ZeroTier and DNS issues
-
@Dashrender said:
Take a typical SMB.
5 servers (2 AD boxes, 3 whatever)
50 desktops (non mobile)
50 laptops (work in and out of the local network)The desire is to give access to the 50 laptops. So you install ZT or Pertino. In this situation, you'll have 55 devices with the vpn client on them. and 50 without.
Right, so you'd have TWO LANs. Two completely separate LANs with some dual homed servers.
-
@adam.ierymenko said:
BTW, does Pertino support Ethernet bridging? ZT can do that but I have yet to check others to see.
Not officially.
-
@adam.ierymenko said:
In that case then yes, you can do precisely the same with ZeroTier. Install it on everything and use it as the primary network. But as @Dashrender says not everyone wants to do that for multiple reasons.
The problem is, to have SDN you have to. It's not there to be a VPN product.
-
So yeah, like I said above you can support a mixed use case with bridging. Install a bridge on the main LAN and connect your mobile clients to it. When they're also in-house they'll end up with two IP addresses: one via their bridged-across ZT extension of the main LAN and one direct. But the direct one will have a lower metric so it will be used preferentially (though any connections to/from the other IP will keep working, just slightly more slowly than direct LAN due to encapsulation overhead).
@scottalanmiller Agreed for greenfield SDN deployments, but greenfield is hard to achieve in enterprise. Part of what's hard about enterprise as I'm sure you're well aware is that it's hard to undo or un-provision anything, ever. I've seen enterprise houses running 1980s Ultrix software in a modified KVM Alpha emulator on a VM in the cloud because the software is binary-only, the maker of the software is gone, and it's mission critical.
-
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
-
@adam.ierymenko said:
@scottalanmiller Agreed for greenfield SDN deployments, but greenfield is hard to achieve in enterprise. Part of what's hard about enterprise as I'm sure you're well aware is that it's hard to undo or un-provision anything, ever. I've seen enterprise houses running 1980s Ultrix software in a modified KVM Alpha emulator on a VM in the cloud because the software is binary-only, the maker of the software is gone, and it's mission critical.
It's not an enterprise product. It was designed solely as SDN for the SMB market. It's only designed to be meaningful in a 100% full mesh deployment. Using it in any other role would be weird and completely not what it is designed for. Certainly not for the majority of deployments.
-
ZeroTier officially support bridging but our documentation on it stinks or is nonexistent. We're going to be fixing that fairly soon.
We have a user in Germany using it to provide a backplane to stitch together hundreds of local mesh access points for a community meshnet project. He says bridging with ZT works fine with dozens of bridges with hundreds of clients behind each bridge, albeit with a bit of traffic overhead... but it's Germany so they get real fiber Internet connections.
-
OOOOOOO K!
Well I can say I've never considered it for that type of use. I've also never read any of their literature either.
That changes a lot.
-
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
-
Pertino's target market is the California startup market specifically where this works beautifully. You'd be surprised how much their 100% mesh completely fits the model used by the west coast IT market. It's the non-west coast's approaches that make it seems strange and impossible. I've dealt with a lot of companies out there where they are like "of course, that just works". It doesn't seem foreign to them at all.
-
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
Question - how do they get to the internet? Does the local machine send DNS queries to AD's DNS via Pertino, then the local clients use the local hardware network to find a route to the internet?
-
@scottalanmiller said:
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
I knew this was how NTG operated, but I knew that only because NTG is a physically diverse network.
-
@hubtechagain has Pertino at a few of his clients.. I wonder if he runs an all or nothing approach.
-
@Dashrender said:
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Because you don't want your NFS traffic for two servers sitting next to each other traversing your WAN link. It still needs to understand how to hit the cloud or not for traffic. No matter how much you abstract your traffic the realities of congestion still exist.
-
We've had the same experience with ZeroTier which does the same thing in this use case minus some of the bundled hacks for things like AD. Greenfield is easy. "Brownfield" as they call it -- namely anywhere other than California -- is a lot harder because you have to still connect to the 1990s Windows NT server that is mission critical or the printers that can't run SDN software or the ancient Solaris box that talks via 1200 baud modem bank to the store PoS systems or the IP over carrier pigeon (RFC1149) deployment.
Right now we've elected to focus more on other uses of SDN, but yes we do eventually want to go there.
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
-
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
-
@Dashrender said:
I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
It IS a huge flat network. /22 now, they just updated.
-
@Dashrender said:
Question - how do they get to the internet? Does the local machine send DNS queries to AD's DNS via Pertino, then the local clients use the local hardware network to find a route to the internet?
Anyway you want, typically direct since the Internet is not part of your LAN. But you could put a proxy on the pLAN somewhere.
Obviously the route to the Internet is handled normally since that is also how you get the route to your Pertino gear.
-
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
For high performance stuff where you don't want any encapsulation overhead it makes more sense to just physically wire thing together on private special purpose backplane networks. You will never beat that with SDN because... well... it's just a wire.
-
@adam.ierymenko said:
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
If you have 100 machines in a single office, you don't want them talking to each other through an Amazon hosted switch.
