Network: Difference between revisions

From NURDspace
 
(61 intermediate revisions by 3 users not shown)
Line 1: Line 1:
= Layer 2 overview =
= Layer 2 overview =
Below you can find the structure of the network as of 10-04-2022. Fat lines are LACP trunks
Below you can find the structure of the network as of 28-07-2023. Fat lines are 2 x 1GE LACP trunks
[[Image:Layer 2 overview 10-04-2022.svg|640px]]
[[Image:Layer 2 overview 28-07-2023.svg|640px]]
 
 
[[File:Infra nurdspace in detail (draw.io).png|640px|download the file below to see the whole thing + to make changes in draw.io]]
 
[[:File:Eis-T Hoe harkt de nurdspace .drawio.xml]]


= Layer 3 overview =
= Layer 3 overview =
we have a single-vlan flat network. Due to legacy, three different prefixes live on this vlan:
we have a single-vlan flat network. The following prefix is active on this network:
* 10.208.11.0/24 (gateway 10.208.11.1)
 
* 10.208.30.0/24 (gateway 10.208.30.1)
* 10.208.0.0/22
* 10.208.42.0/23 (gateway 10.208.42.1)
 
Within this prefix, we have multiple ranges for multiple purposes:
 
* 10.208.0.x Network devices
* 10.208.1.x Servers
* 10.208.2.x DHCP clients
* 10.208.3.x DHCP clients
 
If you are unsure which range you should use, stick with DHCP. DHCP clients can set their hostname via dynamic DNS. Clients in statically managed networks must specify a hostname in FreeIPA. If something is to be part of the infrastructure fabric of the space, it should be in the Servers range. Be sure to contact BOFH if you want to place a system in this range.
 
The default gateway on this network is 10.208.0.1
 
== DNS ==
search nurd.space lan.nurd.space vm.nurd.space vpn.nurd.space dhcp.nurd.space
nameserver 10.208.1.53
 
==Rack info==
        Voorkant        Achterkant
#    Keyboard    Keyboard
#                          Pachtpaneel   
#                          Rangeerrack
#                          Switch
#    Harmony      Racklight 
#    Harmony
#    Plank
#
#    Gateway
#    Gateway
#    Gateway
#    Gateway
#    Gpubak
#    Gpubak
#    Gpubak
#    Gpubak
#    Plank
#
#    Erratic
#    Erratic
#    Erratic
#    Erratic
#    Blind          Aardlek switch


== Layer 3 simplification ==
= Management =
In order to reduce the unnescecary roundtrips via the edgerouter, we need to flatten the networks into a single prefix. The proposal for this is to move to 10.208.28.0/22. This prefix would be used as follows (With the gateway living on 10.208.30.1):
== The team ==
* 10.208.28.1 .. 10.208.29.255 DHCP
The NURDspace infrastructure is managed by [[Network/BOFH|the BOFH team]].  
* 10.208.30.1 .. 10.208.30.255 Static clients
* 10.208.31.0 .. 10.208.30.254 reserved


= Management URLs =
== Services ==
You can find a list of services we manage below:
 
* [[Network/Services/Wiki|The wiki]]
* [[Network/Services/DNS|Internal and external DNS]]
* [[Network/Services/Authentication|LDAP / Kerberos authentication]]
* [[Network/Services/Freifunk|Hosted AP for Freifunk Chemnitz]]
* [[Network/Services/Switches|Cisco-based switching infrastructure]]
* [[Network/Services/DoorLock|Front doorlock system]]
* [[Network/Services/Cryptpad|Online collaboration tools]]
* [[Network/Services/VPN|Wireguard VPN tunnel]]
 
== Upcoming features and functionality ==
See [[Network/Roadmap|our roadmap]] for a list of upcoming features and functionality. If you think something should be added, add this to either the backlog or ideas, depending on the feature. You are more then welcome to join the bofh team to implement features and functionality yourself!
 
== Network management administrative interfaces ==
You can manage our devices using the URLs below:
You can manage our devices using the URLs below:
{|
{|
Line 21: Line 79:
|'''URL'''
|'''URL'''
|'''User'''
|'''User'''
|'''Used for'''
|'''Notes'''
|'''Notes'''
|-
|-
Line 26: Line 85:
|https://gateway.lan.nurd.space:8443/
|https://gateway.lan.nurd.space:8443/
|ubnt
|ubnt
|Routing and NATting towards internet
|
|
|-
|-
Line 31: Line 91:
|http://core-sw.lan.nurd.space
|http://core-sw.lan.nurd.space
|admin
|admin
|Main switch in the space
|
|
|-
|-
|Access points
|Access points
|https://10.208.43.254:4343/
|https://10.208.3.62:4343
|admin
|admin
|
|Virtual controller for WIFI
|-
|Proxmox coherence
|https://coherence.lan.nurd.space:8006/
|root
|
|
|-
|-
Line 46: Line 103:
|https://erratic.lan.nurd.space:8006/
|https://erratic.lan.nurd.space:8006/
|root
|root
|Deploy LXC/KVM instances on our hypervisor
|
|
|-
|-
Line 51: Line 109:
|https://erratic-bmc.lan.nurd.space/
|https://erratic-bmc.lan.nurd.space/
|ADMIN
|ADMIN
|Remote management of erratic
|
|
|-
|-
|Harmony NAS
|Synology
|https://harmony.lan.nurd.space:5001/
|https://harmony.lan.nurd.space:5001/
|nurds
|nurds
|Has a different password due to pwd requirements
|Used for backups and storage
|}
|Has a different password due to pwd requirements. Ask in the bofh channel.
 
= Per-device port inventory =
 
== Fritzbox gamershok ==
{|
|'''Port'''
|'''Description'''
|-
|-
|0
|DNS and identity management
|https://ipa.nurd.space/
|ldap
|DNS / Identity
|
|
|-
|-
|1
|LibreNMS
|
|http://librenms.vm.nurd.space/
|-
|nurds
|2
|Network device metrics
|To Edgerouter Lite keuken
|-
|3
|
|}
 
== Edgerouter Lite keuken ==
'''Device settings'''
{|
|Manage
|https://gateway.lan.nurd.space:8443/
|-
|Username
|ubnt
|}
 
'''Interfaces'''
{|
|'''Port'''
|'''IP Address'''
|'''Description'''
|-
|bond0
|10.208.42.1/23<br/>10.208.30.1/24<br/>10.208.11.1/24
|Linked to Aruba
|-
|eth0
|lacp member
|Part of bond0
|-
|eth1
|lacp member
|Part of bond0
|-
|eth2
|213.154.252.131/32<br/>213.154.252.130/29
|Connected to fritzbox. Mac addr 24:a4:3c:07:73:ab
|-
|tun0
|10.38.20.6/30
|Tunnel to zarya
|-
|tun1
|2001:470:1f14:1fa::2/64
|Tunnel to tunnelbroker.net
|-
|tun4
|172.30.0.6/30
|Tunnel to Techinc
|-
|tun5
|2001:470:7894:beef::2/125
|Tunnel to Techinc (transit???)
|-
|tun6
|10.255.255.10/30
|Tunnel to HBBZ
|}
 
 
'''Connected ports'''
{|
|'''Port'''
|'''Description'''
|-
|0
|To Aruba bar port 46
|-
|1
|To Aruba bar port 47
|-
|2
|To Fritzbox gamershok
|}
 
== Dell keuken ==
{|
|'''Port'''
|'''Description'''
|-
|0
|synology
|-
|1
|Spacesound
|-
|2
|To netgear keuken
|-
|3
|
|-
|4
|
|-
|5
|
|-
|6
|
|-
|7
|
|-
|8
|
|-
|9
|
|-
|10
|
|-
|11
|
|-
|12
|
|-
|13
|
|-
|14
|
|-
|15
|
|-
|16
|
|-
|17
|
|-
|18
|
|-
|19
|
|-
|20
|
|-
|21
|
|-
|22
|
|-
|23
|
|}
 
== Netgear keuken ==
{|
|'''Port'''
|'''Description'''
|-
|0
|To Dell
|-
|1
|
|
|-
|-
|2
|Weathermap
|http://weathermap.vm.nurd.space
|
|
|Network traffic map
|-
|-
|3
|Smokeping
|http://smokeping.vm.nurd.space
|
|
|Network latency measurements
|-
|-
|4
|Icinga2
|
|https://monitor.vm.nurd.space/
|-
|5
|
|-
|6
|Slabbar
|-
|7
|
|-
|8
|Kodi
|}
 
== Aruba keuken ==
{|
|Hostname
|core-sw.lan.nurd.space
|-
|Username
|admin
|admin
|-
|Monitoring service
|mgmt ip
|10.208.30.2
|}
|}


'''Huidige layout''''
== Virtual machine ==
{|
We support hosting multiple virtual machines, using both the KVM and the LXC model. These are deployed using proxmox. We have introduced the 'managed vm', which is a vm which
|'''Port'''
adheres to nurdspace standards. For more information, see the [[Network/ManagedVM|ManagedVM]] and the [[Network/Ansible|Ansible]] pages.
|'''Description'''
|-
|0
|Zaal 1 epc 4
|-
|1
|Zaal 1 ticker
|-
|2
|Dafang Bar
|-
|3
|To Dell
|-
|4
|Zaal 1 epc 2
|-
|5
|Zaal 2
|-
|6
|Phone gamershok
|-
|7
|Deur
|-
|8
|Switch zaal 1
|-
|9
|AP Gamershok
|-
|10
|AP Zaal 1
|-
|11
|Erratic IPMI
|-
|12
|Ding bij koffiehoek
|-
|13
|APC keuken
|-
|14
|Phone rookhok
|-
|15
|EPC3 (?)
|-
|16
|Erratic
|-
|17
|AP Bar
|-
|18
|To netgear bar
|-
|19
|
|-
|20
|To Edgerouter Lite
|-
|21
|Atlas probe
|-
|22
|Coherence
|-
|23
|
|}


'''Nieuwe layout''''
== VPN tunnels ==
{|
We support Roadwarrior and Site-to-Site VPN tunnels, using [[Network/Services/VPN|Wireguard]]. Contact someone from the BOFH team to discuss the possibilities and get connected.
|'''Port'''
'''Mode'''
|'''Description'''
|-
|0
|
|
|-
|1
|
|
|-
|2
|
|
|-
|3
|
|
|-
|4
|
|
|-
|5
|
|
|-
|6
|
|
|-
|7
|
|
|-
|8
|
|
|-
|9
|
|
|-
|10
|
|
|-
|11
|
|
|-
|12
|
|
|-
|13
|
|
|-
|14
|
|
|-
|15
|
|
|-
|16
|
|
|-
|17
|
|
|-
|18
|
|
|-
|19
|
|
|-
|20
|
|
|-
|21
|
|
|-
|22
|
|
|-
|23
|
|
|-
|24
|
|
|-
|25
|
|
|-
|26
|
|
|-
|27
|
|
|-
|28
|
|
|-
|29
|
|
|-
|30
|access
|Atlas probe
|-
|31
|access
|Phone rookhok
|-
|32
|access
|Phone gamershok
|-
|33
|access
|Zaal 1 epc 2
|-
|34
|access
|Zaal 1 epc 4
|-
|35
|access
|AP zaal 1
|-
|36
|access
|AP bar
|-
|37
|access
|To netgear bar
|-
|38
|access
|To netgear keuken
|-
|39
|access
|To switch zaal 2
|-
|40
|lacp
|To switch zaal 1
|-
|41
|lacp
|To switch zaal 1
|-
|42
|lacp
|To Synology
|-
|43
|lacp
|To Synology
|-
|44
|lacp
|To Erratic
|-
|45
|lacp
|To Erratic
|-
|46
|lacp
|To Edgerouter Lite
|-
|47
|lacp
|To Edgerouter Lite
|}


== Phone rookhok ==
== Backups ==
{|
We do daily full backups of managed systems. More details can be found on the [[Network/Backup|Backup page]].
|'''Port'''
|'''Description'''
|-
|0
|To Aruba
|-
|1
|To Switch rookhok
|}


== Switch Rookhok ==
== TLS ==
{|
All servers have a unique ECDSA certificate which can be used for both client and server authentication. Details about this setup can be found on the [[Network/TLS|TLS page]].
|'''Port'''
|'''Description'''
|-
|0
|
|-
|1
|
|-
|2
|
|-
|3
|Pi Rookhok
|-
|4
|To phone rookhok
|}


== Netgear Bar ==
== Network discovery ==
{|
In order to make devices available for discovery, a couple of protocols can be enabled. Note that this only applies to physical systems, not VM/LXCs.
|'''Port'''
|'''Description'''
|-
|0
|VRCade
|-
|1
|TickTack
|-
|2
|
|-
|3
|Switch 3d printer hoek
|-
|4
|
|-
|5
|
|-
|6
|
|-
|7
|To Aruba
|}


== Switch 3d printer hoek ==
=== LLDP ===
{|
The first one of these is lldp (Link-Layer Discovery Protocol). This protocol communicates device attributes to connected peers via ethernet frames. Lldp is enabled on all networking devices. Enabling these should only be done for systems that are physically connected to the network (eg, using an ethernet cable or wifi). Under debian, this is done as follows:
|'''Port'''
|'''Description'''
|-
|0
|Printer 3
|-
|1
|Printer PC
|-
|2
|
|-
|3
|
|-
|4
|To netgear bar
|}


== Zaal 1 switch ==
apt install lldpd
'''Device settings'''
systemctl enable --now lldpd
{|
|Hostname
|nurds-sw-01
|}


'''Port settings'''
{|
|'''Port'''
|'''Description'''
|-
|0
|
|-
|1
|
|-
|2
|
|-
|3
|
|-
|4
|
|-
|5
|
|-
|6
|
|-
|7
|
|-
|8
|
|-
|9
|
|-
|10
|
|-
|11
|
|-
|12
|
|-
|13
|
|-
|14
|
|-
|15
|
|-
|16
|
|-
|17
|
|-
|18
|
|-
|19
|
|-
|20
|
|-
|21
|
|-
|22
|
|-
|23
|
|}


= New network =
=== SNMP ===
Due to the complexity of our current network, I propose a redesign. Goal of this redesign is to simplify the network, by migrating all subnets into a single large subnet of sufficient size. By doing this, we can remove the dependency on the gateway for intra-vlan traffic.
The second protocol to enable is snmp (Simple Network Management Protocol). This protocol allows a device to be queried for various network and host metrics, and allowing us to keep a precise count of per-device traffic rates. But above all, this gives us shiney graphs ^_^


First, install the required daemons and MIBs:
apt install snmp snmpd snmp-mibs-downloader
download-mibs


Next, configure snmpd for use. Edit /etc/snmp/snmpd.conf and set the following two administrative fields:


== Proposal ==
sysLocation    NURDspace,MODIFY_LOCATION_WITHIN_NURDSPACE
We renumber everything into 10.208.42.0/23 (10.208.42.0 .. 10.208.43.255).
sysContact    Admins <bofh@nurdspace.nl>
 
== How ==
We pick a day, get a bunch of people together on-site, and we renumber everything. Starting from the gateway, and working our way through *all* systems.
 
== Dependencies ==
- VPN prefix lists and firewalls need to be changed.
 
{{Outdated}}
= Space network =
The ports for this network are 25-48 on [[nurds-sw-01]]??
 
== DHCP ==
Runs on [[NURDServices]]
=== Settings ===
Router for the network is [[nurds-rtr-03]] its config you can find in [[librenms]]
 
=== Change requests ===
For changes in the network routing/nat for example:
* Portforwards
* Switchports
 
Please contact [[User:Zarya]]
 
 
==== Static ====
Request a ip from https://ipam.nurd.space/
 
==== DHCP ====
* Range: 10.208.42.2-10.208.43.254
* Netmask: 255.255.252.0
* Gateway: 10.208.42.1
* Domain: dhcp.nurd.space
{| class="wikitable"
!Setting
!Value
|-
|DHCP range
|10.208.42.2-10.208.43.254
|-
|Static hostnames
|see [[Infra#Which_hosts_are_online.3F|pingscan]]
|-
|Router
|10.208.42.1
|-
|Netmask
|255.255.252.0
|-
|Domain
|dhcp.nurd.space
|-
|Network boot filename
|gpxelinux.0
|}
 
=== Settings to be old===
{| class="wikitable"
!Setting
!Value
|-
|DHCP range
|192.168.1.31 - 192.168.1.200
|-
|Static hostnames
|see [[Infra#Which_hosts_are_online.3F|pingscan]]
|-
|Router
|192.168.1.1
|-
|Netmask
|255.255.255.0
|-
|Domain
|nurdspace.lan
|-
|Network boot filename
|gpxelinux.0
|}


== Wifi ==
Next, make sure that snmpd can listen on all ip addresses and can be queried using the default community
See [[Spacenet]].
#agentaddress  127.0.0.1,[::1] # ADD A HASH IN FRONT OF THIS LINE
rocommunity  public default
rocommunity6 public default


= Student network =
Finally, enable snmpd and perform a testrun to verify if it is working:
'''obsolete but might still be in some configs'''
systemctl enable --now snmpd
This network is separate from the space network. The DHCP runs on routerboard ([[nurds-rtr-03]]). The ports for this network are 1-24 on both the [[nurds-sw-01]] and [[nurds-sw-02]] switch.
root@erratic:~# snmpwalk -v2c -c public localhost
iso.3.6.1.2.1.1.1.0 = STRING: "Linux erratic.lan.nurd.space 5.15.30-2-pve #1 SMP PVE 5.15.30-3 (Fri, 22 Apr 2022 18:08:27 +0200) x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (8715381) 1 day, 0:12:33.81
iso.3.6.1.2.1.1.4.0 = STRING: "Admins <bofh@nurdspace.nl>"
iso.3.6.1.2.1.1.5.0 = STRING: "erratic.lan.nurd.space"
iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar"
...

Latest revision as of 21:03, 6 September 2024

Layer 2 overview

Below you can find the structure of the network as of 28-07-2023. Fat lines are 2 x 1GE LACP trunks Layer 2 overview 28-07-2023.svg


download the file below to see the whole thing + to make changes in draw.io

File:Eis-T Hoe harkt de nurdspace .drawio.xml

Layer 3 overview

we have a single-vlan flat network. The following prefix is active on this network:

  • 10.208.0.0/22

Within this prefix, we have multiple ranges for multiple purposes:

  • 10.208.0.x Network devices
  • 10.208.1.x Servers
  • 10.208.2.x DHCP clients
  • 10.208.3.x DHCP clients

If you are unsure which range you should use, stick with DHCP. DHCP clients can set their hostname via dynamic DNS. Clients in statically managed networks must specify a hostname in FreeIPA. If something is to be part of the infrastructure fabric of the space, it should be in the Servers range. Be sure to contact BOFH if you want to place a system in this range.

The default gateway on this network is 10.208.0.1

DNS

search nurd.space lan.nurd.space vm.nurd.space vpn.nurd.space dhcp.nurd.space
nameserver 10.208.1.53

Rack info

       Voorkant        Achterkant
  1. Keyboard Keyboard
  2. Pachtpaneel
  3. Rangeerrack
  4. Switch
  5. Harmony Racklight
  6. Harmony
  7. Plank
  9. Gateway
  10. Gateway
  11. Gateway
  12. Gateway
  13. Gpubak
  14. Gpubak
  15. Gpubak
  16. Gpubak
  17. Plank
  19. Erratic
  20. Erratic
  21. Erratic
  22. Erratic
  23. Blind Aardlek switch

Management

The team

The NURDspace infrastructure is managed by the BOFH team.

Services

You can find a list of services we manage below:

Upcoming features and functionality

See our roadmap for a list of upcoming features and functionality. If you think something should be added, add this to either the backlog or ideas, depending on the feature. You are more then welcome to join the bofh team to implement features and functionality yourself!

Network management administrative interfaces

You can manage our devices using the URLs below:

Product URL User Used for Notes
Edgerouter Lite https://gateway.lan.nurd.space:8443/ ubnt Routing and NATting towards internet
Aruba core switch http://core-sw.lan.nurd.space admin Main switch in the space
Access points https://10.208.3.62:4343 admin Virtual controller for WIFI
Proxmox erratic https://erratic.lan.nurd.space:8006/ root Deploy LXC/KVM instances on our hypervisor
Erratic IPMI https://erratic-bmc.lan.nurd.space/ ADMIN Remote management of erratic
Synology https://harmony.lan.nurd.space:5001/ nurds Used for backups and storage Has a different password due to pwd requirements. Ask in the bofh channel.
DNS and identity management https://ipa.nurd.space/ ldap DNS / Identity
LibreNMS http://librenms.vm.nurd.space/ nurds Network device metrics
Weathermap http://weathermap.vm.nurd.space Network traffic map
Smokeping http://smokeping.vm.nurd.space Network latency measurements
Icinga2 https://monitor.vm.nurd.space/ admin Monitoring service

Virtual machine

We support hosting multiple virtual machines, using both the KVM and the LXC model. These are deployed using proxmox. We have introduced the 'managed vm', which is a vm which adheres to nurdspace standards. For more information, see the ManagedVM and the Ansible pages.

VPN tunnels

We support Roadwarrior and Site-to-Site VPN tunnels, using Wireguard. Contact someone from the BOFH team to discuss the possibilities and get connected.

Backups

We do daily full backups of managed systems. More details can be found on the Backup page.

TLS

All servers have a unique ECDSA certificate which can be used for both client and server authentication. Details about this setup can be found on the TLS page.

Network discovery

In order to make devices available for discovery, a couple of protocols can be enabled. Note that this only applies to physical systems, not VM/LXCs.

LLDP

The first one of these is lldp (Link-Layer Discovery Protocol). This protocol communicates device attributes to connected peers via ethernet frames. Lldp is enabled on all networking devices. Enabling these should only be done for systems that are physically connected to the network (eg, using an ethernet cable or wifi). Under debian, this is done as follows: 

apt install lldpd
systemctl enable --now lldpd


SNMP

The second protocol to enable is snmp (Simple Network Management Protocol). This protocol allows a device to be queried for various network and host metrics, and allowing us to keep a precise count of per-device traffic rates. But above all, this gives us shiney graphs ^_^

First, install the required daemons and MIBs: 

apt install snmp snmpd snmp-mibs-downloader
download-mibs

Next, configure snmpd for use. Edit /etc/snmp/snmpd.conf and set the following two administrative fields: 

sysLocation    NURDspace,MODIFY_LOCATION_WITHIN_NURDSPACE
sysContact     Admins <bofh@nurdspace.nl>

Next, make sure that snmpd can listen on all ip addresses and can be queried using the default community 

#agentaddress  127.0.0.1,[::1] # ADD A HASH IN FRONT OF THIS LINE
rocommunity  public default
rocommunity6 public default

Finally, enable snmpd and perform a testrun to verify if it is working: 

systemctl enable --now snmpd
root@erratic:~# snmpwalk -v2c -c public localhost
iso.3.6.1.2.1.1.1.0 = STRING: "Linux erratic.lan.nurd.space 5.15.30-2-pve #1 SMP PVE 5.15.30-3 (Fri, 22 Apr 2022 18:08:27 +0200) x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (8715381) 1 day, 0:12:33.81
iso.3.6.1.2.1.1.4.0 = STRING: "Admins <bofh@nurdspace.nl>"
iso.3.6.1.2.1.1.5.0 = STRING: "erratic.lan.nurd.space"
iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar"
...
Retrieved from "https://nurdspace.nl/index.php?title=Network&oldid=14329"
Last modified
This page was last edited on 6 September 2024, at 21:03.