Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Automate Your Network

github.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Automate Your Network

#21

Post by nu11ptr »

totallywrong wrote: post #20
nu11ptr wrote: post #6

I do network automation for a profession. I build tools (technically compilers) that take a proprietary object model designed for our private cloud and translate that into Ansible (v1) or Terraform (v2) code. At our company, I actually call using these tools in isolation doing it "manually". This is because the largest benefit of automation, I believe, is the abstraction gained from the new object model and being to…

Isn't that a lot of words to say that you have a custom set of Terraform modules for your needs? If you're describing a different or better way to do it I'm missing it.

No. It is a frontend application that works as a CRUD REST API, validates the data, generates what it can, and stores it into a database/IPAM. It can then be changed, viewed, modified, deleted, etc.

When you are ready to deploy I "compile" the object model data into an IR (representing the "network topology") and then make a final pass and translate into HCL for all the various backends.

I'm not saying its "better" as it has trade offs. I'm saying for networks specifically, it is the only way I've seen in the real world to give these tools lots of value. Otherwise the network engineers end up spending all their time looking up the input data (vlans, subnets, ips, etc.) which is the part that is most time consuming for manual configuration as well. The validation and auto-generation of the input data is where the value comes in.

Re: Automate Your Network

#22

Post by totallywrong »

nu11ptr wrote: post #21
totallywrong wrote: post #20

Earlier quoted context omitted.

Isn't that a lot of words to say that you have a custom set of Terraform modules for your needs? If you're describing a different or better way to do it I'm missing it.

No. It is a frontend application that works as a CRUD REST API, validates the data, generates what it can, and stores it into a database/IPAM. It can then be changed, viewed, modified, deleted, etc. When you are ready to deploy I "compile" the object model data into an IR (representing the "network topology") and then make a final pass and translate into HCL for all the various backends. I'm not saying its "better" a…

Got it thanks, makes sense. The way I've frequently seen this done, that goes more in line with the IaC and GitOps trends, is people making a PR to the config repo with the required values. Then a pipeline runs and does all validations, pulls data from external sources, and runs the terraform plan. If everything looks good upon review a merge applies the saved plan.

Re: Automate Your Network

#24

Post by kazen44 »

jimmar wrote: post #4
theideaofcoffee wrote: post #3

I glanced through the guide and it's Windows and Cisco (specifically IOS) heavy: mentions of the old Cisco architecture via Core/Access/Distribution, where larger DC networks have converged onto spine/spline setups, CDP/Cisco Discovery protocol whereas the open-source LLDP is more generic, even the nomenclature of 802.1q VLAN tags: access versus trunk. But I guess if you are starting to automate a legacy office netwo…

> old Cisco architecture via Core/Access/Distribution, where larger DC networks have converged onto spine/spline setups Please correct me if I'm wrong, but I see the "old" core/access/distribution layers still relevant. The datacenter spine/spline setup applies to networking between server racks in the data center. > 802.1q VLAN tags: access versus trunk Again, are you saying that these are outdated? I'm not a practi…

> Please correct me if I'm wrong, but I see the "old" core/access/distribution layers still relevant. The datacenter spine/spline setup applies to networking between server racks in the data center.

this is correct. The place where spine-leaf really shines is when used in combination with evpn-vxlan. You can then encapsulate every tenant network inside a VXLAN domain and route those between your leafs switches through your spine layer.

This is basically a clos fabric which is non-blocking, and is very easy to expand horizontally. It also gives you nice features like ARP suppression[0]. These features are important in a DC fabric because ARP flooding is traffic which is not revenue generating, and should be minimized as much as possible.

For normal Enterprise/Office network, running an evpn-vxlan fabric is usually far to complex for the benefits involved.

[0] https://satishdotpatel.github.io/how-does-arp-suppression-wo...

Re: Automate Your Network

#25

Post by dopylitty »

tguvot wrote: post #11
nu11ptr wrote: post #6

I do network automation for a profession. I build tools (technically compilers) that take a proprietary object model designed for our private cloud and translate that into Ansible (v1) or Terraform (v2) code. At our company, I actually call using these tools in isolation doing it "manually". This is because the largest benefit of automation, I believe, is the abstraction gained from the new object model and being to…

i worked on a product that did something similar for telecoms. had a closed loop automation and graphical designer for object model. it was 10 years ago. looking today at all the manual work with playbooks/etc, it's astonishing. feels like things didn't move forward at all in past decade

Even in the big public clouds the user facing networking really hasn't progressed beyond a layer of lipstick on top of the kludges that were created for connecting physical servers 40 years ago.

For instance in AWS you still have to care about BGP and ASNs if you want to follow the most seamless approach to create a multi-region mesh of VPCs. Why should I have to care about that? AWS already knows where all the packets came from and where they're going and should just put them in the right place. I don't care how they get there and I certainly shouldn't have to care about BGP attributes[1].

1. https://docs.aws.amazon.com/network-manager/latest/cloudwan/...

Re: Automate Your Network

#26

Post by jagged-chisel »

nu11ptr wrote: post #6

I do network automation for a profession. I build tools (technically compilers) that take a proprietary object model designed for our private cloud and translate that into Ansible (v1) or Terraform (v2) code. At our company, I actually call using these tools in isolation doing it "manually". This is because the largest benefit of automation, I believe, is the abstraction gained from the new object model and being to…

Are you using an open source tool/stack to do this? Sounds pretty awesome and I’d love to learn!

Re: Automate Your Network

#27

Post by tguvot »

dopylitty wrote: post #25
tguvot wrote: post #11

Earlier quoted context omitted.

i worked on a product that did something similar for telecoms. had a closed loop automation and graphical designer for object model. it was 10 years ago. looking today at all the manual work with playbooks/etc, it's astonishing. feels like things didn't move forward at all in past decade

Even in the big public clouds the user facing networking really hasn't progressed beyond a layer of lipstick on top of the kludges that were created for connecting physical servers 40 years ago. For instance in AWS you still have to care about BGP and ASNs if you want to follow the most seamless approach to create a multi-region mesh of VPCs. Why should I have to care about that? AWS already knows where all the packe…

probably interoperability with "legacy" equipment and networks

Re: Automate Your Network

#28

Post by tguvot »

nu11ptr wrote: post #19
tmerse wrote: post #14

Earlier quoted context omitted.

This sounds interesting, but I am not sure I fully understand. Could an analogy be the object model to loosely correspond to sth like Amazon cdk and the Ansible part being the derived Cloudformation (any other analogy should do, but those are things I understand a bit more although I use quite a bit of ansible, but I am no network Person)? I still don't fully understand the database part. Is it a better way to manage…

Essentially we have a very specific network topology we are trying to build for each of our clients. The goal is to auto-generate as much of the input as possible, validate that which is given, and allow it to be lifecycled (attributes can change, but only in certain valid ways, objects created/changed/deleted, but only if they aren't referenced by other objects, etc). Due to this, a database is need to store each "o…

just curious, is your system publicly available or is it internal tooling of yours ? i spent a lot of time in service orchestration domain, and it been hobby of mine ever since.

Re: Automate Your Network

#29

Post by dangus »

nu11ptr wrote: post #21
totallywrong wrote: post #20

Earlier quoted context omitted.

Isn't that a lot of words to say that you have a custom set of Terraform modules for your needs? If you're describing a different or better way to do it I'm missing it.

No. It is a frontend application that works as a CRUD REST API, validates the data, generates what it can, and stores it into a database/IPAM. It can then be changed, viewed, modified, deleted, etc. When you are ready to deploy I "compile" the object model data into an IR (representing the "network topology") and then make a final pass and translate into HCL for all the various backends. I'm not saying its "better" a…

Interesting way to do things there. Have you looked into Pulumi or Terraform CDK?

I don’t know if either of those would help you or not and I’m not proficient in either, but some of the components you described seem like they might have some overlap.

Re: Automate Your Network

#30

Post by nu11ptr »

tguvot wrote: post #28
nu11ptr wrote: post #19

Earlier quoted context omitted.

Essentially we have a very specific network topology we are trying to build for each of our clients. The goal is to auto-generate as much of the input as possible, validate that which is given, and allow it to be lifecycled (attributes can change, but only in certain valid ways, objects created/changed/deleted, but only if they aren't referenced by other objects, etc). Due to this, a database is need to store each "o…

just curious, is your system publicly available or is it internal tooling of yours ? i spent a lot of time in service orchestration domain, and it been hobby of mine ever since.

internal, sorry
Post reply on HN