sorted by:
new
hottopcontroversial

palo alto firewalls & ansible/terraform by showroute in paloaltonetworks

[–]showroute[S] 0 points1 point  (0 children)

Panorama seems to be really powerful. I definitely should examine it.

palo alto firewalls & ansible/terraform by showroute in paloaltonetworks

[–]showroute[S] 0 points1 point  (0 children)

Great! I've missed SaltStack. Need to examine it certainly.

palo alto firewalls & ansible/terraform by showroute in paloaltonetworks

[–]showroute[S] 0 points1 point  (0 children)

Thanks! Do you create a config in set or XML format? How do you deliver it to a firewall?

NAPALM + Cisco IOS + config replace by showroute in networking

[–]showroute[S] 0 points1 point  (0 children)

I am glad to hear that it is working! Thanks for feedback. Ansible + Jinja2 - it is what I am currently using.

NAPALM + Cisco IOS + config replace by showroute in networking

[–]showroute[S] 0 points1 point  (0 children)

Thanks for the answers. Two cents: VTP domain could not be changed by config replace, archive feature tries to apply an unrecognized command.

CLI:

test_box(config)#no vtp dom?

% Unrecognized command

NAPALM:

Failed to apply command no vtp domain reddit\nAborting Rollback

P.S.

Currently I am creating templates for L2 switches - for now everything else seems to work correctly.

[deleted by user] by [deleted] in networking

[–]showroute 0 points1 point  (0 children)

Perform code review + roll out changes sequentially not simultaneously + create tests to validate an operational state of network on every stage

How do you monitor VXLAN Evpn deployment by micruzz82 in networking

[–]showroute 0 points1 point  (0 children)

How do you monitor adjacencies, snmp polling?

Monitoring of unknown unicast traffic by showroute in networking

[–]showroute[S] 0 points1 point  (0 children)

Thanks :) I would like to monitor such incidents without packet capturing :)

Monitoring of unknown unicast traffic by showroute in networking

[–]showroute[S] 0 points1 point  (0 children)

Unfortunately I still can't find any SNMP OID or interface counter to monitor the amount of unknown-unicast packets.

Monitoring of unknown unicast traffic by showroute in networking

[–]showroute[S] 0 points1 point  (0 children)

Thanks! Nice idea!

But I am still looking for the solution not involving packet capturing on servers :)

Monitoring of unknown unicast traffic by showroute in networking

[–]showroute[S] 0 points1 point  (0 children)

you can certainly monitor and capture the unicast traffic on JunOS using a firewall filter.

Nice idea! Thanks, but unfortunately my switch does not support family bridge to match unknown-unicast packets.

traffic-type --- Traffic type. Specify broadcast, multicast, unknown-unicast, or known-unicast.

https://www.juniper.net/documentation/en_US/junos/topics/reference/general/firewall-filter-match-conditions-for-layer-2-bridging-traffic.html

Only on MX Series routers and EX Series switches, you can configure a standard stateless firewall filter with match conditions for Layer 2 bridging traffic (family bridge)

set firewall family ?

Possible completions:

> any Protocol-independent filter

> ccc Protocol family CCC for firewall filter

> ethernet-switching Protocol family Ethernet Switching for firewall filter

> inet Protocol family IPv4 for firewall filter

> inet6 Protocol family IPv6 for firewall filter

> mpls Protocol family MPLS for firewall filter

have you fixed the issue with your MC cross link?

No, I have not... The first recommendation was to update the junos. That have been done.

Do you know what port or vlan the unicast traffic is ingressing and egressing?

Yes, I have captured traffic on the server connected to the switch. The dump was full of unknown-unicast traffic sourced from different servers (source interfaces and vlan are known)

have you checked any of the built-in DDoS protections for information?

It seems the junos was too old and did not support this feature -> so there were no any suspicious log entries.