CloudComputing – @TheTunnelix

Tag: CloudComputing

Diving into the basics of IPv6

04/21/2019 Nitin J Mutkawoa Add Comment

The Internet is growing. In case you are not on IPv6, for sure one day, you might need to migrate from IPv4 to IPv6. Now what kind of methodology you would apply whether a dual stack or a direct changeover depends upon a rigid observation and analysis of the network infrastructure. But, it should no more be taken as a complexity. Since a few years, many companies, government bodies, ISPs, and others are moving towards IPv6. Some are adopting dual stack. IPv6 can be said to be version 2 of the Internet. In this blog post, I will make my best to shed some basics and simple way to understand the features and benefits when using IPv6. I will also contrast it with IPv4. For research purpose, I have perused several books and blogs over the Internet and, same are referenced below. One of the challenges in Africa is to enable the smooth transition to IPv6. Whilst others are doing dual stack, others have successfully migrated the whole network infrastructure to IPv6. IPv4 has been created in the early 80’s. The Internet growth which is so huge and it will definitely need to move ahead with modern technology IPv6 running at its core. I had always admired one of the modern futurist physicist, Dr. Michio Kaku who said that “In the future, the Internet might become a brain“.

So why do we really need IPv6?

Besides, from the growth of the Internet and the scarcity of IPv4 addresses, we all knew that in IPv4, the network has been divided into two parts which are the Private IPs and the Public IPs allocation. And, those two segments which are Interconnected required NAT configuration. This breaks the contiguous of the Internet. Another reason is that there is no security in IPv4 at its core. Of course, there are other strategies to secure an IPv4 network. When it comes to data prioritization, it cannot be done at the core of IPv4 which means that there is not much of Quality of Service (QoS). In IPv4, we can configure or assigned an IP to a device or simply use an address configuration mechanism such as DHCP. But, the moment DHCP is down, we land into a problem. Here is the catch, this means that there is no way to make a device to be assigned a globally unique address. So, that’s why we need IPv6. Well, wait… What happened to IPv5 ? and what about IPv1, IPv2, and IPv3?

What happened to IPv1, IPv2, IPv3, and IPv5?

Have a look at the diagram below which makes it pretty easy to understand:

So, IPv0, IPv1, IPv2, and IPv3 were used in the development testing phase. Ipv5 was used while doing the Stream experimentation of the Internet.

Features of IPv6

There is no backward compatibility when using IPv6, but, the basic functions remain the same, and the features have been changed completely. Since IPv4 is a 32-bit address and IPv6 is a 128-bit address, just imagine how much bigger it is. It is almost four times more addresses than IPv4. We can say that there are more than 1500 IP addresses per square meter on earth.

Another feature of the IPv6 is about the header which is twice the size of IPv4.

In IPv6, there is also end-to-end connectivity which means that NAT is not required for the continuity of the Internet. Every host can reach another host over the Internet.

Other features are “auto-configuration” which can be either stateful or stateless. Stateless is a mechanism that does not require any intermediate support in the form of DHCP for IP assignment whereas Stateful serves IP addresses from a pool. Also to take into consideration is “faster routing”. In IPv6, the routing information is stored in the first part of the header which makes routing decisions faster by the router. Another feature is IPSec (IP Security). It creates an end-to-end tunnel between the source and the target though it is optional. “No Broadcast” is another feature within IPv6. Using an IPv4 network, you will notice during the IP Address configuration, the clients need to broadcast to the DHCP. In IPv6, the client doesn’t need to broadcast and instead will multicast to communicate with machines over the network. It is important to understand the difference between ‘broadcast’ (one-to-all) and ‘multicast'(one-to-many). In broadcast, clients will send messages to all hosts on the network, whereas in multicast, messages are sent to a group of stations. This allows the building of distribution networks where group management is required. IPv6 does not limits itself to multicast but also bring the ‘unicast’ (one-to-one) feature. This is used especially between routers which need to communicate to a specific router. However, if you have several routers nearby and you can choose any routers for communication, let’s say for a CDN purpose, we can use the anycast method to process efficiency packet routing.

Photo Credits: techiemaster.wordpress.com

Reading IPv6 addressing

Now, that you have grasped the basic concepts of IPv6 and why we need it, let’s see how to read IPv6. An IPv6 address is made up of 128-bits divided into 16-bits blocks. Each block is then converted into 4-digits hexadecimal numbers separated by colon symbol. For example, this is an IPv6 address in binary:

0010011000000110 0100011100000000 0000000000110000 0000000000000000 0000000000000000 0000000000000000 0110100000010010 0010100001100000

Since we have three series of zeros, it can be escaped between the two colons symbols. Leading zeros in the third block will result in 30. In case, you had one block of zeros, use one zero in the hexadecimal IP address. When converted to hexadecimal it is:

2606:4700:30::6812:2860

Let’s get into more details. There are two rules when reading an IPv6 address.

Rule1: Leading zeros should be discarded. As we can see in the 3rd block of the IPv6 address above i.e; 0000000000110000 when converted it is written as 30, because it can be read as 110000. Here is a video on how to convert Binary to Hexadecimal.

Prev1 of 1Next

How To Convert Binary to Hexadecimal
This video tutorial explains how to convert binary to hexadecimal numbers.

Subscribe:
https://www.youtube.com/channel/UCEWpbFLzoYGPfuWUMFPSaoA?sub_confirmation=1

Access to Premium Videos:
https://www.patreon.com/MathScienceTutor

https://www.facebook.com/MathScienceTutoring/

Prev1 of 1Next

Rule2: If two or more blocks contain consecutive zeros, omit them all and replace by double colons signs. Example the three blocks of zeros in purple above have been replaced as “::“, However, if there is a single block of zero, use 0 in the IPv6 address.

Assignment of IPv6 address

Similar to IPv4, we need to understand how to identify the number of networks and hosts in IPv6. Let’s take an example from a generic unicast address which uses 64-bits as network ID and 64-bits as hosts ID. Please note from the picture below the 64-bits in the network has been shared in three distinctive fields in the IPv6 packet structure.

At this stage, it should be clear how a generic unicast address has been designed. Now, another important point is the IPv6 address scope. A scope is a region where an IPv6 address can be defined as a unique identifier of a network interface. As we can see below, there are three scopes, Global Unicast Address, Unique Local, and Link Local.

Photo Credits: steves-internet-guide.com

The Global Unicast Address is routed and is reachable across the Internet. Also. the prefix for global routing prefix in IPv6 has been assigned by the Internet Assigned Number Authority – IANA, so that by only looking at the prefix of an IPv6 address, you can determine if its global or not. In the picture below, you can see the first 3 bits within the global prefix. Remember, that this is unique globally.

Then, comes the Site level aggregator – SLA which is the subnet ID assigned to the customer by the service provider. This follows by the LAN id that is used by the customer and is free to manipulate. This address is globally unique.

Let’s take a look at a Unique Local Unicast Address. It looks like private IP addresses and is used for local communication intersite usually in a LAN and for VPN purpose. It is not routable on the Internet.

The last one is the link local unicast address. This is used for communication between two IPv6 devices on the same link. By default, it is automatically assigned by the device as soon as IPv6 is enabled, and it is not routable. These types of IP addresses are identified by the first 10-bits of the address, i.e; FE80.

In this blog post, I took an example from only Unicast addresses. Remember, there are also Multicast and Anycast address ranges. Let’s now create some servers and perform some IPv6 configurations.

Goodbye IPv4 and, say Hello to IPv6

I created a CentOS7 machine on my VirtualBox. As you can see, the interface card enp0s8 have the IP Address 192.168.100.9 as well as fe80::9ef3:b9d3:8b87:4940. Remember, the fe80 is the Link Local Address.

You can also see the connection using the following command:

To create a connection using nmcli use the following command and check back the connection. You will notice that the connection has been created without any device attached to it.

I am now modifying ipv6-tunnelix and attached it to enp0s9. I will also assign it to an IPv6 address. (For learning and testing purpose, this IPv6 address has not been assigned to me, it’s that of Facebook’s public IPv6)

As you can see, the address has been assigned. But remember, same as you can assign a public IPv4 address on a virtual machine, you will need to route it for connectivity. In this example, I took an example of Facebook public IP Address.

Are your blog’s IPv6 ready?

In 2016, during migration on Cloudflare, tunnelix.com became dual stack i.e; both compatible for IPv4 and IPv6. You can test any website for IPv6 support at this link.

https://ipv6-test.com

Certifications

Getting certified on IPv6 is really interesting as it can demonstrate comprehensibility. You can participate in free IPv6 training and get certified from Hurricane Electric. It is important to read the IPv6 primer.

There is also a service from Hurricane Electric, called Tunnel Broker which can facilitate you for creating a tunnel from your IPv4 static IP address to free IPv6 tunnels. In future blog posts on IPv6, I will get into more details about it. If you like the article, please comment, and share.

Sources:

Networking, Security centos, CloudComputing, IPv6, linux, VirtualBox

Attending AWSome day online conference 2019

04/08/2019 Nitin J Mutkawoa Add Comment

The AWSome day was a free online Conference and a training event sponsor by Intel that will provide a step-by-step introduction to the core AWS (Amazon Web Services) services. Its free and everyone can attend. It was scheduled on 26 March 2019 online. The agenda covered broad topics such as AWS Cloud Concepts, AWS Core Services, AWS Security, AWS Architecting and AWS Pricing and Support. It’s pretty interesting for IT manager, system engineers, system administrators, and architects who are eager to learn more about cloud computing and how to get started on the AWS cloud. I do have some experience in managing AWS servers and even host my own server. However, I registered for the free training to refresh my knowledge and get more exposure such as the AWS pricing which I am not aware at all. Another interesting thing is that you will receive a certificate of attendance and you received 25 USD of AWS credits. Pretty cool right?

Right from the beginning, I knew this was something interesting. I encountered a minor problem whilst signing in. I had to send a mail to support and it was resolved immediately. Once connected to the lobby, it was pretty easy to attend and follow the online conference. After some minutes, Steven Bryen, head in the AWS Cloud delivered the keynote speech.

There was also an online challenge and I score 25,821 on the Trivia Leaderboard.

On the “Ask an Expert” tab, I was mostly interested in Man on the Side Attack – MOTS attack. They referred me to the WAF section on AWS. Another interesting link is the whitepaper of the AWS Overview of Security guidelines. AWS also offers comprehensive security across all the layers, SSL, DDoS, Firewall, HSM and Networking. I also shoot some question on Metric and Monitoring on application level such as on MariaDB. I discovered about the RDS performance insight. For applications on EC2, Containers, and Lamda, X-Ray looks very promising. Apart from virtualization, its good to note that AWS also provides containerization services.

The event was pretty enriching. The panel on the question area knows well their subject. I discovered a lot by participating in the AWSomeDay. I’m looking forward to AWS certifications in the near future.

Linux Application, Linux System, MeetUps and Presentations, Security, Virtualisation AWS, CloudComputing, linux, MariaDB, security

VMware vSphere High Availability Basics

07/22/2017 Nitin J Mutkawoa Add Comment

VMware vSphere HA is one of the core feature in a cluster. So let’s bring some more precision about it. High Availability – HA enables a cluster of ESXi hosts to work together so that they can provide high levels of High Availability for virtual machines rather than just an ESXi host by itself. In brief, the High Availability feature is provided by pooling virtual machines and the ESXi hosts in the cluster for protection. Some examples could be host failures, host isolations and application crashes. The requirements for HA is a minimum of two hosts, vCenter Server and Shared Storage.

[google_ad data_ad_slot=” data_ad_format=’rectangle’]

One ESXi goes down

By default, HA uses management network (Service Console/Management Network VMkernel connections). Let’s take a scenario where there are three ESXi hosts in a cluster. In the event where a physical server (ESXi hosts) goes down, the VM machines will be restarted on the other ESXi hosts. We can also set up applications to be started on the other physical server. From the three physical servers in the cluster one is going to be elected as master. The master server is going to keep track of other ESXi hosts through the heartbeat of other servers. This is done at the management network level. The master server will always expect to have heartbeat responses from other ESXi hosts.

Only the management network went down

If at any moment, the master server detects that a host is down, it will report that to the vCenter server and all servers will be powered on the other ESXi hosts. What is more interesting is that if only the management network goes down, and other network such the datastore network is still working, that would be referred as an Isolation incident. In that case, the vSphere will communicate to the master server and will claim that the ESXi host is still active is through the datastore heartbeat. In that case, the VMs will not be powered onto other ESXi host because it is an Isolation incident.

Only the Datastore network went down

Now, what if only the Datastore network went down and not the Management network? The master server will still receive heartbeat messages from other ESXi hosts, but no data communication is being sent to the datastore. Another element that is included in HA is VMCP – VM Component Protection which is a component that detects that if a VM is having access to the datastore. In the event of failure messages from the datastore heartbeat, the VMs will be powered onto other ESXi hosts where the datastore is sending alive heartbeat messages.

In all three scenarios, HA implies downtime as servers will be restarted in other ESXi hosts, but same is usually done within minutes. Another point to keep in mind is that HA applies only to physical host. For example, if a particular VM encounter a BSOD or Kernel Panic, HA will not know about it because the Physical server (ESXi host) is still communicating with the master server.

How the election process takes place to become the master?

When HA gets activated in the vSphere, the election process takes around 10-15 seconds. In that process (Enabling HA) an agent gets installed to activate HA which is called FDM – Fault Domain manager. Logs can be checked at /var/log/fdm.log. The election process is defined by an algorithm with two rules. For the first, the host with access to the greatest number of datastores wins.

Now, what if all ESXi hosts see the same number of datastores ? There will be a clash. This is where the second rule kicks in i.e; the host with the lexically-highest Managed Object ID (MOID) is chosen. Note that in vCenter Server each object will have a MOID. For example, objects are ESXI servers, folders, VMs etc.. So the lexical analyzer is a first component where it takes a character stream as input, outputs a token which goes into a syntax analyzer and the lexical analysis is performed. Care must be taken when attempting to rig this election because lexically here means, for example, that host-99 is in fact higher than host-100.

What IF …. ?

So what if vCenter Server goes down after setting up HA?

The answer is HA will still work as it now the capacity to power on the vCenter Server. FDMs are self sufficient to carry on the election process as well as to start the vCenter Server. FDMs are inside the VMs but not inside the vCenter Server.

Enable and Configure vSphere HA

I will be using the free labs provided by VMware to set up HA.

1.The first action is to choose the Cluster then click on ‘Actions‘ then ‘Settings‘.

2. Choose ‘vSphere Availability‘ on the left -> then click on ‘Edit‘.

3. Click on ‘Turn ON vSphere HA’.

4. Choose ‘Failures and Responses‘ option and click on -> and enable ‘VM and Application monitoring‘.

5. On the ‘Admission control‘ -> check the ‘Cluster resource percentage‘ option.

[google_ad data_ad_slot=” data_ad_format=’rectangle’]

6. Click on ‘Heartbeat Datastores’ and select ‘Automatically select datastores accessible form the host‘.

7. From the ‘Summary’ tab click on ‘vSphere Availability‘, it should mentioned vSphere HA: Protected.

REFERENCES and CREDITS:

1.VMware Tech Plus:

VMware official Youtube educational channel

2.VMware White paper:

VMware vSphere HA WhitePaper

3.VMware Labs:

Hands-On-Lab by VMware

4.Other Links:

(i) kb.vmware.com-Error during HA installation

(ii) Lexical analysis – IIT Bangalore

Virtualisation CloudComputing, vmware, vSphere

Recovery Data and Applications with Zerto – Part 2

03/31/2017 Nitin J Mutkawoa Add Comment

The flexibility of Zerto Virtual Replication means that we have multiple options for data recovery depending on what’s specifically needed in each use case. ZVR enables data mobility by adding offsite cloning to the toolkit. You have the ability to restore specific files and folders. Now if a critical folder is inadvertently erased, the clock can be rewind by saving time and money.

JLFR -Journal Level File Restore is a powerful feature that extends Zerto’s protection features to allow recovery of individual files or folders. Restoring a file uses the same checkpoint system to facilitate point in time selection and recovery. Any files in the journal can be recovered with the journal sizing tool. JLFR requires NTFS or FAT and is thus Windows compatible only.

To restore a file, click on “Actions” and then on the “Restore File” button.

Select the ZFileServer and click on next

Files can be restored from the available checkpoints.

The disk need now to be mounted whether physical or virtual that stores the files or folders to recover. Only one disk at a time can be recovered.

After that, the mount process can start.

As usual, the running tasks will be shown running on the dashboard. There are few ways to start restoring files and folders from the mounted disk, including from the monitoring tab or the open folder icon on the right under the running tasks.

For example on the bottom, there is a tasks button.

The browse button allows you to search for the files and restore it. Once finish click on the unmount button.

Another feature is cloning – Cloning will create a copy of the virtual machines saved to a specific point-in-time checkpoint.

By selecting the VPG name from the VPG tab which will open the VGS’s name in another tab. Click on More then on offsite clone.

Once on the Offsite Clone tab, click on Select a checkpoint.

For example, by selecting the latest checkpoint and the name of the Datastore, we can start the cloning operation.

Another recovery option is the backup restore. This is done by clicking on Actions then on Restore Backup. Again from some options, few things need to be checked. By choosing the restore plan which is the name of the VRA, the restore point, VM settings and the Power On option.

And finally the Restore Button

Restoring from backup allowed you to leverage scheduled and unscheduled backups that extend the protection offered by the journal. Cloning extends ZVR by giving you multiple copies of your machines as they looked at a very specific point in time. With the file restore feature, you can extend the functionality of ZVR across the full spectrum of disaster recovery options, ranging from recovery of an entire virtualized datacenter to recovery of just one single file.

Virtualisation CloudComputing, Zerto

Recovery Data and Applications with Zerto – Part 1

03/24/2017 Nitin J Mutkawoa Add Comment

By doing a failover test with Zerto features, we know that in a real disaster or disruption, everything is configured correctly and working as expected. Because if we put our VMs in a VPG, an entire multi-VM application can be rigorously tested without any interruption to that same application in production.

By clicking on the Failover button on the right bottom, we can start a failover test. The VPG can be ticked and click on next to continue.

The execution parameters are that which have been set up in the VPGs for example, boot sequence and checkpoint dates etc.. The Failover Test section is where you can start the Failover test.

The failover test creates VMs in a sandbox using the test network defined in the VPG settings. All testing is written to scratch volumes. The longer the test, the more space is consumed. At the end of the test, ZVR will power on the test VMs and do so in the correct boot order if one was specified.

The test will keep writing to scratch volumes until either:

The hard journal storage limit is reached
It’s manually stopped.

Since Zerto automates the test cleanup, you should only stop a test from within a vSphere client. In a live environment, you would then verify the results of the test in the recovery site and ensure each VM is performing as expected. Assuming a successful test, you can come back to the ZVM and click “Stop” under the running task section.

The report tab provides detail on the test ran. This can be used for confirmation of test success or failure and aid in compliance. The recovery reports can also be exported in PDF.

A live failover test can also be performed. This is an example from where you can toggle from test to live failover.

I have to choose the VPG and click on next

The i click on the checkpoint field to choose the date.

As mentioned the date can be choosen as well as a recovery can be performed from the latest backup.

You can also choose if you want to auto-commit, auto-rollback or none.

Auto-commit – Selecting Auto-Commit means that after a designated time (Default is 0 minutes), Zerto will commit the failover which promotes the failed over VMs to the new live production servers. Once the failover is committed, the DR servers will need to be failed back to production once the production site is restored to keep any changes made on the servers while failed over. To complete this, Reverse Replication will need to be enabled to replicate the changes from the target site back to the production site.

Auto-Rollback – The Auto-Rollback option allows you to designate a time after the Live Failover (Default 10 minutes) for the failover to be rolled back to production. This works similar to a Test Failover as you have a window to test your servers and applications and then undo the changes. This will also remove any changes that were made on the servers while at the DR site and does not require reverse replication.

None – If you set ‘None’ for the commit policy, you will have the option to either Rollback or Commit the failover later in time. This may be used in a situation where your production site is down, but could possibly be brought back online quickly. You have the option to commit the failover if you do not foresee a time production will be back online. However if the option is quickly fixed you can perform a Rollback.

After settings parameters in the “Execution Parameters” settings, the failover can start.

The sucessful failover test can be viewed on the dashboard. A move (or migration) is a more graceful operation than a failover since it is a planned outage It’s great for failbacks, preventive maintenance and site/hardware migrations. ZVM will gracefully powered down the VMs and then, as they are shutting down, grab the very latest copy of the data and use that instead of the journal. To move VPG, click on “actions” and “move VPG”

Then follow the same step by selecting the VPGs, but this time on the execution parameters, the VM need to be shutdown and click on “move”

After ZVR, has finished the commit and processed the VPGs, the move is done and we are back to the green circle which means the SLA has been met and the operation is successful.

Virtualisation CloudComputing, Zerto

Tag: CloudComputing

How To Convert Binary to Hexadecimal