How do I migrate from Vmware to Proxmox?
Recently, VMware ‘s new owner made a statement that echoed throughout the community: there will be no more free VMware licenses, and the cost of new licenses has increased by 40%. This drastic change in licensing policies has led many IT professionals and companies to re-evaluate their virtualization strategies. As a result, alternative solutions are emerging, most notably Proxmox, the most widely used Open Source virtualizer in the world. Proxmox offers a full range of features comparable to those offered by VMware, including functionalities such as clustering, replication, high availability (H.A.) and the guarantee of high availability, all without the high licensing costs associated with the VMware platform. With the ability to perform all these essential virtualization operations without compromising quality or reliability. If you already use VMware and are considering migrating to Proxmox, we’ve put together a detailed article that demonstrates the process of migrating VMs directly from VMware to Proxmox. This practical guide offers step-by-step instructions to ensure a smooth and efficient transition, allowing you to take full advantage of the features and benefits of Proxmox in your virtualization environment. ProxMox migration process Export The first step is to install ovftools using this link, after which you can send it via SCP to your ProxMox server using the command: Immediately after that, on your Proxmox server, grant execute permissions to the uploaded file and then run it: That’s it, OVFtools is installed! With this binary, we’ll go through two steps: exporting and converting. OVFTOOLS will connect remotely to your VMware ESXi server, and via the command line, you’ll specify which VM you want to export. OVFTOOLS will then download that VM and immediately convert it to the Proxmox standard. To perform this step on the server where OVFTOOLS is installed, run the following command: After finishing Export, let’s import this VM using the command: And after IMPORT is finished, the VM will already be configured in your ProxMox With just a few commands, we have already managed to migrate our first VM from VMware to Proxmox. All you have to do is repeat this procedure for the other VMs in your environment. But that’s not all. ProxMox has several other interesting functions that you can use right from the start of your implementation, so stay tuned for future posts! You will learn to: Migrating from VMware to Proxmox can be a strategic choice to optimize your resources and reduce costs without compromising on quality. If you’re looking for a solid, cost-effective alternative to your virtualization needs, we’re here to help. Contact us to explore the possibilities and start the migration process to migration.
How to configure FlowSpec on Huawei Routers
Overview: BGP FlowSpec (Border Gateway Protocol Flow Specification) is an extension of the BGP protocol used to define traffic filtering rules on routers. Unlike conventional BGP, which routes based on IPv4/IPv6 and prefix information, BGP FlowSpec allows network administrators to specify more granular criteria for packet forwarding, including layer 4 information (TCP/UDP ports) and even packet patterns. Simply put, Flowspec allows network administrators to dynamically create firewall rules through BGP announcements, using Layer 4 criteria such as protocol and application ports, and to apply actions that may include dropping traffic or simply applying bandwidth control. If you want to know more about how FlowSpec works, check out this article explaining whatFlowspec is . Operation: BGP FlowSpec works by adding new types of attributes to BGP, allowing network administrators to specify detailed filtering (or dynamic firewall) rules. These rules can include criteria such as: The following actions can be taken with BGP FlowSpec: When these rules are propagated through the BGP network, routers can use this information to filter or manipulate traffic in accordance with the defined policies. Operation – More Details: In the context of BGP FlowSpec, the actions are specified as part of the filter rules. Each filter rule contains three main parts: Actions in BGP FlowSpec are coded using BGP communities. Each action is mapped to a specific BGP community: When you create a BGP FlowSpec rule, you specify the matching fields, the desired action and, optionally, protocol fields. This rule is then encoded as a BGP community and included in a BGP update message that is sent to neighboring routers. The routers that receive this rule apply the specified actions to the packets that match the matching criteria. Please note that the specific BGP communities for each action may vary depending on the BGP FlowSpec implementation on your router. I recommend consulting your equipment’s documentation for detailed information on the BGP communities associated with each action in BGP FlowSpec. Use Cases: BGP FlowSpec can be used to block or redirect malicious traffic during distributed denial of service (DDoS) attacks. Precise rules can be applied to filter out unwanted traffic and keep services online. Network administrators can use BGP FlowSpec to guarantee quality of service by prioritizing certain types of traffic based on specific ports or protocols. BGP FlowSpec can be used to implement granular security policies, blocking traffic associated with malware or suspicious activity. Configuration examples: Now that you know what FlowSpec is and what it can do, we’re going to show you how to configure FlowSpec on Huawei routers. This configuration applies to Huawei NE20, Huawei NE40, Huawei NE8000-M4, Huawei NE8000-M8, Huawei NE8000-M12, Huawei NE8000-F1A or any Huawei that uses Huawei’s VRP operating system. Example configuration of the dynamic BGP flow specification: If the characteristics of DoS or DDoS attack traffic are unknown, a traffic analysis server, such as Made4Flow with Anti-DDoS, can help implement the BGP flow specification to ensure network security. #Network requirements: As shown in the Topology below, Device A belongs to AS 100, while Device B, Device C and the Server belong to AS 200. Device B is an input of the AS 200. AS 200 communicates with AS 100 via Device B. The source of the attack in AS 100 can flow to AS 200 via Device B, posing a threat to AS 200. In this situation, configure dynamic BGP flow specification to ensure network security. The operating process is as follows: Note: Interfaces 1 to 3 in this example represent GE 1/0/0, GE 2/0/0 and GE 3/0/0 respectively. The configuration script goes as follows: Data preparation: To complete the configuration, you need the following data: Procedure: Let’s go over the commands used. In our lab, we are using a simulator such as PNETLAB/EVE-NG. #Configuredevice B: #Checkthe peer connection status of the FlowSpec session on device B, if the session has the status “Established” the session is correct and functional. #Checkthe routes received via BGP Flowspec by device B: #Check the traffic policy (dynamic firewall rule) for each BGP Flowspec route based on the ReIndex shown in the previous output: Complete scenario configuration files: Device configuration file A: Device configuration file B: Below is another basic example of a BGP FlowSpec rule to block traffic from a particular port: Validate BGP Flowspec routes received: Validate details of the route received: To check whether the BGP Flowspec routes are effective, you can use the commands below: Validate route statistics: More commands for validations: Example of a Flowspec route with rate-limit: RFCs: For detailed information on BGP FlowSpec, see the following RFCs: Be sure to consult these RFCs for detailed information on BGP FlowSpec and its extensions. Did you know that Made4Flow now includes automated BGP Flowspec in its configurations, and that you can protect your network and your customers using this technology? You can automate BGP FlowSpec announcements for discard, rate limit, and flexible rules.
What is FlowSpec? How to use FlowSpec to mitigate DDoS attacks?
Essentially, Flowspec is an extension of the BGP protocol that allows routers to apply rules—such as dynamic ACLs or dynamic firewall rules—to specific types of traffic. These rules can be based on a variety of criteria, including source, destination, protocol, port, and so on.
How to Configure NetFlow on Nokia Routers
Today we’ll show you how to configure your Nokia SR OS router to export NetFlow (cflowd). Here we have the Network topology and the Netflow Server information These are the steps required to configure the Nokia SR OS router to export NetFlow v9/v10 via IP Netstream 1 – Configure the NTP server2 – Configure the cflowd parameters with the NetFlow server3 – Configure the interface to enable NetFlow Let’s go through the setup step by step: 1.Configuring the NTP Server It is important to configure an NTP server because flow data uses timestamps based on the router’s time. If the router’s time differs from that of the server, the data will not be time-stamped correctly, resulting in a discrepancy in the information. It is important that you configure at least 2 NTP servers and also your router’s timezone. 2 – Configure the cflowd parameters with the NetFlow server 3- Configure the interface to enable NetFlow Finally, we need to enable NetFlow on the interfaces that will export it. To do this, use the following commands on each interface: Below is the complete configuration of the Router: And enable the following on all interfaces: Detailed description Some additional commands for flow analysis: Conheça o Made4FlowSuporte (WhatsApp)
The Importance of Made4Flow’s New AntiDDoS Decoders
In recent months, our technical team has seen an alarming increase in DDoS attacks of the Carpet bombing type, characterized by intense traffic spikes generally directed at all IP addresses belonging to the ASN. These attacks have negatively impacted network connectivity, presenting an additional challenge in evading detection by many conventional DDoS security systems. Unlike traditional attacks, which focus on a single IP address, these latest attacks show greater sophistication. They send smaller volumes of traffic distributed among several IP addresses, making identifying patterns and distinguishing between legitimate traffic and DDoS attacks a much more complex task. In response to these evolving cybercriminal tactics, the AntiDDoS development team at Made4Flow has taken proactive measures. We recently implemented a series of new decoders to strengthen our detection system. This improvement aims to enhance the accuracy and reliability of our anomaly detection and analysis tool, significantly improving our ability to identify and neutralize more sophisticated DDoS attacks, by taking automated actions that were previously configured in our tool—such as BGP prefix announcements for mitigation or Clean Pipe (scrubbing center) links — in addition to generating reports on the identified attack. In this article, we’ll explore the details of these new Decoders, developed on the basis of extensive Made4Flow analysis and packet captures. These implementations aim to improve the resilience of AntiDDoS, providing a more efficient defense against the complexities of contemporary DDoS attacks. New Decoders from AntiDDoS Made4Flow: • Port 0: Enables the identification of DDoS attacks that use port ZERO in the UDP protocol within an IP packet, whether as the source or destination, since this tactic is frequently used in DDoS amplification attacks.• DNS: A common feature of DDoS attacks is the receipt of packets from DNS servers or hosts responding to DNS requests. These attacks are known as DNS amplification and involve zombie machines (infected machines), servers or assets responding to DNS requests, and the target.• NTP: Another widely used tactic involves attacks using NTP servers. Like DNS-based attacks, these are known as NTP Amplification, exploiting servers or hosts that respond to NTP requests to direct the attack toward its target. Although it is common for devices connected to the network to make NTP queries to keep the date and time up to date, it is possible to improve the detection of DDoS attacks by setting a standard traffic threshold using a decoder.• SSDP: The Simple Service Discovery Protocol (SSDP) can be exploited to send large volumes of packets to the target, abusing device discovery services to amplify the attack and disrupt the target’s connectivity.• IP Fragmentation: Packet fragmentation can occur when a device is unable to send all the necessary information in a single packet. The main issue is that firewall blocks may not be as effective, and large DNS response packets may use fragmented packets. An excess of these packets can impact the network and consume excessive resources from network devices; with this decoder, we can set a threshold and make detection more accurate.• TCP SYN: This decoder plays a key role in detecting attacks known as SYN floods, which involve consuming the resources of servers or device services, rendering them unavailable for use. By setting the correct threshold, we can implement effective preventive measures, preventing this type of attack from occurring and taking actions that result in immediate mitigation.• LDAP: The LDAP decoder plays an important role in identifying DDoS attacks that exploit servers with active LDAP to perform reflections, thereby amplifying malicious traffic.• Chargen: Although it is an older protocol, it is used in some line printers and can be exploited by attackers. Setting a limit for this type of traffic is also important.• TCP and UDP High Ports: In addition to the protocols mentioned above, we have observed in several DDoS attack reports the use of high ports—above port 1024—with the TCP and UDP transport protocols. Therefore, it is important to set limits for these two protocols, making the detection of attacks that use high ports more effective. The addition of new decoders makes DDoS attack detection more efficient by supporting a variety of protocols, protecting against different types of DDoS attacks, minimizing false positives, and enabling more accurate identification of real threats. Acessar a demo do Made4FlowSuporte (WhatsApp)
Ookla Speedtest – How It Works and What the Requirements Are.
When you choose the Ookla Speedtest, you’re choosing an intuitive interface as well as additional features when using the app (Android, iOS, macOS, Windows, etc.). The Ookla Speedtest provides a range of servers for conducting speed tests, as it is the most widely used speed test service on the market. Within the mobile apps, it provides you with testing options, including: Video quality your band can play:Here, it will scan and test videoquality, ranging from lower resolutions to higher ones, such as 4K Status:In this role, he introduces Downdetector, which is also owned by the same company, allowing us to know if any service is experiencing instability. Map feature:Track your location in real time. Regarding the Ookla server, they provide support to respond to open tickets in the event of a service outage. They also offer a server tester that verifies whether your server meets Ookla’s criteria so that it can be used publicly. Regarding the server requirements, you’ll need IPv4 and IPv6, as well as A and AAAA records for your speedtest subdomain pointing to the server. Ookla no longer accepts the “speedtest” subdomain for new servers, but it does allow you to use “test” or “velocidade” as the subdomain. Regarding server hardware, Ookla recommends always using the latest CPUs for performance reasons, since for Speedtest servers, the processor is the most important factor for optimal test performance. Therefore, fewer cores in a higher-performance processor are more effective than more cores in a lower-performance processor. As for memory, the recommended minimum is 16 GB of RAM, even though it doesn’t have much of an impact on test performance. For disk space, Ookla recommends having at least 1 GB to install the application; however, this storage requirement does not include logs, which take up additional space. Regarding network cards, based on reports, they noted that when the server uses Chelsio and Mellanox network cards, it performs better. As for the type of interface, it will depend on the tests to be performed, but the recommended minimum is 1 GB. However, be sure to consider the plans being sold, since higher-tier plans require more data to be transferred during the test, and 1 GB cards may not be sufficient in such cases. If you need assistance implementing Ookla Speedtest on your server, please contact us—we’d be happy to help!
Why Have Your Own Server with Your Internet Service Provider?
These days, IT infrastructure is the foundation of any business, especially when it comes to Internet service providers (ISPs) and corporate customers.The ability to deliver reliable, high-performance services depends significantly on the choice between using in-house servers or relying on third-party services.In this article, we’ll explore the reasons why having an in-house server is a strategic and advantageous choice for ISPs and corporate businesses. 1 – Full control of the infrastructure: By owning your own servers, you gain full control over the infrastructure. This means you can tailor server resources to your organization’s specific needs.From processing to data storage, you decide how the infrastructure is configured and managed.This results in greater flexibility to meet the ever-changing demands of the market. 2 – Security customization: Security is a key concern in any IT operation. Having your own server allows you to customize security measures according to your specific standards and requirements.You can implement firewalls, intrusion detection systems, encryption, and other layers of security as needed, ensuring data protection and customer privacy. 3 – Optimized performance and latency: Performance is crucial for ISPs and corporate enterprises that need to serve a large number of customers or employees.On-premises servers offer the ability to tailor hardware and network configurations to optimize performance and reduce latency. This results in faster, more reliable services, which can be key to gaining and maintaining customer satisfaction. 4 – On-demand scalability: Scalability is vital for handling spikes in demand or future expansion. With your own servers, you have direct control over how and when to scale your resources according to your needs.This means you aren’t bound by third-party limitations and can grow as your organization requires. 5 – Long-term cost reduction: While the initial investment in your own servers may seem significant, in the long run, this usually results in cost savings.You eliminate the recurring expenses associated with using third-party services and achieve a faster return on investment.In addition, you can plan hardware maintenance and upgrades according to your own schedule, avoiding unexpected costs. 6 – Compliance and privacy: Many organizations, especially those that handle sensitive data, must comply with specific privacy and security regulations.Having your own servers provides greater control over compliance with these regulations, ensuring that customer data is protected and that the organization complies with applicable laws. 7 – Customized support and maintenance: When you have your own servers, you can establish customized support and maintenance policies. This means you can respond quickly to technical issues and ensure minimal downtime.In addition, you’re in charge of ensuring that the servers are always up to date, in top working condition, and have backup routines set up, for example. In short, choosing to host your own servers offers unprecedented control over your IT infrastructure. This not only allows for greater flexibility and customization, but can also result in long-term savings and significant improvements in performance and security.For ISPs and corporate companies seeking excellence in IT services, having your own server is a strategic and advantageous choice! Do you need to address any of the topics above, or don’t have your own server yet? Count on us to work with you to validate each necessary step and set up a resilient server infrastructure for your company! Contact Us
What is an ASN, and what are its benefits?
Hoje vamos falar sobre ASN (Autonomous System Number) e quais vantagens ele traz para você. What is ASN? An Autonomous System Number (ASN) is a group of IP address networks managed by one or more network operators that have a clear and unique routing policy. Each Autonomous System (AS) has an associated number that is used to identify the Autonomous System when exchanging external routing information. External routing protocols, such as BGP, use the ASN to exchange routing information with other ASNs. ASNs come in two formats: 2-byte and 4-byte. – A 2-byte ASN is a 16-bit number. This format provides 65,536 ASNs (0 through 65,535). Of these ASNs, the Internet Assigned Numbers Authority (IANA) has reserved 1,023 (64,512 through 65,534) for private use. – A 4-byte ASN is a 32-bit number. This format provides 2³² or 4,294,967,296 ASNs (0 to 4,294,967,295). IANA has reserved a block of 94,967,295 ASNs (4,200,000,000 to 4,294,967,294) for private use. To obtain an autonomous system, you must request an Autonomous System Number (ASN) from the Regional Internet Registry (RIR) corresponding to the region where your organization is located. In Brazil, the responsible organization is LACNIC. In addition, you must configure the network devices in accordance with the routing policies defined by the organization, which can be found on the institutions’ websites. Check out our article on “How to Request an ASN from Your Provider?” There are currently five RIRs in operation: 1 – American Registry for Internet Numbers (ARIN): North America and parts of the Caribbean; 2 – Réseaux IP Européens Network Coordination Centre (RIPE NCC): Europe, the Middle East, and Central Asia; 3 – Asia-Pacific Network Information Centre (APNIC): Asia and the Pacific; 4 – Latin American and Caribbean Internet Addresses Registry (LACNIC): Latin America and parts of the Caribbean; 5 – African Network Information Centre (AfriNIC): Africa. Did you know that it’s not just service providers, telecommunications companies, and ISPs that must be Autonomous Systems? Other types of companies also need to use them, such as banks, universities, insurance companies, production companies, news portals, and large corporations—since internet access is critical to their core business, and an ASN can ensure that these services are always available and secure. When an organization becomes an AS, it is assigned an ASN (Autonomous System Number)—a number that identifies the set of IP addresses owned by that organization—which is crucial for identifying the systems and enabling the exchange of information and routes between them. What are the benefits of having an ASN? Requesting and obtaining an ASN is essential for an organization—especially an Internet service provider—to have full control over its network infrastructure, optimize performance, improve redundancy and security, and actively participate in global Internet routing. We offer comprehensive support and consulting services for requesting and implementing ASN in your network. Please contact us to find out how we can help you.
Firewall: Why use it and how to use it?
In an increasingly interconnected world, network security is a primary concern for internet provider companies and their customers. An essential tool for protecting your IT infrastructure against cyber threats is the firewall. In this article, we’ll explore why using firewalls is critical and how to implement them effectively on your network.
Success Story: Modernization of the Wi-Fi Infrastructure at the Apucarana City Council
Client: Apucarana City CouncilCompany: Made4it Overview: The Apucarana City Council, a government institution responsible for legislating and making decisions on behalf of the local community, faced a significant challenge with its communications infrastructure. With the growing reliance on technology and connectivity, the need to provide a reliable Wi-Fi signal throughout the building has become essential for the efficient conduct of legislative and administrative activities. Challenge: Before partnering with Made4it, the Apucarana City Council faced a number of problems related to Wi-Fi connectivity. Coverage was uneven, with areas where the signal was weak or nonexistent, resulting in interruptions during legislative sessions, difficulties in live-streaming meetings, and slow access to essential digital documents. The challenge was to modernize the Wi-Fi infrastructure to ensure full coverage and high-quality connectivity throughout the building. Solution: Made4it was chosen to tackle this challenge and designed a comprehensive solution to modernize the Apucarana City Council’s Wi-Fi infrastructure. The project was divided into several phases: Results: The Made4it project has yielded remarkable results for the Apucarana City Council: The Made4it project at the Apucarana City Council demonstrated how a well-designed Wi-Fi infrastructure can positively impact the operations of a government agency, increasing efficiency, improving communication, and providing a more modern and connected environment for everyone involved. If you’re looking for a solution to a Wi-Fi issue or any other problem with your network infrastructure or server, please contact us to learn more.
