IPv6 Microsegmentation
|
|
|
- Dinah Boyd
- 7 years ago
- Views:
Transcription
1 IPv6 Microsegmentation Ivan Pepelnjak Network Architect ipspace.net AG
2 Past Kernel programmer, network OS and web developer Sysadmin, database admin, network engineer, CCIE Trainer, course developer, curriculum architect Team lead, CTO, business owner Present Network architect, consultant, blogger Webinar and book author Focus Large-scale data centers, clouds and network virtualization Scalable application design Core IP routing/mpls, IPv6, VPN ipspace.net/about 2 ipspace.net 2015 IPv6 Microsegmentation
3
4 IPv6 RS IPv6 RA IPv6 ND IPv6 NA IPv6 RA IPv6 NA Assumption: one subnet = one security zone Corollary: intra-subnet communication is not secured Consequences: multiple first-hop vulnerabilities Sample vulnerabilities: RA spoofing NA spoofing DHCPv6 spoofing DAD DoS attack ND DoS attack 4 ipspace.net 2015 IPv6 Microsegmentation
5 A A B A B B C A B C A B All LAN infrastructure we use today emulates 40 year old thick coax cable 5 ipspace.net 2015 IPv6 Microsegmentation
6 A B C Typical networking industry solution Retain existing forwarding paradigm Implement layer-2 security mechanisms Sample L2 security mechanisms RA guard DHCPv6 guard IPv6 ND inspection SAVI Benefits Non-disruptive deployment (clusters and Microsoft NLB still works) No need to educate customers Drawbacks Not available on all platforms Expensive to implement in hardware Exploitable by infinite IPv6 header + fragmentation creativity Can we do any better than that? 6 ipspace.net 2015 IPv6 Microsegmentation
7
8 A B Change the forwarding paradigm First-hop network device is a router (layer-3 switch in marketese) Fake router advertisements or ND/NA messages are not propagated to other hosts Simplistic implementation Every host is in a dedicated /64 subnet Default behavior on 3GPP and xdsl networks Somewhat harder to implement on Carrier Ethernet, hard on cable networks C 8 ipspace.net 2015 IPv6 Microsegmentation
9 3GPP RAN xdsl Access CPE Each device-to-network connection is a separate dial-up interface on BRAS/GGNS Customer device (phone, computer, CPE) interacts directly with the first-hop router A /64 subnet is allocated to each dial-up interface (usually from a local pool) Aggregate IPv6 prefix is advertised to the network core to minimize number of prefixes advertised in the core 9 ipspace.net 2015 IPv6 Microsegmentation
10 CPE FTTx Access CPE FTTx Access CPE CPE Option#1: First-hop network device is a layer-3 switch (example: Cisco ME 3600) Option#2: Each customer resides in a dedicated VLAN (extensive service automation is highly recommended) 10 ipspace.net 2015 IPv6 Microsegmentation
11
12 IPv6 RA w/o prefixes Local subnet is not advertised in RA messages IPv6 hosts cannot perform on-net check All intra-subnet traffic goes through the first-hop router Access lists on first-hop router enforce segmentation Drawbacks Relies on proper IPv6 host behavior RA and ND attacks are still possible without IPv6 first-hop security 1 12 ipspace.net 2015 IPv6 Microsegmentation
13 L3 switch Private VLANs can be used to enforce L3 lookup Force traffic to go through L3 device (router / L3 switch) Potential solution for campus environments with low-cost L2-only switches or virtualized environments L3 device must not perform mixed L2/L3 forwarding (hard to implement on a L2/L3 switch) This solution could break DAD process use DAD proxy on the router 13 ipspace.net 2015 IPv6 Microsegmentation
14
15 Hypervisor Hypervisor Challenges VM moved to another server must retain its IPv6 address and all data sessions Existing L3 solutions are too slow for non-disruptive VM moves Live VM mobility usually relies on L2 connectivity between physical servers Large VLANs must span the whole VM mobility domain VLAN across VM mobility domain Core More details in VMware Networking and Cloud Networking webinars 15 ipspace.net 2015 IPv6 Microsegmentation
16 L3 PVLAN (complex) or VLAN-per-VM (VLAN explosion) L3 lookup on core switches East-west traffic always traverses network core Aggregation is impossible due to VM mobility IPv6 routing table explosion We need something better in data centers 16 ipspace.net 2015 IPv6 Microsegmentation
17 May 2014 Port density Switch model GE ports 10GE ports 40GE ports FC ports VDX VDX VDX VDX VDX New VDX Table sizes Switch MAC IPv4 ARP IPv6 VDX K 12K 32K 3K VDX 67xx 32K 2K 12K - 17 ipspace.net 2015 IPv6 Microsegmentation
18 May 2014 Model EX4200 EX4300 EX4500 EX4550 Typical role ToR ToR Tor/Core ToR/Core Max ports 48 x 1GE 2 x 10GE 24 / 48 GE 4 / 8 10GE x 10GE x 10GE 2 x 40GE MAC table 32K 64K 32K 32K IPv4 table 16K 4K 10K 10K ARP 16K 64K 8K 8K IPMC 8K 8K 4K 4K IPv6 table 4K 1K 1K 1K IPv6 ND 16K (shared) 32K 1K 1K New 18 ipspace.net 2015 IPv6 Microsegmentation
19
20 DAD NS A B C D Routing protocol update Transport network Host routes instead of ND entries Hosts are connected to layer-3 switches (routers) Numerous hosts share a /64 subnet a /64 subnet spans multiple routers First-hop router creates a host route on DAD, ND or DHCPv6 transaction IPv6 host routes are propagated throughout the local routing domain Host-side IPv6 addressing and subnet semantics are retained IPv6 ND entries are used instead of IPv6 routing table entries 3 20 ipspace.net 2015 IPv6 Microsegmentation
21 May 2014 Model EX4200 EX4300 EX4500 EX4550 Typical role ToR ToR Tor/Core ToR/Core Max ports 48 x 1GE 2 x 10GE 24 / 48 GE 4 / 8 10GE x 10GE x 10GE 2 x 40GE MAC table 32K 64K 32K 32K IPv4 table 16K 4K 10K 10K ARP 16K 64K 8K 8K IPMC 8K 8K 4K 4K IPv6 table 4K 1K 1K 1K IPv6 ND 16K (shared) 32K 1K 1K New 21 ipspace.net 2015 IPv6 Microsegmentation
22 A B C IP-routed MAC frames D E F Customer Address (CA) VSID: 1 VSID: 2 HNV NVGRE IP IP (layer-3) transport network VSID: 2 VSID: 3 HNV Provider Address (PA) Full layer-3 switch in the hypervisor (distributed routing functionality) L3-only switching for intra-hypervisor and inter-hypervisor traffic IPv4 and IPv6 support in customer (virtual) and provider (transport) network ARP and ND proxies no ARP or unknown unicast flooding Source node flooding or Customer Provider IP multicast mapping 22 ipspace.net 2015 IPv6 Microsegmentation
23 A ND request (B) MAC multicast B VSID HNV VTEP Kernel IP stack NA reply B = MAC-B GW to MAC-A VSID HNV VTEP Kernel IP stack IP transport network VM generates ND multicast L2 broadcast/multicast intercepted by Hyper-V kernel module Local Hyper-V replies to ND request with MAC address of remote VM Remote hypervisor is not involved Unicast ND requests are forwarded to target VM (NUD probes) 4 23 ipspace.net 2015 IPv6 Microsegmentation
24 IP: A B MAC: A B A B C D E F VSID: 1 VSID: 2 VSID: 2 VSID: 1 Overlay Module Overlay Module IP (layer-3) transport network A B On-link, sent directly to MAC-B L3 switched within the hypervisor (based on destination IPv6 address) IPv4, IPv6 and ARP packets are forwarded, all other traffic is dropped Ethernet frame delivered to target VM 4 24 ipspace.net 2015 IPv6 Microsegmentation
25 IP: A F IP: A F MAC: A F A B C MAC: A F D E F VSID: 1 VSID: 2 Overlay Module NVGRE VSID 1 IP to VTEP MAC to VTEP IP to D-VTEP IP (layer-3) transport network A F On-link, sent directly to MAC-F L3 switched within the hypervisor (based on destination IPv6 address) Destination VTEP is remote build NVGRE envelope and send packet Packet received by remote hypervisor L3 switching within the routing domain (based on NVGRE VSID) Ethernet frame delivered to target VM VSID: 2 VSID: 1 Overlay Module 6 25 ipspace.net 2015 IPv6 Microsegmentation
26 IP: A D IP: A D MAC: A GW A B C MAC: A D D E F VSID: 1 VSID: 2 Overlay Module NVGRE VSID 2 IP to VTEP MAC to VTEP IP to D-VTEP IP (layer-3) transport network A D Off-link, sent to GW MAC address L3 switched within the hypervisor (based on destination IPv6 address) Switching across subnets MAC rewrite Destination VTEP is remote build NVGRE envelope and send packet Packet received by remote hypervisor L3 switching within the routing domain (based on NVGRE VSID) Ethernet frame delivered to target VM VSID: 2 VSID: 1 Overlay Module 7 HNV does not rewrite source MAC address or decrement TTL 26 ipspace.net 2015 IPv6 Microsegmentation
27 EBGP IBGP IP routing information distribution Host routes generated from ARP/ND/DHCP information or based on VDP messages (Nexus 1000v only) Subnet routes generated from configuration information External routes learned through routing protocols All IP routes inserted into MP-BGP and distributed across fabric RR RR Each fabric node knows All intra-fabric host routes All intra-fabric subnets All external routes A Z 27 ipspace.net 2015 IPv6 Microsegmentation
28 All layer-3 leaf nodes share Default gateway IP address Default gateway MAC address All ARP/ND requests are answered with GW MAC address (proxy gateway mode) Integrates seamlessly with VM mobility Typical packet forwarding Layer-3 lookup on ingress egress next hop Layer-2 forwarding across fabric Layer-3 lookup on egress delivered to destination IP IP IP IP A Z More in Data Center Fabrics webinar 28 ipspace.net 2015 IPv6 Microsegmentation
29
30 Why? Removes first-hop (L2) IPv6 security challenges How? Dedicated dynamic interface per host (mobile, PPPoX) Dedicated VLAN per host (Carrier Ethernet, campus, data center) Host routing 30 ipspace.net 2015 IPv6 Microsegmentation
31 IPv6 and IPv4 Hyper-V Network Virtualization Juniper Contrail Cisco Dynamic Fabric Automation (DFA) IPv4 only Nuage Virtual Services Platform (VSP) Cisco Application Centric Infrastructure (ACI) Unrelated honorable mention IPv6 RA guard and ND inspection implemented on VMware NSX Hint: vote with your wallet! 31 ipspace.net 2015 IPv6 Microsegmentation
32 IPv6 Microsegmentation IPv6-Only Data Centers IPv6 High Availability Strategies IPv6 Transition Mechanisms IPv6 Security Building Large IPv6 Networks Enterprise IPv6 First Steps Service Provider IPv6 Introduction Availability Live sessions Recordings of individual webinars Yearly subscription Other options Customized webinars ExpertExpress On-site workshops More 32 ipspace.net 2015 IPv6 Microsegmentation
33 33 If you ipspace.net have 2015 VoIP problems, try IPv6 the Microsegmentation dial-in phone numbers
34 Web: Blog: Twitter: ipspace.net IPv6: Webinars: Consulting: ipspace.net/ipv6 ipspace.net/webinars ipspace.net/consulting 34 ipspace.net 2015 IPv6 Microsegmentation
Automating Network Security
Automating Network Security Ivan Pepelnjak (ip@ipspace.net) Network Architect ipspace.net AG Who is Ivan Pepelnjak (@ioshints) Past Kernel programmer, network OS and web developer Sysadmin, database admin,
IPv6 First Hop Security Protecting Your IPv6 Access Network
IPv6 First Hop Security Protecting Your IPv6 Access Network What You Will Learn This paper provides a brief introduction to common security threats on IPv6 campus access networks and will explain the value
Extending Networking to Fit the Cloud
VXLAN Extending Networking to Fit the Cloud Kamau WangŨ H Ũ Kamau Wangũhgũ is a Consulting Architect at VMware and a member of the Global Technical Service, Center of Excellence group. Kamau s focus at
Data Center Fabrics What Really Matters. Ivan Pepelnjak (ip@ioshints.info) NIL Data Communications
Data Center Fabrics What Really Matters Ivan Pepelnjak (ip@ioshints.info) NIL Data Communications Who is Ivan Pepelnjak (@ioshints) Networking engineer since 1985 Technical director, later Chief Technology
Cloud Networking From Theory to Practice" Ivan Pepelnjak (ip@ioshints.info) NIL Data Communications"
Cloud Networking From Theory to Practice Ivan Pepelnjak (ip@ioshints.info) NIL Data Communications Who is Ivan Pepelnjak (@ioshints) Networking engineer since 1985 Consultant, blogger (blog.ioshints.info),
VXLAN: Scaling Data Center Capacity. White Paper
VXLAN: Scaling Data Center Capacity White Paper Virtual Extensible LAN (VXLAN) Overview This document provides an overview of how VXLAN works. It also provides criteria to help determine when and where
Introducing Basic MPLS Concepts
Module 1-1 Introducing Basic MPLS Concepts 2004 Cisco Systems, Inc. All rights reserved. 1-1 Drawbacks of Traditional IP Routing Routing protocols are used to distribute Layer 3 routing information. Forwarding
Skip the Transitions, Jump Straight into IPv6
Skip the Transitions, Jump Straight into IPv6 Ivan Pepelnjak (@ioshints, ip@ioshints.info) NIL Data Communications Presentation @ 7. Slovenian IPv6 Summit organized by go6.si Who is Ivan Pepelnjak (@ioshints)
OVERLAYING VIRTUALIZED LAYER 2 NETWORKS OVER LAYER 3 NETWORKS
OVERLAYING VIRTUALIZED LAYER 2 NETWORKS OVER LAYER 3 NETWORKS Matt Eclavea (meclavea@brocade.com) Senior Solutions Architect, Brocade Communications Inc. Jim Allen (jallen@llnw.com) Senior Architect, Limelight
IPv6 Associated Protocols
IPv6 Associated Protocols 1 New Protocols (1) New features are specified in IPv6 Protocol -RFC 2460 DS Neighbor Discovery (NDP) -RFC 4861 DS Auto-configuration : Stateless Address Auto-configuration -RFC
CCNA R&S: Introduction to Networks. Chapter 5: Ethernet
CCNA R&S: Introduction to Networks Chapter 5: Ethernet 5.0.1.1 Introduction The OSI physical layer provides the means to transport the bits that make up a data link layer frame across the network media.
How Network Virtualization can improve your Data Center Security
How Network Virtualization can improve your Data Center Security Gilles Chekroun SDDC, NSX Team EMEA gchekroun@vmware.com 2014 VMware Inc. All rights reserved. Security IT spending Security spending is
VXLAN Bridging & Routing
VXLAN Bridging & Routing Darrin Machay darrin@arista.com CHI-NOG 05 May 2015 1 VXLAN VM-1 10.10.10.1/24 Subnet A ESX host Subnet B ESX host VM-2 VM-3 VM-4 20.20.20.1/24 10.10.10.2/24 20.20.20.2/24 Load
Analysis of Network Segmentation Techniques in Cloud Data Centers
64 Int'l Conf. Grid & Cloud Computing and Applications GCA'15 Analysis of Network Segmentation Techniques in Cloud Data Centers Ramaswamy Chandramouli Computer Security Division, Information Technology
SOFTWARE-DEFINED NETWORKING AND OPENFLOW
SOFTWARE-DEFINED NETWORKING AND OPENFLOW Freddie Örnebjär TREX Workshop 2012 2012 Brocade Communications Systems, Inc. 2012/09/14 Software-Defined Networking (SDN): Fundamental Control
BUILDING A NEXT-GENERATION DATA CENTER
BUILDING A NEXT-GENERATION DATA CENTER Data center networking has changed significantly during the last few years with the introduction of 10 Gigabit Ethernet (10GE), unified fabrics, highspeed non-blocking
VMware NSX Network Virtualization Design Guide. Deploying VMware NSX with Cisco UCS and Nexus 7000
VMware NSX Network Virtualization Design Guide Deploying VMware NSX with Cisco UCS and Nexus 7000 Table of Contents Intended Audience... 3 Executive Summary... 3 Why deploy VMware NSX on Cisco UCS and
Virtual Firewalls. Ivan Pepelnjak (ip@ioshints.info) NIL Data Communications
Virtual Firewalls Ivan Pepelnjak (ip@ioshints.info) NIL Data Communications Who is Ivan Pepelnjak (@ioshints) Networking engineer since 1985 Focus: real-life deployment of advanced technologies Chief Technology
Software Defined Networks Four Years Later. Quo Vadis, SDN? Ivan Pepelnjak (ip@ipspace.net) Network Architect. ipspace.net AG
Software Defined Networks Four Years Later Quo Vadis, SDN? Ivan Pepelnjak (ip@ipspace.net) Network Architect ipspace.net AG Who is Ivan Pepelnjak (@ioshints) Past Kernel programmer, network OS and web
Internetworking II: VPNs, MPLS, and Traffic Engineering
Internetworking II: VPNs, MPLS, and Traffic Engineering 3035/GZ01 Networked Systems Kyle Jamieson Lecture 10 Department of Computer Science University College London Taxonomy of communica@on networks Virtual
VMware Virtual SAN Layer 2 and Layer 3 Network Topologies
VMware Virtual SAN Layer 2 and Layer 3 Network Topologies Deployments TECHNICAL WHITE PAPER Table of Contents Introduction... 2 Network and vsphere Technologies... 2 Networking Related Technologies...
Cisco Nexus 1000V Switch for Microsoft Hyper-V
Data Sheet Cisco Nexus 1000V Switch for Microsoft Hyper-V Product Overview Cisco Nexus 1000V Switches provide a comprehensive and extensible architectural platform for virtual machine and cloud networking.
Fundamentals of Windows Server 2008 Network and Applications Infrastructure
Fundamentals of Windows Server 2008 Network and Applications Infrastructure MOC6420 About this Course This five-day instructor-led course introduces students to network and applications infrastructure
Overview of Routing between Virtual LANs
Overview of Routing between Virtual LANs This chapter provides an overview of virtual LANs (VLANs). It describes the encapsulation protocols used for routing between VLANs and provides some basic information
What is VLAN Routing?
Application Note #38 February 2004 What is VLAN Routing? This Application Notes relates to the following Dell product(s): 6024 and 6024F 33xx Abstract Virtual LANs (VLANs) offer a method of dividing one
Demonstrating the high performance and feature richness of the compact MX Series
WHITE PAPER Midrange MX Series 3D Universal Edge Routers Evaluation Report Demonstrating the high performance and feature richness of the compact MX Series Copyright 2011, Juniper Networks, Inc. 1 Table
IP(v6) security. Matěj Grégr. Brno University of Technology, Faculty of Information Technology. Slides adapted from Ing.
IP(v6) security Matěj Grégr Brno University of Technology, Faculty of Information Technology Slides adapted from Ing. Tomáš Podermański What is IP security? Encryption? Authentication? Authorization? Surveillance?
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
Availability Digest. www.availabilitydigest.com. Redundant Load Balancing for High Availability July 2013
the Availability Digest Redundant Load Balancing for High Availability July 2013 A large data center can comprise hundreds or thousands of servers. These servers must not only be interconnected, but they
SOFTWARE-DEFINED NETWORKING AND OPENFLOW
SOFTWARE-DEFINED NETWORKING AND OPENFLOW Eric Choi < echoi@brocade.com> Senior Manager, Service Provider Business Unit, APJ 2012 Brocade Communications Systems, Inc. EPF 7 2012/09/17 Software-Defined Networking
TRILL for Service Provider Data Center and IXP. Francois Tallet, Cisco Systems
for Service Provider Data Center and IXP Francois Tallet, Cisco Systems 1 : Transparent Interconnection of Lots of Links overview How works designs Conclusion 2 IETF standard for Layer 2 multipathing Driven
Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
Network Virtualization and Data Center Networks 263-3825-00 Data Center Virtualization - Basics. Qin Yin Fall Semester 2013
Network Virtualization and Data Center Networks 263-3825-00 Data Center Virtualization - Basics Qin Yin Fall Semester 2013 1 Walmart s Data Center 2 Amadeus Data Center 3 Google s Data Center 4 Data Center
EVOLVING ENTERPRISE NETWORKS WITH SPB-M APPLICATION NOTE
EVOLVING ENTERPRISE NETWORKS WITH SPB-M APPLICATION NOTE EXECUTIVE SUMMARY Enterprise network managers are being forced to do more with less. Their networks are growing in size and complexity. They need
ETHERNET VPN (EVPN) OVERLAY NETWORKS FOR ETHERNET SERVICES
ETHERNET VPN (EVPN) OVERLAY NETWORKS FOR ETHERNET SERVICES Greg Hankins RIPE 68 RIPE 68 2014/05/12 AGENDA 1. EVPN Background and Motivation 2. EVPN Operations 3. EVPN
Security Technology White Paper
Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without
How To Make A Vpc More Secure With A Cloud Network Overlay (Network) On A Vlan) On An Openstack Vlan On A Server On A Network On A 2D (Vlan) (Vpn) On Your Vlan
Centec s SDN Switch Built from the Ground Up to Deliver an Optimal Virtual Private Cloud Table of Contents Virtualization Fueling New Possibilities Virtual Private Cloud Offerings... 2 Current Approaches
How Routers Forward Packets
Autumn 2010 philip.heimer@hh.se MULTIPROTOCOL LABEL SWITCHING (MPLS) AND MPLS VPNS How Routers Forward Packets Process switching Hardly ever used today Router lookinginside the packet, at the ipaddress,
ETHERNET VPN (EVPN) NEXT-GENERATION VPN FOR ETHERNET SERVICES
ETHERNET VPN (EVPN) NEXT-GENERATION VPN FOR ETHERNET SERVICES Alastair JOHNSON (AJ) February 2014 alastair.johnson@alcatel-lucent.com AGENDA 1. EVPN Background and Motivation 2. EVPN Operations 3. EVPN
Secure Cloud Computing with a Virtualized Network Infrastructure
Secure Cloud Computing with a Virtualized Network Infrastructure Fang Hao, T.V. Lakshman, Sarit Mukherjee, Haoyu Song Bell Labs Cloud Security: All or Nothing? Amazon EC2 Government Cloud Shared computing,
Smart-Table Technology Enabling Very Large Server, Storage Nodes, and Virtual Machines to Scale Using Flexible Network Infrastructure
Smart-Table Technology Enabling Very Large Server, Storage Nodes, and Virtual Machines to Scale Using Flexible Network Infrastructure Topologies Sujal Das Product Marketing Director Network Switching July
IPv4/IPv6 Transition Mechanisms. Luka Koršič, Matjaž Straus Istenič
IPv4/IPv6 Transition Mechanisms Luka Koršič, Matjaž Straus Istenič IPv4/IPv6 Migration Both versions exist today simultaneously Dual-stack IPv4 and IPv6 protocol stack Address translation NAT44, LSN, NAT64
vsphere Networking ESXi 5.0 vcenter Server 5.0 EN-000599-01
ESXi 5.0 vcenter Server 5.0 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions
Expert Reference Series of White Papers. The Evolution of Cisco Switching
Expert Reference Series of White Papers The Evolution of Cisco Switching 1-800-COURSES www.globalknowledge.com The Evolution of Cisco Switching Joe Rinehart, MBA, CCIE #14256, CCNP/DP/VP Introduction Cisco
TRILL for Data Center Networks
24.05.13 TRILL for Data Center Networks www.huawei.com enterprise.huawei.com Davis Wu Deputy Director of Switzerland Enterprise Group E-mail: wuhuajun@huawei.com Tel: 0041-798658759 Agenda 1 TRILL Overview
Data Center Infrastructure of the future. Alexei Agueev, Systems Engineer
Data Center Infrastructure of the future Alexei Agueev, Systems Engineer Traditional DC Architecture Limitations Legacy 3 Tier DC Model Layer 2 Layer 2 Domain Layer 2 Layer 2 Domain Oversubscription Ports
s@lm@n Juniper Exam JN0-343 Juniper Networks Certified Internet Specialist (JNCIS-ENT) Version: 10.1 [ Total Questions: 498 ]
![s@lm@n Juniper Exam JN0-343 Juniper Networks Certified Internet Specialist (JNCIS-ENT) Version: 10.1 [ Total Questions: 498 ]](/thumbs/39/18985711.jpg "s@lm@n Juniper Exam JN0-343 Juniper Networks Certified Internet Specialist (JNCIS-ENT) Version: 10.1 [ Total Questions: 498 ]")
s@lm@n Juniper Exam JN0-343 Juniper Networks Certified Internet Specialist (JNCIS-ENT) Version: 10.1 [ Total Questions: 498 ] Topic 1, Volume A Question No : 1 - (Topic 1) How much overhead does the GRE
IPv6 over IPv4/MPLS Networks: The 6PE approach
IPv6 over IPv4/MPLS Networks: The 6PE approach Athanassios Liakopoulos Network Operation & Support Manager (aliako@grnet.gr) Greek Research & Technology Network (GRNET) III Global IPv6 Summit Moscow, 25
Vocia MS-1 Network Considerations for VoIP. Vocia MS-1 and Network Port Configuration. VoIP Network Switch. Control Network Switch
Vocia MS-1 Network Considerations for VoIP Vocia software rev. 1.4 or higher required Vocia MS-1 and Network Port Configuration The Vocia Message Server 1 (MS-1) has a number of roles in a Vocia Paging
CCT vs. CCENT Skill Set Comparison
Operation of IP Data Networks Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs Select the components required to meet a given network specification
Internet Control Protocols Reading: Chapter 3
Internet Control Protocols Reading: Chapter 3 ARP - RFC 826, STD 37 DHCP - RFC 2131 ICMP - RFC 0792, STD 05 1 Goals of Today s Lecture Bootstrapping an end host Learning its own configuration parameters
Layer 3 Routing User s Manual
User s Manual Second Edition, July 2011 www.moxa.com/product 2011 Moxa Inc. All rights reserved. User s Manual The software described in this manual is furnished under a license agreement and may be used
OpenFlow and Software Defined Networking presented by Greg Ferro. OpenFlow Functions and Flow Tables
OpenFlow and Software Defined Networking presented by Greg Ferro OpenFlow Functions and Flow Tables would like to thank Greg Ferro and Ivan Pepelnjak for giving us the opportunity to sponsor to this educational
Configuring the Transparent or Routed Firewall
5 CHAPTER This chapter describes how to set the firewall mode to routed or transparent, as well as how the firewall works in each firewall mode. This chapter also includes information about customizing
Security Assessment of Neighbor Discovery for IPv6
Security Assessment of Neighbor Discovery for IPv6 Fernando Gont project carried out on behalf of UK Centre for the Protection of National Infrastructure LACNIC XV 15 al 20 de Mayo de 2011. Cancún, México
VMware. NSX Network Virtualization Design Guide
VMware NSX Network Virtualization Design Guide Table of Contents Intended Audience... 3 Overview... 3 Components of the VMware Network Virtualization Solution... 4 Data Plane... 4 Control Plane... 5 Management
Enhancing Cisco Networks with Gigamon // White Paper
Across the globe, many companies choose a Cisco switching architecture to service their physical and virtual networks for enterprise and data center operations. When implementing a large-scale Cisco network,
How To Make A Network Secure
1 2 3 4 -Lower yellow line is graduate student enrollment -Red line is undergradate enrollment -Green line is total enrollment -2008 numbers are projected to be near 20,000 (on-campus) not including distance
Network layer: Overview. Network layer functions IP Routing and forwarding
Network layer: Overview Network layer functions IP Routing and forwarding 1 Network layer functions Transport packet from sending to receiving hosts Network layer protocols in every host, router application
Address Resolution Scalability for VPN oriented Data Center Services
Address Resolution Scalability for VPN oriented Data Center Services Linda Dunbar Huawei Technologies, Plano, TX. USA ldunbar@huawei.com Abstract Modern data centers tend to have very large number hosts
BASIC ANALYSIS OF TCP/IP NETWORKS
BASIC ANALYSIS OF TCP/IP NETWORKS INTRODUCTION Communication analysis provides powerful tool for maintenance, performance monitoring, attack detection, and problems fixing in computer networks. Today networks
DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch
DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch What You Will Learn A demilitarized zone (DMZ) is a separate network located in the neutral zone between a private (inside)
Ethernet-based Software Defined Network (SDN) Cloud Computing Research Center for Mobile Applications (CCMA), ITRI 雲 端 運 算 行 動 應 用 研 究 中 心
Ethernet-based Software Defined Network (SDN) Cloud Computing Research Center for Mobile Applications (CCMA), ITRI 雲 端 運 算 行 動 應 用 研 究 中 心 1 SDN Introduction Decoupling of control plane from data plane
Implementing DHCPv6 on an IPv6 network
Implementing DHCPv6 on an IPv6 network Benjamin Long benlong@iol.unh.edu 8-11-2009 Implementing DHCPv6 on an IPv6 network 2 Table of Contents DHCPv6 Overview...3 Terms used by DHCPv6...3 DHCPv6 Message
Configuring Network Load Balancing for vethernet
Configuring Network Load Balancing for vethernet This chapter contains the following sections: Information About Microsoft Network Load Balancing, page 1 Guidelines and Limitations, page 1 Configuring
Virtual PortChannels: Building Networks without Spanning Tree Protocol
. White Paper Virtual PortChannels: Building Networks without Spanning Tree Protocol What You Will Learn This document provides an in-depth look at Cisco's virtual PortChannel (vpc) technology, as developed
Firewalls. CEN 448 Security and Internet Protocols Chapter 20 Firewalls
CEN 448 Security and Internet Protocols Chapter 20 Firewalls Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
VLAN 802.1Q. 1. VLAN Overview. 1. VLAN Overview. 2. VLAN Trunk. 3. Why use VLANs? 4. LAN to LAN communication. 5. Management port
1. VLAN Overview 2. VLAN Trunk 3. Why use VLANs? 4. LAN to LAN communication 5. Management port 6. Applications 6.1. Application 1 6.2. Application 2 6.3. Application 3 6.4. Application 4 6.5. Application
SOFTWARE DEFINED NETWORKING: INDUSTRY INVOLVEMENT
BROCADE SOFTWARE DEFINED NETWORKING: INDUSTRY INVOLVEMENT Rajesh Dhople Brocade Communications Systems, Inc. rdhople@brocade.com 2012 Brocade Communications Systems, Inc. 1 Why can t you do these things
4m. MONITORING OF ETHERNET/IP NETWORK TRAFFIC.
4m. MONITORING OF ETHERNET/IP NETWORK TRAFFIC. Wireshark (see Section 6) is a network packet analyser. It is used to: troubleshoot network problems, examine security problems, debug protocol implementations,
Open Source Networking for Cloud Data Centers
Open Source Networking for Cloud Data Centers Gaetano Borgione Distinguished Engineer @ PLUMgrid April 2015 1 Agenda Open Source Clouds with OpenStack Building Blocks of Cloud Networking Tenant Networks
Redundancy and load balancing at L3 in Local Area Networks. Fulvio Risso Politecnico di Torino
Redundancy and load balancing at L3 in Local Area Networks Fulvio Risso Politecnico di Torino 1 Problem: the router is a single point of failure H1 H2 H3 VLAN4 H4 VLAN4 Corporate LAN Corporate LAN R1 R2
Overlay networking with OpenStack Neutron in Public Cloud environment. Trex Workshop 2015
Overlay networking with OpenStack Neutron in Public Cloud environment Trex Workshop 2015 About Presenter Anton Aksola (aakso@twitter,ircnet,github) Network Architect @Nebula Oy, started in 2005 Currently
Intro to NSX. Network Virtualization. 2014 VMware Inc. All rights reserved.
Intro to NSX Network Virtualization 2014 VMware Inc. All rights reserved. Agenda Introduction NSX Overview Details: Microsegmentation NSX Operations More Information SDDC/Network Virtualization Security
Roman Hochuli - nexellent ag / Mathias Seiler - MiroNet AG
Roman Hochuli - nexellent ag / Mathias Seiler - MiroNet AG North Core Distribution Access South North Peering #1 Upstream #1 Series of Tubes Upstream #2 Core Distribution Access Cust South Internet West
Implementing and Troubleshooting the Cisco Cloud Infrastructure **Part of CCNP Cloud Certification Track**
Course: Duration: Price: $ 4,295.00 Learning Credits: 43 Certification: Implementing and Troubleshooting the Cisco Cloud Infrastructure Implementing and Troubleshooting the Cisco Cloud Infrastructure**Part
VMware Software Defined Network. Dejan Grubić VMware Systems Engineer for Adriatic
VMware Software Defined Network Dejan Grubić VMware Systems Engineer for Adriatic The Transformation of Infrastructure Infrastructure Servers Clouds Be more responsive to business, change economics of
Virtual Machine Manager Domains
This chapter contains the following sections: Cisco ACI VM Networking Supports Multiple Vendors' Virtual Machine Managers, page 1 VMM Domain Policy Model, page 2 Virtual Machine Manager Domain Main Components,
A Dell Technical White Paper Dell Storage Engineering
Networking Best Practices for Dell DX Object Storage A Dell Technical White Paper Dell Storage Engineering THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND
Packet Sniffing on Layer 2 Switched Local Area Networks
Packet Sniffing on Layer 2 Switched Local Area Networks Ryan Spangler ryan@packetwatch.net Packetwatch Research http://www.packetwatch.net December 2003 Abstract Packet sniffing is a technique of monitoring
Quantum Hyper- V plugin
Quantum Hyper- V plugin Project blueprint Author: Alessandro Pilotti Version: 1.0 Date: 01/10/2012 Hyper-V reintroduction in OpenStack with the Folsom release was primarily focused
Configuring the Fabric Interconnects
Configuring the Fabric Interconnects This chapter includes the following sections: Initial System Setup, page 1 Performing an Initial System Setup for a Standalone Configuration, page 3 Initial System
Redundancy and load balancing at L3 in Local Area Networks. Fulvio Risso Politecnico di Torino
Redundancy and load balancing at L3 in Local Area Networks Fulvio Risso Politecnico di Torino 1 Default gateway redundancy (1) H1 DG: R1 H2 DG: R1 H3 DG: R1 R1 R2 ISP1 ISP2 Internet 3 Default gateway redundancy
> Technical Configuration Guide for Microsoft Network Load Balancing. Ethernet Switch and Ethernet Routing Switch Engineering
Ethernet Switch and Ethernet Routing Switch Engineering > Technical Configuration Guide for Microsoft Network Load Balancing Enterprise Solutions Engineering Document Date: March 9, 2006 Document Version:
IPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region
IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express
Preserve IP Addresses During Data Center Migration
White Paper Preserve IP Addresses During Data Center Migration Configure Cisco Locator/ID Separation Protocol and Cisco ASR 1000 Series Aggregation Services Routers 2015 Cisco and/or its affiliates. All
IPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc. Nalini.elkins@insidethestack.com
1 IPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc. Nalini.elkins@insidethestack.com Agenda What has not changed between IPv4 and IPv6 traces What has changed between IPv4 and
White Paper. Juniper Networks. Enabling Businesses to Deploy Virtualized Data Center Environments. Copyright 2013, Juniper Networks, Inc.
White Paper Juniper Networks Solutions for VMware NSX Enabling Businesses to Deploy Virtualized Data Center Environments Copyright 2013, Juniper Networks, Inc. 1 Table of Contents Executive Summary...3
Network Commodity Innovations
Network Commodity Innovations Piotr Jabłoński Network Consulting Engineer CCIE #19476, CCDE 2012::7 2009 Cisco Systems, Inc. All rights reserved. Is an innovation here? Four Commodity Areas to check Routing
Nutanix Tech Note. VMware vsphere Networking on Nutanix
Nutanix Tech Note VMware vsphere Networking on Nutanix Nutanix Virtual Computing Platform is engineered from the ground up for virtualization and cloud environments. This Tech Note describes vsphere networking
IPv6 Functionality. Jeff Doyle IPv6 Solutions Manager jeff@juniper.net
IPv6 Functionality Jeff Doyle IPv6 Solutions Manager jeff@juniper.net Copyright 2003 Juniper Networks, Inc. Agenda ICMPv6 Neighbor discovery Autoconfiguration Agenda ICMPv6 Neighbor discovery Autoconfiguration
CLOUD NETWORKING FOR ENTERPRISE CAMPUS APPLICATION NOTE
CLOUD NETWORKING FOR ENTERPRISE CAMPUS APPLICATION NOTE EXECUTIVE SUMMARY This application note proposes Virtual Extensible LAN (VXLAN) as a solution technology to deliver departmental segmentation, business
CHAPTER 10 LAN REDUNDANCY. Scaling Networks
CHAPTER 10 LAN REDUNDANCY Scaling Networks CHAPTER 10 10.0 Introduction 10.1 Spanning Tree Concepts 10.2 Varieties of Spanning Tree Protocols 10.3 Spanning Tree Configuration 10.4 First-Hop Redundancy
Bandwidth Management in MPLS Networks
School of Electronic Engineering - DCU Broadband Switching and Systems Laboratory 1/17 Bandwidth Management in MPLS Networks Sanda Dragos & Radu Dragos Supervised by Dr. Martin Collier email: dragoss@eeng.dcu.ie
OS3 Fiber Day Broadband networks - Network Architecture. May 20, 2016 / Jan Martijn Metselaar Vodafone
OS3 Fiber Day Broadband networks - Network Architecture May 20, 2016 / Jan Martijn Metselaar Vodafone Quizzz Dual play, Triple play, Multi play IP all the way! But what does the end-user care? 2 Current
Cisco Which VPN Solution is Right for You?
Table of Contents Which VPN Solution is Right for You?...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1 Components Used...1 NAT...2 Generic Routing Encapsulation Tunneling...2
Microsegmentation Using NSX Distributed Firewall: Getting Started
Microsegmentation Using NSX Distributed Firewall: VMware NSX for vsphere, release 6.0x REFERENCE PAPER Table of Contents Microsegmentation using NSX Distributed Firewall:...1 Introduction... 3 Use Case
Understanding Cisco Cloud Fundamentals CLDFND v1.0; 5 Days; Instructor-led
Understanding Cisco Cloud Fundamentals CLDFND v1.0; 5 Days; Instructor-led Course Description Understanding Cisco Cloud Fundamentals (CLDFND) v1.0 is a five-day instructor-led training course that is designed
RARP: Reverse Address Resolution Protocol
SFWR 4C03: Computer Networks and Computer Security January 19-22 2004 Lecturer: Kartik Krishnan Lectures 7-9 RARP: Reverse Address Resolution Protocol When a system with a local disk is bootstrapped it
Allen-Bradley Stratix 5700 Network Address Translation (NAT)
00:00:BC:66:0F:C7 DANGER SINK\ SOURCE SOURCE 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 00 08 01 09 02 10 03 11 04 12 05 13 06 14 07 15 COM COM 0 1 NC NC +V +V 00 08 01