Network: Difference between revisions

From NURDspace
No edit summary
Line 24: Line 24:
==Rack info==
==Rack info==
         Voorkant        Achterkant
         Voorkant        Achterkant
#22    Keyboard       Keyboard
22    Keyboard     Keyboard
#21                     Pachtpaneel     
21                         Pachtpaneel     
#20                     Rangeerrack
20                         Rangeerrack
#19                     Switch
19                         Switch
#18    Harmony         Racklight   
18    Harmony     Racklight   
#18    Harmony
18    Harmony
#17    Plank
17    Plank
#16
16
#15    Gateway
15    Gateway
#14    Gateway
14    Gateway
#13    Gateway
13    Gateway
#12    Gateway
12    Gateway
#11    Gpubak
11    Gpubak
#10    Gpubak
10    Gpubak
#09    Gpubak
09    Gpubak
#08    Gpubak
08    Gpubak
#07    Plank
07    Plank
#06
06
#05    Erratic
05    Erratic
#04    Erratic
04    Erratic
#03    Erratic
03    Erratic
#02    Erratic
02    Erratic
#01    Blind          Aardlek switch
01    Blind          Aardlek switch


= Management =
= Management =

Revision as of 13:17, 23 July 2023

Layer 2 overview

Below you can find the structure of the network as of 06-05-2022. Fat lines are 2 x 1GE LACP trunks Layer 2 overview 06-05-2022.svg

Layer 3 overview

we have a single-vlan flat network. The following prefix is active on this network:

  • 10.208.0.0/22

Within this prefix, we have multiple ranges for multiple purposes:

  • 10.208.0.x Network devices
  • 10.208.1.x Servers
  • 10.208.2.x DHCP clients
  • 10.208.3.x DHCP clients

If you are unsure which range you should use, stick with DHCP. DHCP clients can set their hostname via dynamic DNS. Clients in statically managed networks must specify a hostname in IPAM.

The default gateway on this network is 10.208.0.1

DNS

search nurd.space lan.nurd.space vm.nurd.space management.nurd.space router.nurd.space dhcp.nurd.space
nameserver 10.208.1.53

Rack info

       Voorkant        Achterkant

22 Keyboard Keyboard 21 Pachtpaneel 20 Rangeerrack 19 Switch 18 Harmony Racklight 18 Harmony 17 Plank 16 15 Gateway 14 Gateway 13 Gateway 12 Gateway 11 Gpubak 10 Gpubak 09 Gpubak 08 Gpubak 07 Plank 06 05 Erratic 04 Erratic 03 Erratic 02 Erratic 01 Blind Aardlek switch

Management

Network management administrative interfaces

You can manage our devices using the URLs below:

Product URL User Used for Notes
Edgerouter Lite https://gateway.lan.nurd.space:8443/ ubnt Routing and NATting towards internet
Aruba core switch http://core-sw.lan.nurd.space admin Main switch in the space
Access points https://10.208.43.254:4343/ admin Virtual controller for WIFI
Proxmox erratic https://erratic.lan.nurd.space:8006/ root Deploy LXC/KVM instances on our hypervisor
Erratic IPMI https://erratic-bmc.lan.nurd.space/ ADMIN Remote management of erratic
Synology https://harmony.lan.nurd.space:5001/ nurds Used for backups and storage Has a different password due to pwd requirements. Ask in the bofh channel.
IPAM ip+dns https://ipam.nurd.space/ ldap IP and DNS registration
LibreNMS http://librenms.vm.nurd.space/ nurds Network device metrics
Weathermap http://weathermap.vm.nurd.space Network traffic map
Smokeping http://smokeping.vm.nurd.space Network latency measurements
Icinga2 https://monitor.vm.nurd.space/ admin Monitoring service

Virtual machine

We support hosting multiple virtual machines, using both the KVM and the LXC model. These are deployed using proxmox. We have introduced the 'managed vm', which is a vm which adheres to nurdspace standards. For more information, see the ManagedVM and the Ansible pages.

VPN tunnels

We support Roadwarrior and Site-to-Site VPN tunnels, using Wireguard and OpenVPN. Contact someone from the BOFH team to discuss the possibilities and get connected.

Backups

We do daily full backups of managed systems. More details can be found on the Backup page.

TLS

All servers have a unique ECDSA certificate which can be used for both client and server authentication. Details about this setup can be found on the TLS page.

Network discovery

In order to make devices available for discovery, a couple of protocols can be enabled. Note that this only applies to physical systems, not VM/LXCs.

LLDP

The first one of these is lldp (Link-Layer Discovery Protocol). This protocol communicates device attributes to connected peers via ethernet frames. Lldp is enabled on all networking devices. Enabling these should only be done for systems that are physically connected to the network (eg, using an ethernet cable or wifi). Under debian, this is done as follows:

apt install lldpd
systemctl enable --now lldpd


SNMP

The second protocol to enable is snmp (Simple Network Management Protocol). This protocol allows a device to be queried for various network and host metrics, and allowing us to keep a precise count of per-device traffic rates. But above all, this gives us shiney graphs ^_^

First, install the required daemons and MIBs:

apt install snmp snmpd snmp-mibs-downloader
download-mibs

Next, configure snmpd for use. Edit /etc/snmp/snmpd.conf and set the following two administrative fields:

sysLocation    NURDspace,MODIFY_LOCATION_WITHIN_NURDSPACE
sysContact     Admins <bofh@nurdspace.nl>

Next, make sure that snmpd can listen on all ip addresses and can be queried using the default community

#agentaddress  127.0.0.1,[::1] # ADD A HASH IN FRONT OF THIS LINE
rocommunity  public default
rocommunity6 public default

Finally, enable snmpd and perform a testrun to verify if it is working:

systemctl enable --now snmpd
root@erratic:~# snmpwalk -v2c -c public localhost
iso.3.6.1.2.1.1.1.0 = STRING: "Linux erratic.lan.nurd.space 5.15.30-2-pve #1 SMP PVE 5.15.30-3 (Fri, 22 Apr 2022 18:08:27 +0200) x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (8715381) 1 day, 0:12:33.81
iso.3.6.1.2.1.1.4.0 = STRING: "Admins <bofh@nurdspace.nl>"
iso.3.6.1.2.1.1.5.0 = STRING: "erratic.lan.nurd.space"
iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar"
...