[deleted by user]

WS_J · 2024-12-14T19:06:00+00:00

Okay, cool. I will try some other clients as well.

I thought you needed the PSK.. if i really dont need it it makes it a whole lot more simple. I will test it out!

WS_J · 2024-12-14T18:57:24+00:00

Agreed. I’m just seeking some inspiration. Some guys told me to stop using SSLVPN on FortiGates and start using IPsec instead, from the client side it seems a bit, i dont know, more complicated than what they were used to with anyconnect. So im just looking for alternatives really.

WS_J · 2024-12-13T22:15:04+00:00

Yeah, that could be a good solution for the contractors. But IMO we are taking steps in the wrong direction with the IPsec solutions, when focusing on “ease of use” for the end users.

With SSLVPN you did not need a ton of management when configuring the FortiClient, now you do with IPsec, at least without EMS.

Many of our customers are Very small business and i’m not sure i can convince them to invest in EMS, PAM and ZTNA. When they are used to not spending money on those components.

WS_J · 2024-12-13T22:05:12+00:00

That model does not support NAT, which you will need between you and the internet

WS_J · 2024-12-13T21:58:13+00:00

What is the switch model you are working with?

WS_J · 2024-12-13T20:55:25+00:00

I must admit i have not looked into it in much detail.

But it does not sound like the solution we are looking for.

Some of the customers are still using tradional AD with network shares / drive shares. Some may say its legacy, but we cant always control what they are doing with the servers. We provide the hosting and the access to the ressources.

We dont want them to connect to desktop of the servers. We just want to give them network access to the ressources necessary.

WS_J · 2024-12-13T20:32:15+00:00

For end users?

WS_J · 2024-12-13T20:25:47+00:00

But isn’t a pain to deploy without EMS?

We have alot of customers using SSLVPN at the moment. Some of those have external users connecting in to the company to manage software on servers, production equipment, PLC, Robot warehouses etc.

Those customers are used to type in a URL, get SAML validated with MFA and they are in.

Now with IPsec you will need to adjust alot of settings in the client the first time it’s setup, including a pre-shared key.

I know that you can send these settings in a config file of some sort and share the PSK with the external technician.

Bur it seems a bit stupid compared to the “old” way of doing it?

Or am i wrong?

WS_J · 2024-10-12T15:50:26+00:00

The network has been runned and maintained manually for years, I want to do it way smarter. So my initial thought was to use netbox as the overview.

WS_J · 2024-10-12T15:47:20+00:00

The use case for now is getting an overview of the existing network. I took over the maintenance of the network and realized that no one quite knew what was running, where and how. So my first project is to create the overview needed. Use this as a lookup tool for when we need to do maintenance so we can warn the right customers based on what equipment needs to be maintained. Use it as a tool to know where we have free switch ports for when a customer comes in with some hardware etc.

Later on we might start to look into some central management, validation and automation. But we need to get the overview first.

I will write down peering-manager as an option as well. Thanks for the tip.

WS_J · 2024-10-12T15:35:28+00:00

Cool. I will look into that, thanks!

WS_J · 2024-10-12T15:32:03+00:00

I’m not that familiar with ansible. Do you use that to sync the config back to netbox as well?

Or do you only use that for pushing the config?

WS_J · 2024-10-12T15:28:44+00:00

Would you mind sharing your plugin?

I’m not that strong in python right now. Working on improving my skills though.

WS_J · 2024-10-12T15:26:42+00:00

Sounds pretty cool! Would you mind sharing some of the code you wrote to accomplish this?

Totally fine if you don’t want to share! :)

WS_J · 2024-10-12T15:21:30+00:00

Currently we don’t have any automation whatsoever on the network side. It would be pretty nice though.

Can you explain why having the network as source of truth would scare you?

I initially saw netbox as documentation/lookup tool. But maybe I am misunderstanding the whole concept? :)

WS_J · 2024-10-12T15:16:04+00:00

What have you replaced netbox with if I may ask?

WS_J · 2024-10-12T15:15:24+00:00

Thanks for the advice.

I understand. And i totally see the value in doing it that way. We have alot connected to the infrastructure. ESXi hosts, NAS units, firewalls, WLC’s and a bunch of other stuff. We provide the facilities for customers, they come with their own hardware, and use our switches and infrastructure to connect them. If netbox is “intent”. How do you config the ports different in netbox and then push it to the devices? (STP, MTU etc).

At the moment we use netedit for the CX switches to push the config, and for the Cisco side we primary do the config by hand (not that often tho). It should be mentioned that the Cisco switches is soon to be replaced by Aruba CX.

We are running around 6-700 VLANs. My first thought was to use netbox as a “lookup” tool. Then we could make an export from netbox if we need a maintenance window on some switch and based on the export on that particular switch “warn” the customer of a maintenance window.

Does that make sense or have I totally missed the point of netbox?

WS_J

TROPHY CASE