The Network DNA

What Your Business Should Automate This 2025

2025-01-17T15:40:00.005-05:00

What Your Business Should Automate This 2025

-Sponsored Post

Running a business in 2025 feels like trying to juggle while riding a bicycle. There's so much to handle, and sometimes it seems impossible to keep everything moving smoothly. That's where smart automation steps in - not to take over everything, but to catch the balls you don't need to juggle yourself.

Let's break down which tasks you should consider automating this year and, more importantly, why it matters for your bottom line.

Customer Support

Picture this: It's 3 AM, and someone across the world needs help with their order. In the past, you'd either need a night shift team or leave customers hanging until morning. Now, smart support systems can handle those late-night questions. They can:

Answer common questions about shipping and returns
Help customers track their packages
Book appointments and meetings
Sort incoming requests by urgency

But here's the thing - don't go overboard. Save real human conversations for solving tricky problems or helping upset customers feel heard.

Marketing

Remember spending hours scheduling social media posts? Those days are over. Modern marketing tools can:

Roll out email campaigns that feel personal and timely
Put your social media on autopilot (while still looking fresh)
Figure out which ads work best
Keep tabs on how well everything's doing
Spot trends in what your customers like

The real magic happens when these tools learn from past campaigns. They pick up on what works and what flops, so each new campaign performs better than the last.

Financial Management and Accounting

Let's face it - nobody started a business because they love paperwork. Here's what you can take off your plate:

Creating and sending bills
Chasing down late payments
Recording day-to-day transactions
Sorting out what got spent where
Running payroll
Getting ready for tax time

Your numbers people can stop pushing papers and start planning how to grow your money instead. This includes faster accounts receivable collection, streamlining cash flow, and reducing the time spent chasing down late payments.

Inventory Management

Empty shelves make nobody happy. Modern inventory systems can:

Watch your stock levels like a hawk
Order more stuff before you run out
Keep an eye on deliveries
See what's coming around the corner
Spot trouble before it hits your doorstep

This means fewer headaches, happier customers, and money not tied up in stuff sitting on shelves.

Employee Management and HR

Your HR folks should be helping people grow, not drowning in forms. Let computers handle:

Keeping track of who's working when
Processing time-off requests
Getting new hires set up
Managing health insurance and benefits
Setting up review meetings
Rolling out training programs

This gives your people more time to focus on what computers can't do - building a workplace where people want to stay.

Project Management and Workflows

Stop getting lost in spreadsheets. Good project tools can:

Hand out tasks and set deadlines
Show how things are moving along
Share files without the email chaos
Book meetings without the back-and-forth
Ping people who need a nudge
Keep everything in one place where everyone can find it

Your project leads can focus on keeping teams happy and projects moving forward.

Decision-Making and Monitoring

In 2025, making the right decisions quickly is essential, and automation can help you stay ahead no matter your industry—whether real estate, finance, security, you name it. Automation tools not only streamline the decision-making process but also allow you to monitor essential business data in real time, ensuring you can make timely and informed choices. Here’s how:

Automate sales predictions by analyzing historical data and identifying current trends to guide business strategies.
Anticipate market shifts or industry trends, from forecasting carbon credits in trading to predicting fluctuations in real estate property values.
Automate the process of scoring and prioritizing leads based on their likelihood to convert.

By integrating these automated decision-making and monitoring strategies, you’ll not only access valuable insights quickly but also make smarter choices for your business.

Data Security

In 2025, data protection isn't optional. Set up systems to:

Save everything important, regularly
Check for security problems
Watch who's accessing what
Make sure you're following the rules
Safeguard passwords, private or encryption keys, and other credentials
Check if everything's running right

What Still Needs the Human Touch

Some things just need people power:

Coming up with fresh ideas
Solving weird problems
Making big deals happen
Helping team members grow
Building relationships with important clients
Handling major problems when they pop up

Final Thoughts

As we roll through 2025, automation tools keep getting smarter. But remember - they're here to help your team shine, not replace them. Consider automation a really good assistant - it handles routine stuff so your people can tackle big challenges.

Start by examining what takes up most of your team's time. Maybe it's answering the same customer questions over and over or manually entering data that could be automated. Fix those pain points first.

The winners in 2025 won't be the businesses that use technology for everything. They'll be the ones who find the sweet spot—using automation to handle the routine while letting their people focus on what humans do best: building relationships, solving problems, and dreaming up what comes next.

WLAN Evolution - IEEE 802.11 Standards

2025-01-16T09:09:00.008-05:00

WLAN Evolution - IEEE 802.11 Standards!

In this article, we are going to learn about various IEEE 802.11 standards to understand how WLAN has evolved since 1997.

IEEE 802.11, 802.11a, 802.11b, and 802.11g also written as 802.11a/b/g collectively were the initial standards and these met the Wireless LAN requirement with data rates up to 54Mbps and supported 2.4 and 5 GHz frequency bands. As time passed the data requirement for new devices increased and the demand for higher bandwidth WLAN standards increased.

IEEE 802.11n standard added more throughput up to 600 Mbps (theoretically) but typically was able to provide decent bandwidth up to 300Mbps which was higher than the earlier stands as mentioned above. This was achieved by increasing the channel width using the modulation technique like QAM and Multiple input/multiple output (MIMO)

IEEE 802.11ac standard was developed that uses only a 5 GHz range and provides a very high throughput (VHT) compared to the 802.11n standard that was meeting the demand for a High Throughput (HT) environment. This standard as able to support data rates up to 6.9 Gbps (theoretically) and is also known as Wi-Fi 5.

IEEE 802.11ax standard is the latest and support both 2.4 and 5 GHz with data rates up to 4.8 Gbps. Multiple-user MIMO was introduced here where multiple transmission was possible at the same time. The early version of the 802.11ax standard is also known as Wi-Fi 6.

IEEE 802.11ax extension was developed in 2020 that was able to support data rates up to 7.8 Gbps. This standard was able to support 6 GHz spectrum and 1 Gbps channel width. It is also known as Wi-Fi 6E.

A quick summary is below for reference.

Hope you find this informative.

Wireless LAN Standards - Regulatory Bodies!

2025-01-15T05:32:00.007-05:00

Wireless LAN Standards - Regulatory Bodies!

In this article we are going to cover what are the various bodies involves in defining the Wireless LAN Standards. This information is useful if you want to make a strong foundation in WLAN technology.

These regulatory bodies are responsible for defining standards on RF technologies and how to use them in a Wireless LAN environment.

You can broadly categories these regulatory bodies into groups –

Regulatory bodies responsible for defining the Wi-Fi standards related to WLAN Control and Provisioning. For example, the IETF is an International Internet standards organization, responsible for Wi-Fi Standards related to WLAN control & Provisioning.

Regulatory bodies responsible for RF regulations. RF regulations are not same globally therefore local RF regulations are there. These local RF regulators main concern is on minimizing the RF interference – they regulate RF powers and usable WLAN frequencies. Some of the example of local RF regulators are FCC – that regulates RF in US, ETSI regulates the Europe.

Regulatory bodies responsible for WLAN Standards. Define how layer 1 and layer 2 of the OSI functions will be implemented in a Wireless LAN environment. IEEE is responsible for defining such standards. IEEE developed the 802.11 standard for wireless. This standard exists in FCC unlicensed space. Therefore, the FCC also contributes to defining the power regulations in Wireless networks. IEEE 802.11 standards for Wireless define how to use various channels, layer 1 transmission methods and layer 2 frame types and protocols.

Finally there comes the bodies that defines standards to ensure that different wireless products from different OEMs work in a Wireless network. For this we have Wi-Fi alliance. Wi-Fi Alliance is the group of WLAN hardware and software manufacturers. This alliance’s focus is on interoperability ensuring different OEM’s APs and clients can work together. Their focus largely is on the QoS and the security features.

Hope you find this article informative.

What is your answer to "What is Ethernet?"

2025-01-14T11:37:00.002-05:00

What is your answer or explanation if someone asks, “What is Ethernet?” Sometimes new learner don’t get the precise answer to this question. Let’s try to learn what Ethernet is here in this small article.

Ethernet is the group of network technologies that are used at layer 1 and layer 2 of the OSI layer. Ethernet at layer 2 provides the physical addressing to the Network Interface Cards in a networking device. Yes you are right this physical address is called the MAC address.

MAC Address is a 6-byte or 48-bits long address that is written in hexadecimal format. If you notice your MAC address you can see that each byte has two hexadecimal characters separated by either colon or hyphen character.

Let’s see how my computer's MAC Address looks like. You can get it from the command prompt using the “ipconfig /all” command and find the "Ethernet adapter" section:

Figure 1: My Computer MAC Address

The physical address in the output is your computer's MAC address. Notice each byte is separated with a hyphen (-) character and there are a total 6 bytes and 12 hexadecimal characters.

This MAC address is globally unique address. I mean there is no other computer that has same MAC address globally. You may question how this is possible. It is possible by following the standard rules define by standard bodies.

One of the rule is that the manufacturer should use only the address assigned to it by the standard body. Each manufacturer is assigned a unique address – first 3 bytes in any MAC address (also known as most significant bytes) are the OUI address assigned to manufacturers.

In my case 50-81-40 is the OUI assigned to HP Inc. if you want to verify your system vender using MAC address you can go to https://macvendors.com site. Just paste your MAC address and it will show you the vendor name.

Second part of the MAC address, I mean next 3 bytes after OUI, represent to the NIC serial number. Every NIC serial is the unique value. A manufacturer cannot assign the same serial number to two NICs. This way a MAC address is globally unique address.

Sometimes there are networking software when installed on the systems also get the MAC address. If you see a MAC address starting with x2, x4, xA or xE, it is the private address. It is same as private IP address defined in RFP 1918. Now a days products form popular vendors like Apple, Microsoft can pseudo-randomize their device MAC address for higher privacy. They utilize the private MAC ranges to achieve the same.

Hope you find this small article informative.

Unlocking High-Performance Data Scraping with Datacenter Proxies

2025-01-05T16:21:00.001-05:00

Unlocking High-Performance Data Scraping with Datacenter Proxies

In today’s data-driven world, businesses rely on web scraping to gather insights for decision-making. However, this process often encounters challenges like IP bans, rate limitations, and restricted access to geo-specific content. Enter datacenter proxies—a vital tool for achieving efficiency and scalability in data scraping operations. This article explores the role of datacenter proxies in web scraping, supported by data and best practices.

The Growing Importance of Proxies in Data Scraping

Web scraping is an essential practice for industries like e-commerce, travel, and market research. According to a study by Grand View Research, the global web scraping market is projected to reach $10.3 billion by 2027, growing at a compound annual growth rate (CAGR) of 13.4%.

However, scraping at scale presents challenges:

IP Blocking: Websites often block repetitive requests from the same IP.
Geo-Restrictions: Some content is region-specific, inaccessible from certain IPs.
CAPTCHAs and Anti-Bot Measures: Many websites employ advanced techniques to detect and prevent scraping.

Datacenter proxies help overcome these hurdles by offering anonymity, speed, and geographic flexibility.

Advantages of Datacenter Proxies for Data Scraping

Improved Anonymity: Datacenter proxies rotate IPs to reduce detection risks, ensuring uninterrupted data extraction.
Scalability: With thousands of IPs available, these proxies support high-volume scraping without risking bans.
Cost Efficiency: Compared to residential proxies, datacenter proxies offer a balance between performance and affordability, making them ideal for startups and large enterprises alike.
Speed: Modern data centers use optimized servers, providing faster response times and reducing latency during scraping tasks.

Use Cases for Datacenter Proxies

1. Competitive Analysis
E-commerce businesses use web scraping to monitor competitors’ pricing, product availability, and promotional strategies. Datacenter proxies ensure that large-scale requests don’t get flagged.

2. SEO Monitoring
Marketing teams track keyword rankings, backlinks, and website performance using automated scraping tools. Datacenter proxies enable seamless access to search engine results without interruptions.

3. Market Research
Aggregating data from multiple sources for sentiment analysis or consumer behavior studies becomes efficient with datacenter proxies.

4. Ad Verification
Digital advertisers use proxies to verify the placement and visibility of their ads across different regions, ensuring compliance and quality.

Limitations of Datacenter Proxies

Despite their advantages, datacenter proxies come with a few drawbacks:

Detection Risks: Some websites employ advanced algorithms to identify and block datacenter proxies.
Limited Geo-Targeting: While available in various regions, they lack the granular targeting of residential proxies.
Shared Infrastructure: Cheaper plans might involve shared proxies, increasing the risk of blacklisting.
For applications that require the highest anonymity, residential or mobile proxies might be more suitable. However, for most data scraping tasks, datacenter proxies remain a robust choice.

Best Practices for Using Datacenter Proxies

Choose a Reliable Provider: Look for providers with high uptime guarantees, robust support, and scalable IP pools.
Use Proxy Rotation: Employ rotating proxies to distribute requests across multiple IPs, reducing detection risks.
Monitor Performance: Regularly track the success rate of your scraping tasks and refine configurations for better results.
Comply with Legal Standards: Always respect the terms of service of the websites you scrape and ensure compliance with data privacy laws.

The Digital Transformation of Traditional Private Equity Firms

2024-12-18T09:25:00.007-05:00

The Digital Transformation of Traditional Private Equity Firms

Private equity (PE) firms are transforming. Traditionally, these firms operated in a world of spreadsheets, quarterly reports, and personal connections. But today, technology is driving change across every industry, and private equity is no exception.

To stay competitive, private equity firms embrace digital transformation to enhance efficiency, improve decision-making, and create value in their portfolio companies. Let’s explore how this shift is happening and why it’s vital for the future of private equity.

Embracing Technology in a Traditional Industry

For years, private equity firms relied on tried-and-true methods for evaluating investments and managing portfolios. However, with increasing competition and the growing complexity of markets, those traditional methods have limits.

Adopting innovative technologies like big data analytics, machine learning, and cloud solutions allows PE firms to move from reactive to proactive strategies. For example, instead of waiting for quarterly reports, you can now monitor real-time data to make informed decisions faster. This shift enhances your ability to compete in a crowded market while giving you the tools to make smarter, more strategic investments.

Firms like Silver Lake and Apax Partners, known for being early adopters, have used these technologies to gain an edge. They’ve embraced the shift by transitioning from traditional to digital networks, paving the way for others in the industry.

Tools Driving the Transformation

Various cutting-edge technologies fuel digital transformation in private equity, each offering unique advantages:

Artificial Intelligence (AI) and Machine Learning

Beyond analyzing data, these tools can also:

Help identify hidden patterns
Predict trends
Optimize decision-making processes

AI-powered algorithms can evaluate risk aspects in possible investments. Machine learning models, consequently, can continuously refine their accuracy as new data becomes available. This means your firm can react swiftly to market changes and make smarter, data-driven decisions.

Big Data Analytics

With access to massive data sets, big data analytics provides insights that were once unimaginable. From market trends and customer behaviors to operational inefficiencies, these tools help uncover actionable intelligence.

With these, firms can now analyze social sentiment data to gauge consumer confidence. Plus, they can also use predictive analytics to foresee market fluctuations, gaining themselves a competitive edge in deal sourcing and portfolio management.

Blockchain

Blockchain technology revolutionizes how transactions are executed. Smart contracts—self-executing agreements with the terms directly written into code—streamline processes, reduce legal overhead, and eliminate intermediaries.

Blockchain also ensures that sensitive financial data is securely shared among stakeholders, minimizing the risk of fraud or data breaches.

Software as a Service (SaaS)

SaaS platforms eliminate the need for costly infrastructure. They also offer scalable, on-demand solutions for portfolio management, financial reporting, and collaboration.

Tools like virtual data rooms enable seamless communication during due diligence, while SaaS-driven dashboards allow for real-time performance tracking across multiple investments. This ultimately makes all your workflows more efficient.

Internet of Things (IoT)

IoT solutions are transforming the operations of portfolio companies by enabling real-time monitoring of physical assets and production processes. Sensors embedded in machinery, for instance, can provide critical data about maintenance needs, preventing costly downtimes.

Enhancing Portfolio Company Performance

Digital transformation improves your firm’s internal processes and adds value to your portfolio companies. It can also help:

optimize operations
improve customer experiences
accelerate organizational growth

For example, machine learning can automate routine processes, allowing teams to focus on more important objectives. Big data can help portfolio companies better understand their customers, enabling personalized offerings and stronger customer

Additionally, IoT-driven insights help optimize supply chains, improve inventory management, and reduce operational inefficiencies, all of which enhance overall performance.

How to Overcome the Common Constraints to Digital Evolution

While digital transformation offers enormous potential, it’s not without challenges. Deploying new technologies demands considerable time and resources. Team members may also resist change, preferring the familiarity of traditional methods.

To overcome these barriers, start by identifying areas where technology can have the most immediate impact. For example, automating manual tasks like financial reporting can quickly show results and build momentum.

Next, ensure your team receives proper training to use new tools effectively. When everyone understands the value of digital transformation, they’re more likely to embrace it.

Collaborating with reliable management companies to get administrative support can also ease the transition. By outsourcing routine tasks, you free up internal resources to focus on higher-value activities, like improving portfolio performance or sourcing new deals.

Why Now Is the Time

The digital revolution is already here. Firms that delay adoption risk falling behind as competitors leverage technology to outpace them. The sooner you adapt, the better equipped you’ll be to navigate the future of private equity. With the right strategy and tools, you can turn digital transformation into a powerful competitive advantage. The future of private equity is digital—adapt now and lead the charge!

Basic configurations on Cisco ASA Firewall - Part 2

2024-11-26T15:52:00.003-05:00

Basic configurations on Cisco ASA Firewall - Part 2

As a part of the understanding on the basics of Cisco ASA firewalls, these are some of the commands used to configure Cisco ASA firewall in real scenario.

Fig 1.1- Cisco ASA in a Network

Configuring DHCP, AAA, and SSH

NDNA-ASA(config)# dhcpd address 10.10.10.3-10.10.10.100 inside

NDNA-ASA(config)# dhcpd dns 112.110.112.5

NDNA-ASA(config)# dhcpd option 3 ip 10.10.10.1

NDNA-ASA(config)# dhcpd enable inside

Configure AAA to use the local database for authentication

NDNA-ASA(config)# username admin password NDNA1@

NDNA-ASA(config)# aaa authentication ssh console LOCAL

Configure SSH remote access to the ASA

NDNA-ASA(config)# crypto key generate rsa modulus 1024

Allow SSH connections from any host on the inside network

NDNA-ASA(config)# ssh 10.10.10.0 255.255.255.0 inside

NDNA-ASA(config)# ssh 10.10.1.3 255.255.255.255 outside

NDNA-ASA(config)# ssh timeout 10

Configure a static default route for the ASA

NDNA-ASA(config)# route outside 0.0.0.0 0.0.0.0 112.23.16.11

Configure address translation using PAT and network objects

NDNA-ASA(config)# object network INSIDE-NET

NDNA-ASA(config-network-object)# subnet 10.10.10.0 255.255.255.0

NDNA-ASA(config-network-object)# nat (inside,outside) dynamic interface

NDNA-ASA(config-network-object)# end

Add the inspection of ICMP traffic to the policy map list

NDNA-ASA(config)# policy-map global_policy

NDNA-ASA(config-pmap)# class inspection_default

NDNA-ASA(config-pmap-c)# inspect icmp

Display the default MPF policy map to verify ICMP

CCNA-ASA(config-pmap-c)# show run policy-map

Configure the DMZ interface Gi1/1 on the ASA

Configure DMZ interface Gi1/1, which is where the public access web server will reside. Assign Gi1/1 the IP address 10.10.2.1/24, name it dmz, and assign a security level of 70

NDNA-ASA(config)# int gi1/1

NDNA-ASA(config-if)# ip address 10.10.2.1 255.255.255.0

NDNA-ASA(config-if)# nameif dmz

NDNA-ASA(config-if)# security-level 70

NDNA-ASA(config-if)# no shut

Configure static NAT to the DMZ server using a network object

NDNA-ASA(config)# object network dmz-server

NDNA-ASA(config-network-object)# host 10.10.2.3

NDNA-ASA(config-network-object)# nat (dmz,outside) static 112.23.16.11

Configure an ACL to allow access to the DMZ server from the Internet

NDNA-ASA(config)# access-list OUTSIDE-DMZ permit ip any host 10.10.2.3

NDNA-ASA(config)# access-group OUTSIDE-DMZ in interface outside

Clear the NAT counters using the clear nat counters command.

NDNA-ASA# clear nat counters

Continue Reading...

More on Cisco ASA...

Basic configurations on Cisco ASA Firewall - Part 1

2024-11-26T15:46:00.001-05:00

Basic configurations on Cisco ASA Firewall - Part 1

As a part of the understanding on the basics of Cisco ASA firewalls, these are some of the commands used to configure Cisco ASA firewall in real scenario.

Fig 1.1- Cisco ASA Firewall in a Network

What is Cisco ASA Firewall?

Cisco ASA is a security device that includes a firewall, antivirus, intrusion prevention, and a virtual private network (VPN). It enables proactive threat defense, preventing assaults from spreading throughout the network.

How to check the show version command ?

Here is the command
NDNA-ASA# show version

Display the ASA file system using the show file system command ?
NDNA-ASA# show file system

Display the contents of flash memory using one of these commands: show flash, show disk0, dir flash: or dir disk0
NDNA-ASA# show flash

You can restore the ASA to its factory default settings by using the configure factory-default command
NDNA-ASA# conf t
NDNA-ASA(config)# configure factory-default

Use the write erase command to remove the startup-config file from flash memory.
NDNA-ASA# write erase
NDNA-ASA# show start
NDNA-ASA# reload

Configure the hostname and domain name
NDNA-ASA-Init# config t
NDNA-ASA-Init(config)# hostname NDNA-ASA
NDNA-ASA(config)# domain-name theNDNA.com

Configure the login and enable mode passwords.
NDNA-ASA(config)# passwd cisco
NDNA-ASA(config)# enable password class

Set Date and time
NDNA-ASA(config)# clock set 10:19:00 November 12 2024

Configure the inside and outside interfaces.
NDNA-ASA(config)# interface gi1/2
NDNA-ASA(config-if)# nameif inside
NDNA-ASA(config-if)# ip address 10.10.10.1 255.255.255.0
NDNA-ASA(config-if)# security-level 100
NDNA-ASA(config-if)# no shutdown

NDNA-ASA(config-if)# interface G1/1
NDNA-ASA(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
NDNA-ASA(config-if)# ip address 112.23.16.11 255.255.255.248
NDNA-ASA(config-if)# no shutdown

Configure ASDM access to the ASA

You can configure the ASA to accept HTTPS connections using the http command. This allows access to the ASA GUI (ASDM). Configure the ASA to allow HTTPS connections from any host on the inside network (10.10.10.0/24).

NDNA-ASA(config)# http server enable
NDNA-ASA(config)# http 10.10.10.0 255.255.255.0 inside

Continue Reading...

More on Cisco ASA...

CCNA: IP Routing

2024-07-31T05:37:00.007-04:00

CCNA: IP Routing (Communication between two different networks)

In this article, we are going to talk about IP routing which is a process of communication between two different networks. This communication could be between two different VLANs in a switching environment. In one of the articles, we talk about layer 2 switching where switches build the MAC address table to decide where to forward frame based on the destination MAC address.

Here we’ll see how a layer 3 switch or a router transmit packets between different networks using the layer 3 destination address. IP layer assign an identifier or an address to all the endpoints on the network. This address is called the layer 3 address or IP address. This needs to be unique in a network to avoid any unpredictable behavior.

A process to analyze the layer 3 header and taking the forwarding decision based on the destination address is called the routing. Routing is performed by routers, firewalls, multi-layer switches and gateways. They not just forward the traffic based on the destination IP address but select the best path to reach to the destination.

It may look simple in words but in actual it required a deep thought process to understand the routing & switching under the hood. We’ll be assuming all the prerequisite are in place and traffic is through from Host A to Host B. Now let’s look at using an example of a network and communication between devices.

Let’s say Host A (10.10.10.10) on Network 1 wants to communicate to Host B (10.10.30.10) on Network 3. To make this communication happen both routing and switching works together.

IP network must have unique IP address assigned to each device in the network and you can see all the devices are configured with unique IP address. This is the first prerequisite in IP routing.

Now Host A creates a packet with source IP (10.10.10.10 /24) and destination IP address (10.10.30.10 /24). This packet is handed over to NIC card to perform the lookup. It is confirmed that the Host B is not in the same network (10.10.10.0/24). Any host that is not part of the source device network can be reached through the default router or gateway. An administrator configures default gateway configuration manually while configuring the system on the LAN or it can be configured automatically using the DHCP protocol. From this configuration, NIC of a device know it’s default gateway to forward traffic to another network.

This packet is encapsulated in Ethernet frame and using the ARP entries on the Host A it forwards the frame to the default gateway on the network. Frame is received by Router 1 on Eth1 interface. Router extract the layer 3 packet and checks the destination IP address in the routing table. Routing table assist a layer 3 device where to forward the packet towards the destination using the next-hop information for each route entry. In our example, router sees destination address (10.10.30.10 /24) can be reached through (10.10.20.2) that is on Eth 2 it switches the packet to Eth2 of Router 1.

Now Eth 2 interface is connected to Eth 1 Interface of Router 2 and packet is extracted by router 2. Router 2 observes the destination address (10.10.30.10), it comes to know that this network address is locally configured on once of the interfaces (Eth 2). Router 2 handover the packet to Ethernet 2.

Now the packet is received on the destination network (10.10.30.0 /24) and the Host B must exist on this network. Router finds the MAC address of the Host B from the ARP table maintained in RAM and hand over traffic to Host B.

Routing table is build using two ways – either it is configured by administrator manually by typing the destination network, subnet mask and next-hop address. Or it is built automatically by using the different routing protocols such as OSPF, BGP, RIP etc. Hope you find this article informative!

Continue Reading...

Global Outage : Windows machines in a BSOD loop after CrowdStrike update

2024-07-19T12:00:00.004-04:00

Global Outage : Windows machines in a BSOD loop after CrowdStrike update

Globally, a recent update to the CrowdStrike Falcon sensor is seriously affecting Windows users. This upgrade is rendering systems unusable and causing blue screen of death (BSOD) cycles.

Starting on July 19, 2024, Windows 10 and 11 systems running CrowdStrike's endpoint security software are impacted by the problem. Users report repeatedly seeing "DRIVER_OVERRAN_STACK_BUFFER" error messages on their BSODs, which prevent the machine from booting up and operating normally.

Asserting that their engineering teams are "aware of reports of crashes on Windows hosts related to the Falcon Sensor," CrowdStrike has recognized the issue and said they are working to fix it.

Affected users are advised by the company not to file individual support tickets at this time. Enterprise users have been particularly hard hit by this upgrade; according to some businesses, hundreds of devices, including crucial production servers and SQL nodes, have been impacted.

In an effort to minimize the harm, some IT departments are removing CrowdStrike-related files from impacted systems in order to get those systems back up and running.

This incident brings to light the possible vulnerabilities that come with security software updates that happen automatically, particularly in workplace settings. In order to avoid such occurrences in the future, a large number of impacted users are now requesting the adoption of phased rollout rules and stricter testing protocols.

CrowdStrike is anticipated to release more information and a long-term solution to the problem as events unfold. Affected users are recommended to keep an eye on official CrowdStrike communication channels in the interim for instructions on recovery methods and temporary solutions.

Microsoft has informed users to expect "service degradation" and acknowledged that it is looking into a "issue" affecting its 365 apps and operating systems.

"American cybersecurity company CrowdStrike has taken ownership of the mistake and said they are "working on it." Experts warn that it is too soon to "rule out" the likelihood of a cyberattack but speculate that a "buggy" security upgrade may have caused the issue.

How to Check CrowdStrike sensor version is affected by the BSOD issue

Identify your sensor version: Boot into Safe Mode and check the CrowdStrike Falcon sensor version installed on your system. The problematic update seems to be affecting various sensor versions, including version 6.58.
Check the installation date: Look at the installation date of the CrowdStrike Falcon sensor. If it coincides with the onset of BSOD issues (around July 19, 2024), it’s likely to be the cause.
Look for specific error messages: The BSOD error associated with this issue is “DRIVER_OVERRAN_STACK_BUFFER”. If you’re seeing this error, your system is likely affected.

Possible Workarounds

Boot Windows into Safe Mode or the Windows Recovery Environment
Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
Locate the file matching “C-00000291*.sys”, and delete it.
Boot the host normally.

CCNA: Address Resolution Protocol (ARP)

2024-07-16T08:06:00.002-04:00

CCNA: Address Resolution Protocol (ARP)

In this article, we will talk about ARP that maps the layer 3 address to the layer 2 MAC address. Before we talk technical, let’s imagine you are in a conference. Someone hands over a notebook to you to hand it over to John. You don’t know which person is John Heard so you say, “Excuse me who is John Heard?”. Everyone in the conference hears you but only John responds, “I am John Heard”. Now you know John Heard and can associate with him and know his location.

This is similar to Address Resolution Protocol, which maps layer 3 IP addresses to the layer MAC addresses.

Figure 1: ARP In Action

In Figure 1, PC 1 knows that it must communicate with PC-2 using a 1.1.1.2 IP address. To do that it builds the Ethernet Frame and puts its MAC address as the Source MAC address (SMAC) and layer 2 broadcast address (ff:ff:ff:ff:ff:ff). A switch forwards the broadcast out all the ports in same VLAN (except the port where broadcast was received). All hosts in same VLAN received this ARP request including PC-2. All other hosts will ignore this ARP request as their IP address is not 1.1.1.2. Only PC-2 is configured with 1.1.1.2 will process this request and respond to PC-1.

PC-2 now creates an Ethernet frame to respond to the ARP. It puts its own MAC Address (0x4a::56) as SMAC and PC-1 MAC address (0x4a::55) as the Destination MAC address (DMAC). PC-2 knows about the PC-1 MAC address from the SMAC value of the ARP request that it received from PC-1.

Remember PC-2 knows the MAC address of the PC-1 when responding to ARP Request, so ARP Response is NOT broadcast, it is Unicast communication between PC-2 and PC-1. PC-1 gets the response and creates an entry in the ARP table also known as ARP cache. PC-1 maps the IP address 1.1.1.2 with 0x4a::56. The benefit of this process is, that next time when PC-1 wants to communicate with PC-2, it doesn’t need to send a broadcast on the network.

PC-2 also creates ARP entry in the cache when it received the ARP request from PC-1. ARP request had both the information PC-1 MAC address and the IP address.

You can see the ARP table from any IP device as it is must to make communication happen. You can try the same on the PC you are reading this article on using arp -a from command prompt.

I hope you find this informative!

Continue Reading...

Replacing cEdge in Cisco SDWAN environment

2024-07-09T12:13:00.001-04:00

Replacing cEdge in Cisco SDWAN environment

Replacing the cEdge router with another cEdge through an RMA process for Cisco SDWAN , we need to put the basic configuration on the new RMA router and should be reachable via vManage. It is important that you should know the new router serial number should be learned to vManage NMS.

Fig 1.1- Replacing cEdge

Here are the steps below :

Step 1: Make sure your new RMA device is compatible with the vManage/vSmart Controller versions else it will not support.

Step 2: Add the bootstrap configuration on the cEdge router with the following as under "system" as shown below

C8000-NDNA# Config-transaction
C8000-NDNA(config)# system
C8000-NDNA(config-system)# system-ip 10.10.10.1
C8000-NDNA(config-system)# site-id 2000
C8000-NDNA(config-system)# organization-name NDNA-111
C8000-NDNA(config-system)# vbond 123.11.23.12
C8000-NDNA(config-system)# exit
C8000-NDNA(config)# exit
C8000-NDNA#

Step 3: Make sure System clocks that are properly configured on the cEdge and that are compatible with other devices/controllers in a SDWAN Fabric.

C8000-NDNA#sh clock
11:43:59.361 EDT Tue Jul 9 2024
C8000-NDNA#

Step 4: Now you need to configure one of the transport interface (VPN0) on the new RMA device with the tunnel interface as below:

C8000-NDNA# Config-transaction
C8000-NDNA(config)# interface GigabitEthernet0/0/1
C8000-NDNA(config-if)# description MPLS
C8000-NDNA(config-if)# ip address 10.20.20.26 255.255.255.252
C8000-NDNA(config-if)# no ip redirects
C8000-NDNA(config-if)# ip tcp adjust-mss 1360
C8000-NDNA(config-if)# arp timeout 1200
C8000-NDNA(config-if)# exit
C8000-NDNA(config)# ip route 0.0.0.0 0.0.0.0 10.20.20.25
C8000-NDNA(config)# interface Tunnel1
C8000-NDNA(config-if)# ip unnumbered GigabitEthernet0/0/1
C8000-NDNA(config-if)# no ip redirects
C8000-NDNA(config-if)# ipv6 unnumbered GigabitEthernet0/0/1
C8000-NDNA(config-if)# no ipv6 redirects
C8000-NDNA(config-if)# tunnel source GigabitEthernet0/0/1
C8000-NDNA(config-if)# tunnel mode sdwan
C8000-NDNA(config-if)# exit
C8000-NDNA(config)# exit
C8000-NDNA#

Step 5: Configure the interface under "sdwan" as shown below to make a part of sdwan.

C8000-NDNA# Config-transaction
C8000-NDNA(config)# sdwan
C8000-NDNA(config-sdwan)# interface GigabitEthernet0/0/1
C8000-NDNA(config-sdwan)# tunnel-interface
C8000-NDNA(config-sdwan)# encapsulation ipsec weight 1
C8000-NDNA(config-sdwan)# color mpls
C8000-NDNA(config-sdwan)# allow-service all
C8000-NDNA(config-sdwan)# no allow-service bgp
C8000-NDNA(config-sdwan)# allow-service dhcp
C8000-NDNA(config-sdwan)# allow-service dns
C8000-NDNA(config-sdwan)# allow-service icmp
C8000-NDNA(config-sdwan)# allow-service sshd
C8000-NDNA(config-sdwan)# no allow-service netconf
C8000-NDNA(config-sdwan)# no allow-service ntp
C8000-NDNA(config-sdwan)# no allow-service ospf
C8000-NDNA(config-sdwan)# no allow-service stun
C8000-NDNA(config-sdwan)# exit
C8000-NDNA(config)#exit
C8000-NDNA#

Step 6: Once to added the configuration, move MPLS link from old router to new router as same MPLS configuration is present on new ISR router. MPLS link will come up and you will be see the router is available on vManage.

Step 7: Now copy the device template and save it from the old router. Once done, Now in cert, move the old router from valid to staging and move the rest of the links from old router to new one.

Step 8: Now attached the device template on the new router and upload the saved file to that new router template, it will take all the parameters and values and push the configuration.

Step 9 : Once all configuration pushed, Check sdwan control connections and other configurations.

Continue Reading...

Cisco SDWAN

Cisco sdwan Manager (vManage) Alarms and Types
Manual Bootstrap Tutorial for Cisco SD-WAN Edge Devices
Introduction to Adaptive Qos in Cisco SDWAN
Cisco Catalyst SDWAN: Inbound Vs Outbound Control Policy
Features in Cisco Catalyst SDWAN release 20.13.x

Free Tools...

Introduction to VXLAN MP-BGP EVPN Route Types

2024-07-05T10:58:00.006-04:00

Introduction to VXLAN MP-BGP EVPN Route Types

Before we start with the route types lets talk about the EVPN, EVPN (Ethernet Virtual Private Network), enables virtualized Ethernet communication between various network devices. Data center and service provider networks frequently employ EVPN to offer effective and scalable network connection.

EVPN provides several benefits over traditional Layer 2 VPN technologies, such as Virtual Private LAN Service (VPLS). One of the main benefits of EVPN is that it enables multi-tenancy, where multiple customers or tenants can share the same physical infrastructure while maintaining separate and secure virtual networks.

While VXLAN is designed to provide the same Ethernet Level 2 services as VLAN, but with greater extensibility and flexibility. In a large multitenant environment, VXLAN provides a flexible, multitenant solution over a shared physical infrastructure. It operates by using IP plus UDP to travel over the physical network.

Fig 1.1- VXLAN EVPN Basic Topology

EVPN Route Type

The EVPN control plane advertises the following types of information:

Ethernet auto-discovery (AD) routes are route type 1. The Ethernet segment identity, Ethernet Tag ID, and EVPN instance information are advertised using this sort of Ethernet Auto-Discovery (EAD) route. Every Ethernet segment or every EVPN instance may receive EAD route ads.
Route type 2, or the advertisement route for MAC/IP: This broadcasts the MAC and IP addresses of the endpoints, or VTEPs, as well as endpoint reachability data.
The inclusive multicast Ethernet tag route, or route type 3, announces its desire to employ ingress replication for particular VNIs and is capable of performing multicast router advertisement.
Ethernet segment routes, or route type 4, are used to broadcast the length of the IP address, the originating router's IP address, and the Ethernet segment identifier.
Route type 5 is an IP prefix route that is used to advertise externally learnt routes and internal IP subnets to VXLAN networks.

The most focused route types are Route Type 2 and Route Type 3 and let's focus on those for a moment.

Route Type 2:

As we discuss that the purpose of EVPN Route Type 2 is to broadcast MAC addresses and optional IP address information across a network. It is essential to EVPN instances because it makes it possible to build a redundant, effective Layer 2 network that spans a large geographic area. EVPN Route Type 2 minimizes broadcast traffic, which typically overloads network resources, and improves route targeting by mapping MAC addresses to IP addresses and matching Ethernet segments.

In order to maximize network service delivery and dependability, EVPN Route Type 2 makes use of a number of essential components. These consist of Labels for traffic segregation, Ethernet Tag ID, MAC Address Length, MAC Address, and IP Address Length. To guarantee that data packets take the most effective route through the network, each component makes a fine-grained contribution to the identification, routing, and segregation of traffic.

Route Type 3:

Broadcast, Unknown Unicast, and Multicast (BUM) traffic delivery via EVPN networks requires Type 3 routes. P-tunnels that should be utilized to send BUM traffic are discussed in Type 3 messages.

An EVPN instance's other PE devices would not be able to receive BUM traffic from the ingress router if Type 3 messages were absent. According to RFC 6514, a Provider Multicast Service Interface (PMSI) Tunnel attribute must also be carried by a Type 3 route.

The following Tunnel Types are defined, although your vendor might only support a subset of tunnel types:

0 – No tunnel information present
1 – RSVP-TE P2MP LSP
2 – mLDP P2MP LSP
3 – PIM-SSM Tree
4 – PIM-SM Tree
5 – BIDIR-PIM Tree
6 – Ingress Replication
7 – mLDP MP2MP LSP

Continue Reading...

Free Tools...

Introduction to Micro-BFD ( BFD over Port channel)

2024-06-28T11:46:00.003-04:00

Introduction to Micro-BFD ( BFD over Port channel)

Micro BFD sessions are those that run on member links of the port channel. Micro BFD sessions are available for both LACP and non-LACP-based port channels. If BFD identifies a failure in the bidirectional channel connecting two forwarding engines, which includes interfaces and data links, the member link is deleted from the forwarding table.

This approach provides faster failure detection because BFD sessions are formed on individual port-channel interfaces. Users can configure BFD across the primary port-channel interface to monitor LAG bandwidth utilization via a mini BFD session for each member.

Fig 1.1- Introduction to Micro-BFD ( BFD over Port channel)

If a member port goes down, it is deleted from the forwarding table, preventing traffic from blackholing on that member. Micro BFD only works when it is enabled for all port-channel members. The logical BFD session uses less aggressive timers than the BFD on LAG sessions, regardless of whether it is configured on the port-channel or port-channel sub interfaces.

With the micro BFD functionality enabled, the port channel manager considers the state of micro BFD sessions when determining the state of the port channel interface. Port channel implementation supports minimum links (lacp min-links) configuration to assure bandwidth availability by making a port channel usable or unusable based on whether the specified number of ports are available or not.

The detection of micro BFD happens only when Link Aggregation Control Protocol (LACP) in COLLECTIING_DISTRIBUTION is in active state. Maximum member port supported for LACP mode per port-channel varies from one platform to another.

Purpose of micro BFD sessions are:

Run a BFD session on each LAG member link.
Check for link continuity in each member link.
Allow BFD to control the LAG member link so that it is included in the LAG interface's L2 load-balancing table, whether LACP is present or not.

Configuration of BFD on Link Aggregation Group Bundle

Step 1: Configuring BFD Template

NDNA_R1(config)# bfd-template single-hop testing
NDNA_R1(config-bfd)# interval min-tx 50 min-rx 50 multiplier 3
NDNA_R1(config-bfd)# end

Step 2: Applying Template to Port-Channel Interface

NDNA_R1(config)#interface port-channel 1
NDNA_R1(config-if)#port-channel bfd destination ipv4 10.10.10.1 testing
NDNA_R1(config-if)#ip address 10.10.10.3 255.255.255.0
NDNA_R1(config-if)#no shutdown
NDNA_R1(config-if)#end

Step 3: Adding Member Ports to Port-Channel Group
Perform the following steps to add member ports to port-channel group:

NDNA_R1(config)#interface Gi0/0/1
NDNA_R1(config-if)#channel-group 1 mode active
NDNA_R1(config-if)#no shutdown
NDNA_R1(config-if)#end

Continue Reading...

Cisco SDWAN

Free Tools...

CCNA: MAC Address Table

2024-06-25T01:06:00.009-04:00

CCNA: MAC Address Table

Layer 2 Switches use the MAC address table to make forwarding decisions. This table is populated automatically when a switch receives a frame on a port. As a frame is received on a port, its source MAC address is noted. Let’s try to understand how this works in this article.

A switch that you just powered up, has nothing in the MAC address table. Then PC-1 wants to communicate with PC-2. The switch receives the frame from PC-1 that contains the MAC address 80::01 on port 1. Port 1 is configured as a member of VLAN-11. All this information, the MAC Address, Port Number, and VLAN ID are stored in the switch MAC address table. So in short MAC address table maps the MAC address to the Switch’s VLAN and port and this entry is referred for forwarding decision.

At this port switch has only one entry in the table. The switch doesn’t know where to forward the frame to other devices like 80::02, so it floods the frame out of all other ports in VLAN-11. All other connected devices in VLAN-11 receive the frame and check the destination MAC address of the frame. All of them except once accept the frame as the destination MAC address matches with its own MAC address and the rest all drop this frame.

PC-2 says “Hey this frame belongs to me and I’ll respond to this frame”. PC-2 responds to PC-1 using its MAC address as the source MAC and the original frame’s source address as the destination MAC address. The switch receives this frame and knows the MAC address of the PC-2 from this response.

This way, the switch builds the table entries automatically when it sees a frame on a port. The switch now knows the destination MAC address (80::1) is on port 11 and forwards the frame to port 11.

I hope you find this informative!

Continue Reading...

CCNA: TCP SEQ and Port Number

2024-06-19T05:57:00.005-04:00

CCNA: TCP Sequence & Port Number

This article can be read as the second part of the previous article “CCNA: 3-Way Handshake” where we discussed what makes TCP a reliable protocol for transmitting information. Let’s discuss the TCP SEQ and Port numbers in this article.

TCP SEQ Number

Let’s say TCP has been assigned a task to transmit a large file that TCP cannot transfer at once. To make this happen, TCP breaks this large file into smaller chunks and assigns a number that is called the Sequence number. For instance, HTTP application handover “CCNA” to transmit from PC-1 to PC-2. TCP breaks this information into two pieces “CC” and “NA”.

PC-1 assign sequence number 1 to “CC” and sequence number 2 to “NA” data. It sends the first chunk with sequence number 1 to PC-2.

PC-2 receives the information and sends the ACK with number 2. By sending the ACK number 2 PC-2 confirms that it has received the information with SEQ 1, please send the next chunk of information with sequence number 2.

PC-1 now sends the last piece of information “NA” with sequence number 2 as requested by PC-2. PC-2 gets this information and acknowledges PC-1 with Acknowledgement number 3. PC-2 combines the received information into single file and sends it to the application.

TCP Port Number

In a multi-processing environment, there can be multiple applications running on the system. These applications are identified using the port numbers. Port number ensures that relevant application should receive the data for processing.

For example, HTTP uses standard port number 80 and FTP uses standard port number 20. PC-1 sends the data using the standard port number as the destination port during the 3-way handshake process.

When PC-1 receive data from FTP to transmit it sets the destination port number 20 in TCP header. PC-1 uses the port 1026 as a source port number. When PC-1 gets the response from PC-2 for FTP application, it sees the destination port number is 1026 and hands it over to FTP.

This way port number ensures the packets are handed over to correct application. Port Numbers range from 1 to 65535. Well known port number range from 1 to 1024 that are assigned to known applications. Port range 1025 to 65535 are randomly used by the host to be used as source port number.

Hope you find this informative!

Continue Reading...

CCNA: TCP Three-Way Handshake

2024-06-17T07:05:00.009-04:00

CCNA: TCP 3-Way Handshake

In this article, let’s take a look at TCP three-way handshake and other useful information that makes TCP a reliable communication protocol.

Before TCP can send any traffic, it first contacts the other device and establish a reliable and controlled connection. TCP can be considered as a reliable employee to transfer information from PC-1 to PC-2. Let’s consider an example where an HTTP application on PC-1 wants to send data to PC-2. The HTTP data is handed over to TCP for transmission. TCP says wait let me establish a connection with PC-2 to ensure data is sent reliably and a sequence of packets (3-way handshake) happens between the devices.

Figure 1: TCP Three-way Handshake

The three-way handshake process utilizes the fields in TCP headers – Sequence Number (SEQ), the Acknowledgement Number (ACK), the Synchronize flag (SYN), and the ACK flag.

The three-way handshake process is as follows – SYN is sent by source PC-1, SYN-ACK is sent by target PC-2, and ACK from the PC-1 source.

PC-1 starts by creating a TCP packet with no data. It just signals PC-2, “We should start a connection”. PC-1 sets the SEQ = 1, and raises the SYN flag to 1.

PC-2 receives this TCP packet and knows that the Packet is received from PC-1 as the SYN flag is set – PC-1 wants to connect. Now PC-2 informs PC-1 that it received SEQ 1 and now it expect SEQ 2.

PC-2 sends the packet with ACK 2, with both SYN and ACK flag set to 1. In this communication PC-1 and PC-2 sequence numbers are independent. PC-2 sets the SEQ = 11. It means PC-2 is saying “I am using Sequence number 11 to respond to your Sequence number 1”.

PC-1 receives the ACK. PC-1 sends the new packet with SEQ number set to 2 to confirm the PC-2. PC-1 says, “Hey PC-2 you expected the next sequence which is 2 to acknowledge your sequence number 11 and now I expect SEQ 12 from your end”. It sends the ACK and SYN flag raised to 1.

At this point, a reliable communication connection is established. PC-1 and PC-2 both have received and acknowledged a sequence of packets from one another. Now actual data transfer happens.

Let’s say HTTP uses port 80 to identify the application at PC-2, PC-1 chooses Port 80 as the destination port and selects a random port 36000 as the source port.

I hope you find this blog informative!

Continue Reading...

CCNA: Layer 2 Ethernet Frame

2024-06-11T08:18:00.010-04:00

CCNA: Ethernet Frame

Today let’s talk about the Ethernet Frame and its different fields. Understanding the Ethernet Frame and fields helps to understand the communication between systems and troubleshooting when things are not in place.

A typical Ethernet frame looks like the one in Figure 1.

Figure 1: Ethernet Frame

Let’s assume PC 1 receives data from the upper layers of the OSI model, Ethernet here is working as a conveyer. The Upper layers have given Ethernet a payload and asked it to give it to PC 2. The Ethernet wraps the Payload with a header and a trailer. Fields in the headers and their size (in Bytes) are mentioned in Figure 1.

Preamble: this informs the receiving system that a frame is starting and enables the synchronization.

Start Frame Delimiter (SFD): Indicates that the destination MAC address starts with the next byte.

Destination MAC (DMAC): Identifies the NIC of the destination system. In this case PC-2 reads the MAC address and knows DMAC contains its MAC address and I should accept the frame. All other systems on the LAN read the MAC and ignore the frame as the message is not for them as the DMAC value does not match with their hardware address.

Source MAC (SMAC): Identifies the NIC of the source system. This is how a system knows where the message has come from and whom to respond to.

EtherType: this field defines which layer 3 protocol will handle the processing of the frame at the next top layer, such as IPv4 or IPv6.

Payload: It is the data that is transmitted. This data is not just the data application created, but include the header information added by other upper layers i.e. TCP headers – that

Frame Check Sequence (FCS): allows detection of the data corruption during transfer. The methods that are used to find the errors are CRC or checksum. When PC-1 creates a frame, it performs the mathematical calculations on header and payload bits. It stores the result of this calculation in the FCS field. When PC-2 receives the frame, it performs the same calculation, and the result is compared with the FCS value. If the calculated result of PC-2 matches with the FCS value then there is no error during transmission else it is assumed that the data is corrupt – and the frame is discarded.

I hope you find this brief article informative!

Continue Reading...

Understanding "XLATE" (translation) table in Cisco ASA Firewall

2024-06-10T12:13:00.003-04:00

Understanding "XLATE" (translation) table in Cisco ASA Firewall

Many of you already heard about the "XLATE" table in Cisco ASA Firewall but some of you want to understand what exactly it is and what is the purpose of this table.

The "XLATE" table in an ASA firewall represents the translation table used for Network Address Translation (NAT). It's an essential component that keeps track of the mapping between real IP addresses and their translated (mapped) counterparts. This table is required for the firewall to maintain and translate private IP addresses to public ones, allowing communication over the internet.

Fig 1.1- Cisco ASA XLATE Table

Real IP Address: The actual IP address assigned to a device within a private network.
Mapped (Translated) IP Address: The IP address that the real IP is translated to, which is used for communication outside the private network.

The ASA firewall utilizes the XLATE database to manage both dynamic and static NAT translations. Dynamic translations are transitory and will expire if not utilized, whereas static translations are permanent unless manually removed.

Here's what the xlate table stores:

1. Original Source and Destination Addresses: These are the original IP addresses and port numbers of packets when they enter the firewall.

2. Translated Source and Destination Addresses: After performing any NAT or PAT operations, the xlate table stores the translated IP addresses and port numbers.

3. Protocol Information: It comprises information about the protocol being used (e.g., TCP, UDP, ICMP).

4. Session Information: The xlate table stores TCP and UDP session state information, such as established connections and timeouts.

5. Interface Information: It records the ingress and egress interfaces for packets.

6. Security Context: In multi-context mode, when the ASA acts as numerous virtual firewalls, the xlate table additionally contains information about the security context for each translation.

Free Tools...

Why is Cisco ACI replacing traditional networks?

2024-06-10T11:06:00.007-04:00

Why is Cisco ACI replacing traditional networks?

Companies are increasingly moving from traditional networks to SDN-based networks. Cisco ACI is an excellent SDN solution that most companies adopt.

⚡ What is Cisco ACI ? 📜

Cisco Application Centric Infrastructure (ACI) is a Next generation SDN solution and is designed for data centers spine-leaf architecture for the policy-driven solution. Cisco ACI provides application agility and data center automation with simplified operations.

Cisco Application Centric Infrastructure (ACI) uses Spine-Leaf architecture as you know and is typically deployed as two layers: spines (like an aggregation layer), and leaves (like an get right of entry to layer). spine-leaf topologies provide excessive-bandwidth, low-latency, non-blocking server-to-server connectivity.

Let's look at the top nine benefits and characteristics of ACI as compared to traditional networks.

Fig 1.1- Why is Cisco ACI replacing traditional networks?

1. Management Simplification 📜

ACI integrates multiple switches into a single fabric infrastructure. Lets take an example, if you need to configure 50 switches, APIC can do it with a few clicks. If you need to add a new switch, simply connect it to the fabric, and it will instantly inherit all of the APIC policies and configuration. Saving time to login to the CLI of every device and configure helps shorten the overall time of the configuration and implementation.

2. Programmability & Automation📜

ACI has full native programmability using a REST API that enables access to all features. Ansible is another tool that ACI uses for automation. Automation handles frequent recurring updates so you don't have to log into APIC.

3. Access Control & Security📜

ACI provides uniform access policies across the domain, including for remote sites and cloud services. Micro segmentation for the same subnet traffic, even when it is spread over two datacenters.

4. Security devices integration📜

Cisco ACI allows you to establish a firewall or an intrusion prevention system (IPS) between EPGs as a Layer 4–7 service. The security device encrypts east-west traffic across application tiers within EPGs, as well as north-south traffic between users and apps.

5. Virtual Environment Support📜

The inclusion of Virtual Machine Manager (VMM) allows the ACI fabric to extend network policies to the end hosts' virtualization switching layer. ACI can integrate with VMware, Microsoft, OpenStack, Kubernetes, and Open Shift.

6. Network Configuration Failure Recovery📜

In the incident of a failure due to network configuration, ACI changes can be reversed in seconds. It is not always straightforward to roll back changes on a typical network because you may need to enter into several devices manually.

7. Scalability📜

ACI is highly scalable. Adding spine switches increases fabric bandwidth. Adding leaf switches increases end point bandwidth. They will integrate automatically using APIC's setup.

8. Visibility📜

APIC provides full network view from a single pane of glass. It is more than just interface counts and show commands; it provides full end-to-end visibility with built-in dedicated tools.

9. Software Upgrades📜

Download the image and send it to APIC. Push on the fabric. You will not be able to upgrade the entire fabric at once, but using APIC saves time and eliminates the possibility of inconsistencies.

Continue Reading...

Basics of Cisco ACI...

Free Tools...

Cisco Meraki Launches MX650

2024-06-06T16:33:00.004-04:00

Cisco Meraki Launches MX650

New announcement from Cisco Meraki to help you in a very large environment where the site to site throughput required more than 25Gbps. Cisco Meraki launches a new beast device Cisco Meraki MX650 to take its portfolio towards large infrastructure.

The Meraki MX650 is a security and SD-WAN appliance that offers VPN Concentration services for big VPN networks. It is perfect for network administrators that require both ease of use and cutting-edge feature sets. The Meraki dashboard enables the MX650 to be deployed quickly and easily in practically any place.

The MX650 is excellent for datacenter environments that require a high concentration of VPN topologies. Currently, it can only be deployed as a single-armed concentrator, which Meraki also recommends for DC deployments.

When placing a Meraki MX on a DC, it is advised that it be configured as a HUB, with all tunnels from the branches terminated. A second one can be deployed in warm spare mode for redundancy, with no additional licenses required.

Fig 1.1- Cisco Meraki Launches MX650

If you have two datacenters, you can use the DC-DC failover design, which routes traffic to the primary HUB and then fails over to the secondary one in the event of a disaster.

Supported Features

VPN Concentrator Mode
Traffic Analytics (DPI, NBAR)
Client Details Reporting
Intrusion Detection and Prevention (IPS)
Layer 3 Firewall Rules
eBGP
AutoVPN
IPSec VPN

Comparing with Meraki MX450

The MX650 has approximately 5.5 times more VPN throughput (25Gbps) and twice as much advanced security compared to the MX450. It supports an impressive amount of VPN tunnels and devices.

Cisco Meraki MX650, some numbers to compare it with Cisco Meraki MX450

Site-to-Site Throughput - 25 Gbps
Advanced Security - 16 Gbps
Site-to-Site Tunnels - 10 000
Device Count - 50 000

Cisco Meraki MX450

Site-to-Site Throughput - 4.5 Gbps
Advanced Security - 7 Gbps
Site-to-Site Tunnels - 1 500
Device Count - 10 000

Here is the full Datasheet in case you are checking the full specs

MX650 Datasheet - Cisco Meraki Documentation

Continue Reading...

Cisco SDWAN

Free Tools...

CCNA: TCP/IP Stack

2024-06-05T02:20:00.005-04:00

CCNA: TCP/IP Stack

TCP/IP Stack is the most widely used protocol stack. TCP/IP stack is a conceptual model consisting of network communication protocols. It provides end-to-end data communication. It specifies how data should be packetized, addressed, transmitted, and routed across the network.

TCP/IP stack has four layers – Application, Transport, Internet, and Network Interface. As shown in Figure it can be compared with the OSI layer –

Figure 1: TCP/IP vs OSI Model

TCP/IP stack application layer is for user interaction, creating data, deciding the correct format (presentation layer), and managing the sessions (session layers).

The Transport layer of both the models maps directly. The main role of this layer is to maintain the flow and the error control. This establishes the direct end-to-end logical session between two devices. TCP/IP networks use TCP or UDP protocol at this layer.

This OSI layer Network and TCP/IP stack Internet layer perform the same function –route traffic across logical networks using logical addressing and paths. IPv4 and IPv6 are the protocols used at this layer.

The OSI Layer Data Link and Physical layer maps to the Network Interface layer of the TCP/IP stack. This layer includes protocols that relates to physical medium i.e. copper wires, fiber optics, and radio frequency. Ethernet and Wi-Fi are commonly used protocols on this layer.

I hope this small overview of the TCP/IP stack was informative!

Continue Reading...

Introduction to Azure Load Balancer

2024-06-03T11:44:00.012-04:00

Introduction to Azure Load Balancer

Load balancers enable scaling and high availability for applications and services. A load balancer consists of three components: frontend, backend, and routing rules.

Load balancers route requests from the frontend to the backend, where several instances of a service are deployed. This can be used for performance, distributing traffic evenly amongst endpoints in the backend, or for high availability, using several instances of services to ensure at least one endpoint is always accessible.

We will configure Azure internal Load Balancer, Azure Public Load Balancer, Backend Pool, Health probes, Azure load balancer rules, Azure inbound NAT rules and Azure Explicit outbound rules

Fig 1.1- Introduction to Azure Load Balancer

1. Azure Internal Load Balancer

Lets start with creating the load balancer in Azure. As you know that Microsoft supports internal and public load balancers. Here in this section we are going to create an internal Load Balancer.

The internal load balancer is assigned a private IP address from the virtual network's subnet range for the frontend and targets the private IP addresses of backend services (often Azure virtual machines). Internal load balancers are typically used for non-internet-facing services that can only be accessible within the virtual network.

Step 1: Login to the Azure portal with your credentials
https://portal.azure.com

Step 2: Select Create a resource, then Load Balancer under Networking services.

Step 3: In the new pane, we must select a Subscription option and a Resource group option for where the load balancer is to be created. Then, we must provide information for the Name, Region, Type, and SKU options. In this case, we select Internal for Type to deploy an internal load balancer and set SKU to Standard.

Finally, we must select the virtual network and subnet with which the load balancer will be attached, as well as information about the IP address assignment, which can be static or dynamic.

Step 4: After entering all the necessary information, pick the Review + Create option to validate and deploy the load balancer.

2. Azure Public Load Balancer

The second type of load balancer in Azure is the public load balancer. The key difference is that a public load balancer is assigned a public IP address in the frontend and receives requests via the internet. The requests are routed to endpoints in the backend.

Step 1: Login to the Azure portal with your credentials
https://portal.azure.com

Step 2: Select Create a resource, then Load Balancer under Networking services.

Step 3: To create the load balancer, pick the Subscription and Resource group options in the new pane. Next, submit information for Name, Region, Type, and SKU. To deploy a public load balancer, select Public as the type and set SKU to Standard. Choosing Public as the load balancer type will somewhat modify the window.

We won't be able to choose a virtual network or subnet like we could with the internal load balancer. We can select options for Public IP address (new or existing), SKU, assignment, and IPv6.

The load balancer SKU determines the public IP address SKU, which is automatically transferred to the IP address.

Step 4: After entering all the necessary information, pick the Review + Create option to validate and deploy the load balancer.

3. Backend Pool Azure LB

After the load balancer is created, either internally or publicly, we need to configure it further in order to start using it. During the creation process, we define the frontend of the load balancer and know where traffic needs to go to reach the load balancer. But, in order to define where that traffic needs to go after reaching the load balancer, we must first define a backend pool.

Step 1: Login to the Azure portal with your credentials
https://portal.azure.com

Step 2: In order to create the backend pool, we must do the following:

In the Azure portal, locate the previously created load balancer (either internal or

public). In the Load balancer pane, under Settings, select Backend pools. Select Add to

add the new backend pool

Step 3: Click Add and a new pane will open. Here we can add the VMs we want to associate with the backend pool. Note that the VMs must be in the same virtual network as the load balancer and in the same availability set. Select the VMs that you want to add to the backend pool

Step 4: After the VMs are selected, they will appear under the Virtual machines list for creating the pool. Click Add to create the backend pool with the associated VMs

Step 5: The backend pool creation process takes a few minutes after entering the configuration. Following that, the linked resources will appear in the backend pool list.

4. Azure LB Health Probes

After defining the frontend and backend of the load balancer, traffic is distributed evenly to endpoints in the backend. What happens if one of the endpoints is unavailable? If the issue is not detected, some requests may fail temporarily or permanently. The load balancer sends requests to defined endpoints in the backend pool, which fail if directed to an unavailable server.

The load balancer includes two more components: health probes and rules. These components identify issues and define appropriate responses.

Step 1: To create a new health probe in the load balancer, we must do the following:

In the Azure portal, locate the previously created load balancer (either internal

or public). In the Load balancer pane, under Settings, select Health probes. Select Add to

add a new health probe

Step 2: In the Load balancer pane, under Settings, select Health probes. Select Add to add a new health probe. In the new pane, we need to provide information about the health probe's Name and IP version, or Protocol, we want to use, as well as configuring the Port, Interval, and Unhealthy threshold options

Step 3: After we select OK, the new health probe will be created and will appear on the list of available health probes associated with the load balancer

5. Azure LB Rules

The rules bind everything together and specify which health probe (if many) will monitor which backend pool. Rules enable port mapping from a load balancer's frontend to the backend pool, creating port relationships and forwarding incoming traffic.

Step 1: In the Azure portal, locate the previously created load balancer (either internal or public). In the Load balancer pane, under Settings, select Load balancing rules. Select Add to add a load balancing rule

Step 2: To configure a load balancer, enter the name, IP version, frontend IP address (if multiple), protocol, and port mapping (incoming traffic will be redirected to the backend port).

If we enable high-availability ports (only available on internal load balancers), this will remove the protocol options and enable load balancing on all ports for TCP and UDP protocols. Furthermore, we need to provide information for the Backend Port, Backend pool, Health probe, Session persistence, and Idle timeout (minutes) settings, and decide whether we want to use a Floating IP.

Step 3: After we select OK, a new rule will be created, which will appear on the list of available load balancing rules.

Frontend IP address is used and which backend the pool traffic will be forwarded to. The health probe is assigned to monitor the endpoints in the backend pool and to keep track of whether there are any unresponsive endpoints. We also create a port mapping that will determine which protocol and port the load balancer will listen on and, when the traffic arrives, where this traffic will be forwarded.

As its default distribution mode, Azure Load Balancer uses a five-tuple hash (source IP, source port, destination IP, destination port, and protocol type). If we change the session persistence to Client IP, the distribution will be two-tuple (requests from the same client IP address will be handled by the same VM). Changing session persistence to Client IP and protocol will change the distribution to three-tuple (requests from the same client IP address and protocol combination will be handled by the same VM).

6. Azure LB inbound NAT Rules

Azure Load Balancer has the option to enable inbound network address translation (NAT) rules. These rules redirect traffic from a certain port on the frontend to a specific port on the backend.

Inbound NAT rules direct traffic to a specific VM, whereas load balancer rules route traffic to a backend pool.

Step 1: Login to the Azure portal with your credentials
https://portal.azure.com

Step 2: In the Azure portal, locate the previously created load balancer (either internal or public). In the Load balancer pane, under Settings, select Inbound NAT rules. Select Add to add a new inbound NAT rule.

Step 3: we must enter information for the Name, Frontend IP address, IP Version (determined by the frontend IP address), Service, Protocol, and Port sections. We may also change the Idle timeout, which is set at four minutes by default. Choose Target virtual machine and Network IP configuration for the same machine (if the VM has several IP configurations).

Step 4: After we select OK, a new inbound NAT rule will be created.

7. Azure LB Explicit Outbound Rules

When creating load balancing rules, we can create implicit outbound rules. This will enable Source Network Address Translation (SNAT) for VMs in the backend pool and allow them to access the internet over the load balancer's public IP address (specified in the rule).

However, in some cases, implicit rules are insufficient, and we must define explicit outbound rules. Only public load balancers with the Standard SKU support explicit outbound rules (and SNAT in general).

Step 1: In the Azure portal, locate the previously created public load balancer. In the Load balancer pane, under Settings, select Outbound rules. Select Add to add the load balancing rule

Step 2: In the Outbound rules pane, enter the rule name and pick the Frontend IP address, Protocol (All, TCP, or UDP), Idle timeout, TCP reset, and Backend pool fields. To allocate ports, select options for port allocation, outbound ports, ports per instance (disabled when the maximum number of backend instances is selected), and maximum number of backend instances.

Outbound rules are based on frontend IP addresses, backend pool instances, and connections. Frontend IP addresses have a restricted number of available ports for connections.

Assigning extra IP addresses to the frontend increases the number of authorized connections. However, the number of connections per backend instance reduces as the number of instances increases.

If we set the default number of outbound ports, they are allocated automatically and without our intervention. If a VM scale set contains the default number of instances, port allocation is automatically performed for each VM. As the number of instances in a scale set increases, each VM's port allocation decreases.

To prevent this, change port allocation to manual and limit the number of instances or ports per instance. This ensures each VM has dedicated ports and prevents connection drops.

Continue Reading...

Free Tools...

Cisco Firepower : FMC SQL Injection Vulnerability

2024-05-28T16:37:00.007-04:00

Cisco Firepower : FMC SQL Injection Vulnerability

About the new Vulnerability

Vulnerability: CVE-2024-20360
Advisory ID: cisco-sa-fmc-sqli-WFFDnNOs

An authenticated, remote attacker might use a vulnerability in Cisco Firepower administration Center (FMC) Software's web-based administration interface to carry out SQL injection attacks on an affected system.

This vulnerability exists because the web-based management interface fails to properly check user input. An attacker could exploit this vulnerability by authenticating with the application and sending crafted SQL queries to an affected system. A successful vulnerability could allow the attacker to extract any data from the database, run arbitrary instructions on the underlying operating system, and gain root access. To exploit this issue, an attacker would require at least Read Only user credentials.

This issue affects devices running a vulnerable version of Cisco FMC Software, regardless of device configuration.

As per cisco, There are no workarounds that address this vulnerability.

Full Read: Cisco Firepower Management Center Software SQL Injection Vulnerability

Free Tools...

Cisco SDWAN: No control connection but need tunnel between TLOC

2024-05-28T12:57:00.008-04:00

No control connection but need tunnel between TLOC

Some of the design requirement where customer wants IPsec tunnels between the TLOCs using restrict option but they don't want to setup control connection with the SDWAN controllers. This has been asked many times. we can achieve this with the configuration on the feature template that will be used for the specific TLOC interface.

Fig 1.1- Cisco SDWAN Control Connections

Let's take an example , Lets us suppose we have a requirement which says my TLOC color MPLS create a tunnel with other sites MPLS interfaces but we don't want my MPLS create a control connection with the sdwan controllers. Although this is not a recommended design but sometimes we have multiple control connections and we don't want this specific color to have control connection.

Step 1: Go to Cisco SDWAN >>> Configuration >> Templates as shown below

Step 2: now click on Feature template and create a new interface feature template as below

Feature Template >>>> Cisco VPN Interface Ethernet , Give name to the template and go to the Tunnel and configure for "Maximum control connections = 0"

Step 3: Rest all configurations are same as you did for your other office using TLOC MPLS. Now import this interface feature template into your device template and implement. This will help you no to create any control connection with the controllers but you still can have TLOC tunnels with other sites.

Continue Reading...

Cisco SDWAN

Free Tools...