Clay Haynes Clay Haynes, Senior Network Security Engineer at Twitter

Time 2020-09-30 01:08:20

Web Name: Clay Haynes Clay Haynes, Senior Network Security Engineer at Twitter

WebSite: http://alostrealist.com

ID:64560

Keywords:

Senior,Network,Clay,

Description:

Today s post is part of a series on how to develop an automation infrastructure in your environment. While there are a wealth of resources on how to setup an automation pipeline, to me it seems like there are missing pieces of the puzzle. This series will document how I build automation into my home network.Junos 20.1r1 was released recently, and with it came a rather exciting feature the ability to configure IPFIX flow export on the SRX Branch series! This update also includes the ability to support flow record exports in chassis clusters as well. This is a great feature to support traffic analysis through a myriad of tools, and even support basic Denial of Service Attack detection. With the addition of IPFIX we can also generate flow data for IPv6 traffic which previously was not supported on the SRX. Without further ado, let s configure IPFIX!I wrote a script a few years ago that would check to see if address entries existed in the more than one address-set. It works well, but it was missing one key component what happens if an address-set entry contains another address-set?I ve since updated the script with a little bit of logic to include tracking this very scenario, and I ll explain the changes below. The script is still available on GitHub if you want to download a copy and use it for your operations!This is an extremely long-overdue post, but I wanted to add a follow-up to the old blogpostRoute-based VPN with Multiple Source/Destination Networks to a 3rd Party Device. While the previous method still works, it still had some drawbacks:It required the use of ephemeral IP address, which can be a waste of IP spaceIt only worked if there was one destination network, as Next-Hop Tunnel Bindings (NHTBs) did not address which source network traffic came fromTraffic selectors were introduced as feature starting in Junos12.1X46-D10 (SRX200, SRX1400, and SRX3k series) and Junos 17.3R1 (SRX300, SRX1500, SRX4k, and SRX5k series) for IKEv1. IKEv2 support was added inJunos 15.1X49-D100, meaning this is only available for the SRX300, SRX1500, SRX4k, and SRX5k series.

TAGS:Senior Network Clay 

<<< Thank you for your visit >>>

Clay Haynes, Senior Network Security Engineer at Twitter

Hot Websites