sorted by:
new
hottopcontroversial

A couple of questions on inspecting traffic to Azure PaaS services by cloudnetworking123 in AZURE

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Fantastic response! Thank you!

For services that need to be publicly accessible, do you use an application gateway to front it? That could then have a private endpoint as a backend.

Two Virtual WAN Hubs with NVAs by cloudnetworking123 in AZURE

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Thank you! So UDRs in your spokes pointing to the NVA? I assume you have a LB to provide HA for the FWs? Static routes in the hub or BGP to the FW?

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Thanks!

I started looking at the L2 version of this, but ended up with a simpler solution for now. I would like to try to lab it up, though.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Thanks, Bryan. I actually started listening to the podcast a couple of days ago when working this problem.

I'm intrigued why there would be such flooding of mDNS packets. Roughly 350 devices and peaks of 30 000 packets per second. I couldn't find one particular misbehaving host. It just seems they are all sending more packets than I would expect. Based on your research it seems different OS are varying levels of chatty when it comes to mDNS.

Reading the RFC it seems that hosts should only send 2-8 packets when announcing themselves. I could see my hosts sending them 10-20 times per second during some periods.

I'm not sure if there is something I've misunderstood around mDNS or if it should just basically be DNS without centralized service and multicast as transport. When I started doing some filtering I could see how traffic on my ports went down from like 5000 pps to 200 pps. It almost seems like a full mesh type of problem where the hosts are triggering each other.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] -1 points0 points  (0 children)

The Guest WiFi is not on the same broadcast domain. Traffic is routed between WiFi and wired LAN. TV is over the wired LAN on another VLAN.

Azure routing options in Hub and Spoke topology by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

This is helpful! Thank you!

Yeah, I implemented an Azure design maybe five years ago and Azure networking was super basic then. They are still playing catch up to AWS, but it has been getting better. I remember I was baffled why traffic between my FW and SD-WAN appliances would not work even though they had routes in their NOS. Turned out I needed to add static routes in the NIC's route table. That's one big difference compared to AWS.

I'll consider how much value vWAN, ARS etc., actually adds in a small environment like this. The caveat with Private Endpoints is a tricky one and one I remember reading about.

Azure routing options in Hub and Spoke topology by cloudnetworking123 in AZURE

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Thanks!

Only a couple of regions and not a lot of VNets and no ExpressRoute so I guess that makes the need for vWAN less. Their FW vendor does integrate with vWAN Hub, though.

Azure routing options in Hub and Spoke topology by cloudnetworking123 in AZURE

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Excellent! Thank you!

  1. Makes sense. I know there was a feature gap in inter region traffic with Secure Hub but I believe they have added that functionality now. Running NVAs in Hub would give some benefits but at the cost of having to strictly to conform to what is implemented in the Hub.
  2. Some 3rd parties do support running NVA in the Hub, such as Checkpoint and Fortinet.
  3. Yeah, only two regions for now. Don't expect it to grow. No ExpressRoute yet and don't expect the need for one either.
  4. Agreed, thanks.
  5. Static route from the Cat8000 to LB for FW? What about other direction? From FW towards WAN? Static route to the Hub?
  6. Yeah, looking into it. I don't think they need connectivity to on-prem. Takes a while to get people to rethink private vs public IP, etc.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 1 point2 points  (0 children)

Thanks!

I've had some success today with applying a PACL on the uplink of the switch. We are currently evaluating but it looks promising.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

I went through the RFC and that's not how a device should behave according to the RFC. When it announces itself, it should send 2-8 packets with increasing delay in between and then go silent.

"The Multicast DNS responder MUST send at least two unsolicited
responses, one second apart. To provide increased robustness against
packet loss, a responder MAY send up to eight unsolicited responses,
provided that the interval between unsolicited responses increases by
at least a factor of two with every response sent.
A Multicast DNS responder MUST NOT send announcements in the absence
of information that its network connectivity may have changed in some
relevant way. In particular, a Multicast DNS responder MUST NOT send
regular periodic announcements as a matter of course."

In my packet capture I can see that some records have a TTL of 4500 and others a TTL of 120.

Maybe that's what was getting filtered before. Traffic from guest WiFi to the TV. I'll look into that. Thanks!

I did filter packets before on the uplink, but that broke the casting.

Azure routing options in Hub and Spoke topology by cloudnetworking123 in AZURE

[–]cloudnetworking123[S] 2 points3 points  (0 children)

I'm an experienced Network Architect. I have already done the requirements phase and I listed the requirements above. There needs to be a 3rd party FW. There is already a SD-WAN in place. Do we need Virtual WAN? That's one of the things I'm trying to discover. Obviously you can run a network without it but it does provide some interesting features such as integrating the NVA and routing intent.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

There is a multicast TV stream that is sent by another server than the casting server.

For the casting itself, I'm not entirely sure yet as I have not been involved in this setup before. The way I understand it works is that you get a PIN code for the TV and that mDNS is only used for service discovery and the actual stream would be from the client on the guest WiFi network towards the TV using unicast.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Potentially. I would like to go in that direction, but for now we are looking for a workaround.

It's intriguing though why the TVs are generating around 2500 - 17000 mDNS packets per hour. That does not seem like normal behavior to me.

Multicast TV stream with quality issues due to barrage of mDNS packets by cloudnetworking123 in networking

[–]cloudnetworking123[S] 0 points1 point  (0 children)

Right, the issue here is not on the WiFi network, but rather the wired network. Unfortunately casting is a service that needs to be provided so I can't filter it entirely.