pass through the VPN tunnel first.

There are also some disadvantages of Split-Tunneling in that the user now by-passes Corporate security controls  that may be in place by the Security team for access to specific sites etc.

Posted on

The Packet Wizard : Link Aggregation Group

The image above shows a link aggregation group between two switches. The reason we use Link Aggregation Groups (LAGs) are they allow you to combine multiple network physical connections to make a single higher load sharing bandwidth path thus increase the throughput beyond what a single connection could support, and also to provide redundancy incase one of the links should fail.

You can read on how to configure LAG’s on Ruckus Switches here:
Ruckus : Configure Link Aggregation Groups

Posted on

Ruckus : Configure Link Aggregation Group

This is how to build a Link Aggregation Group on the Ruckus 7150. It is slightly different on the 7250’s.

 

tpwsw1# conf t

 

Configure the Link Aggregation Group. There are multiple LAG types and they must match on both sides of the lag, other vendors may use different names for the same thing here are the common ones:

Ruckus LAG Types Other Vendor Types
Static On
Dyanmic Active

Configure a static LAG.

tpwsw1(config)# lag <name-of-the-lag> static id 1

 


Configure a dynamic LAG.

tpwsw1(config)# lag <name-of-the-lag> dynamic id 1

 

 

The LAG ID can be automatically generated and assigned to a LAG using the auto option.

tpwsw1(config)# lag <name-of-the-lag> dynamic id auto

 

The Link Aggregation Group IDs are unique for each LAG on the switch. The LAG ID can’t be assigned to more than one LAG. If a LAG ID is already used, the CLI will reject the new LAG configuration and display an error message that suggests the next available LAG ID that can be used.

Once the LAG is built you have to add ports to the LAG.

tpwsw1(config-lag-<name-of-the-lag>)# ports ethernet 1/2/7 ethernet 1/2/8

 

Posted on

The Packet Wizard : Work Travel

I am home! I have been travelling for work for the best part of the past 5 weeks. I was in Boston doing a network refresh the week before Easter, which included replacing all the network cables, installing new Palo Alto Firewalls and removing Cisco ASA’s. I also removed all Cisco Switches and installed a new stack of Ruckus 7250, replace the core switches with 2 new Arista’s. I then came home for 2 days and I left again for Singapore for 3 weeks. I was in Singapore integrating a new company we bought into our network, this was a team effort as we had other sites to bring online within 48 hours. Copenhagen and a small site in Kaohsiung, Taiwan. I have learned a lot over the past 2 month. I have some articles to write on what I have learned but for now, I just wanted to give a quick update. Here is some cable porn from the Boston Network Refresh.

Before:

After:

 

 

Posted on

Wireless Access Points


Notice: Trying to access array offset on value of type null in /home/minted6/thepacketwizard.com/wp-content/plugins/amazon-associates-link-builder/vendor/mustache/mustache/src/Mustache/Parser.php on line 278

Here are some of the Wireless Access Points I use at home.

Products from Amazon.com

Posted on

Switches


Notice: Trying to access array offset on value of type null in /home/minted6/thepacketwizard.com/wp-content/plugins/amazon-associates-link-builder/vendor/mustache/mustache/src/Mustache/Parser.php on line 278

Here are some of the switches I have written about on previous posts.

Posted on

Books

These are some of the books I recommend.

Products from Amazon.com

Posted on

Arista : MLAG Setup

I have recently been setting up some Arista switches for a network refresh at our Boston site.

MLAG is short for Multi Chassis Link Aggregation and it allows more than 1 switch usually 2, to act like one logical switch which can allow you to just manage one switch instead of multiple. It also helps with redundancy and diversify paths. Its an awesome technology.  Here is the basic MLAG Topology:

1. Create Port Channel For Peer Links

I am using 2 Arista DCS-7150S-24-R switches with 2 10Gb Ethernet as our MLAG peer links. On each switch we will create a port channel 1000

 tpwsw1# config t
 tpwsw1(conf)#interface e23-24
 tpwsw1(config-if-Et23-24)# channel-group 1000 mode active
 tpwsw1(config-if-Et23-24)# interface port-channel 1000
 tpwsw1(config-if-Po1000)# switchport mode trunk

 

2. Create a VLAN for Peer MLAG Communication

You need to create a separate VLAN for MLAG communication and assign it the mlag-peer trunk group and disable spanning-tree on the VLAN. This step is done on both switches.

 tpwsw1(conf)#vlan 4094
 tpwsw1(config-vlan-4094)# trunk group mlag-peer
 tpwsw1(config-vlan-4094)# interface port-channel 1000
 tpwsw1(config-if-Po1000)# switchport trunk group mlag-peer
 tpwsw1(config-if-Po1000)# exit
 tpwsw1(conf)#no spanning-tree vlan 4094

 

 tpwsw2(conf)#vlan 4094
 tpwsw2(config-vlan-4094)# trunk group mlag-peer
 tpwsw2(config-vlan-4094)# interface port-channel 1000
 tpwsw2(config-if-Po1000)# switchport trunk group mlag-peer
 tpwsw2(config-if-Po1000)# exit
 tpwsw2(conf)#no spanning-tree vlan 4094

 

3. Set an IP on each Switch
On VLAN 4094 that was created above, we need to assign it an IP so each switch can communicate over layer 3 with each other.

 

tpwsw1(conf)#int vlan 4094
tpwsw1(config-if-Vl4094)# ip address 1.1.1.1/30

 

tpwsw2(conf)#int vlan 4094
tpwsw2(config-if-Vl4094)# ip address 1.1.1.2/30

***Send some pings to confirm basic connectivity

 

4. Configure MLAG peering for each switch

 tpwsw1(config)#mlag
 tpwsw1(config-mlag)#local-interface vlan 4094
 tpwsw1(config-mlag)#peer-address 1.1.1.2
 tpwsw1(config-mlag)#peer-link port-channel 1000
 tpwsw1(config-mlag)#domain-id mlagDOMAIN

 

 

 tpwsw2(config)#mlag
 tpwsw2(config-mlag)#local-interface vlan 4094
 tpwsw2(config-mlag)#peer-address 1.1.1.1
 tpwsw2(config-mlag)#peer-link port-channel 1000
 tpwsw2(config-mlag)#domain-id mlagDOMAIN

 

 

5. Verify MLAG Domain
On each switch, do a #show mlag to see if MLAG is up and running and you can confirm this by seeing State:Active and peer-link status: UP and locl-int status:UP

tpwsw1(config-mlag)#show mlag
MLAG Configuration:
domain-id : mlagDOMAIN
local-interface : Vlan4094
peer-address : 1.1.1.2
peer-link : Port-Channel1000
MLAG Status:
state : Active
negotiation status : Connected
peer-link status : Up
local-int status : Up
system-id : 02:1c:73:1e:97:dc
MLAG Ports:
Disabled : 0
Configured : 0
Inactive : 0
Active-partial : 0
Active-full : 0

 

 

tpwsw2(config-mlag)#show mlag
MLAG Configuration:
domain-id : mlagDOMAIN
local-interface : Vlan4094
peer-address : 1.1.1.1
peer-link : Port-Channel1000
MLAG Status:
state : Active
negotiation status : Connected
peer-link status : Up
local-int status : Up
system-id : 02:1c:73:1e:97:dc
MLAG Ports:
Disabled : 0
Configured : 0
Inactive : 0
Active-partial : 0
Active-full : 0

 

You can read more about MLAG here – https://www.arista.com/en/products/multi-chassis-link-aggregation-mlag

A great book to read about Arista is called Arista Warrior. I loved it. You can buy it here:

Posted on

The Packet Wizard : Today I begin the CCNP R&S

Today, I officially start the CCNP Route Switch Course.

I have purchased the following book set, I have provided a link if you wish to purchase them:

I am also using Chris Bryant’s Video Udemy Course (Who helped me pass the CCNA R&S and Security, very thorough video series) and I will try and get his books. I have provided a link if you wish to purchase them :

https://www.udemy.com/ccnpallinone/

I plan to have passed the CCNP Switch by July, because I have some pretty big work trips coming up and I know that is going to get in the way a little. However the 18hr flight to Singapore, I should be able to get through a power of reading and labs 🙂

I will start to blog on my progress and things I am learning.

Wish me Luck!