Routers

• 2 Juniper routers
  • Were MX80s, upgraded to MX204s (this meeting)
    • Convergence: ~25 minutes -> ~1.5 minutes
• Core routers for network
  • BGP (eBGP, iBGP)
    • RPKI
  • OSPF / OSPFv3
  • DHCP relay / RA
  • BCP38
  • Passive ARP learning (more if we have time...)

ARP ARP ARP... ARP ARP...

ARP ARP ARP... ARP ARP...

    aggregate {
        inactive: route 130.129.0.0/16;
        route 31.133.128.0/18;
        route 31.130.224.0/20;
    }

RPKI

routing-options {
    validation {
        group rpki-servers {
            session 31.130.229.4 {  # Dragon Research Labs RPKI Toolkit
                preference 100;
                port 323;
            }
}
policy-statement RPKI {
        term whitelist {...}
        term invalid {
            from {
                protocol bgp;
                validation-database invalid;
            }
            then {
                validation-state invalid;
                community add RPKI_Invalid;
                reject;
            }
      

    policy-statement RPKI {
        term whitelist {
            from {
                protocol bgp;
                prefix-list RPKI_Whitelist;
            }
            then {
                validation-state valid;
                community add RPKI_Whitelist;
                next policy;
            }
        }
        term invalid {
            from {
                protocol bgp;
                validation-database invalid;
            }
            then {
                validation-state invalid;
                community add RPKI_Invalid;
                reject;
            }
        }
        term valid {
            from {
                protocol bgp;
                validation-database valid;
            }
            then {
                validation-state valid;
                community add RPKI_Valid;
                next policy;
            }
        }
      

  term unknown {
            from {
                protocol bgp;
                validation-database unknown;
            }
            then {
                validation-state unknown;
                community add RPKI_Unknown;
                next policy;
            }
        }
        /* This should not happen -- things should be valid, invalid or unknown */
        term failed {
            from protocol bgp;
            then {
                community add RPKI_Failure;
                next policy;
            }
        }
    }

Switches

• 2 x Cisco Catalyst 4500X Core stacked
• 10 x Cisco IDF switches
• 40 x Cisco 12 port switches
• "Joe's magic..."
  • Y'all keep plugging in DHCP servers :-(

  • A new switch to a fully provisioned switch in ~15 minutes (including a software upgrade).

  • Rooms are dynamic - this means we need to reconfigure things often and quickly

Switch Automation

• Feature-wise, the switch automation includes:
  • Initialize new switch with desired config and software image
  • Validation of config and image (checksum)
  • Auto-generation of SSH host key
  • Call-home for when a switch should re-ZTP
  • Auto-detection of connected device type (switch, AP, probe)
  • Port auto-config and auto-doc update
  • Detection of lost device and port description update

Guestroom Network

IETF participants are "weird"...
... no, really weird...

From recent stay

wkumari$ git push
ssh: connect to host git.kumari.net port 22: Connection refused
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

wkumari$