Networking with OpenBSD in a virtualized environment

Video in TIB AV-Portal: Networking with OpenBSD in a virtualized environment

Formal Metadata

Networking with OpenBSD in a virtualized environment
Title of Series
CC Attribution - ShareAlike 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this license.
Release Date

Content Metadata

Subject Area
Virtualized systems running on hypervisors such as bhyve, ESXi, Xen, etc are increasingly important in the datacenter. With a long history of stable regular releases, security, and networking performance OpenBSD is very well suited to take advantage of virtualization and to help improve the state of the art. This presentation will explore why OpenBSD is well suited to deploying as virtual network devices on the various hypervisors and present practical examples of using OpenBSD for production networking in a virtual system. I will discuss what tools are in base, what tools are easily installable from ports/packages, current automation and management tools, and how to use them effectively using specific real world examples from large data center networks. Will present examples and methods for using OpenBSD to build routers, firewalls, and loadbalancers running on the various hypervisors. Will talk about methods for automating deployment, configuration, and integration with existing vendors. Will also address possible future applications in switching. Will discuss how to use the tools in OpenBSD to run a better and faster network with fewer problems and how virtualization can be part of that. In addition to the above I will discuss why the OpenBSD community in particular should care about virtualization and work to improve the state of engineering there.
Standard deviation Implementation Theory of relativity State of matter Computer network Bit Parameter (computer programming) Icosahedron Stack (abstract data type) Virtual reality Integrated development environment Software Internet forum Internetworking Data center National Institute of Standards and Technology Chaos theory Whiteboard Implementation Computing platform
Complex (psychology) Group action Weight Weight Computer network Open set Group action Computer font Goodness of fit Software Scalar field Software Set (mathematics) Configuration space Cuboid Website Estimation
Standard deviation Scripting language Software developer INTEGRAL Disintegration Virtual machine Set (mathematics) Prototype Touch typing Logic Set (mathematics) Cuboid Energy level Medizinische Informatik Address space Stability theory Scripting language Standard deviation Server (computing) Computer network Bit Dynamic Host Configuration Protocol Software Touch typing Revision control Data center Configuration space Lastteilung Moving average Modul <Datentyp> Fiber bundle Virtual reality Booting
Rapid Prototyping Complex (psychology) Building Overlay-Netz Code Multiplication sign 1 (number) Bell and Howell Set (mathematics) Open set Icosahedron Mereology Different (Kate Ryan album) Chaos theory Set (mathematics) Cuboid Area Overlay-Netz Metropolitan area network Channel capacity Sampling (statistics) Physicalism Bit Cloud computing Control flow 10 (number) Proof theory Sample (statistics) Telecommunication Internet service provider Configuration space Lastteilung Chaos theory Virtual reality Probability density function Point (geometry) Backup Implementation Mobile app Server (computing) Firewall (computing) Similarity (geometry) Expert system Value-added network System programming Implementation Metropolitan area network Routing Standard deviation Forcing (mathematics) Interface (computing) Code Computer network Limit (category theory) Subject indexing Database normalization Wind tunnel Software Integrated development environment Data center Video game Point cloud Operating system Cloning
Point (geometry) Gateway (telecommunications) Server (computing) Implementation Multiplication sign Virtual machine Maxima and minima Client (computing) Replication (computing) Mereology Subset Twitter Mathematics Virtual memory Different (Kate Ryan album) Internetworking Bridging (networking) Control theory Overlay-Netz Operations research Metropolitan area network Dependent and independent variables Texture mapping Server (computing) Web page Moment (mathematics) Bit Maxima and minima Grand Unified Theory Port scanner Connected space Degree (graph theory) Inclusion map Internetworking Software Integrated development environment Personal digital assistant System programming Data center Virtual reality
Gateway (telecommunications) Freeware Service (economics) Computer file Real number Virtual machine Client (computing) Regular graph IP address Population density Mixed reality Internetworking Integrated development environment Control theory Office suite Information security Metropolitan area network Jackson-Methode Server (computing) Chemical equation Grand Unified Theory Connected space Human migration Internetworking Integrated development environment Software Different (Kate Ryan album) Data center
Building Beta function INTEGRAL View (database) Multiplication sign Open set Mereology IP address Formal language Different (Kate Ryan album) Atomic number Cuboid Multiplication Identity management Social class Exception handling Overlay-Netz Structural load Software developer Bit 3 (number) Variable (mathematics) Flow separation Category of being Message passing Process (computing) Order (biology) System programming Right angle Lastteilung Quicksort Virtual reality Point (geometry) Laptop Trail Server (computing) Implementation Freeware Service (economics) Real number Firewall (computing) Disintegration Virtual machine Spiral Knot Similarity (geometry) Device driver Graph coloring Theory Number Population density Bridging (networking) System programming Backup Mobile Web Domain name Default (computer science) Multiplication Standard deviation Demo (music) Weight Cellular automaton Professional network service Vector potential Subject indexing Software Data center Point cloud Communications protocol Identity management
Group action Freeware Multiplication sign Virtual machine Device driver Mass Latent heat Computer hardware Gastropod shell System programming Cuboid Software testing Data structure Multiplication Information Key (cryptography) Projective plane Device driver Plane (geometry) Software Computer hardware Configuration space Right angle Cycle (graph theory) Cuboid Identity management
Area Gateway (telecommunications) Complex (psychology) Server (computing) Chemical equation Graph (mathematics) Virtual machine Database normalization Spring (hydrology) Roundness (object) System programming System programming Virtual reality Booting Form (programming)
Building Server (computing) Tournament (medieval) Maxima and minima Cloud computing Solid geometry Client (computing) Total S.A. Arm Storage area network Value-added network Web 2.0 Scalar field Gamma function Summierbarkeit Address space Newton's law of universal gravitation World Wide Web Consortium Metropolitan area network Demo (music) Server (computing) Keyboard shortcut Parallel port Bit Mereology Fehlererkennung Open set Type theory Process (computing) Software System programming Video game Communications protocol Operating system
Metropolitan area network Gateway (telecommunications) Haar measure Server (computing) Information systems Cloud computing Maxima and minima Client (computing) Ext functor Client (computing) Plastikkarte Disk read-and-write head Discrete element method Arm Open set Value-added network Storage area network Set (mathematics) Helix Summierbarkeit World Wide Web Consortium Window
Metropolitan area network Wechselseitige Information Demo (music) Server (computing) Maxima and minima Client (computing) Port scanner Open set Arm Value-added network Predictability Runge's theorem Mach's principle Inclusion map Software development kit Lastteilung Cycle (graph theory) Gamma function World Wide Web Consortium
Gateway (telecommunications) Group action State of matter Multiplication sign Set (mathematics) Cyberspace Open set Mereology Disk read-and-write head Food energy Arm Pointer (computer programming) Bit rate Analogy Cuboid Control theory Series (mathematics) Office suite Information security Identity management Metropolitan area network Computer icon Boss Corporation Theory of relativity Software developer Gradient Ext functor Bit Flow separation Open set Proof theory Vector space Configuration space Right angle Cycle (graph theory) Quicksort Whiteboard Virtual reality Writing Laptop Ocean current Virtual machine Division (mathematics) Device driver Event horizon Theory Product (business) Power (physics) Number Mach's principle Bridging (networking) Computer hardware System programming Energy level Software testing Gamma function World Wide Web Consortium Gateway (telecommunications) Server (computing) Cellular automaton Basis <Mathematik> Grand Unified Theory Mortality rate Limit (category theory) Word Wind tunnel Kernel (computing) Software Integrated development environment Personal digital assistant Video game Cuboid Family Gradient descent
morning and great personal no relation to call I Bill just a little bit of background I do datacenter network clean and and several very large data centers heavily virtualized environments and so now 14 in virtualized environments and with virtualizing there's kind of a big interest in behind because it's important and that's something that we're all going to be doing more basically you wanna talk about how we can better region assumed and be a season general to make the virtual world a little less chaotic and a little less scary so as you all
probably know the BSP is the thing being go way back to the 1st 2 steps implementations came out of Berkeley and pretty much all moderate TCP IP stacks go back to the used state on nearly all IP SEKT goes back to the 1st obviously implementation and there is in my opinion a strong and sustainable argument to be made that's the BSD network implementations that TCP stacks excetera are the best in the world across the board and there is here a extremely strong arguments we made the BSD NIST sale licensing is 1 of the reasons why the Internet works as well as it does without those standards interoperability and the fact that it's not viral things with such a lot more so it's a logical platform to use for heavy-duty networking
but brief outline of the history of the the IP
stack and so these these and this is 1 of the reasons why Juniper net scalar were several of the other large vendors use them so much is they enable the habits of good engineers it enables laziness of action the configurations are easy and good and it's remarkably easy to spin up the open EST box that is ready to do industrial site you know big networks out of the box the documentation is really nice and we attempt to not make a mess out of that which is good but parsimony and as a person coming from the network side of the house I hate complex network configurations there the and and the open BST network configurations are incredibly personal us and easy
so powerful tools for networking and troubleshooting and general computing I mean we have to be lands built and that are incredibly easy trunking incredibly easy and things like really the where you can turn up a load balancers that competes with any of the major vendors out of the box and everything's integrated is another thing that I like because it's all in base really Dean lands on everything you need to network is base it's integrated you get the stability get the logical the faults and things work well responsible for a standards compliant so
especially on IBM you can spin up an open BST installed we have basically all the networking 18 bits that you need in something like 10 minutes I 0 touch provisioning is awesome especially in the data center and everything in based and this this and the ability to do customized roll outs with the host specific sets and site-specific scripts across to data center that's incredibly important and it's really cool when you start building large-scale virtualize is and environments because if you wanna spin up you're load balancer at a speed this up there's a virtual load balancer for 100 customers across to you know 10 machines having that level of automation is absolutely critical and integration makes complex things it really easy to set up and 1 of the examples that I use it's a rather trivial example that's cool is the DH seeking integration the PF integration means you can spin up and prototype of machine to enforce on MAC addresses in and minutes and NSH is a really cool tool on actually Peter put it and ports after widening a lot about it a hum 1 of the things it brings it is the ability to give your overnight guys these very simple configurations and they can drop on and make your configuration very network like it feels if you come from the Cisco Juniper Arista whatever side of the house it feels very intuitive feels very natural because the configurations are in a logical way that used to so specifically about
virtualization really open BST plays nice with essentially all the hypervisors and the ones that there doesn't yet there it's being worked on and the axle and here's the affine fascinating and index landers what's think about a large part of the talk but so often BST had the 1st implementation of the X land and areas in many ways by far the best and it's basically a tool to build overlay networks so an underlay network is the physical network as it's laid out switches firewalls Layer 1 Layer 2 getting packets from here to there and it's pretty complex and ran by Bell people like myself what an overlay network allows you to do is virtualize all that away universalize all about away you can chop down you can get rid of all the layer to complexity well you can get rid of the complexity that you can hide you can hide it from yourself so where I might give you a medium over here and you have a medium over here 2 different hypervisors 2 different layer to networks everything out and between here all that complexity want DOS use and sensible the tunnel that encapsulates the packets from here takes over here and treats it to your points it looks like it's 1 great big happy the or something and that allows things like to do cop between hypervisor is backups are particularly nice with this because a lot of backup tools assume that you're in on the same the land and so it simplifies a lot of that it can allow you to get back past a lot of the limitations that might be put on you by Infrastructure-as-a-Service or for the purpose of this talk or hold and provided by being able to build tunnels between different environments different subnets it doesn't matter if you expand upon this House refuse spun upon a data center 100 miles away from your other dataset are as long as you have connectivity and if you can get paying through you can virtualize all that away that's really exciting stuff out and it allows a lot of automation I really be really is a pretty amazing tool and I'm not saying that just because the man of you I was there's a year like the next 1 yeah i have heard of so really the is a load balancer on par with any of the big things at this point so that's there are 5 free lady can do essentially everything they can do and it runs on a nice based on on esteem box which is really not scarp of course we all know cop cop is extremely useful for redundancy PDF is kind of the gold standard of the land I have maybe 1 sample code and I mean so it's dead easy bridging is nice 1 of the things I want really like about networking with company is the rapid prototyping and specifically in a virtual environment the ability to do a proof of concept and an hour or an afternoon for something really complex is incredibly nice and with some of the tools that we have it doesn't really matter where you're doing it because you can make it work and so you have the ability to do rapid prototyping more than once I've done things that would have cost had tens of thousands of dollars from a vendor award taking a very very long time in an afternoon with tools essentially index so the other kind of communication and his candidate thing is between network people and systems people there's a bit of a gap but if we communicate with coder configurations snippets it reduces a lot of miscommunication and that's 1 of the things that I like about specifically using open BST fervor for communication is I take for example the the Wang configuration from obviously box I had that to somebody that knowing the lands of all life on Cisco they can see what I did that with pretty much know pretty much instantly they can see what I did and that's really powerful because you improve the amount of because you reduce miscommunication and I mean if you're looking at the configuration you know what it is so that's really pretty powerful and it's a dramatic difference from some other operating systems but the era
flight and the RF in don't actually have an example of so you're a flight is in obviously based integrated with Pf integrated with all the routing Damon's it's very span of a box the on base you have all the tools you need it I and again and the other thing I like about it is the configuration if you do it you needed to do the configuration you'll see some examples later I decided not to put in any examples and so the whole talk on it and if you a little bit if you do that configuration handed against your Cisco got hydrogen burning the network guys never touch to BST box should know instantly what you did there because it goes through a logical uses a lot of similar syntax it was obviously written and designed by people who have to work with the following in which again I really like 3 basic commands to set up an works like you would expect it to if you've used any other implementations if you set up suspected set upon the juniper anyplace else it essentially I mean if you don't the RFC on juniper Cisco whatever it works like it was and so then I started reading the how not many that tired needed so I mean that's literally all it takes to create a the land on open estate configures which right plotted on here and you're good to go and that is to a network of that so incredibly intuitive configuration what threats that appear interface creatively land assigned the onto the interface to the IP done so now is a good time for an aside on pets forces livestock in the virtual worlds is remained in the hypervisor shortly so it's the idea of are you ready for Infrastructure-as-a-Service off a cloud over to virtualize and if your servers are pets you probably aren't at their named anymore and they go down and that's a problem you probably don't you probably have a problem on the other hand livestock if your app is written or whatever you're doing is written in such a way that can take a noun bring about you know run chaos monkey had everything got down backwards with and then you're ready and the thing that the network is I can bring here is the ability to move things around so for example if you decide you wanna go from AWS to some other provider that has to that there are literally I was just telling about spot on the spot markets in cloud computing people so you capacity and whatever provider you want and you just move your stuff around and that's pretty powerful and there's some quality issues there of course but so
on the other hand everything isn't exactly rosy and he is not wrong but now we are going to be running things in a virtual world as the other talks here late clear as makes clear I mean we can't keep the whole thing we physically can't keep the whole thing lumbering along on all physical machines at this point so we have to virtualize the goal is how to make a subclass and by leveraging St for the networking you can make it subclass to a large degree at that's going to be critical so solicited
some Twitter advice about and if anybody else had a b X land implementations and so I can actually find any mention for around on Google of anybody else having 1 of and and and that was her response right back which data news used to me who do that should so little more more in depth to the our little more in depth to the overlay network thing and I was 2 ways slashed disease slash socializing to make my own and so on and drawings where ignore the fact that I'm not actually using the example of the land ranges colitis stole these basically so the upper drying shows what's called your underlying so you have your server of the and in this case can iteratively switch to your gateway which again is just another VM there and I can go over any network now that shows that you know going over the same subset then you're a gateway has a connection to the Internet will ignore for the moment all the stuff in between it and the internet over here client which is on a completely different subject doing a lot of stuff over that set up and gets to be difficult so for example if you want to do database replication that's a hard problem with just access to the underlying network you're also at the minimum of all lot of stuff there's no 1 the with our and in particular if you were running in a highly many virtualized environment without 1st you'd have to talk to somebody like me quite a bit to make changes to that and you would probably be going through a gateway you don't control but if you're in that kind of environment to get with do control has problems because again you don't necessarily control all of the routing and everything out on all the part that's hidden by that police had might be switched so the bottom drying shows a very basic I overlay network using the so your server texture bridge but it's just a straight bridged to network at that point i and then you have your internet in then you basically build the excellent time all this says taking anything for 10 . 0 . 0 0 . 2 and send it down the time this is of course a very basic sense and and that virtualizes away all of that underlies and gives you a nice machine to machine and and connection to do whatever it but 1 of the things this is really powerful for is saying these were different hypervisor is in different data centers it would let you migrate your VM's without having to taken down because you just eliminated the whole you can only migrating and on the same subnet problem so that's basically the overlay networking in a nutshell and it's a powerful tool so I
have the same migrating between hypervisors so if you're going say from the unwary behind for xanten beehive or behind is or wherever wherever it simplifies that greatly because to the machine and everything looks like this on the same subnet next hypervisor environments so where if you have to go between subnets don't really play nice together so again using the VAX land simple file that will get rid of that and all the density is probably better for it because you not at the winds of vendors and my gradients between different behind and that's important it's and another 1 for example is if you have a and made of and environment and you don't trust the vendor provided you can or you wanna pay whatever outrageous price they're charge you for the the around or for a i the can sorry that been on pay pay whatever outrageous prices charging you for a VPN connection you simply you go
back you stand out a gateway on the subnet there with your server pages for whatever that you get the regular internet connection out which normally you commit to do a VPN over because there's a whole bunch of stuff and only into the real IP address getting them to set up the the imbalances connections is a pain for whatever reason set that up set up the other clients at your office the 1 have a VPN connection to separate the excellent title which required you ask some from 1 port to essentially and boom you bypass you have your began under your control you greatly simplify things and you don't have to necessarily pay for your vendor for or whatever they're charging a further the can but it can also if you have as as popular a lot of people these days will also set up multiple environments because it will spin up I mean and infrastructures services spin up your environment wherever it spends adopt use it up and suddenly you don't care because you can relatively easily make all your stuff play nice with each other I downsides of the x there's no security whatsoever this is not BPM high itself it's essentially a tunnel over which you can build a weekend that somebody again by itself it has no security to it it does depend on the underlying physical network and routing so it can be used it can so it can be used to compensate for bad network designs but it probably should that on but you can use it once you have a solid under network you can then use it to do really interesting things that would otherwise cost a lot of money but 1 of the things you can do with that that's really important is if you get on a hypervisor and have a given hypervisor that is running really hot if you have the axle and it makes it really easy to quickly migration to another hypervisor it also makes it easier to spread out your machine so if you need to spread out machines across a 20 hypervisor is across 2 data centers all you have to do is stop them into innocent medicine connections and if you're machines only to appear to be on the same so that you can do that I'm honestly quite excited about this effect of and
so things yes all of the all of the of the of the of the yes and yes yes you know I'm not using had no I I don't exist but not using that I didn't was the 11th pound weight easy and have their origins in the in the real world so layer Europe and in this work that uses the 5th what of all the URI if you work with you know who you are or what you want you to model or something nice so we basically get for free almost the whole of the year I have all the the you will be called the year note you is our our our is goal in use of the of the of the news right and the other nice thing about this land is it's also been used by a lot of the OMB unicorn slash STM people and they use that a lot for the Unicorn so I mean it's really nice because it allows seamless integration into a lot of that and I have a quite well so yeah he's mobility and cloud spot markets overlays let you have leverage that so I mean if you wanna move between 2 wherever the cheaper infrastructure that really does indeed able in a lot of ways is the promise of moving between things relayed the free functional secure load balancing with some really cool tools and really easy this set up I think I set up the implementation I have running for demo purposes I started speeding up for the the hands for it when we ordered dinner last nite and by the time we were 18 I had mostly working with that but the mostly parts because I have a crappy hypervisor on laptop similar story but mostly feature complete with major vendors so I mean the thing is is and the reason why that's important is because here have customers asking at 5 candidates that's here can do this we can do the other here can you do this and I mean it's important to do that to to them that that's how you sell it so I mean and again also from a number of things point of view if you know of 5 if you notice here if you know how to load balance you know how to use related because it keeps the concepts akin to configure language that is really understandable I mean it's a little bit different but it's really understandable actually it's really understandable and again virtual reserved portable passes easy-to-deploy know I haven't spun up really quick and manage and monitor with your existing tools so if you're running BSD servers specifically on communities are but anything and you using salts to manage those you can use all to manage all your stuff danceable whatever you're basically can now manage all your network wrapped with all the crap that URI manage all your other pathways and so all the crockery having no and love or don't take to the less whatever that I the other upside to that is again it's standards compliant and and of course deployment tools that you have work so you don't have to write or go through another workflow to deploy a virtual fire order deploy a virtual load balancers order spin up the load balancer you just do it with all the tools that you already have a new as long as is obviously is a possible against under systems it just works because it's all index which is sweet PF it's the gold standard I really don't need to say a lot else about it are domains sweets sweety we are flight without we are far light to multi tendency is impossible without multi Tennessee the modern data center is essentially impossible I am not going to go deep into our domains because beta will be going much more in depth on them but they're basically there are critical to multi Tennessee with the art of naming PF integration we are a remarkably close on open to being able to build virtual firewalls is on par with any of the current big it's there's a couple bits that I either have been able to figure out yeah have you know find yet and I may very well get credit and you have so happy for that but we're basically on track I mean we have almost all the tools to compete with the Cisco's the juniper the checkpoints the Palo Alto goes on virtualized firewalling it's really exciting and it's really exciting for me because I kind of have that old-school
BST religion I wanted to be in basin of a sort of basic scrap of and having all of that in based on a machine I can spin up in 10 minutes that that's what and of course we can run multiple atoms for isolation in the meantime so since there so light and we can spin up you know 10 atoms run the firewalling through that color today and part of Mainz on our back and potential for ah well our domains and to relay did you get it's probably end enough separation and honestly more separation the most of your major funders provide today and you can set up a multi-tenant spiral I mean you can set up and to borrow a phrase from the M where you can basically set up a virtual data center on a box running pretty much nothing but on the estate and that's pretty awesome plays nice under all major hypervisors is assigned well and basically I mean it plays nice and VMware excuse me Xenbase stuff I forget behave either getting supporter has support has support In and I've heard some other a seriously cool rumors that I'm not sure I'm not sure how much I should talk about but there some other service they call I that basically under all is becoming troops efficient network and I mean it's a great networking stack constantly being improved and of course manager property crap URI have 2 major the crap which that's all it is also 1 of the world with what the is it it can run as a guest under earth with the exception of the Microsoft stuff and that's actually possibly changing it runs as again I mean obviously in cells runs as a guest under create everything I can think sodium where the height is an interior and the kind of work and it installs and runs with well it you also runs with the Intel 1000 III always the neck typically uses but I mean they all have the among driver that works with on the ST so so so so yeah you're not near the neck is going to be the MOE and 1 on under most hypervisors all of them right off right so I was gonna say yes yes yes and that's actually that's actually wake also so in couple the unclad ourselves on a couple via more classes that I've taken in the past couple years yeah how long always been upper obviously destitute because of course I will again be able to spin it up and put on the VMX metric with like is inside of 100 that's just it's also because if you get all that for for free because people who use the building and that's kind of where I get really excited about open BST specifically is the development is pretty much done by people who do this crap for a living and so it's just it's beautiful when it gets down to a knuckle dragger like me because it's all there are built by people who you know kind of think like me not of in bridges in switching so obviously has absolutely wonderful bridging and the 1st time I spun it up by sat down with a so and a couple of docs had hadn't ever done that before a half an hour later I had a very slow variable pore density switch up up but you know I got the job done and multiprotocol by default will hitch at the at the which is fun because you know what a protocol or multi-layer switches are all the rage and as opposed to having to figure out whether in the hell licenses was an alarm you put on it it but I have all right there and of course again I have a thing for management because as a professional network I am sick and tired of configuring network devices by hand I am so done with that and the more we can get standard saying probably BEST OS is doing jobs here the faster I can start using all these tools that the server guys talk about that idea it seriously jealous of and so in theory you can build a virtual switch to work with public IP API is under again pretty much all major hypervisors they can in theory be done under the where the open switch guys they use all public I provide that they use all public API to run under the Indian where so it's theoretically possible I couldn't do it and it would require somebody a lot smarter than me to do the work but in theory it's possible to build a virtual switch out of the of the estate which would be very exciting because again he would have all those management tools and you want to have to go through worship at the
altar of the Cisco pricing structure and a slight aside into white box switching or a bare-metal switching so in the networking world merchant silicon is becoming very popular this whole idea that a Cisco is going to design and a 6 from the ground up integrate the software into a build releases the specific that a sick and release the switches on very slow release cycles and have these very slow vendor-driven upgrade cycles is becoming really unpopular people are really quite done with that and Arista has kind of completely proven that you can take 1 of the off the shelf mostly Broadcom 86 plug it into a machine to spin up a stock OS right some drivers Dublin on there and have incredibly high performance which is that people do just really excited about and from the system side it seems kind of obvious you know you the system side is the managing things with things like salt API is configuration all that for a long time while that workers are a deal managing huge massive infrastructure by SSH inter-machine writing reconfigure cessation to another machine right interconvert tell into that and such that you hate right another machine writing another configure as a group getting tired of it and I'm just start so being able to build this off of it to get the drivers mostly commodity hardware again with a 6 hours you know kind of the elephant in the room of the issue of course is is convincing Broadcom to give up the documentation to allow us to write the drivers Cost as the obvious the community is well known for previously and basically everybody is you know we don't what drivers from you give us the documentation the info we write the drivers we have the people to write the drivers and we have people write better drivers the key of course is talking the lenders out of that documentation and that's a huge project but it's a potentially really exciting 1 so rest of course runs on pretty much a stock well center less actually Net workers get incredibly excited about this because you show a drop in in the shell there and all the things you can do on a switch with configuration and getting information off of testing if you have access to the shell gap well I want that obviously I can't do it but for that honesty and I think it would be a huge win because we will decrease some really cool tools so that's an aside on that so
concerns about virtualization in all its forms quality is a concern when we get into a world where where Spain at machines and when they have problems were killing them in the spring of again now we risk stop troubles stopping actual troubleshooting you destroy the machinery bill that is the new reboot and quality becomes a concern with that and it's something I think that we need to be concerned as a community about how to get that balance between moving fast and maintaining the kind of quality the world used to other hand we have really powerful tools and we have tools that can be leveraged in really interesting ways once they start to capture the imagination and to increase our flexibility of lot all of them we get into a v area of complex and fragile systems so we know about
that and we add redundancy and we have in so imagine we added a couple of gateways there were graphs in 1 redundancy round character on were building a tunnel were running cop on the other end because obviously what redundancy there we have all the stuff that's actually at the physical layer below the logical underway there and we don't this highly redundant powerful system but it has some fragility built and it's similar there's actually the researchers from the biological from the biology side doing research and how ecosystems become really complex and fragile and a lot of surprisingly applicable to networks and so the fragility that is introduced ironically with the increasing complexity that we get as we try to be more redundant and as we virtualize a lot of things is a concern the
BEST somehow help make can less fragile because we're building solid tools building well-designed tools were building simple tools to do complex jobs it can help to being make things considerably less potentially fragile so
0 now a bit of a demo as I was saying this is the 1 him in the
tournament in so this is running under parallels and it has some kind of problem with the and climate it's a crappy desktop but this is the set up that I spun up last nite over dinner it is as you can see a really basic set and so we define our external address KKR what's going to eventually garbage like we define a pool couple of web server sitting behind it put them actually into the pool the data really intuitive syntax and so the interval so the interval is how often pool has how often it probes each server to make sure it's up and set up define what we want http to look like for purposes of this for the protocol and then we actually bind it all together with a related to be proxy were listening on the external edges on 80 this thing for 80 forwarding to or posts on import to load balancing the error checking that it gets back at 200 to mark servers up because if the server you know stops returning 200 we want to be removed from the pool we do relatio hosts it shows how often our resources what assuredly bound up it shows us how many checks we have you show that to you a networker who has spent their whole life working with the 5 and scalar there read that instantly know what's what they're looking at it's really intuitive so then our web servers restrain base e to crucial basic set up so that clients using 2 or 3 0 13 . 2 we do curl gets signing and see if I remember how to disable this the 1 that really really creative thinking the funny thing is I have in my other example host way so it's host disable right handed out Savannah type which is not the in the fault of the operating system removal of hardly enough nobody's got a mean drunk enough yet to put Tom obvious Yunnan natively maybe tonight and it's search returning from much of 1 and for every other on and off have thing to door to my
other clients to do something else that's why I'm
running the 1 I'm running head so at home I have yes x running on a Mac Mini crammed full memory from and I am considering
after being here going completely crazy and protein of but not completely crazy
but I'm considering sigh heavier 6 ironic as
it useful for you know for work and considering putting behind 1 because I wanna start playing beehive I've gotten refilling excited about beehive some and I
wasn't able to get my on so I wasn't able to get some idea of land demo working because so there we can save 1 gonna 1 the other guy another I don't quite have the load balancing set up so that it still do the whole cycle through the think so parallels doesn't have a proper virtual switch so I wasn't able to get my explain stuff actually working but I mean to demonstrate how
all of you and then
considering after you want 0 nice that's on the rest of the ad gap and basically basic parallels on because about the laptop and I before I traveled citing is something that was really fast and they're like spend money without L. more research showed rather than considering virtual box and fusion the reactor Idaho with this is usually not what the reasons that just like the best of times the gradient of the what because it will be the company and the work on the basis the rural but in any case as you can see there's where the bridge set up the land they're fine going down and it really as I mean and that's the configuration this is and role in basic set of but I mean that's the thing that's all there is to it and that's as a network that is incredibly exciting to me and you have lot to say have somebody setting up a VAX land Teresita terminating this tunnel and set of 1 another open BST box on the juniper well so and so the excellent tunnel provides the tunnel or the road and extending that analogy a little is the and then you run your IP sex several over those of the cars running over the road so whatever appears on and that's where you build the tunnel to to add security to at so so so so you basically you build on the road with the excellent tunnel and then your IP sex stuff you running as the cars over the road so in this case and a set of words coming from 198 which 1 101 going to 100 to so if I wanted to then yes the theory but I would love to hear but what you have here is the rest of the story of how would you production of systems work that's all I want is 6 months apart cycle all know once you learned what well well how was that they actually actually open BSD had is actually Jennifer probably still obviously probably at 1st but obviously actually has the same sort of release cycle the juniper I mean if you have a cell that's the same management it's exactly the release cycle that's on juniper adults they they they they do a new release every 6 months and it's officially supported for years the other thing is
assuming you have backed the vector command I work for somebody who has backed that they tracker money up to the but I mean assuming you pack you back to the truck money on to the shore but assuming you don't have the big truck of money that's the creation of the movement was a there there there there are people I'm I'm I'm sure you could talk to on either these gentlemen I'm I'm sure there's absolutely certain absolutely or and you have a you know who he is right in my head but I just want to lecturer who developed I haven't met before so I wouldn't have recognized and before now the so I mean it is and now joking aside it is a concern and the last place I really ran lot in production was where I had enough trust from my boss that he would let me stand up things and he will doing and you really do I mean it's and the whole have deploy any of this and production where it's not already but 1 of the things I like about it and 1 of the the reasons why I get personally really excited about how well this works under virtualized environments because if I can you know given to give me a space on a hypervisor and I can do some proof of concept take it's my boss shown how well it works like the 1st thing next week I'm going to be doing is spinning up lab off of the end of the office of the ends that I have to show how we're going to use VAX land to sell the customer problem and if I can do that proof of concept take it to him that makes selling that considerably easier the problem with this is this was going through all the that we this is something that people but the cost of which the right to so anything I would like to get to is the guest achieved the 1st part of my research and what is wrong with by I need to go to the U. of of the of the time limits on the x in the area of of the power of the the the the the base state that there are also things all of the background of the of the of the of the of the controller to find the spread of social policy gradient descent over here you have have a lot of it as a set of relations events if you on the other the variants of the of the of the current of the people of the of the of the of the family of testing of the of the of the all of the other there is just going to go into production that is more there so I get excited about it I get excited about it because I don't like running something that I had that level of control over where I can and that makes me happy and it's under rapid development and you know I will be the 1st to tell you some of this is you know stuff that's going to be equal as it continues working on and set the school and stuff that I think school to start thinking about now because this is what we're getting there and we're building it out and I particularly and getting really excited about the behind so I also think it's cool because a lot of the systems guys I mean I would love to see more people doing network so as system any more questions go well thank you well if you would way that for fear of the writing of this is just a number of of the actions given the of the fight to the other critical that there was something probably don't have anything off the top of my head right now but it's possible now I mean where I ran it so it and actually need Peter of any numbers from your set up that you can share our life on the the people rise in the 1st half of the IRA members that now that some physical hardware but there are a lot of time in the in the in the in the in the southern part of the of the freedom of the of of the earth and you want to find the he's so current you used the so this is still a lot of so those people not the all of you know and like this that I've noticed as i've ran over virtual environments are have any exact numbers but I think it has gotten significantly better and I run mostly under VM where because of foreign and what I do and now with the MX now 3 drivers I do pretty well on most things now I'm not doing anything I'm not doing anything with obvious to you really high traffic yet 1 but the stuff that I gave you works fine and I mean we had a so I did have a few years back a virtual machine was running under the end where at the time I was a little bit differently this was not PF boxes a gateway for access control to a series of VPN tunnels and we were running 3 400 users through that at any given time and this was 4 or 5 years ago we were running 3 400 users during a given time and no complaints about the performance of the system when for that within it and so I mean is pretty heavy-duty I mean that it will end mu no not really yes there are many of them you have on the previous excuse me all the hype of these who who worked with or you the person from the hot all going well didn't say yeah I mean that's that was what I wasn't sure how much energy doc about that yes there were I haven't talked with rate plus the added value mentioned to me that in a year that Microsoft person me so yeah I mean and that is really exciting to me because he had been able to get some of these tools in those environments is cool but that because those environments exist in the powerful in the cool and new mortals we have the better if I'm all about 1 big happy family just in improving the state of engineering across the board so right so the to with some of it is 1 of the reasons for this are you know you know all of this kernel trick that you want to were small of the relations with the and of the time reaches the working on on this which this and this is the use of what you think tools so thank you all very much


  927 ms - page object


AV-Portal 3.20.1 (bea96f1033d39fbe77f82542458e108105398441)