No edit summary |
|||
| Line 87: | Line 87: | ||
| | | | ||
|Network traffic map | |Network traffic map | ||
|- | |||
|Icinga2 | |||
|https://monitor.vm.nurd.space/ | |||
|admin | |||
|Monitoring service | |||
|} | |} | ||
Revision as of 22:19, 19 August 2022
Layer 2 overview
Below you can find the structure of the network as of 06-05-2022. Fat lines are 2 x 1GE LACP trunks
Layer 3 overview
we have a single-vlan flat network. Due to legacy, three different prefixes live on this vlan:
- 10.208.11.0/24 (gateway 10.208.11.1)
- 10.208.30.0/24 (gateway 10.208.30.1)
- 10.208.42.0/23 (gateway 10.208.42.1)
This has the issue that traffic between the vlans will always be routed via the gateway, leading to unneeded roundtrips.
IP addresses
- 10.208.30.0/24 is used for static allocations. Register your ip's in IPAM.
- 10.208.42.0/23 is used for dynamic allocations using DHCP
DNS
search nurd.space lan.nurd.space vm.nurd.space management.nurd.space router.nurd.space dhcp.nurd.space nameserver 10.208.30.254
Layer 3 simplification
In order to reduce the unnescecary roundtrips via the edgerouter, we need to flatten the networks into a single prefix. The proposal for this is to move to 10.208.28.0/22. This prefix would be used as follows (With the gateway living on 10.208.30.1):
- 10.208.28.1 .. 10.208.29.255 DHCP
- 10.208.30.1 .. 10.208.30.255 Static clients
- 10.208.31.0 .. 10.208.30.254 reserved
Management
Network management administrative interfaces
You can manage our devices using the URLs below:
| Product | URL | User | Used for | Notes |
| Edgerouter Lite | https://gateway.lan.nurd.space:8443/ | ubnt | Routing and NATting towards internet | |
| Aruba core switch | http://core-sw.lan.nurd.space | admin | Main switch in the space | |
| Access points | https://10.208.43.254:4343/ | admin | Virtual controller for WIFI | |
| Proxmox erratic | https://erratic.lan.nurd.space:8006/ | root | Deploy LXC/KVM instances on our hypervisor | |
| Erratic IPMI | https://erratic-bmc.lan.nurd.space/ | ADMIN | Remote management of erratic | |
| Synology | https://harmony.lan.nurd.space:5001/ | nurds | Used for backups and storage | Has a different password due to pwd requirements. Ask in the bofh channel. |
| IPAM ip+dns | https://ipam.nurd.space/ | ldap | IP and DNS registration | |
| LibreNMS | http://librenms.vm.nurd.space/ | nurds | Network device metrics | |
| Weathermap | http://weathermap.vm.nurd.space | Network traffic map | ||
| Icinga2 | https://monitor.vm.nurd.space/ | admin | Monitoring service |
Virtual machine
We support hosting multiple virtual machines, using both the KVM and the LXC model. These are deployed using proxmox. We have introduced the 'managed vm', which is a vm which adheres to nurdspace standards. For more information, see the ManagedVM and the Ansible pages.
VPN tunnels
We support Roadwarrior and Site-to-Site VPN tunnels, using Wireguard and OpenVPN. Contact someone from the BOFH team to discuss the possibilities and get connected.
Network discovery
In order to make devices available for discovery, a couple of protocols can be enabled.
LLDP
The first one of these is lldp (Link-Layer Discovery Protocol). This protocol communicates device attributes to connected peers via ethernet frames. Lldp is enabled on all networking devices. Enabling these should only be done for systems that are physically connected to the network (eg, using an ethernet cable or wifi). Under debian, this is done as follows:
apt install lldpd systemctl enable --now lldpd
SNMP
The second protocol to enable is snmp (Simple Network Management Protocol). This protocol allows a device to be queried for various network and host metrics, and allowing us to keep a precise count of per-device traffic rates. But above all, this gives us shiney graphs ^_^
First, install the required daemons and MIBs:
apt install snmp snmpd snmp-mibs-downloader download-mibs
Next, configure snmpd for use. Edit /etc/snmp/snmpd.conf and set the following two administrative fields:
sysLocation NURDspace,MODIFY_LOCATION_WITHIN_NURDSPACE sysContact Admins <bofh@nurdspace.nl>
Next, make sure that snmpd can listen on all ip addresses and can be queried using the default community
#agentaddress 127.0.0.1,[::1] # ADD A HASH IN FRONT OF THIS LINE rocommunity public default rocommunity6 public default
Finally, enable snmpd and perform a testrun to verify if it is working:
systemctl enable --now snmpd root@erratic:~# snmpwalk -v2c -c public localhost iso.3.6.1.2.1.1.1.0 = STRING: "Linux erratic.lan.nurd.space 5.15.30-2-pve #1 SMP PVE 5.15.30-3 (Fri, 22 Apr 2022 18:08:27 +0200) x86_64" iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10 iso.3.6.1.2.1.1.3.0 = Timeticks: (8715381) 1 day, 0:12:33.81 iso.3.6.1.2.1.1.4.0 = STRING: "Admins <bofh@nurdspace.nl>" iso.3.6.1.2.1.1.5.0 = STRING: "erratic.lan.nurd.space" iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar" ...
Per-device port inventory
All devices which are not in librenms need to have documentation for their ports. You can fill this in below:
Fritzbox gamershok
| Port | Description |
| 0 | |
| 1 | |
| 2 | To Edgerouter Lite keuken |
| 3 |
Netgear keuken
| Port | Description |
| 0 | To Dell |
| 1 | |
| 2 | |
| 3 | |
| 4 | |
| 5 | |
| 6 | Slabbar |
| 7 | |
| 8 | Kodi |
Phone rookhok
| Port | Description |
| 0 | To Aruba |
| 1 | To Switch rookhok |
Switch Rookhok
| Port | Description |
| 0 | |
| 1 | |
| 2 | |
| 3 | Pi Rookhok |
| 4 | To phone rookhok |
Netgear Bar
| Port | Description |
| 0 | VRCade |
| 1 | TickTack |
| 2 | |
| 3 | Switch 3d printer hoek |
| 4 | |
| 5 | |
| 6 | |
| 7 | To Aruba |
Switch 3d printer hoek
| Port | Description |
| 0 | Printer 3 |
| 1 | Printer PC |
| 2 | |
| 3 | |
| 4 | To netgear bar |
Zaal 1 switch
Device settings
| Hostname | nurds-sw-01 |
Port settings
| Port | Description |
| 0 | |
| 1 | |
| 2 | |
| 3 | |
| 4 | |
| 5 | |
| 6 | |
| 7 | |
| 8 | |
| 9 | |
| 10 | |
| 11 | |
| 12 | |
| 13 | |
| 14 | |
| 15 | |
| 16 | |
| 17 | |
| 18 | |
| 19 | |
| 20 | |
| 21 | |
| 22 | |
| 23 |