r/networking • • 10h ago

Design 6PE over an mpls core

16 Upvotes

My company is at the verge of turning up backbone links between our metros and we will run sr mpls. At a new site I had a chance to configure mpls so it's ready. All Nokia routers. IPv6 was a bit of an afterthought for me. We do have it on all interfaces, but nobody here wants to run Srv6. Would rather stay with the more mature mpls.

We could run dual stack ipv4 / ipv6, but im not sure if TE would be too difficult like that. We'll probably run rsvp for congestion control. I heard that it's better to run v6 over v4 mpls if you want this. And 6PE was an easy way to set that up. So I did that.

But...on these Nokias it was a bit of a headache to get working. I thought it was a simple as enabling label-unicast in the neighbor config. It's a bit more. Iad to adjust all the ibgp export policies for label-ipv6 also. Then, because SR holds separate RIB's for ipv6 and label-ipv6, I had to manually import routes between theories using import policies.

It works now but I found that after this import, only one best path is imported. We use multipath to load balance but that wont work for ipv6 routes now. You also have to do a special 'show route all' to see the imported best routes in the ipv6 RIB. They are hidden otherwise.

So I don't think it was a very good experience configuring this on the Nokias. I belive it's much easier on other platforms. But that could be another bring assumption. What do you guys think? Is 6PE needed for a reason beyond having a v6vfeee core? Is it actually really needed if you want TE? And is it less difficult to get working on most platforms?


r/networking • • 23m ago

Security Do you block outbound port 53 from endpoints?

• Upvotes

Curious how common this actually is. Do you force everything through internal resolvers and block 53 out from endpoints, or is it more of a “we should” thing?

For those who did it, what broke? And do you block DoH too, or is that a lost cause?


r/networking • • 17h ago

Security Consola de Fortigate no RESPONDE al encender en GNS3 AYUDA!!

0 Upvotes

Hola en resumen que cuando pongo el qcow2 de fortigate (ya probe todas las versiones) enciende pero no muestra nada en consola, probe de todo, cambiandole el nombre al qcow2 que sea igual a la hora de poner la plantilla, probre poner el GNS3 con VMWARE y VIRTUALBOX, me da el mismo error en los dos, probe instalar versiones anteriores de GNS3 pero nada sigue igual.

MI VM de GNS3 tiene 8 cores y 20gb de RAM