firewall integration in Cisco ACI

(do a blog search for “service_insertion”)

firewalls in Linux

The default host-based firewall in RHEL allows all outgoing connections and blocks all incoming ones, except those explicitely permitted.

The firewall daemon is called firewalld. To interact with it, use the firewall-cmd tool. The firewalld daemon translates the instructions of firewall-cmd into policies that use the syntax of the kernel’s netfilter and nftables.

firewall rules

A rule dictates that a service is allowed to be accessed by an inbound connection. A firewalld service is added with firewall-cmd --add-service or removed with firewall-cmd --remove-service.

Certificates

Issuing a Digital Certificate

Certificate server, Certificate Authority. The entities that want the CA to issue a digital certificate for them must send their public key, their IP address and their FQDN to the CA. The CA replies with a digital certificate, aka identity certificate, aka public key certificate which means ‘I certify that the entity named in this certificate own the public key mentioned in this digital certificate.’ The digital certificate does not last forever; It has a validity period. The digital certificate is a file with the extension .cer.

In VMware, a good practice is to configure ESXi hosts in a cluster, then present the LUNs to the ESXi cluster. A VMware datastore is a LUN that has been formatted with a filesystem like VMFS. A VMware VM can access the datastore but has no awareness of the underlying LUN or its constituing storage disks. Any protocol that carries the SCSI Command descriptor Block (like FC, FCoE, iSCSI, SAS) uses the LUN concept. A successor to SCSI is NVMe. When I configure a new datastore in a vCenter datacenter, I am presented by a menu to choose a ESXi from. (sc) This is because vCenter simply does not have direct access to the storage devices; it asks that selected ESXi server (can be seen as a ’temporary agent’) to access the storage devices ot its behalf, format the access storage as VMFS disks and make them available in the datastore to many ESXi hosts. This action is only required once during the configuration of the datastore. This interaction takes place on the management vmkernel of the ESXi host. Later when I attach the datastore to the ESXI hosts, they will be able to access the VMFS disks directly, and they will access the storage devices.

VMware NSX-T does not support VXLAN!

NSX-T Segments

a VM is connected to a segment.

• is a layer-2 domain.
• invokes a transport zone.
• once the transport zone configured, you can no longer edit it later.
• VLAN-based segments are equivalent to VLAN IDs
• VLAN-based segments are not permitted to connect to Tier-0 or Tier-1 gateways.

Edge Uplink Segments

require VLAN transport zones. A single Edge Uplink segment can be used more than once.

SSH on Cisco devices

SSH Terminal-Line Access Feature

replaces reverse Telnet feature that was typically configured on terminal services routers.

provides secure console access for servers physically connected to a terminal services router.

introduces the concept of ‘rotary’.

Remember that each physical Async port has an associated logical line to it.

Each router line (not the Async ports) must be configured with a unique rotary number.

Number of rotaries == number of lines

VPN Advantage

A VPN is a network where private network services are provided to one or more customers over a public network, Internet, or a private network. 

A VPN consists of one or more VPN tunnels! 

VPN connects sites of a same customer together.  A set of “policies” determine which sites communicate with each other and which not;  

In one scenario, the customer itself defines and implements them, in collaboration with the SP. The customer may for example want to force traffic from site S1 to traverse site S2, because the latter has a firewall installation.