ZeroTier and DNS issues
-
OOOOOOO K!
Well I can say I've never considered it for that type of use. I've also never read any of their literature either.
That changes a lot.
-
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
-
Pertino's target market is the California startup market specifically where this works beautifully. You'd be surprised how much their 100% mesh completely fits the model used by the west coast IT market. It's the non-west coast's approaches that make it seems strange and impossible. I've dealt with a lot of companies out there where they are like "of course, that just works". It doesn't seem foreign to them at all.
-
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
Question - how do they get to the internet? Does the local machine send DNS queries to AD's DNS via Pertino, then the local clients use the local hardware network to find a route to the internet?
-
@scottalanmiller said:
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
I knew this was how NTG operated, but I knew that only because NTG is a physically diverse network.
-
@hubtechagain has Pertino at a few of his clients.. I wonder if he runs an all or nothing approach.
-
@Dashrender said:
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Because you don't want your NFS traffic for two servers sitting next to each other traversing your WAN link. It still needs to understand how to hit the cloud or not for traffic. No matter how much you abstract your traffic the realities of congestion still exist.
-
We've had the same experience with ZeroTier which does the same thing in this use case minus some of the bundled hacks for things like AD. Greenfield is easy. "Brownfield" as they call it -- namely anywhere other than California -- is a lot harder because you have to still connect to the 1990s Windows NT server that is mission critical or the printers that can't run SDN software or the ancient Solaris box that talks via 1200 baud modem bank to the store PoS systems or the IP over carrier pigeon (RFC1149) deployment.
Right now we've elected to focus more on other uses of SDN, but yes we do eventually want to go there.
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
-
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
-
@Dashrender said:
I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
It IS a huge flat network. /22 now, they just updated.
-
@Dashrender said:
Question - how do they get to the internet? Does the local machine send DNS queries to AD's DNS via Pertino, then the local clients use the local hardware network to find a route to the internet?
Anyway you want, typically direct since the Internet is not part of your LAN. But you could put a proxy on the pLAN somewhere.
Obviously the route to the Internet is handled normally since that is also how you get the route to your Pertino gear.
-
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
For high performance stuff where you don't want any encapsulation overhead it makes more sense to just physically wire thing together on private special purpose backplane networks. You will never beat that with SDN because... well... it's just a wire.
-
@adam.ierymenko said:
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
If you have 100 machines in a single office, you don't want them talking to each other through an Amazon hosted switch.
-
@scottalanmiller Sure, but why wouldn't you handle that a layer down? Are you saying Pertino uses DNS to route traffic?
-
@adam.ierymenko said:
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
How is ZeroTier determining how to address a machine in one place or another? Say a laptop is communicating with a server that is remote and then becomes local. How does it know when to switch?
-
we use pertino only on our laptops and "out of office" computers. not installed on every workstation, that would be silly. We use pertino essentially as a vpn, a means for those geographically separate devises to still use LAN resources securely and easily (doctors, nurses, etc)
-
@adam.ierymenko said:
@scottalanmiller Sure, but why wouldn't you handle that a layer down? Are you saying Pertino uses DNS to route traffic?
Yes. DNS is used to determine where to send traffic. Because it gives different addresses out under different circumstances.
-
@scottalanmiller said:
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
What I mean is that I wouldn't bother setting up DHCP on a Windows Server to handle the local network portion... I'd leave that to some unrelated device, and not have the local network be part of the Windows concern.
But in reading some of your responses I'm not sure how that would work either.
Let's say I'm on a 1 Gb network... the server is on that same network... but we're using Pertino... I have a 5 meg internet connection, how fast are files going to move between me and the server?
-
@scottalanmiller Every ZT device has a cryptographically-defined identity, so any time it gets a packet it knows who sent it. It can then try various paths for connectivity and use them if a bi-directional link is determined to be present. ZeroTier devices on the same virtual network try each other over their local IPs as well as via NAT-t and other methods and if that works they prefer local to global. But if it stops working they'll fall back to whatever works according to a preference order based on IP scope/class and type (V6 over V4, local over global, direct over indirect).
It's open source if you're curious: https://github.com/zerotier/ZeroTierOne
-
@adam.ierymenko said:
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
Good to know - can you tell us how that works? Ok you did the post before mine.
