Alex Scoble's IT Notes - An Information Technology Blog

Networking for OpenStack

When using Mirantis Fuel Web to build up an OpenStack cloud, it requires 6 separate networks to be created. Simplest way to do this is by using virtual networks (VLANs), however this presents a few challenges because of the complexities of configuring VLANs.

This post is specific to Cisco switches, but may be relevant for other networking equipment as well.

For test purposes, this was all done on one switch and each bare metal server had one interface cabled to the switch. In production environments, it is likely that, at a minimum, a completely separate storage network would also exist, but more complicated networking schemes are quite possible.

For each port on the switch that will be connected to one of the bare metal servers, the following needs to be done:

switchport mode trunk
switchport trunk allowed vlan 10,100-104
switchport trunk native vlan 10
spanning-tree portfast trunk
switchport nonegotiate

Trunking mode must be used because each interface needs to be able to handle all 6 of the virtual networks. In the normal access mode, an interface can only communicate over a single VLAN.

For each interface, it's a good practice to specify which vlans it is allowed to handle.

Trunk native tells the switch that untagged traffic goes over this vlan. VLAN tags are the mechanism that allows a network interface to communicate over multiple discrete subnets. So in this case, only traffic going over vlans 100 through 104 will be tagged.

Spanning-tree portfast trunk tells the switch that this port is a trunk connected to a server or PC and to bypass the usual network loop checks.

Switchport nonegotiate forces the switch to treat this interface as a trunk because the connected device does not understand the protocol the switch uses to negotiate trunking vs access modes.

In the switch config the VLANs also need to be activated using:

vlan10,100,101,102,103,104

For those who normally work with vlans in switchport access mode, the switch automatically does this, but apparently, when working with trunks, adding a vlan to a port does not automatically create and enable that vlan.

I am not a networking expert so some particulars here may have been missed, but I hope this is helpful.

Linksys loses my business: WRT54GX4 sucks

For Christmas 2006 I purchased a Linksys WRT54GX4 for my dad to replace his older D-Link router that had started having problems.

I got the WRT54GX4 from Amazon for around $80, which is about what I expect to pay for a wireless router.

The router ran fine for a while and then my dad started having issues with his internet (which turned out to be related to his ISP and not to the router). During troubleshooting of the issue, I noticed that his firmware was out of date on the router, so I told him to update it.

Sadly the router update failed and left the router in a "bricked" state. Fine, we figured. My dad got Linksys to send him out a new one and shipped, at his cost, the failed one back.

Fast forward to Sunday, 30 December 2007. I was having problems with the wireless connection to his router. I again checked his firmware and noticed that it was out of date. Again I attempted to update the firmware (and yes I made sure it was the right firmware for the right router) and AGAIN this new router failed to update and ended up bricked.

Linksys wanted to charge us for return shipping of the unit to them, but I told them no way...after sitting on hold while the customer support person tried to reach a supervisor, I looked at my dad and said "this is nuts, I have a plane to catch, let's just get a D-Link".

Which is exactly what I did. I got him a new D-Link DIR-625 "N" class wireless router. Same router that a few friends of mine and I have. It works great.

Needless to say that for making a security product that proved to be unable to accept firmware updates, Linksys has been crossed off my list of vendors to use.

That's right. Because of this, I will no longer be buying Linksys products. Period.

A router is a security device and as such should be kept up to date with the latest vulnerability and bug fixes. A router that cannot be updated is not secure. Period.

The WRT54GX4 is a crappy router and should not be purchased. If you have one, get rid of it with a better product from a better vendor.

Goodbye Linksys, you will not be missed.

Netscreens No Longer Support Manual Key Dial-Up VPNs

Starting with Netscreen OS 5.0.0 Netscreen devices no longer support Manual Key Dial-Up VPNs.

Big deal for me as I now have to change all of my VPN users (the ones that are left any how) to Autokey VPNs. Oy what a pain.

But as they say, out with the old, in with the new. I'm sure that this will have benefits later on down the road. I just hope that they will outweigh the costs of making the change.

New Netscreen-25 Firewall

Just got in our new firewall. A Juniper Netscreen-25. Now I just need to figure out how to migrate the configuration of the current firewall (Netscreen-10) to the new one.

Will try to blog as much as possible about how I do it.

Corporate Firewalls

We have an old Netscreen 10 firewall here at the firm and it's beyond it's support life. This is usually not a good thing with firewalls as you can't get software updates for them (which is probably how they get you to keep to a faster upgrade cycle).

Anyhow, I had previously looked at a Netscreen 25, but I'm wondering what other firewalls are good out there in that price range (last time I got a quote the NS 25 was $3500 with support contract and everything).

Most likely I will stick to Netscreen as I already have an installed base of SecureRemote users (yes I know that SonicWall also uses the same VPN client, but I have had more than a few problems with SonicWall firewalls).

The biggest issues are speed, particularly VPN speed, how good security is out of the box and ease of setup. Netscreen is pretty good with respect to these points, although it is a bit more complicated than the SonicWall firewalls in same class (but seems a bit more flexible too, and flexibility usually comes at a price of higher complexity - Adobe's products are a good example of that).

Some other issues that aren't important are VPN reliability and ease of setup (so far the Netscreen has performed less than spectacularly in these areas), although this issue isn't as important as it once was now that I have our two main resources available through SSL over HTTP.

I do need a firewall that can deal with multiple NAT to external IP translations so please don't suggest something cheap and inflexible like SmoothWall.

Based on past experience, would probably not go with any CheckPoint product either, as they seem to be needlessly complex, hard to support and more expensive to boot.

Any other ideas are welcome though.