Link: DMVPN Explained

Link: DMVPN Explained

The following is a great blog post about how mGRE tunnels work and DMVPN: DMVPN Explained
As a PDF: DMVPN-Explained.PDF

BGP Route Convergence on the Internet

BGP Internet Route Convergence

If your network is multihomed -- How long does it take routes TO you to converge? These slides are very informative.  Wish I was in the classroom during this talk....

http://www.cs.northwestern.edu/~ychen/classes/cs450-05/lectures/BGP_Convergence.ppt

Redundant Datacenter Connectivity

Datacenter Connectivity

Goals

• Create redundant datacenters. For now, 2 of them.
• Redundant, diverse, physical circuits/paths
• Allow simple movement of services between datacenters => support the same IP address ranges in either location

An example:  http://connect.iltanet.org/ILTANET/Go.aspx?c=BlogViewer&BlogKey=d671b21d-b20a-4b07-84d5-3d4357723f0a

Issues/Discussion Items
Layer 2
to allow the same IP address ranges

• Circuits are different vendors taking very different paths with unknown infrastructure in between the datacenters. A failure could occur within the service provider, but all my ports show "up." 
• So, Spanning Tree and Port Channels will not work for "in between" failures
• UDLD, Unidirectional Link Detection, doesn't seem work on a "virtual circuit" over a provider network like Metro Ethernet.
• Cisco's OTV is supposed to accomplish a big part of this, but it seems that a much less overblown solution could at least provide the Layer 2 redundancy.

Routing Redundancy

• For routing to work, the (outbound)default route must be configured to go out through the same datacenter where the inbound traffic will be arriving. 
• So any kind of automatic redundancy that fails the inbound route to the secondary datacenter needs to also initiate a change to the default route of all machines in the "shared" networks.
• A compromise would be a "one button push" method to switch inbound and outbound routing to change between datacenters.
• Does OTV address this?

Nuts & Bolts

• A traditional solution would possibly involve 2 circuits each with a router at each end.  L3 redundancy between the 2 links using HSRP/GLBP, some kind of IP tracking to expose a service provider outage, and somehow create L2 tunnels over each one and use them via a port aggregation at the core switch.  The question remains whether this solution can be designed to show a link as down even if the failure is in between.
• There seems to be little in the way of configuration help or reference material for GRE/MGRE tunnels.  Even less for L2 tunneling.  I suppose the motivation for helping users do that is even less now that there is a nebulous thing called OTV that involves a big spend on monster Nexus 7K core switches.
• I haven't been able to get into the guts of this and do any testing.  Thinking it through on paper I always get bogged down with the L2 tunnel.  A possible example L2TP configuration is:

Router A:

pseudowire-class test
encapsulation l2tpv3
protocol none
ip local interface Loopback0
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/1
description LAN
no ip address
speed 100
full-duplex
xconnect 2.2.2.2 1 encapsulation l2tpv3 manual pw-class test
l2tp id 1 2


Router B:

pseudowire-class test
encapsulation l2tpv3
protocol none
ip local interface Loopback0
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!interface FastEthernet0/1
no ip address
duplex auto
speed auto
xconnect 1.1.1.1 1 encapsulation l2tpv3 manual pw-class test
l2tp id 2 1

Check internet routes to my network

helpful for testing:
telnet route-views.routeviews.org

Cisco::VRF::Routing

Segregating WAN traffic to provide public internet access from a central location

We provide wireless internet in public areas in every office. For this purpose we provide cable internet, DSL, or dedicated T1 circuits. To save money and better control this traffic, we want to direct that traffic back through our headquarters' internet circuits. To do this we need a way to segregate this traffic on our WAN links for security and to keep it from overutilizing our WAN.
VRF and tunnels seems to be the answer.

Cisco Design Guide
Good Overview

Network Latency

Latency due to distance = approximately 1ms per 100km

from: http://www.nessoft.com/kb/42

There are two *normal* factors that significantly influence latency

• The latency of the connecting device. For a cable modem, this can normally be between 5 and 40 ms. For a DSL modem this is normally 10 to 70ms. For a dial-up modem, this is normally anywhere from 100 to 220ms. For a cellular link, this can be from 200 to 600 ms. For a T1, this is normally 0 to 10 ms.


• The distance the data is traveling. Data travels at (very roughly) 120,000 miles (or 192,000 kilometers) per second, or 120 miles (192 km) per ms (millisecond) over a network connection. With traceroute, we have to send the data there and back again, so the latency will raise roughly 1ms for every 60 miles (96km, although with the level of accuracy we're using here, we should say "100km") of distance between you and the target.

VisualRoute traceroute server: trace IP address, trace route, IP trace, IP address locations : "Test Internet Connectivity and Trace IP Addresses with VisualRoute "


Online demo

Can't get to Delta.com

I had this problem recently and a search of the internet found several interesting instances of this happening to others.
One example:http://www.experts-exchange.com/Security/Q_21649945.html

Title: Access denied due to security policy violation

When I link to some web pages, I am getting this error message:

Access denied due to security policy violation

Reject ID: 438f612b-1000c-42852404-7b6

Does this look familiar to anyone? I can't tell if it is coming from something on our end (like Checkpoint NG) or on the other end. It does not happen all the time on even the same website, just on certain pages for unknown reason.

I see several reports of this exact message on Google, but no one has an answer to the question.


Comment from HarkinsIT
Date: 01/26/2006 01:15PM PST
Comment


I have received a few complaints from my users about not being able to access particular sites, particularly delta.com. I too am running a Checkpoint firewall (NGXR60) and have found the following in the SmartDefense log: WSE0020008 found both content-length and transfer-encoding headers in response.

It's not the same exact error you are getting, RobWalling, but I was wondering if you had found a solution. I have been pouring through the SmartDefense settings and so far I haven’t been able to find anything about this.

Just wondering.....Thanks.


Comment from RobWalling
Date: 01/27/2006 11:40AM PST
Comment


After playing around with it for awhile and talking to Check Point, I finally discovered that the "ASCII Only Response Headers" criteria in the Web Intelligence piece of NGX was what was causing the problem. Turned it off, and all is well. Putting it in "Monitor Only" mode will still block it though! That really made it hard to figure out. Of course what opened myself up to, I'm not sure yet.

BTW, user ID "mobot" is someone else. I latched onto this thread because it described the same problem.

Thanks.



Comment from m298908
Date: 01/27/2006 11:42AM PST
Comment


We recently upgraded our check point software also and started having this for delta.com. It is only happening to one user though. I can get to it fine. Very strange. I will try this setting and see if it works. thx

Active FTP vs. Passive FTP, a Definitive Explanation: "Active FTP vs. Passive FTP, a Definitive Explanation"