Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Hack Update] 036-BGP Replace NVA image due to vendor EOL, updates to most student and coach guides #933

Open
wants to merge 24 commits into
base: master
Choose a base branch
from

Conversation

davmhelm
Copy link

Per Cisco's End-of-Sale and End-of-Life for ISR 1000v, image availability has been pulled from Azure Marketplace. Recommended replacement is Cisco Catalyst 8000V series.

Changes made in lab:

  • Challenge 0, bgp.sh deploy script
    • Deploy CSRs using C8000V marketplace image
      • Configure C8000V for VPN feature support
    • Update Azure VPN tunnel Phase1/Phase2 to use GCM encryption
    • NSG updates
      • Use NSGs on subnets instead of individual NICs
      • Narrow down SSH permit rule in NSGs to use deployment client's IP address
      • Increase error checking on SSH connections relying on NSG rules
    • Updated SSH options (ServerAliveInterval, MAC, etc) based on dry run experiences in WSL and Azure Cloud Shell environments
  • Challenge guide updates
    • Student resources: Cisco command cheat sheet; challenges 0, 2, 7; incorporating changes made in challenge 0 deploy script
    • Coach guides 1-7 updates; incorporating changes made in challenge 0 deploy script

* Hide warnings on deploy script [lines 39-40]
* Update CSR scripts to C8000V config processes [lines 531-542]
* Use latest encryption+integrity for phase1/phase2 (avoid deprecated options on CSR side) [lines 309-312, 318-321, 327-330, 336-339, 486-489, 494-497, 556-558, 566]
* Clarified some debug output lines [lines 530, 618]
* Added ServerAliveInterval option to ssh client per recommendation in Cisco docs (probably more important to use this in interactive connections later ;) )
* switch from NSGs assigned to NICs over to NSGs assigned to subnets
* narrow scope of NSG rule permitting SSH in to your client's source IP
* address situations where other automation might remove NSG rules allowing SSH in mid-script, which can leave lab deployment in an undefined state.

Longer-term, could examine cloud-init custom-data scripts on CSR VM deployment, but I don't expect we'll be able to get away from heredoc configs entirely.
* Update SSH MAC proposals
* Replace service used for finding "my" IPv4 public IP address
* moved finding "my" IPv4 public IP address to reduce calls to the API service
@davmhelm davmhelm requested a review from a team as a code owner December 18, 2024 15:27
@erjosito
Copy link
Contributor

Looks good to me! @microsoft/whatthehack-admins not sure how I can approve this one, I don't seem to have permissions.

CC @davmhelm

@davmhelm
Copy link
Author

davmhelm commented Jan 6, 2025 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants