{"id":95220,"date":"2020-09-26T19:42:34","date_gmt":"2020-09-26T17:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/postroenie-setevoj-infrastruktury-na-baze-nebula-chast-1-zadachi-i-resheniya"},"modified":"2020-09-26T19:42:34","modified_gmt":"2020-09-26T17:42:34","slug":"postroenie-setevoj-infrastruktury-na-baze-nebula-chast-1-zadachi-i-resheniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/postroenie-setevoj-infrastruktury-na-baze-nebula-chast-1-zadachi-i-resheniya","title":{"rendered":"Building a Network Infrastructure Based on Nebula. Part 1 - Challenges and Solutions","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Building
\nThis article discusses the problems of organizing network infrastructure in the traditional way and the methods of solving these issues using cloud technologies.<\/em><\/p>\n

<\/a><\/noindex><\/p>\n

For your information.<\/strong> Nebula is a SaaS cloud environment for remote management of network infrastructure. All devices supporting Nebula are managed from the cloud through a secure connection. A large distributed network infrastructure can be managed from a single center without the effort required to establish one.<\/p>\n

<\/p>\n

What is the purpose of another cloud service?<\/h2>\n

<\/p>\n

The main problem when working with network infrastructure is not the design of the network or the purchase of equipment, nor even the mounting in a rack, but everything else that will need to be done with this network later.<\/p>\n

<\/p>\n

A new network - old worries<\/h3>\n

<\/p>\n

When putting a new network node into operation after installing and connecting the equipment, the initial configuration begins. From the perspective of the 'higher-ups' \u2014 it seems simple: 'Take the working documentation for the project and start configuring\u2026' It sounds great when all network elements are located in one data center. However, if they are scattered across branches, it becomes a headache to ensure remote access. It's a vicious cycle: to gain remote access over the network, network equipment needs to be configured, and for that, network access is required\u2026<\/p>\n

<\/p>\n

Different schemes have to be devised to break out of the described deadlock. For example, a laptop with Internet access through a USB 4G modem is connected to the network being configured via a patch cord. A VPN client is launched on this laptop, and through it, the network administrator from headquarters tries to gain access to the branch network. The scheme is not the most transparent - even if you bring a laptop with a pre-configured VPN to the remote site and ask to turn it on, there is no guarantee everything will work on the first try. Especially if it's a different region with another provider.<\/p>\n

<\/p>\n

Thus, the most reliable way is to have a good specialist \"on the other end of the line\" who can configure their part according to the project. If there is none in the branch, options remain: either outsourcing or a business trip.<\/p>\n

<\/p>\n

A monitoring system is also needed. It requires installation, configuration, and maintenance (at least to keep track of disk space and regularly make backups). And it shouldn\u2019t know about our devices until we inform it. For this, settings for all equipment must be configured, and records should be regularly updated.<\/p>\n

<\/p>\n

It's wonderful when there is a 'one-man band' on staff who, besides specific knowledge as a network administrator, knows how to work with Zabbix or another similar system. Otherwise, we need to hire another person or outsource it.<\/p>\n

<\/p>\n

Note.<\/strong> The most unfortunate mistakes begin with the words: 'What\u2019s so difficult about setting up Zabbix (Nagios, OpenView, etc.)? I\u2019ll just quickly get it up and running!'<\/em><\/p>\n

<\/p>\n

From Implementation to Operation<\/h3>\n

<\/p>\n

Let's consider a specific example.<\/p>\n

<\/p>\n

An alarming message has been received indicating that a WiFi access point is unresponsive somewhere.<\/p>\n

<\/p>\n

Where is it located?<\/p>\n

<\/p>\n

Of course, a good network administrator has their personal directory where everything is noted. Questions arise when this information needs to be shared. For instance, if one urgently needs to send someone to sort things out on-site, they must provide something like: 'The access point is located in the business center at Stroitely Street, building 1, on the 3rd floor, office N 301 next to the entrance door under the ceiling.'<\/p>\n

<\/p>\n

Let's say we are lucky, and the access point is powered via PoE, while the switch allows for remote rebooting. No need to go there, but remote access to the switch is required. We still need to configure port forwarding through PAT on the router, deal with VLAN for external connections, and so on. It\u2019s great if everything was set up in advance. The task may not be complicated, but it still needs to be done.<\/p>\n

<\/p>\n

So, the access point has been rebooted for power. Didn't help?<\/p>\n

<\/p>\n

Suppose something is wrong with the hardware. Now we need to look for information about the warranty, the start of operation, and other interesting details.<\/p>\n

<\/p>\n

Speaking of WiFi, using a home version of WPA2-PSK, where one key is used for all devices, is not recommended in a corporate environment. Firstly, having a single key for everyone is simply insecure; secondly, when an employee leaves, you have to change this common key and reconfigure all devices for all users. To avoid such issues, there is WPA2-Enterprise with individual authentication for each user. However, this requires a RADIUS server\u2014another infrastructure component that needs to be monitored, backed up, and so on.<\/p>\n

<\/p>\n

Note that at every stage, whether it's implementation or operation, we utilized auxiliary systems. This includes a laptop with an 'external' Internet connection, a monitoring system, a reference database for equipment, and RADIUS as an authentication system. Besides network devices, we also have to support third-party services.<\/p>\n

<\/p>\n

In such cases, you might hear the advice: 'Put it in the cloud and don't worry about it.' Surely there is a cloud-based Zabbix, there may be a cloud-based RADIUS somewhere, and even a cloud database to maintain a list of devices. The problem is that these need to be integrated, not separate. And there are still questions about access organization, initial device setup, security, and many others.<\/p>\n

<\/p>\n

How does it work with Nebula?<\/h2>\n

<\/p>\n

Of course, initially the 'cloud' knows nothing about our plans or the equipment purchased.<\/p>\n

<\/p>\n

First, an organization profile is created. This means that the entire infrastructure\u2014headquarters and branches\u2014is initially documented in the cloud. Credentials are specified, and accounts are created to delegate permissions.<\/p>\n

<\/p>\n

You can register the used devices in the cloud in two ways: the old-fashioned way\u2014by simply entering the serial number when filling out a web form, or by scanning a QR code with a mobile phone. All that is needed for the second method is a smartphone with a camera and Internet access, including through a mobile provider.<\/p>\n

<\/p>\n

Of course, Zyxel Nebula provides the necessary infrastructure for storing both account information and configurations.<\/p>\n

<\/p>\n

\"Building
\nFigure 1. Security report of the Nebula Control Center.<\/em><\/p>\n

<\/p>\n

What about access settings? Opening ports, forwarding traffic through the incoming gateway, all that which security administrators affectionately refer to as 'poking holes'? Fortunately, none of this is necessary. Devices under the Nebula control initiate an outbound connection. The administrator connects to the cloud instead of to a separate device for configuration. Nebula acts as an intermediary between two connections: with the device and with the network administrator's computer. This means that the step involving the incoming admin can be minimized or even skipped entirely. And there are no additional 'holes' in the firewall.<\/p>\n

<\/p>\n

What about the RADIUS server? A centralized authentication is necessary, right?<\/p>\n

<\/p>\n

Nebula also takes care of this function. Authentication of accounts for access to equipment occurs through a secure database. This greatly simplifies delegating or revoking rights to manage the system. To transfer rights, we create a user and assign a role. To revoke rights, we perform the reverse actions.<\/p>\n

<\/p>\n

It's worth mentioning WPA2-Enterprise, which requires a separate authentication service. Zyxel Nebula has its own equivalent \u2014 DPPSK, which allows using WPA2-PSK with an individual key for each user.<\/p>\n

<\/p>\n

\"Inconvenient\" questions<\/h2>\n

<\/p>\n

Below, we will attempt to answer the most challenging questions that are often asked when entering the cloud service.<\/p>\n

<\/p>\n

Is it really safe?<\/h3>\n

<\/p>\n

In any delegation of control and management, two factors play an important role in ensuring security: anonymization and encryption.<\/p>\n

<\/p>\n

The use of encryption to protect traffic from prying eyes is somewhat familiar to readers.<\/p>\n

<\/p>\n

Anonymization hides the owner's information and the source from the cloud provider's staff. Personal information is removed, and records are assigned a 'faceless' identifier. Neither the developer of the cloud software nor the administrator servicing the cloud system can know the owner of the requests. 'Where did this come from? Who could be interested in this?' \u2014 such questions will remain unanswered. The absence of data about the owner and source makes insider threats a meaningless waste of time.<\/p>\n

<\/p>\n

When comparing this approach to the traditional practice of outsourcing or hiring a temporary admin, it is clear that cloud technologies are more secure. A temporary IT specialist knows quite a bit about the organization they are working with and can, either intentionally or unintentionally, cause significant security harm. Additionally, there is the issue of termination or contract completion. Sometimes, aside from blocking or deleting an account, it leads to a global password change for access to services, as well as an audit of all resources for 'forgotten' entry points and possible 'backdoors'.<\/p>\n

<\/p>\n

How much more expensive or cheaper is Nebula compared to a temporary admin?<\/h3>\n

<\/p>\n

Everything is understood in comparison. The basic features of Nebula are available for free. In fact, what could be cheaper?<\/p>\n

<\/p>\n

Of course, it is impossible to completely do without a network administrator or someone to take their place. The issue lies in the number of people, their specialization, and distribution across sites.<\/p>\n

<\/p>\n

As for the paid extended service, asking a direct question: is it more expensive or cheaper? This approach will always be inaccurate and one-sided. It is better to compare multiple factors, from the payment for the work of specific specialists to the costs involved in ensuring their interaction with a contractor or individual: quality control, documentation preparation, maintaining a level of security, and so on.<\/p>\n

<\/p>\n

Speaking of whether it is beneficial or not to purchase the paid service package (Pro-Pack), the approximate answer may sound like this: if the organization is small, the basic version will suffice; if the organization is growing, it makes sense to consider the Pro-Pack. The differences between the Zyxel Nebula versions can be seen in Table 1.<\/p>\n

<\/p>\n

Table 1. Differences between the basic version and the Pro-Pack version features for Nebula.<\/em><\/p>\n

<\/p>\n

\"Building<\/p>\n

<\/p>\n

This includes extended reporting, user auditing, configuration cloning, and much more.<\/p>\n

<\/p>\n

What about traffic protection?<\/h3>\n

<\/p>\n

Nebula uses the protocol NETCONF<\/a><\/noindex> to ensure the security of network equipment operations.<\/p>\n

<\/p>\n

NETCONF can operate over several transport protocols:<\/p>\n

<\/p>\n