ZeroTier and DNS issues
-
@scottalanmiller said:
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
I knew this was how NTG operated, but I knew that only because NTG is a physically diverse network.
-
@hubtechagain has Pertino at a few of his clients.. I wonder if he runs an all or nothing approach.
-
@Dashrender said:
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Because you don't want your NFS traffic for two servers sitting next to each other traversing your WAN link. It still needs to understand how to hit the cloud or not for traffic. No matter how much you abstract your traffic the realities of congestion still exist.
-
We've had the same experience with ZeroTier which does the same thing in this use case minus some of the bundled hacks for things like AD. Greenfield is easy. "Brownfield" as they call it -- namely anywhere other than California -- is a lot harder because you have to still connect to the 1990s Windows NT server that is mission critical or the printers that can't run SDN software or the ancient Solaris box that talks via 1200 baud modem bank to the store PoS systems or the IP over carrier pigeon (RFC1149) deployment.
Right now we've elected to focus more on other uses of SDN, but yes we do eventually want to go there.
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
-
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
-
@Dashrender said:
I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
It IS a huge flat network. /22 now, they just updated.
-
@Dashrender said:
Question - how do they get to the internet? Does the local machine send DNS queries to AD's DNS via Pertino, then the local clients use the local hardware network to find a route to the internet?
Anyway you want, typically direct since the Internet is not part of your LAN. But you could put a proxy on the pLAN somewhere.
Obviously the route to the Internet is handled normally since that is also how you get the route to your Pertino gear.
-
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
For high performance stuff where you don't want any encapsulation overhead it makes more sense to just physically wire thing together on private special purpose backplane networks. You will never beat that with SDN because... well... it's just a wire.
-
@adam.ierymenko said:
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
If you have 100 machines in a single office, you don't want them talking to each other through an Amazon hosted switch.
-
@scottalanmiller Sure, but why wouldn't you handle that a layer down? Are you saying Pertino uses DNS to route traffic?
-
@adam.ierymenko said:
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
How is ZeroTier determining how to address a machine in one place or another? Say a laptop is communicating with a server that is remote and then becomes local. How does it know when to switch?
-
we use pertino only on our laptops and "out of office" computers. not installed on every workstation, that would be silly. We use pertino essentially as a vpn, a means for those geographically separate devises to still use LAN resources securely and easily (doctors, nurses, etc)
-
@adam.ierymenko said:
@scottalanmiller Sure, but why wouldn't you handle that a layer down? Are you saying Pertino uses DNS to route traffic?
Yes. DNS is used to determine where to send traffic. Because it gives different addresses out under different circumstances.
-
@scottalanmiller said:
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
What I mean is that I wouldn't bother setting up DHCP on a Windows Server to handle the local network portion... I'd leave that to some unrelated device, and not have the local network be part of the Windows concern.
But in reading some of your responses I'm not sure how that would work either.
Let's say I'm on a 1 Gb network... the server is on that same network... but we're using Pertino... I have a 5 meg internet connection, how fast are files going to move between me and the server?
-
@scottalanmiller Every ZT device has a cryptographically-defined identity, so any time it gets a packet it knows who sent it. It can then try various paths for connectivity and use them if a bi-directional link is determined to be present. ZeroTier devices on the same virtual network try each other over their local IPs as well as via NAT-t and other methods and if that works they prefer local to global. But if it stops working they'll fall back to whatever works according to a preference order based on IP scope/class and type (V6 over V4, local over global, direct over indirect).
It's open source if you're curious: https://github.com/zerotier/ZeroTierOne
-
@adam.ierymenko said:
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
Good to know - can you tell us how that works? Ok you did the post before mine.
-
@Dashrender said:
Let's say I'm on a 1 Gb network... the server is on that same network... but we're using Pertino... I have a 5 meg internet connection, how fast are files going to move between me and the server?
Depends, are you using Pertino free or Pertino with the AD Connector? If using the free it all goes through the hosted switch so over your WAN bidirectionally.
If using the AD Connector it is going over the GigE network directly and not over the WAN.
-
and that was with design help from pertino. if a device/resource needs to be accessed off lan, stick a client on it. so our app/dc/sql/rds servers all have pertino installed on them. works great. local traffic still uses 10.x.x.x pertino uses 172.x.x.x
-
Interesting. I haven't looked deeply into Pertino because my business philosophy is to focus on doing what users want and what makes technical design sense and ignore competition. In fact, during ZT initial design I deliberately did not try any alternatives because I didn't want to "pollute" my headspace.
ZT may not need the DNS hack, since it doesn't use DNS to route traffic. It doesn't need any of that. It does everything a layer down using crypto for authentication and lazy route-learning with automatic switching and preference order. It's like VXLAN over a p2p mesh. It will fall back to WAN-in-WAN-out however if your LAN has rules that prohibit lateral communication... I've seen that in houses that run WiFi switches that do that.
It does seem like the DNS hack would help with the IP ambiguity issue though in mixed deployments, and mixed deployments are what most non-greenfield existing enterprises are going to want because they can't install SDN software on everything... either because they are risk/change averse or because they run a lot of things that are too old/slow/whatever to run it.
-
adam, want to talk to you about a possible switch to your product sometime?
