[Jool-list] JOOL in a multitenant service provider environment [EXTERNAL]

[Stefan Brudny]

Cool, it's bcs that sounded a lot like my config.

Depending on the protocol and more likely its direction it might be easier
to stick to the application proxies here and there. This is another topic,
but sometimes building a network only to one ip has its benefits.
Especially for http like protocols.

If there are more dcs, it might be necessary to span the l3 ipv6 network
among them so it is mpls vpn, a Vpn etc.

If you still neet to nat64, then recipe is to
Create namespace and link them to monitoring tool using ipv6.
Link and route the customers networks into name spaces (gre, vlans, vpns)
Setup nat64 in name spaces.
Optional: expose services to customer networks using some ha ky technique,
i used dnat but this could be proxy, another tunnel etc.

Feel free to ask directly, maybe I could find ab exemplary config.



On Wed, 16 Dec 2020, 16:09 Art Cancro, <Art.Cancro at tierpoint.com> wrote:

> The suggestions below look promising.  Thank you for posting them.
>
> Stefan, you are correct in guessing that we have to overcome the
> limitations of a monitoring tool, actually *many* monitoring and management
> tools.  Our monitoring system is capable of siting a data collector inside
> each customer's network, but we have 40+ data centers, each with hundreds
> of customers, so this is not always practical ... and we have other tools
> that need to reach in as well.
>
> Thank you both for the suggestions.  I do know a bit about namespaces and
> will try it.
>
>
>
>
>
> From: Jool-list <jool-list-bounces at nic.mx> on behalf of Alberto Leiva via
> Jool-list <jool-list at nic.mx>
> Sent: Tuesday, December 15, 2020 16:43
>
> Not sure exactly how you're setting things up, but if your translator is
> an SIIT, chances are you only need one instance, and you just need to add
> each customer network as an entry to the Explicit Address Mappings Table:
> [0]
> Otherwise you can indeed set up multiple Jool instances and match their
> traffic with iptables: [1]
>
> [0] https://jool.mx/en/usr-flags-eamt.html
> [1] https://jool.mx/en/usr-flags-instance.html
>
> On Tue, Dec 15, 2020 at 3:11 AM Stefan Brudny via Jool-list <
> jool-list at nic.mx> wrote:
> Hi,
>
> Let's focus on use case.
>
> I am guessing using ipv6 and single address space is an approach to
> overcome limitation of a monitoring tool. If so, I'd suggest:
>
> * use single ipv6 /48 for all customers. You are not assigning networks,
> so RIPE doesn't bound you this time. Your monitoring tool may assign any
> subnet, /96 is fine, for a customer. Jool doesn't need to be aware of that
> assignment, it's business side, except constructing entries in name spaces.
> * use network namespace for each customer translation.
> * stateful NAT64 could be used to embed the customer traffic in a namespace
> * be ready to master routing in namespaces: what is planned to connect the
> customers networks? Vlan, gre, openvpn, wireguard?
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail-lists.nic.mx/pipermail/jool-list/attachments/20201216/7e2de609/attachment.htm>