Tag: cloud networking

multi-cloud networkingLeave a comment

Hello again old friend…

rtrentin

Distributed Cloud Firewall Distributed Cloud Firewall enhances security by enforcing network policies between SmartGroups, which you define to manage applications within single or multiple cloud environments. SmartGroups: Network Policy Enforcement: How to enable it Once you are logged in on Copilot, go to Security -> Distributed Cloud Firewall. Click on Enable Distributed Cloud Firewall: Click Beging Using Distributed Cloud Firewall to start configuring it: A Greenfield Rule will be created to allow traffic that maintains the current state, facilitating the creation of custom rules for specific security needs. Distributed Cloud Firewall will deny all previously permitted traffic due to its … Continue reading Hello again old friend…

multi-cloud networkingLeave a comment

OCI Notes

rtrentin

Terraform Provider https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformproviderconfiguration.htm#environmentVariables OCI CLI Requirements: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/cliconcepts.htm#Requirements Quick start: https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#Quickstart Environment variables: https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clienvironmentvariables.htm Authenticate: To refresh the token: Examples https://github.com/oracle/terraform-provider-oci/tree/master/examples AVX Access Account https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#five https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm Do not forget to click the add button to add the private key to the user. Supported Instance Sizes Regions and Availability Domains https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm Minimal Required OCI IAM Policy Bound by Compartment Continue reading OCI Notes

multi-cloud networkingLeave a comment

Private Mode

rtrentin

Private Mode facilitates Aviatrix deployments without relying on public IPs. Private Mode was introduced on Aviatrix software version 6.8. Constraints Architecture Transit to Spoke data plane tunnels will utilize orchestrated native peering as an underlay. Cloud instances will only have private IPs (Aviatrix Controller, Gateways, and CoPilot) and management traffic occurs through native cloud constructs like Load Balancers, Private Link Services, and peering connections, serving as the foundation for the Aviatrix encrypted Transit network. Load Balancers Elastic Load Balancing (ELB) automatically disperses incoming traffic among multiple targets, including EC2 instances, containers, and IP addresses, across one or more Availability Zones. … Continue reading Private Mode

multi-cloud networkingLeave a comment

AVX “Global VPC” Tagging

rtrentin

GCP Global VPC creates regional awareness between the VPC and Aviatrix gateways allowing you to restrict spoke gateway traffic to transit gateways in the same region as the spoke gateway. Without global VPC, communications between spokes over transit in the same region are routed outside the region. Regional awareness is achieved by appending regional network tags to virtual machines and adding regional routes to the gateways in the routing table using tags. From Google Cloud documentation: “A tag is simply a character string added to a tags field in a resource, such as Compute Engine virtual machine (VM) instances or … Continue reading AVX “Global VPC” Tagging

multi-cloud networkingLeave a comment

External Connections Traffic Engineering

rtrentin

BGP (Border Gateway Protocol) is typically used in wide-area networks (WANs) to exchange routing information between different autonomous systems (ASes) on the internet. It’s not commonly used in local area networks (LANs) because LANs typically use interior gateway protocols (IGPs) like OSPF or RIP for routing within the same network. However, there are scenarios where BGP can be used within a LAN, particularly in large-scale data center environments or specialized network setups. One such scenario is when peering with third-party Network Virtual Appliances (NVAs) that are deployed within the LAN. These NVAs might need BGP to exchange routing information with … Continue reading External Connections Traffic Engineering

multi-cloud networkingLeave a comment

Google Cloud Shared VPC

rtrentin

A Shared Virtual Private Cloud (VPC) is a feature within Google Cloud that enables organizations to connect resources from multiple projects to a common network infrastructure. This shared network, hosted within a designated “host project,” allows secure and efficient communication among resources using internal IP addresses. Service projects, attached to the host project’s network, can utilize specific subnets for their instances. This setup offers a balance between centralized control over network resources, such as subnets and firewalls, and decentralized administration of instances within individual service projects. By segregating administrative responsibilities, organizations can enforce consistent access control policies, enhance security, and … Continue reading Google Cloud Shared VPC

multi-cloud networkingLeave a comment

Google Cloud Migration Scenarios

rtrentin

Lab and Configuration Staging The lab diagram for this exercise is show below: Staging Aviatrix Flows of Interest Constraints Migration Approaches The Slicer Constraints Testing Flow 1 and Flow 2 Migration using The Slicer (Switch Traffic) Slicing it: CSR1000v routes: If the Cloud Router custom advertisement is doing (route) summarization, the slice on the avx spoke gateway advertised routes is not required. In this case, we should customize the advertisement to only allow the subnetwork where the avx gateway was deployed. Flow3 and Flow 4 Migration using The Slicer (Switch Traffic) This step requires that all the north-south flows were … Continue reading Google Cloud Migration Scenarios

multi-cloud networking1 Comment

Apigee not bee :)

rtrentin

Apigee is a Google SaaS platform for developing and managing APIs. Apigee provides an abstraction layer to backend service APIs and provides security, rate limiting, quotas, and analytics. Apigee consists of the following components: A more granular network friendly diagram is show below: A more in depth overview is provided here: https://cloud.google.com/apigee/docs/api-platform/architecture/overview Setting it up There are at least three different ways to provision Apigee: https://cloud.google.com/apigee/docs/api-platform/get-started/provisioning-intro#provisioning-options I’m going to use a free trial wizard to get acquainted with Apigee: The evaluation wizard guides us through the steps: Apigee runtime requires a dedicated /22 range for evaluation: Each Apigee instance requires … Continue reading Apigee not bee 🙂

multi-cloud networkingLeave a comment

Using Azure Route Server for Dynamic Routing

rtrentin

Azure Route Server is a service provided by Microsoft Azure that simplifies the process of dynamic routing for network virtual appliances (NVAs). NVAs are commonly used in virtual networks to perform tasks such as load balancing, network address translation (NAT), and virtual private network (VPN) connectivity. In a traditional network setup, dynamic routing protocols such as Border Gateway Protocol (BGP) require manual configuration and maintenance of each individual NVA. This can become time-consuming and error-prone as the network scales. With Azure Route Server, NVAs can simply connect to the route server and exchange routing information automatically. Azure Route Server supports … Continue reading Using Azure Route Server for Dynamic Routing

cloud networkingLeave a comment

Hyperautomation with GCP (draft)

rtrentin

Hyperautomation Hyperautomation is a business-driven, disciplined approach that organizations use to rapidly identify, vet and automate as many business and IT processes as possible. Hyperautomation involves the orchestrated use of multiple technologies, tools or platforms, including: artificial intelligence (AI), machine learning, event-driven software architecture, robotic process automation (RPA), business process management (BPM) and intelligent business process management suites (iBPMS), integration platform as a service (iPaaS), low-code/no-code tools, packaged software, and other types of decision, process and task automation tools. Gartner Here are some use cases: Prime: AI Artificial intelligence (AI) is a key component of hyperautomation, as it enables organizations … Continue reading Hyperautomation with GCP (draft)