multi-cloud networkingLeave a comment

AVX and AWS DNS

rtrentin

AWS DNS Design Options (from reference #1) Option 1: Inbound and Outbound endpoints deployed in the hub vpc Option 2: Inbound and Outbound endpoints deployed in the hub vpc for forwarding Option 3: VPC sharing This option will not be investigated as it does not fit a scalable and secure hub and spoke topology. Option 4: Shared Private Zones and Forwarded Rules (AWS recommended) Testing Configuration Information Hosted Private Zone: Outbound Config: Rule: Inbound config: Design Option 1 Create a dhcp option set pointing to the inbound endpoints: and associate to the vpc: Servers will have its /etc/resolv.conf updated to: … Continue reading AVX and AWS DNS

multi-cloud networkingLeave a comment

Tech Note: Migrating an Aviatrix Controller from AWS to Azure

rtrentin

Constraints AWS Controller Change the AWS account from IAM role-based to Access and Secret keys This procedure is only supported on Accounts without Gateways deployed. Backup Shutdown Controller Azure Controller Requirements Aviatrix Cloud Network Controller deploys Controller 7.1.4105 and later. To deploy Controller version 7.1.4101 or earlier, subscribe to Aviatrix Secure Networking Platform BYOL. Deploy New Controller The steps below should be completed before the cut over. Bring the controller to the desired software version (7.1.3176) Onboard Access Accounts Transfer Backup from AWS Bucket to Azure Storage Account Restore Use the Controller Settings -> Maintenance -> Backup and Restore to … Continue reading Tech Note: Migrating an Aviatrix Controller from AWS to Azure

multi-cloud networkingLeave a comment

Experimenting with GCP PBR

rtrentin

Policy-based routes can route traffic based on: destination, protocol,and source. How to Configure it PBR requires an internal pass-through network load balancer as next hop: Do not forget to create the proper firewall rules for the health checks. HCs are sourced from the following ranges: 130.211.0.0/22 and 35.191.0.0/16. Create a route but select Policy Based Route from the drop down menu: Testing Test is quite simple. From Test VM, if we ping 10.17.60.51 the traffic should not go through the Standalone Gateways but if we ping 192.168.200.3 we should see the traffic flowing through the standalone gateways. Constraints You can … Continue reading Experimenting with GCP PBR

multi-cloud networkingLeave a comment

Supernetting

rtrentin

From Wiki: A supernetwork, or supernet, is an Internet Protocol (IP) network that is formed by aggregation of multiple networks (or subnets) into a larger network. The new routing prefix for the aggregate network represents the constituent networks in a single routing table entry. The process of forming a supernet is called supernetting, prefix aggregation, route aggregation, or route summarization. https://en.wikipedia.org/wiki/Supernetwork Topology Prefix Advertised Gateways advertise by default subnets prefixes discovered during the deployment: Supernetting Testing Pinging an existent target: Pinging a non existent target: Continue reading Supernetting

multi-cloud networkingLeave a comment

A little help from my friend… hacks on how to work with default routes

rtrentin

Most if not all GCP customers consume GCP PaaS/SaaS services like GKE, Cloud SQL, and others. Those services have their compute capacity provisioned inside Google owned VPCs and to establish a data plane for customers to use them vpc peerings are used. AVX Behavior Constraints Workarounds AVX Gateway Routes Create routes with a higher priority and with the tag avx-<vpc name>-gbl with the next hop “Default internet gateway”. Those are used exclusively by AVX Spoke Gateways. This step is necessary to prevent a route loop when executing the step below. 0.0.0.0/0 Option 1 It is possible to use the feature … Continue reading A little help from my friend… hacks on how to work with default routes

multi-cloud networkingLeave a comment

Hello again old friend…

rtrentin

Distributed Cloud Firewall Distributed Cloud Firewall enhances security by enforcing network policies between SmartGroups, which you define to manage applications within single or multiple cloud environments. SmartGroups: Network Policy Enforcement: How to enable it Once you are logged in on Copilot, go to Security -> Distributed Cloud Firewall. Click on Enable Distributed Cloud Firewall: Click Beging Using Distributed Cloud Firewall to start configuring it: A Greenfield Rule will be created to allow traffic that maintains the current state, facilitating the creation of custom rules for specific security needs. Distributed Cloud Firewall will deny all previously permitted traffic due to its … Continue reading Hello again old friend…

multi-cloud networkingLeave a comment

OCI Notes

rtrentin

Terraform Provider https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm#environmentVariables OCI CLI Requirements: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cliconcepts.htm#Requirements Quick start: https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#Quickstart Environment variables: https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clienvironmentvariables.htm Authenticate: To refresh the token: Examples https://github.com/oracle/terraform-provider-oci/tree/master/examples AVX Access Account https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#five https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm Do not forget to click the add button to add the private key to the user. Supported Instance Sizes Regions and Availability Domains https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm Minimal Required OCI IAM Policy Bound by Compartment Continue reading OCI Notes

multi-cloud networkingLeave a comment

Private Mode

rtrentin

Private Mode facilitates Aviatrix deployments without relying on public IPs. Private Mode was introduced on Aviatrix software version 6.8. Constraints Architecture Transit to Spoke data plane tunnels will utilize orchestrated native peering as an underlay. Cloud instances will only have private IPs (Aviatrix Controller, Gateways, and CoPilot) and management traffic occurs through native cloud constructs like Load Balancers, Private Link Services, and peering connections, serving as the foundation for the Aviatrix encrypted Transit network. Load Balancers Elastic Load Balancing (ELB) automatically disperses incoming traffic among multiple targets, including EC2 instances, containers, and IP addresses, across one or more Availability Zones. … Continue reading Private Mode

multi-cloud networkingLeave a comment

AVX “Global VPC” Tagging

rtrentin

GCP Global VPC creates regional awareness between the VPC and Aviatrix gateways allowing you to restrict spoke gateway traffic to transit gateways in the same region as the spoke gateway. Without global VPC, communications between spokes over transit in the same region are routed outside the region. Regional awareness is achieved by appending regional network tags to virtual machines and adding regional routes to the gateways in the routing table using tags. From Google Cloud documentation: “A tag is simply a character string added to a tags field in a resource, such as Compute Engine virtual machine (VM) instances or … Continue reading AVX “Global VPC” Tagging

multi-cloud networkingLeave a comment

External Connections Traffic Engineering

rtrentin

BGP (Border Gateway Protocol) is typically used in wide-area networks (WANs) to exchange routing information between different autonomous systems (ASes) on the internet. It’s not commonly used in local area networks (LANs) because LANs typically use interior gateway protocols (IGPs) like OSPF or RIP for routing within the same network. However, there are scenarios where BGP can be used within a LAN, particularly in large-scale data center environments or specialized network setups. One such scenario is when peering with third-party Network Virtual Appliances (NVAs) that are deployed within the LAN. These NVAs might need BGP to exchange routing information with … Continue reading External Connections Traffic Engineering