Category: Networking

27 July 2024

SONIC and Leaf and Spine

If that title makes you think of a pixelated hedgehog who has acquired two new sidekicks then you’re probably as old as me. However, SONIC is an open source networking operating system originally developed by Microsoft and its command line will be familiar to anybody who has worked with Cisco. I used it to play with leaf and spine networking. This fine gentlemen provides a […]

Firewalls Networking

21 March 2024

FortiGate SDWAN – Out of the Lab

I was recently involved in a project to roll out FortiGate SDWAN on what sounded like an almost text book scenario: two Hubs and two Branches. Obviously, I won’t post the client’s configs in this post but I will attach some configs from a lab that I created to generate configurations and test generally. (Please review with caution. I did a lot of tweaking and […]

Firewalls Networking

18 July 2023

BFG, BGP and BFD

If you were a Big Friendly Giant and wanted fast BGP convergence,you might well investigate BFD. (OK, now I have justified my alliteration we can move on) In the previous post, we had a resilient BGP topology which I will remind us of here: When the FG1 Fortigate was shutdown it took BGP between two and three minutes to re-route traffic through FG2. Popular wisdom […]

Firewalls Networking

28 June 2023

Fortigate and BGP

Last week I attended an event at Fortinet’s offices in London which are on the 26th floor of a building in the City. With a view like this you’d be forgiven for spending a lot of time looking out of the window Today, I’d like to tinker with BGP on Fortigates. (I have to declare an interest I got a couple of pens, a nice […]

Firewalls Networking

9 January 2023

Forti SD-WAN Hub and Spoke: Part Two

Picking up from the previous post, we now are going to test the resilience of our Hub and Spoke SD-WAN topology using the tests described in the Fortigate design reference guide below: https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-self-healing-with-bgp/559415/overview The following diagram is from the above post’s ‘Testing and Verification section’ which I’m essentially following (though I’m using port1 and port2 not port2 and port3). Having cited my source and given […]

Firewalls Networking

5 January 2023

Forti SD-WAN Hub and Spoke: Part One

UPDATE: I couldn’t get this working without the frig detailed below. However, there’s probably still some value in this post. (Translation: I’m too lazy to do a similar one) but I did get hold of some evaluation licenses and set up topology the detalied in the link below using FortiOS 7.2.5 – and it worked fine. https://docs.fortinet.com/document/fortimanager/7.2.0/single-datacenter-for-enterprise/503190I If you’re deploying an SD-WAN topology of any […]

Firewalls Networking

30 October 2022

Forti SD-WAN DIA (and GNS3 Cloud types!)

I’ve been looking at SD-WAN recently and labbed up a simple implementation to test this using GNS3. This is the setup: The southern cloud to the left allows management access to the Fortigate and the cloud next to it is a connection to a VMWare Workstation Linux box. The clouds north of the Fortigate are both GNS3 Nat clouds out to the Internet. It occurs […]

Networking

7 August 2022

MPLS and MP-BGP

To me MPLS has always been a cloud on a network diagram that was someone else’s problem. But I decided to lab it up and see how it worked. Happily, I found someone who had described how to set up the lab to do just this: https://packetlife.net/blog/2011/may/16/creating-mpls-vpn/ The rest of the post assumes you have read this link but I will repeat or emphasise relevant […]

Encryption Networking

21 June 2021

I Can See Clearly Now…

Wireshark is a powerful tool which captures no end of network protocols but 90% of the time you’re probably working with TCP and 90% of that TCP is probably http and 90% of that is probably encased in TLS encryption making it https. The problem here is that sometimes you need to see what’s inside those packets. The good news is you can using the […]

Networking

1 May 2021

You Can’t Handle the Data!

Wireshark is a great tool but to my mind it’s only worth using when you’ve exhausted other avenues: firewall or event logs, browser developer tools or even tcpdump. However, there are some occasions when it’s all you have, especially if you don’t have access to intermediate network or filtering devices. I encountered a scenario recently where it was very useful but first I’d like to […]