About


vpn.center is the personal blog of Buck Wallander,
 an IT infrastructure professional of 15+ years with particular interests in cloud, datacenter and WAN technologies, but also a daydreamer and dabbler in software. For the most part I design, build, fix, scale and secure IP network and cloud infrastructures.

Much of my background is in the datacenter and multi-tenant cloud space where I tend to enjoy a penchant for unconventional. Consequently, I have a fair bit of expertise in secure transport network overlays (hence the blog name). I'm ex-CCIE #27123.

Otherwise I enjoy my attempts at brewing what could hopefully pass for Belgian-style ales, PC gaming, exploring the world, smoking meats, working on my motorcycle and an aversion for the oxford comma.

View Buck Wallander's LinkedIn profile
My GPG Public Key (0xC7A670E6)

Popular posts from this blog

Running ASA on Firepower 2100: An End-to-End Guide

Image
This process shows you step by step how to run the tried and tested ASA appliance on a Firepower 2100 series chassis out of the box. Note that no special hardware (SSD, etc) is needed on the Firepower 2100 series devices to support this configuration. A quick housekeeping aside: To anyone who reads this article and believes that one is giving up security by replacing FTD with ASA, I strongly contend that you're probably wrong about that. Also, if from reading this it sounds as though I'm being harsh toward Cisco and their Firepower product team's top-level decision making, it's only because it actually is that terrible. </sarcastic rant> On that note, let's get started! Concepts and Key Terms Cisco's Firepower isn't actually a product in and of itself but a suite of products and subcomponents. For those uninitiated with the breakdown, it's important to understand what those components are for this procedure. FXOS  (Firepower eXte
Read more

Configuring Cisco ASA for Route-Based VPN

Image
Here I'll attempt to give an overview of Cisco ASA's implementation of the static virtual tunnel interface (aka "SVTI", or "VTI" for short), also known more simply as "route-based VPN", and how to configure it on Cisco ASA firewalls. Some benefits of using VTI is it that does away with the painful requirement of configuring all of those joyless static crypto map access-lists, meaning you no longer have to manually maintain all possible local-to-remote prefix security associations. IPSec VPN deployments ultimately become easier and with BGP you also satisfy HA requirements to public cloud connectors such as AWS and GCP. Guidelines Below are a snapshot of guidelines for using SVTI specific to the ASA platform (keep in mind that SVTI is not ASA or even Cisco-specific technology, each device will have a different implementation): You can use dynamic or static routes for traffic over the tunnel interface  The MTU for VTIs is automatically se
Read more

Up and Rawring with TRex: Cisco's Open Traffic Generator

Image
Network performance testing is hard. Historically it's required expensive [cost-prohibitive for < $BN enterprises] equipment starting at tens of thousands of dollars for what amounts to an overly complex traffic simulation appliance, then practically requiring a professional level certification just to operate it. Sound familiar at all? Personally I must admit that I've largely scoffed at the entire concept of simulated traffic testing, noble as it may be. I conceded that, as an engineer of a relatively budget-conscious organization, the only way to properly test something on the network was to simply put it into production, and then watch it from a safe distance whilst wearing a white lab coat and holding a pen and clipboard. Either it would perform admirably, or promptly catch fire and explode, indicating a yank-and-forget...or a step upgrade. Easy enough. That being said, it's just not everyday that a big name vendor offers a super useful tool completely free o
Read more

GCP Network Design: The Basics

Image
This is a write up on best practice networking basics for Google Cloud Platform with what I've learned over the last year while working on a large company migration to the cloud from AWS. I hope that it comes in handy for anyone new to designing networking in and to Google Cloud, or those who may just be generally interested in the details of the networking architecture stitching their projects together. Overview The Google Cloud Platform (the AWS-like division of the larger "Google Cloud", hereon referred to as just 'GCP'') organizational resource layout is generally like this: Created cloud resources live in a VPC, which are part of a project, which are organized in folders or subfolders. The flow is... Create a folder for each BU or department in your organization. From there, create a project for nearly everything else. This includes creating a dedicated project for the shared VPC to exist in. Nearly every different use case pretty much get
Read more