Curiefense is a new, open source Web application firewall designed for cloud-native environments. Currently a "sandbox" project in the Cloud Native Computing Foundation, Curiefense is now generally available.
The post Curiefense, A New Open Source Web App Firewall, Tackles Cloud-Native Security appeared first on Packet Pushers.
Martez Reed, Director of Technical Marketing at Morpheus Data, joins the Day Two Cloud podcast for a discussion. To hear this entire conversation, GO HERE. And hey, have a great day. Youâre doing an outstanding job. đ You can subscribe to the Packet Pushersâ YouTube channel for more videos as they are published. Itâs a [âŚ]
The post What Is Technical Marketing?đłđ§ â Video appeared first on Packet Pushers.
A few months ago I described how you could use JSON Schema to validate your automation data models, host/group variable files, or even Ansible inventory file.
I had to use a weird toolchain to get it done â either ansible-inventory to build a complete data model from various inventory sources, or yq to convert YAML to JSON⌠and just for the giggles jsonschema CLI command requires the JSON input to reside in a file, so you have to use a temporary file to get the job done.
Artificial Intelligence is useful, powerful, and dangerous when used irresponsibly. Its being leveraged by a wide variety of industries including but not limited to social media, defense contractors and information security companies. Some of the dangers created by the use of AI are overt while others are very subtle. For example, the ongoing rapid development of autonomous weapons is overt while the use of AI in social media is subtle and possibly more damaging. The AI used in various social media platforms is in part responsible for the current divide here in the united states.
Artificial intelligence (AI) occupies an unusual position in the public consciousness. On the one hand, every cybersecurity solution â and a number in other tech industries as well â seems to contain âAIâ, a claim that carries varying levels of truth. On the other hand, many of the things that most people think of as AI â such as general intelligence, conscious robots, etc. â have not yet been created.
While âtraditionalâ popular conceptions of AI are still in the future, AI is a very real part of our daily lives today. AI already shapes how people think and behave â often without their knowledge â and other parts of daily life.
This article launches a series on the modern use of AI. This series discusses some of the ways in which AI is commonly used today and the cybersecurity considerations of AI-based systems.
AI has effects on many different aspects of daily life. Some of the biggest areas where AI plays a critical role in society include:
These three topics will be the focus of the next few articles in this series. In each, we will dive into the details of how AI is used in each of these particular scenarios, what they do right, and where they go wrong.
As we become more reliant on AI as part of our daily lives, it is also important to consider the security of AI systems. What makes an infosec AI system effective or ineffective? Is it possible to âhackâ AI in ways beyond standard IT security?
The final two articles in this series will deal with the security of AI systems:
Being âdata drivenâ is a goal of most organizations, and AI systems are a crucial part of accomplishing this. As organizations continue to develop and deploy AI solutions, it is essential to understand the capabilities of AI and where things can go wrong.
This series dives into the modern use of AI. It explores how AI is used today, the risks and benefits to its creators and other parties, and the security considerations of AI-based systems.
The post AI Series Part 1: Introduction to the Modern Threats of AI appeared first on Netragard.
One of my readers sent me this question:
My job required me to determine if one IP address is unicast or anycast. Is it possible to get this information from the bgp dump?
TL&DR: Not with anything close to 100% reliability.
If youâre not familiar with IP anycast: itâs a brilliant idea of advertising the same prefix from multiple independent locations, or the same IP address from multiple servers. Works like a charm for UDP (thatâs how all root DNS servers are built) and supposedly pretty well across distant-enough locations for TCP (with a long list of caveats when used within a data center).
In-person events will return some day. In the meantime, a huge crop of tech companies and investors are betting that virtual events can thrive not just during a pandemic, but beyond.
The post Betting On Virtual Events In A Post-Covid World appeared first on Packet Pushers.
One aspect of networking is that some understanding of the protocols using the network is required. As HTTPS replaces nearly all other protocols I would suggest that everyone needs a working understanding of how a web page is fetched by a web browser. WebPageTest is a community tool that reads web pages and then displays [âŚ]Now that you know all about regions and availability zones (AZ) and the ways AWS and Azure implement subnets, letâs get to the crux of the original question Daniel Dib sent me:
As I understand it, subnets in Azure span availability zones. Do you see any drawback to this? You mentioned that itâs difficult to create application swimlanes that way. But does subnet matter if your VMs are in different AZs?
Itâs time I explain the concepts of application swimlanes and how they apply to availability zones in public clouds.
Up to a year to patch a modest Linux kernel vulnerabilityA while ago Antti Leimio wrote a long twitter thread describing his frustrations with Cisco ACI object model. I asked him for permission to repost the whole thread as those things tend to get lost, and he graciously allowed me to do it, so here we go.
I took a 5 days Cisco DCACI course. This is all new to me. Iâm confused. Who is ACI for? Capabilities and completeness of features is fantastic but how to manage this complex system?
Juniper Networks is rebuilding its enterprise SD-WAN strategy around the Session-Smart Router (SSR) from 128 Technology, which Juniper acquired in October 2020. The Session-Smart Router integrates with Juniper's Mist AI platform and will replace Contrail Service Orchestration as its enterprise SD-WAN play.
The post Juniper Rebuilds Its Enterprise SD-WAN Strategy With The Session-Smart Router appeared first on Packet Pushers.
We all know that building snowflake networks is bad, right? If itâs not a repeatable process itâs going to end up being a problem down the road. If we canât refer back to documentation to shows why we did something weâre going to end up causing issues and reducing reliability. But what happens when a snowflake process is required to fix a bigger problem? Itâs a fun story that highlights where process can break down sometimes.
Iâve mentioned before that I spent about six months doing telephone tech support for Gateway computers. This was back in 2003 so Windows XP was the hottest operating system out there. The nature of support means that youâre going to be spending more time working on older things. In my case this was Windows 95 and 98. Windows 98 was a pain but it was easy to work on.
One of the most common processes we had for Windows 98 was a system reload. It was the last line of defense to fix massive issues or remove viruses. It was something that was second nature to any of the technicians on the help desk:
The whole process took two or three phone calls to complete. Any time you got to something that would take more than fifteen minutes to complete you logged the steps in the customer trouble ticket and had them call back when it was completed. The process was so standard that it had its own acronym in the documentation â FFR, which stood for âFDISK, Format, Reloadâ. If you told someone where you were in the process they could finish it no problem.
The whole process was manual with lots of steps and could intimidate customers. At some point in the development process the Gateway folks came up with a solution for Windows ME that they thought worked better. Instead of the manual steps of copying files and drivers and such, Gateway loaded the OS CD with a copy of the image they wanted for their specific model type. The image was installed using ImageCast, an imaging program that just dropped the image down on the drive without the need to do all the other steps. In theory, it was simple and reduced call times for the help desk.
In practice, Windows ME was a disaster to work on. The ImageCast program worked about half the time. If you didnât pick the right options in the reload process it would partition the hard drive and add a second clean copy of WinME without removing the first one. It would change the MBR to have two installations to choose from with the same identifiers so users would get confused as to which was which. And the image itself seemed to be missing programs and drivers. The fact that there was a Driver CD that shipped with the system made us all wonder what the real idea behind this âimprovedâ process was.
Because Windows ME was such a nightmare to reload, our call center got creative. We had a process that worked for Windows 98. We had all the files we needed on the disks. Why not do it the ârightâ way? So we did. Informally, the reload process for Windows ME was the same as Windows 98. We would FFR Windows ME boxes and make sure they looked right when they came back. No crazy ImageCasting programs or broken software loads.
The only issue? It was an informal snowflake process. It worked much better but if someone called the main help desk number and got another call center they would be in the middle of an unsupported process. The other call center tech would simply start the regular process and screw up the work weâd done already. To counter that, we would tell the customer to call our special callback voicemail box and not do anything until we called them back. That meant the reload process took many more hours for an already unhappy customer. The end result was better but could lead to frustrations.
Was our informal snowflake process good or bad? Itâs tough to say. It led to happier customers. It meant the likelihood of future support calls was lower because the system was properly reloaded instead of relying on a broken image. However, it was stressful for the tech that worked on the ticket because they had to own the process the whole way through. It also meant that you had to ensure the customer wouldnât call back and disrupt the process with someone else on the phone.
The process was broken and it needed to be fixed. However, the way to fix the broken process wasnât easy to figure out. The national line had their process and they were going to stick to it. We came up with an alternative but it wasnât going to be adopted. Yet, we still kept using our process as often as possible because we felt we were right.
In your enterprise, you need to understand process. Small companies need processes that are repeatable for the ease of their employees. Large companies need processes to keep things consistent. Many companies that face regulatory oversight need processes followed exactly to ensure compliance. The ability to go rogue and just do it the way you want isnât always desired.
If you have users that are going around the process you need to find out why. We see it all the time. Security rules that get ignored. Documentation requirements that are given the bare minimum effort. Remember the shutdown dialog box in Windows Server 2003? Most people did a token entry before rebooting. And having eighteen entries of â;lkj;kljl;kâ doesnât help figure out whatâs going on.
Get your users to tell you why they need a snowflake process. Especially if thereâs more than one person relying on it. The odds are very good that theyâve found hiccups that you need to address. Maybe itâs data entry for old systems. Perhaps itâs problem with the requirements or the order of the steps. Whatever it is you have to understand it and fix it. The snowflake may be a better way to do things. You have to investigate and figure it out otherwise your processes will be forever broken.
Inbound tech support is full of stories like these. We find a broken process and we go around it. Itâs not always the best solution but itâs the one that works for us. However, building a toolbox full of snowflake processes and solutions that no one else knows about is a path to headaches. You need to model your process around what people need to accomplish and how they do it instead of just assuming theyâre going to shoehorn their workflow into your checklist. If you process doesnât work for your people, youâd better get a handle on the situation before youâre buried in a blizzard of snowflakes.
Responding to Eyvonne's piece on escalationI concluded the Focus on Business Challenges First presentation (part of Business Aspects of Networking Technologies webinar) with a few technology guidelines starting with:
For more guidelines, watch the video (available with Free ipSpace.net Subscription).
Browsers keep users safe from excessive user trackingEvery now and then Iâm getting questions along the lines âwhy doesnât X support unequal-cost multipathing (UCMP)?â for X in [ OSPF, BGP, IS-IS ].
To set the record straight: BGP does support some rudimentary form of unequal-cost multipathing with the DMZ Bandwidth community, but it only works across multiple egress points from a single autonomous system. Follow-up nerd knobs described how to use the same community over EBGP sessions; not sure whether anyone implemented that part (comments welcome).
One of my readers was âblessedâ with the stretched VLANs requirement combined with the need for inter-VLAN routing and sub-par equipment from a vendor not exactly known for their data center switching products. Before going on, you might want to read his description of the challenge heâs facing and what I had to say about the idea of building stackable switches across multiple locations.
Hereâs an overview diagram of what my reader was facing. The core switches in each location work as a single device (virtual chassis), and thereâs MLAG between core and edge switches. The early 2000s just called and they were proud of the design (but to be honest, sometimes one has to work with the tools his boss bought, soâŚ).
Now that we know what regions and availability zones are, letâs go back to Daniel Dibâs question:
As I understand it, subnets in Azure span availability zones. Do you see any drawback to this? Does subnet matter if your VMs are in different AZs?
Wait, what? A subnet is stretched across multiple failure domains? Didnât Ivan claim thatâs ridiculous?
TL&DR: What I claimed was that a single layer-2 network is a single failure domain. Things are a bit more complex in public clouds. Keep reading and youâll find out why.
A few weeks ago Adrian Giacometti described a no-stretched-VLANs disaster recovery design he used for one of his customers.
The blog post and related LinkedIn posts generated tons of comments (and objections from the usual suspects), prompting Adrian to write a sequel describing the design requirements he was facing, tradeoffs he made, and interactions between server and networking team needed to make it happen.
The next time youâre about to whimper how you canât do anything to get rid of stretched VLANs (or some other stupidity) because whatever, take a few minutes and read How To Put Faith in UX Design by Scott Berkun, mentally replacing UX Design with Network Design. Hereâs the part I loved most:
[⌠]there are only three reasonable choices:
- Move into a role where you make the important decisions.
- Become better at influencing decision makers.
- Find a place to work that has higher standards (or start your own).
Unfortunately the most common choice might be #4: complain and/or do nothing.
Andy Jassy, the top executive at AWS, will step into the role of CEO of Amazon some time in 2021. Who will take over at AWS? It doesnât really matter. Hereâs why: 1. The operating model and corporate culture are in place Amazon spent years developing an effective way to share infrastructure within the organization. [âŚ]
The post 4 Reasons The Next CEO Of AWS Doesnât Really Matter appeared first on Packet Pushers.
In this Day Two Cloud podcast clip, we discuss whether the code we use to manage our infrastructure and the code we use for our applications should be stored in different repositories. To hear the entire episode, go to Day Two Cloud 085: Hosting Your Infrastructure Code In The Cloud. Hosts Ned Bellavance and Ethan [âŚ]
The post Should App Code & IaC Be In Separate Repositories? â Video appeared first on Packet Pushers.
Itâs amazing to me that itâs been ten years since I attended by first Tech Field Day event. I remember being excited to be invited to Tech Field Day 5 and then having to rush out of town a day early to beat a blizzard to be able to attend. Given that we just went through another blizzard here I thought the timing was appropriate.
How did attending an industry event change my life? How could something with only a dozen people over a couple of days change the way I looked at my career? I know Iâve mentioned parts of this to people in the past but I feel like itâs important to talk about how each piece of the puzzle built on the rest to get me to where I am today.
The first thing Tech Field Day did to change my life was to show me that I mattered. I grew up in a very small town and spent most of my formative school years being bored. The Internet didnât exist in a usable form for me. I devoured information wherever I could find it. And I languished as I realized that I needed more to keep learning at the pace I wanted. When I finally got through college and started working in my career the same thing kept happening. I would learn about a subject and keep devouring that knowledge until I exhausted it. Yet I still wanted more.
Tech Field Day reinforced that my decision to start a blog to share what I was learning was the right one. It wasnât as much about the learning as it was the explanation. Early on I thought a blog was just about finding some esoteric configuration stanza and writing about it. It wasnât until later on that I figured out that my analysis and understanding and explanation was more important overall. Even my latest posts about more âsoft skillâ kinds of ideas are less about the ideas and how I apply them.
Blogging and podcasting are just tools to share the ideas that we have. We all have our own perspectives and people enjoy listening to those. They may not always agree. They may have their own opinions that they want to share. However, the part that is super critical is that everyone is able to share in a place where they can be discussed and analyzed and understood. As long as we all learn and grow from what we share then the process works. Itâs when we stop learning and sharing and try to protest that our way is right and the only way that we stop growing.
Tech Field Day gave me the platform to see that my voice mattered and that people listened. Not just read. Not just shared. That they listened and that they wanted to hear more. People started asking me to comment on things outside of my comfort zone. Maybe it was wireless networking. It could have been storage or virtualization or even AI. It encouraged me to learn more and more because who I was and what I said was interesting. The young kid that could never find someone to listen when I wanted to talk about Star Wars or BattleTech or Advanced Dungeons and Dragons was suddenly the adult that everyone wanted to ask questions to. It changed the way I looked at how I shared with people for the better.
The second way Tech Field Day changed my life was when Iâd finally had enough of what I was doing. Because of all the things that I had seen in my events from 2011 to 2013, I realized that working as an engineer and operations person for a reseller had a ceiling I was quickly going to hit. The challenges were less fun and more frustrating. I could see technology on the horizon and I didnât have a path to get to a place to implement it. It felt like watching something cool happening outside in the yard while I was stuck inside washing the dishes.
Thankfully, Stephen Foskett knew what I needed to hear. When I expressed frustration he encouraged me to look around for what I wanted. When I tried to find a different line of work that didnât understand why I blogged, it crystallized in me that I needed something very different from what I was doing. Changing who I was working for wasnât enough. I needed something different.
Stephen recognized that and told me he wanted me to come on board without him. No joking that my job offer was âDo you want to be the Dread Pirate Roberts? I think youâd make an excellent Dread Pirate.â. He told me that it was hard work and unlike anything Iâd ever done. No more CLI. No more router installations. In place of that would be event planning and video editing and taking briefings from companies all over the place about what they were building. I laughed and told him I was in.
And for the past eight years Iâve been a part of the thing that showed me that my voice mattered. As I learned the ropes to support the events and eventually started running them myself, I also grew as a person in a different way. I stopped by shy and reserved and came out of my shell. When youâre the face of the event you donât have time to be hiding in the corner. I learned how to talk to people. I also learned how to listen and not just wait for my turn to talk. I figured out how to get people to talk about themselves when they didnât want to.
Now the person I am is different from the nerdy kid that started a blog over ten years ago. Itâs not just that I know more. Or that Iâm willing to share it with people. It has now changed into getting info and sharing it. Itâs about finding great people and building them up like I was built up. Every time I see someone come to the event for the first time Iâm reminded of me all those years ago trying to figure out what Iâd gotten myself into. Watching people learn the same things Iâve learned all over again warms my heart and shows me that we can change people for the better by showing them what theyâre capable of and that they matter.
Tech Field Day isnât an event of thousands. Itâs personal and important to those that attend and participate. Itâs not going to stop global warming or save the whales. Instead, itâs about the people that come. Itâs about showing them they matter and that they have a voice and that people listen. Itâs about helping people grow and become something they may not even realize theyâre capable of. I know I sound biased because the pay the bills but even if I didnât work there right now I would still be thankful for my time as a delegate and for the way that I was able to grow from those early days into a better member of the community. My life was changed when I got on that airplane ten years ago and I couldnât be happier.
In January, Jason Edelman kindly invited me for a chat about the state of (software defined) networking and network automation in particular. The recording was recently published on Network Collective.
Not content with having dug the Northbound Networks Zodiac FX out of a pile of overlooked technology in my office, I thought that the poor thing desperately needed to have a case to sit in. When I originally received the switch, I did not have a 3D printer and had no idea what it would take to make a case; now though, I do have a 3D printer ⌠and no idea what it would take to make a case. Sounds like a plan to me!
The most important tool I bought to go with my 3D printer (a Creality CR6-SE) was some digital calipers. I discovered early on how important it was to ensure that if I was going to screw up, I should be able to screw up accurately.
<figure class="wp-block-image size-large">
</figure>
These calipers are made by RexBeti, and if youâve never heard of that company thatâs ok, because before I purchased this I hadnât either. The calipers claim to be accurate to 0.01mm, but I donât have any way to validate that claim, so letâs just assume that they are. I do know that it beats using a ruler. A few minutes of careful mismeasurement later and I had a page of diagrams showing all the critical dimensions of the switch board from which I could use to create sketches in Fusion360 and hopefully generate some kind of 3D model.
In the end I went with a pretty simple design; purely functional, no chamfering or filleting of the edges, and a simple clip system on the side to close the case. The base and lid are shown here in Cura (preparing to be printed):
<figure class="wp-block-image size-large">
</figure>
Holding the board in place without screws was achieved in part by making the base a close fit to the size of the board and designing it so that the board would sit inside it, then using a combination of rigid components on the lid which would press down on the board to hold in in place. There are small pieces in each corner which sit against the board, and there is also a bar running across the top the ethernet ports.
The Zodiac FX has a power LED, but itâs on the board at the back left hand side which is not ideal unless you fancy making some kind of light pipe to bring that light to the front of the switch, which I do not. Therefore I decided to print the case in crystal PLA which is translucent enough to allow the green LED to diffuse through the case and be visible from the outside. A regular, opaque PLA would not have done this and would not be as pretty. This decision also meant that I printed with 100% infill, because seeing the cubic infill pattern at 40% infill is cute, but not great. The results were pretty acceptable, all things considered:
<figure class="wp-block-image size-large">
</figure>
<figure class="wp-block-image size-large">
</figure>
I then added the board to the base, and ensured that it fit correctly.
<figure class="wp-block-image size-large">
</figure>
Then I added the lid, clicked the clips into place, and plugged in the power!
<figure class="wp-block-image size-large">
</figure>
Not bad for a quick job. The tolerances are quite tight, so may need tweaking depending on the materials and printing environment, but this worked well for me and my set up (Creality CR6-SE, IIID+ Crystal PLA+ filament, 0.2mm layer height, 80mm/s fill, 40mm/s walls, 200degC hot end, 65degC base, no supports). I got a very small bit of elephantâs foot in one corner of the base, but it wasnât significant enough to consider reprinting.
I know that there are literally thousands of you who have been waiting for this, so of course my Zodiac FX Case is on Thingiverse. Iâve posted the STL files there as well as a STEP file for those who really hate themselves. Believe it or not, thereâs another case design on Thingiverse from 2016, as it turns out; so now there are two.
Ok, that was fun. Does that mean I have to do something with it now?
If you liked this post, please do click through to the source at Zodiac FX Gets a 3D Printed Case and give me a share/like. Thank you!
Bandwidth map of global internetLast year I wrote an article describing data model optimization going from a simple this is what we need to configure individual devices to a highly polished high-level network nodes and links model. Not surprisingly, as Jeremy Schulman was quick to point out, the latter one had Jinja2 templates you wouldnât want to debug. Ever. You canât run away from complexity⌠but you can manage it.
Many successful network automation solutions (example: Cisco NSO) solve the âweâd love to work with high-level data models but hate complex templatesâ challenge with data transformation: operators work with an abstracted data model describing services, nodes and links, and the device configuration templates use low-level data derived from the abstracted data models through a series of business logic rules or lookups (aka network design).
The following post is aimed for photographers and other digital hoarders. Those of us that want to keep various digital assets not just for a few years, but a lifetime, and even multiple lifetimes (passed down, etc.)
There are three levels of data protection: Data resiliency, data backup, and data archive.
Data resiliency is when you have multiple disks in some sort of redundant configuration. Typically this is some type of RAID array, through there are other technologies now that operate similar to RAID (such as ZFS, Storage Spaces, etc.) This will protect you from a drive failure. It will not, however, protect you from accidental file deletion, theft, flood/natural disaster, etc. The drives have the same file system on them, and thus have a lot of âshared fateâ, where if something happens to one, it can happen to the other.
To put it simply, while there are some scenarios where your data is protected by data resiliency (drive failure), there are scenarios where it wonât (flood, theft).
RAID is not backup.
One of the maxims we have in the IT industry in which Iâve worked for the past 20 years is RAID is not backup. As stated in the previous section, there are scenarios where RAID will not keep your data safe. What will make it safer in the short term is to have a good backup solution. Data backup is not generally a long-term solution, but it is something thatâs good to have.
A data backup is a mechanism where files are copied from your active environment to a non-active environment. Probably the best general backup mechanism Iâve seen is Time Machine from Apple. You can designate a drive, typically an external one, and the system automatically backs up files to that drive. You can browse the history of your file and file systems and retrieve something you deleted months ago.
There are lots of cloud solutions now, where your data is backed up to a cloud service like Dropbox, Backblaze, etc. Short term, I like these solutions. I do not like them for long term solutions.
I donât like them for archive.
Backup is not archive.
Archive is probably what most of us really want long term. Our treasured photos, memories, projects, etc., we want to keep them forever. Not only do we want them to last our entire lifetime, we want to be able to pass them to our heirs.
Over the years and decades, your data will have different homes. Multiple drives or even arrays, copied from one to the other.
I donât like any backup solutions for archive, as backup solutions are too tied to a particular platform. The best backup solution is putting your files in a file structure.
For photos, I prefer having the JPEGs, raw files, HEIFs, etc., just in file systems. I donât like them stored in photo management systems like Apple Photos or Adobe Lightroom. These systems change/evolve over time, and it can make accessing them a decade from now difficult. Iâve run into this with Apple iPhotos, which transitioned to Photos a few years ago. Photos will convert an older iPhotos repos into Photos, but itâs not always perfect. Itâs just much easier to have the basic files in a basic file structure.
These files will be copied onto multiple hard drives so there are multiple copies, and moved every few years (about 5 years or so) since hard drives have a limited life span.
Archive can often be associated with backup, but I like to keep the two distinct, as I feel there are different strategies between them.
Conclusion
Thereâs a lot more details that go into these three concepts of course, but I hope this will get you thinking about your long term plan for your treasured files.
The network was definitely up, and had been up. There was nothing in the logs indicating link flaps, spanning-tree convergence events, or routing process adjacency changes. The packets had been, were presently, and presumably would forever be flowing. Flowing like a river. I was pondering this inaccurate version of reality because of an annoying ticket that wouldnât go away...
The post Preempting Gray Failures With AI/ML appeared first on Packet Pushers.
One of my readers sent me this interesting question:
Assuming we are running a very large OSPF area with a few thousand nodes. If we follow the chain reaction of OSPF LSA flooding while the network is converging at the same time, how would all routers come to know that they all now have same view of area link states and there are no further updates or convergence?
I have bad news: the design requirements for link state protocols effectively prevent that idea from ever working well.
Recent versions of firmware (after v0.80) running on the Northbound Networks Zodiac FX can be updated directly from the web interface, or using XMODEM via the serial console. But what if, say, you had sat one your Zodiac FX for a while and are running firmware earlier than v0.81 and have a sudden, unexpected desire to upgrade the firmware? Say you are, for example, me?
The process turned out to be less straightforward than I had hoped, so I am documenting the successful steps I followed in case itâs of use to somebody else.
Back in 2015 I backed a Kickstarter project for this awesome-sounding four-port FastEthernet SDN switch with OpenFlow support. It sounded so cool that I even ordered a two-pack as I thought it would be more fun to have two OpenFlow switches to mess around with). The project was funded successfully, but embarrassingly when the beautifully-made boards arrived in early 2016, for some reason I never quite got around to playing with them. I think it was in part because it was just a printed circuit board without a case and without easy access to 3D printing I was turned off trying to use them. In retrospect I realized that have very kind friends who have 3D printers and while I couldnât reasonably ask them to actually design the case for me, somebody else did eventually put up a Zodiac FX case on Thingiverse (although to be honest it doesnât look great and I intend to design my own, hopefully better case).
Either way, the boards languished in my office/lab space at home until this week when I stumbled across one of them again and thought âOh, I wonder whatâs going on with Northboundâ and discovered the unfortunate reality of what 2020 did to Paul Zannaâs creation. Nonetheless, the hardware still works, so thereâs no time like the present to upgrade the firmware, right? And thatâs where you join me in my journey.
The most important thing to have in this process will turn out to be a working USB to MicroUSB cable connecting a host PC to the Zodiac board. The USB cable powers the board and also offers a serial console connection to the host. In order to upgrade the firmware, the host computer must be able to see and use the serial console connection over the USB.
In my case, I am running macOS Catalina and when I plugged in the Zodiac FX, a new device appeared in /dev, tty.usbmodem1412401. This turned out to be the Zodiac switch, as a quick test was able to validate. After entering screen, hit ENTER a couple of times to trigger a response:
~$ screen /dev/tty.usbmodem1412401
_____ ___ _______ __
/__ / ____ ____/ (_)___ ______ / ____/ |/ /
/ / / __ \/ __ / / __ `/ ___/ / /_ | /
/ /__/ /_/ / /_/ / / /_/ / /__ / __/ / |
/____/\____/\__,_/_/\__,_/\___/ /_/ /_/|_|
by Northbound Networks
Type 'help' for a list of available commands
Zodiac_FX# show status
----------------------------------------------------------------
Device Status
Firmware Version: 0.57
CPU Temp: 27 C
Uptime: 00:00:50
----------------------------------------------------------------
Zodiac_FX#
Bingo bingo, itâs alive and itâs running an old firmware version! To disconnect from the screen session, use Ctrl-A then Ctrl-D. Linux users should have a similar experience, but Windows users may need to install a USB driver before they see the USB device as a COM port; I have only tested it in macOS so far.
The full procedure can be found in section 2.3 of the Northbound Networks Zodiac FX User Manual, a copy of which I am mirroring here just in case the original becomes unavailable.
In brief, the steps are to download the âfull installâ firmware file (currently v0.86), then:
Steps 1 to 4 went just fine and the board flash was erased successfully, ready to be programmed just in time for me to discover that the link to the Atmel SAM-BA Programmer software from the Northbound Networks update page no longer works (I wonât include it here since itâs broken). The next problem was that when I located a download for Atmel SAM-BA (now Microchip SAM-BA since Microchip acquired Atmel), I found that it was only available for Windows and Linux, but since I had a Windows device available I decided to use that. Unfortunately, despite the February 2020 release date, the software simply did not seem to work in Windows 10 and left complaints about DCOM permissions in the event log. I would have used linux, but I did not have a suitable host on which to map a USB device through to the guest OS.
In the end I discovered Shumatechâs BOSSA, an open-source replacement for Atmelâs SAM-BA which is available for Windows, Linux and macOS. Installation was slightly tricky, in that the installer not only requires the application to be dragged on an Applications folder shortcut, but also requires two CLI tools (bossac and bossash) to be dragged on to a folder shortcut to /usr/local/bin and macOS apparently does not like doing that. However, double clicking on the bin icon opens up the folder in Finder, and the two CLI tools can then be dragged from the installer to the Finder window instead:
</figure>
With that minor annoyance resolved, it was time to go to the shell and see if BOSSA worked as advertised.
With the Zodiac board plugged in and powered up on USB, I tried the bossash utility first to confirm if it could communicate with the device, and was delighted to see that it could:
~$ bossash bossa> connect tty.usbmodem1412401 Connected to device on tty.usbmodem1412401 bossa> info Device : ATSAM4E8 Version : v1.0 May 10 2012 18:12:25 Address : 0x400000 Pages : 1024 Page Size : 512 bytes Total Size : 512KB Planes : 1 Lock Regions : 64 Locked : none Security : false Boot Flash : false bossa>
Thatâs good news, so then I tried using the bossac tool to install the âfull installâ binary. I selected the command line options based on comments in the user manual like:
When the âLock region(s)â pop-up window appears select âNoâ
I converted that to the option --unlock. Similarly:
Under the âScriptsâ section, select âBoot from Flash (GPNVM1)â from the drop down list
âŚbecame --boot=1 (0 is ROM, 1 is flash). Itâs actually the default, but I prefer setting an explicit option for clarity. The final result was as follows:
~$ bossac --erase --verify --port=tty.usbmodem1412401 --write ZodiacFX_v86_Full_Install.bin --unlock --boot=1 Unlock all regions Erase flash Done in 4.777 seconds Write 499284 bytes to flash (976 pages) [==============================] 100% (976/976 pages) Done in 16.924 seconds Verify 499284 bytes of flash [==============================] 100% (976/976 pages) Verify successful Done in 13.204 seconds Set boot flash true ~$
With a successful write showing, I powercycled the board and connected to the serial power expecting to see the Zodiac FX prompt, but it was not to be:
[Connected] Zodiac FX BIOS 1.10 No firmware installed, please type 'upload' to install new firmware.
If there is no firmware installed then what exactly did I just do with BOSSA? It took me a moment to realize, but thereâs a subtle clue here. The option to upload a firmware update via the serial port was added in v0.81, and the BIOS seems to be offering me the option to upload a firmware update, which means that I must be running a newer version of the firmware, or at least enough of it to get into the BIOS. With that in mind I downloaded the âupdateâ firmware and used XMODEM to transfer the file to the board.
Yes, kiddo; XMODEM. Back when I was a child, it was possible to recover seemingly unrecoverable Cisco routers from ROMMON by loading a new IOS image over the serial port using the XMODEM protocol. If I felt brave, I would up the ante and use YMODEM. The update file for this board is only 200KB; now imagine how it felt transferring an IOS image over a serial port. Anyway, the point is, itâs possible to transfer a file over the serial port, and XMODEM is one way to do it. Unfortunately, screen does not support XMODEM, but I do have a serial terminal emulator app called Serial which connects to just about anything which looks like a serial port and it supports XMODEM, so:
Bootloader# upload
Please begin firmware upload using XMODEM
signature padding 1 found
signature padding 2 found
signature padding 3 found
signature padding 4 found
[Disconnected]
[Connected]
_____ ___ _______ __
/__ / ____ ____/ (_)___ ______ / ____/ |/ /
/ / / __ \/ __ / / __ `/ ___/ / /_ | /
/ /__/ /_/ / /_/ / / /_/ / /__ / __/ / |
/____/\____/\__,_/_/\__,_/\___/ /_/ /_/|_|
by Northbound Networks
Type 'help' for a list of available commands
Zodiac_FX#
Zodiac_FX# show version
Firmware version: 0.86
Zodiac_FX#
There may be other ways to XMODEM in macOS rather than using Serial (indeed, Iâve seen a way to do it using screen, and screen doesnât cost a pile of money), but thatâs the tool I had to hand, so I used it. Windows users with HyperTerm may now laugh because they have that tool available for free.
Just one, tiny little note which is easily overlooked:
If you are upgrading from 0.57 or below you must run the âfactory resetâ command (in config mode) after updating the firmware and then restart the switch to re-align the config ROM
After the upgrade, the board did not respond on its default IP address of 10.0.1.99 any more, which seemed odd. Thankfully, that was easily fixed:
Zodiac_FX(config)# factory reset Writing Configuration to EEPROM (198 bytes) Zodiac_FX(config)# restart Restarting the Zodiac FX, please reopen your terminal application. [Disconnected] [Connected]
The Northbound Networks Zodiac FX was now ready to be configured:
Zodiac_FX# config Zodiac_FX(config)# set ip-address 192.168.2.238 IP Address set to 192.168.2.238 Zodiac_FX(config)# set netmask 255.255.255.0 Netmask set to 255.255.255.0 Zodiac_FX(config)# save Writing Configuration to EEPROM (198 bytes) Zodiac_FX(config)# restart Restarting the Zodiac FX, please reopen your terminal application. [Disconnected] [Connected]
The IP address configured above will only be accessible on port 4. This interface is configured by default to be the management interface (and the one which should face the OpenFlow controller), as can be seen when viewing the port status, where Port 4 has a VLAN type of âNativeâ rather than âOpenFlowâ:
Zodiac_FX# show ports ---------------------------------------------------------------- Port 1 Status: DOWN VLAN type: OpenFlow VLAN ID: 100 Port 2 Status: DOWN VLAN type: OpenFlow VLAN ID: 100 Port 3 Status: DOWN VLAN type: OpenFlow VLAN ID: 100 Port 4 Status: UP VLAN type: Native VLAN ID: 200 ----------------------------------------------------------------
So with an ethernet cable connected to port 4, the web interface was finally visible!
<figure class="wp-block-image size-large">
</figure>
Should a future firmware be released, it can be uploaded using the âUpdate f/wâ option in the web interface, which sounds significantly simpler than the process above. That said, based on the dates of the last file updates of the Northbound Networks Zodiac FX firmware in GitHub and the recent news about Northbound Networks, Iâm not honestly expecting any further updates.
I hope that was useful and/or of interest. If you have a Zodiac FX, please let me know if you used it and what you got up to with it!
If you liked this post, please do click through to the source at Upgrading Firmware on Northbound Networks Zodiac FX and give me a share/like. Thank you!
My friend Daniel Dib sent me this interesting question:
As I understand it, subnets in Azure span availability zones. Do you see any drawback to this? Does subnet matter if your VMs are in different AZs?
Iâm positive I donât have to tell you what networks, subnets, and VRFs are, but you might not have worked with public cloud availability zones before. Before going into the details of Danielâs question (and it will take us three blog posts to get to the end), letâs introduce regions and availability zones (youâll find more details in AWS Networking and Azure Networking webinars).
Digging through my office looking for some other technology which I had misplaced, I stumbled across a small box containing a Northbound Networks Zodiac-FX, a small 4-port FastEthernet OpenFlow SDN switch which I had picked up after backing a 2015 kickstarter campaign.
</figure>These were a pretty cool idea, and at the time OpenFlow (OF) was the hottest thing around, everything was being SDN-washed, and the idea that a regular user like myself could afford actual hardware with OF capabilities to toy with in the home lab was beyond belief. Of course, it was possible to virtualize OF with Mininet, but thereâs something about using a real switch that goes beyond that. Even though, as youâll in a future post, I ended up wasting that opportunity, I am still honored to have backed it, and my hat is off to Northbound Networksâ founder Paul Zanna for what he has accomplished.
With that in mind, Iâm sad to note that when I went to the Northbound Networks website, I discovered that some time around August 2020 the company stopped manufacturing SDN hardware.
</figure>Since the original Zodiac FX campaign, Paul had expanded the available products to include an 802.11ac Wireless AP (Zodiac WX) and a 5-port gigabit switch (Zodiac GX).
Of course, discovering this news just as I have rediscovered my Zodiac FX is ironic and rather bitter timing. Nonetheless, I intend to wake the Zodiac up and put the latest firmware on it, the process for which Iâll cover in a subsequent post. Meanwhile, late to the party though I may be, I wanted to offer up a tip of the hat to Mr Zanna, to send my regrets that after four years of hard work this is how it ended up, and to wish him well in whatever he ends up doing next. I sincerely hope that you have another Zodiac line of products in you!
If you liked this post, please do click through to the source at Farewell to Northbound Networks and give me a share/like. Thank you!
If you are not negotiating your salary, you are almost certainly leaving money on the table. Negotiation is an important career skill and activity because it provides a very nice upside in overall career earnings. Preparation is important because the person you are negotiating with probably has a lot more experience in salary negotiations than [âŚ]
The post Negotiating your maximum salary appeared first on Packet Pushers.
Hereâs a recent tweet by my friend Joe Onisick that triggered this blog post:
My favorite people are the ones that start with âhow could we make that work?â Before jumping into all of their preconceived bs on why it wonât work.
I couldnât agree more with that sentiment. The number of people who would invent all sorts of excuses just to avoid turning on their brains and keep to their cozy old methods is staggering. Unfortunately, someone immediately had the urge to switch into what I understood to be a heroic MacGyver mode (or maybe it was just my lack of caffeine, in which case I apologize for the misquote⌠but you might still like the rest of the rant):
I love the recent Internet of Trash article by Geoff Huston, in particular this bit:
âMove fast and break thingsâ is not a tenable paradigm for this industry today, if it ever was. In the light of our experience with the outcomes of an industry that became fixated on pumping out minimally viable product, itâs a paradigm that heads towards what we would conventionally label as criminal negligence.
Of course itâs not just the Internet-of-Trash. Whole IT is filled with examples of startups and âvenerableâ companies doing the same thing and boasting about their disruptiveness. Now go and read the whole article ;)
Just in case you were recently promoted to be a team leader or a manager: read these somewhat-tongue-in-cheek advices:
Need more career advice? How about The Six Year Rule by Bryan Sullins⌠or you could go and reread my certifications-related blog posts.
During a few recent chats with my friends in the industry, Iâve heard a common refrain coming up about technologies or products being offered for sale. Typically these are advanced ideas given form that are then positioned as products for sale in the market. Overwhelmingly the feedback comes down to one phrase:
This is a solution in search of a problem.
Weâve probably said this a number of times about a protocol or a piece of hardware. Something that seems to be built to solve a problem we donât have and couldnât conceive of. But why does this seem to happen? And what can we do to fix this kind of mentality?
If I told you today that I was creating software that would revolutionize the way your autonomous car delivers music to the occupants on their VR headsets youâd probably think I was crazy, right? Every one of the technologies I mentioned in the statement is a future thing that we expect may be big down the road. We love the idea of autonomous vehicles and VR headsets and such.
Now, letâs change the statement. Iâm working on a new algorithm for HD-DVD players to produce better color accuracy on plasma TVs that use PowerPC CPUs. Hopefully that statement had you giggling a little no matter what your tech level. Whatâs the difference? Well, that statement was loaded with technology that no one uses any more. HD-DVD lost a format war against Blu-Ray. Plasma TVs are now supplanted by LCD, LED, and even more advanced things. PowerPC has been replaced with RISC architecture and more modern takes on efficient CPUs in mobile devices.
If youâd have bet on the second combination of things back in the heyday of those technologies you might have made yourself a bit of money. Youâd ultimately find yourself without a product to sell now, though. Because technology always changes. Even the dominant form of tech eventually goes away. Blu-Ray may have beat HD-DVD but it couldnât stop streaming services. LCD replaced plasma but now weâre moving beyond that tech into OLED and even more advanced stuff. You canât count on tech staying the same.
Which leads to the problem of trying to create solutions for problems that havenât happened yet or are so far out on the horizon that you may not be able to create a proper solution for it. Maybe VR headsets will have great software that doesnât need a new music match algorithm. Maybe the passengers in your autonomous vehicle wonât wear VR headsets. Perhaps music as we know it will change and not even be as relevant in the future. Thereâs no telling which butterfly effects will impact what youâre trying to accomplish.
Aside from the future problems you hope to be solving with your fancy new product you also have to take into account human behavior. Are people more likely to buy something to solve an issue they donât currently have? Or are they more apt to buy something to solve a problem they have now? Startups that are looking five years into the future are going to stumble over the problems people have today on their way to the perfect answer to a question no one has asked yet.
I wanted a tablet because it was cool when they first came out. After using one for a few weeks I realized that it was a solution that didnât address my pressing issues. I didnât need what it offered at the time. Today a tablet solves many other issues that have come up since then, such as note taking or having quick access to information away from my desk. However, those problems needed to develop over time instead of hoping that my solution would work for something I couldnât anticipate. I didnât need a word processor for my tablet because I wouldnât by typing much with an on-screen keyboard. Today I write a lot on my tablet because of the convenience factor. I also take notes because I have a pencil to write with instead of my fingers.
Solving problems people have right now is a sure fire way to make your customers happy and give you the breathing room to look to the future. How many times have you seen a startup with a great idea that ends up building something mundane because they canât build the first thing right or they realize the market isnât quite there yet?
I can remember specifically talking to Guardicore when they were first out of stealth and discussing how their SDN-based offensive security systems worked. It was amazing stuff with very little market. When they looked around and realized they needed to switch it up they went full-on into zero trust security and microsegementation. They took something that could be a great solution later on and pivoted to solving problems that people have right now. The result is a healthy company that makes things people want to buy instead of trying to sell them a solution for a problem they may never have.
If you are looking at the market and thinking to yourself, âI need to build X because it will revolutionize the way we do thingsâ stop and ask yourself how we get there. What steps need to be taken? Who will buy it and when? Are there problems along the way? If the answer to the last question is anything other than ânoâ you need to focus on those problems first. You may find that you donât need to build your fancy new vision of perfect future success because you solved all the other problems people needed fixed first. Your development efforts will be rewarded with customers and income instead of the perfect solution no one wants to buy.
Solutions without problems to solve are a lot like one-off kitchen gadgets. I may have a use for an avocado slicer twice a year. I also have a knife that does the exact same thing a little slower that I can use for many other problems around my house. I donât need the perfect avocado slicing solution for the future when Iâm making guacamole and avocado toast every day. I need a solution that gets my problems of slicing, chopping, dicing, and cutting done today. Technology is no different. Build what solves problems now and youâll be a success. Build for the future if and only if you have the disposable time and income to get there.
The second part of the Cisco SD-WAN webinar focused on design considerations and trade-offs in several scenarios. David Penaloza briefly reviewed the types of policies and their capabilities before discussing what to keep in mind when designing the solution.
In this Day Two Cloud podcast clip, we discuss consulting and MONEY. To hear the entire episode, go here. Hosts Ned Bellavance and Ethan Banks are joined by Michael Jenkins, Sr. Systems Reliability Engineer at Managed Kaos; and Anthony Nocentino, Enterprise Architect at Centino Systems and Pluralsight author. If you like engineering discussions like this, [âŚ]
The post What Should A Consultant Charge Clients? â Video appeared first on Packet Pushers.
Aaron's Worthless Words
About Networks
BGPmon.net Blog
Brian Raaen
Bridging the gap between CCIE RS and SP
CCIE in 3 Months - Is it Possible?
Chewtoy's Technical Musings
Cioara's Cisco Blog
Ethan Banks on Technology
Evil Routers
FirstDigest
Honest Networker
IPEngineer.net
In Search of Tech
Inevitable (Himawan's blog)
Jason Edelman's Blog
Layer 1 Transport
Loopback Mountain
Masood Ahmad Shah
Moving Packets
My CCIE Training Guide
My Etherealmind
Network Design and Architecture
Networker's Online
Networking Now (Juniper Blog)
Packet Pushers
PacketLife.net Blog
Peter's CCIE Musings and Rants
Potaroo blog
Router Jockey
Routing Freak
SNOsoft Research Team
ShortestPathFirst
The Data Center Overlords
The Network Therapy Blog
The Networking Nerd
Vijay Gill's Blog
XKCD Comics
ipSpace.net Blog (Ivan Pepelnjak)
Last updated:
March 05, 2021 07:00 AM
All times are UTC.
Powered by:
Contact Me
