Skip to content

Home

  • 1 min read

A Practical Guide to Deploying SAML for AnyConnect (External)

The pandemic has rapidly advanced the need for high-quality and secure remote access VPN solutions (RAVPN). As a result, many RAVPN solutions provided by vendors have been targetted by hackers. This has resulted in newly identified vulnerabilities and security advisories being released by the vendors. One area of concern is around user credential management and multi-factor authentication (MFA). The configuration examples, provided by Cisco and authentication providers, for configuring SAML and Cisco AnyConnect fail to highlight how to configure multiple group-policies so that you can restrict access appropriately for each business unit and vendor. Instead, they highlight have to apply a single group-policy to cover all of your remote access users. I've written a blog post for my employer Optanix that provides a production-grade example of how to deploy SAML for Cisco AnyConnect, using multiple group-policies and LDAP attribute maps for fine-grained access control.

Read A Practical Guide to Deploying SAML for AnyConnect for more details and let me know what you think!

Simple SNMP Queries with Python

The need to query network devices for information on a repeated and consistent basis always been a critical function of performing network management. Monitoring the health of your network devices, building reports for use by management, querying the status of a particular function, and so on. There are an increasing number of ways to perform this type of data gathering. From the extremes of manually logging in to run a CLI command or check a web GUI, to using the latest API or Netconf, network engineers have their choice of protocol to use. However, nothing is as common and widely deployed as Simple Network Management Protocol (SNMP). Most network monitoring platforms will rely on using SNMP, especially if a particular network platform is a decentralized platform like common routers and switches, requiring each network device to be queried individually instead of through a centralized controller.

Using Ansible Inventory Files in Python Scripts

With the various methods for performing network automation, one of the challenging aspects to consider is inventory management. One of the tools available to us is Ansible which expects an inventory file in YAML format with specific variable or to use a dynamic inventory. But Ansible doesn't solve all automation use-cases. I have used Ansible for configuration management, but I have also used many different Python scripts for generating reports and performing complex operations that seemed easier to implement directly in Python than in Ansible. There is no 'one size fits all' solution to network automation.

  • 1 min read

Increase Network Change Implementation Success (External)

Having worked in the Network Management / Operations industry for over 15 years, I have been involved in the implementation of network changes on many ocassions. I have also helped drive process transformation of how various teams implement changes based on best practices that I have picked up along the way. I've written a blog post for my employeer Optanix on some steps that you can take to help increase confidence and success in network changes.

Read Increase Implementation Success With a Proven Network Change MAnagement Process for more details and let me know what you think!

  • 1 min read

How to Upgrade Cisco ASA Firewalls (External)

With the ever increasing number of vulnerabilities and security advisories that are released by networking vendors, having a well defined plan for performing software upgrades each platform in your network is critical. Cisco ASA firewalls are most commonly deployed at the edge of your network, many times with interfaces that are connected to the public network or to a network that you may not manage. I've written a blog post for my employer Optanix that defines a well-defined plan for upgrading Cisco ASA firewalls.

Read How to Upgrade Cisco ASA Firewalls for more details and let me know what you think!

Exploring NETCONF and YANG on Cisco IOS-XE

I have been reading up on model-driven programmability using NETCONF and YANG models and found myself playing around with these after a Reddit user was having difficulty updating a Cisco IOS-XE interface description and VLAN. Other than reading about YANG and getting the basic capabilities from my lab router, I hadn't actually configured anything using NETCONF and YANG models before so this seemed like a good challenge to get me thinking in the right mindset. I suspected that it had to do with the XML namespace the user was referencing, but I had to figure out a way to prove it. In this post I will cover a little bit about NETCONF/YANG as well as how you can explore using it with your Cisco devices. This guide isn't meant to be a complete overview of these protocols, just something to get you started on learning about them.

Initial Thoughts on Cisco NFVIS API

With multiple Cisco NFVIS software upgrades planned in the near future I thought I would explore the API to see how this might help speed up the process. My initial goals for exploring the API were to:

  • Discovery which end-points can be used for hardware and software inventory reporting
  • Determine how to update the IP receive ACL's
  • Automate transfer and registration of the new NFVIS image files
  • 11 min read

Overview of the Viptela vManage API

The move away from decentralized management of network devices has been a huge time saver when it comes to gathering data on these technologies. Although there is no single centralized manager or controller which manages all networking technologies, instead of querying each individual network device you have centralized managers for particular networking functions. Cisco DNAC for your wireless and switch infrastructure, Panorama, Cisco FirePower Management Center (FMC) or FortiManager for your firewall infrastructure, and in the case of this article Viptela's vManage for your SD-WAN overlay. While no centralized manager will be perfect, for many common bulk tasks it will save you quite a bit of time because of the API's that they expose to their administrators.

The Role of Automated Health Checks

The increasing complexity of network infrastructure devices has drastically changed what is required to perform a thorough health check to ensure it is operating correctly and efficiently. Take for example SD-WAN; what used to be a relatively simple health check on a router now requires deeper knowledge of the specific traffic traversing the device. In the past a few checks of system health (CPU, memory, hardware status, interface status and errors, routing changes) has now evolved to also include app-routing and application aware functions (app routes, SLA's, BFD, NetFlow, QoS, among many others). Health checks on a site router can now consume valuable time in driving the incident to resolution. Then take into account all of the devices in a network path between a source and destination, of which many of these devices now include rapidly evolving network technologies, and it becomes a painful battle to beat the clock as your business is being impacted by a critical incident.