About vpn.center


vpn.center is the personal blog of Buck Wallander. Who is that, you might be asking?

I'm a networking professional of 15 years and have particular interests in cloud, datacenter and WAN, but also a daydreamer and dabbler in software. For the most part I design, build, fix and secure IP network infrastructures.

Much of my background is in the datacenter and multi-tenant cloud space where I tend to enjoy a penchant for unconventional. Consequently, I have a fair bit of expertise in secure transport network overlays (hence the blog name). I'm CCIE #27123.

Otherwise I enjoy my attempts at brewing what could hopefully pass for Belgian-style ales, PC gaming, exploring the world and avoiding the oxford comma.

View Buck Wallander's LinkedIn profile
My GPG Public Key (0xC7A670E6)

Popular posts from this blog

Running ASA on Firepower 2100: An End-to-End Guide

Image
This process shows you step by step how to run the tried and tested ASA appliance on a Firepower 2100 series chassis out of the box. Note that no special hardware (SSD, etc) is needed on the Firepower 2100 series devices to support this configuration.

A quick housekeeping aside: To anyone who reads this article and believes that one is giving up security by replacing FTD with ASA, I strongly contend that you're probably wrong about that. Also, if from reading this it sounds as though I'm being harsh toward Cisco and their Firepower product team's top-level decision making, it's only because it actually is that terrible. </sarcastic rant>

On that note, let's get started! Concepts and Key Terms Cisco's Firepower isn't actually a product in and of itself but a suite of products and subcomponents. For those uninitiated with the breakdown, it's important to understand what those components are for this procedure. FXOS (Firepower eXtensible OS) - More or…
Read more

Configuring Cisco ASA for Route-Based VPN

Image
Here I'll attempt to give an overview of Cisco ASA's implementation of the static virtual tunnel interface (aka "SVTI", or "VTI" for short), also known more simply as "route-based VPN", and how to configure it on Cisco ASA firewalls.

Some benefits of using VTI is it that does away with the painful requirement of configuring all of those joyless static crypto map access-lists, meaning you no longer have to manually maintain all possible local-to-remote prefix security associations. IPSec VPN deployments ultimately become easier and with BGP you also satisfy HA requirements to public cloud connectors such as AWS and GCP.
Guidelines Below are a snapshot of guidelines for using SVTI specific to the ASA platform (keep in mind that SVTI is not ASA or even Cisco-specific technology, each device will have a different implementation):
You can use dynamic or static routes for traffic over the tunnel interface The MTU for VTIs is automatically set, accordin…
Read more

Up and Rawring with TRex: Cisco's Open Traffic Generator

Image
Network performance testing is hard. Historically it's required expensive [cost-prohibitive for < $BN enterprises] equipment starting at tens of thousands of dollars for what amounts to an overly complex traffic simulation appliance, then practically requiring a professional level certification just to operate it. Sound familiar at all?

Personally I must admit that I've largely scoffed at the entire concept of simulated traffic testing, noble as it may be. I conceded that, as an engineer of a relatively budget-conscious organization, the only way to properly test something on the network was to simply put it into production, and then watch it from a safe distance whilst wearing a white lab coat and holding a pen and clipboard. Either it would perform admirably, or promptly catch fire and explode, indicating a yank-and-forget...or a step upgrade. Easy enough. That being said, it's just not everyday that a big name vendor offers a super useful tool completely free of cha…
Read more