Author: rtoodtoo

Worked for more than 10 years as a Network/Support Engineer and also interested in Python, Linux, Security and SD-WAN // JNCIE-SEC #223 / RHCE / PCNSE

Traffic shaping with TC in Linux

Traffic shaping is a method to control the rate at which packets are sent and Linux does a pretty good job in doing this. I am currently developing a shell-like interface for TC in python and the following script is the framework for the application. I will update this post as I have more experience
Read More »

Simple Junos Commit Script

Here is a simple junos commit script that checks if a given interface is assigned to trust zone or not. It is very basic of course but can be extended using junos automation reference documents. /* basic-sanity-check.slax */ version 1.0; ns junos = "http://xml.juniper.net/junos/*/junos"; ns xnm = "http://xml.juniper.net/xnm/1.1/xnm"; ns jcs = "http://xml.juniper.net/junos/commit-scripts/1.0"; import "../import/junos.xsl"; match
Read More »

Simple NSRP configuration

A quick NSRP configuration for reference purposes; VSD: Virtual Security Device, it is a container for VSIs. VSI: Virtual Security Interface. NSRP is slightly different than VRRP when it comes to IP floating. In VRRP, nodes have their own IPs and acquire master IP during failover. However in NSRP, there is only one interface IP
Read More »

Path MTU, IP Fragmentation and MSS

I would like to write about Path MTU discovery and IP Fragmentation in this post and the relation between them. As per the topology above, if the host LINUX1 is sending a packet to LINUX3 device. Packet has to go through a path in which there are various MTU sizes involved. In the past I
Read More »

Generic/TCP Segmentation Offload and Wireshark

Before reading this post you may have a look at the link http://en.wikipedia.org/wiki/Large_segment_offload which is the main motive of this post. While I was trying to troubleshoot some TCP communication, I wanted to investigate something which I have ignored so far. Maybe one screenshot is more than many words; Have a look at total length field of
Read More »

Dynamic VPN in SRX

Here is my simple dynamic vpn configuration.  I have tested it and it works:) However I could only use windows clients in my setup although I tried so hard to get a working linux client, debugging didn’t provide me any useful information. Here is the config: 1) First configure profile config which contains users and
Read More »

IPSEC VPN between SRX and Linux

After a little struggle, I have managed to establish an IPSEC VPN tunnel between an SRX box and a Linux machine. In case someone else needs below is my configuration. SRX 650, JunOS 10.4R5.5 IKE CONFIG [edit security] root@host# show ike traceoptions { file ike.log; flag all; } proposal pro-basic { authentication-method pre-shared-keys; dh-group group2;
Read More »

JNCIP-SEC [ 2 – Virtualization ]

According to exam topics I will focus on routing instances, routing between instances and filter based forwarding. Lets get started; Routing Instances Routing instances may be considered to be virtual routers within a physical router configured like below. I have two virtual routers configured each of which inherits one interface from physical router.  In configuring
Read More »