[{"content":"Late 2025 has seen a few major cloud outages. Notably, the Azure Front Door outage on October 29th and DynamoDB DNS issues within AWS on October 19th.\nThis seems to have generated a lot of talk regarding availability of cloud providers. I\u0026rsquo;ve seen many conversations being held on LinkedIn (grain of salt = taken) about how hosting infrastructure in the cloud isn\u0026rsquo;t reliable enough for production workloads. Seeing these conversations made me wonder; are these concerns grounded in reason, or knee jerk opinions?\nUtilizing cloud solutions certainly isn\u0026rsquo;t the best fit for every business or organization. It is not a one-size-fits-all solution. Each use-case should be considered if it would be best hosted either on-premises, hybrid, or fully in a cloud. Regardless where your infrastructure exists, disaster recovery planning concepts and business continuity plans remain relatively the same. Redundant circuits? Hot site? Backup strategy? Regional or global availability needs? Multi-cloud strategies? These are all questions and considerations for planning your infrastructure.\nHow many outages has your organization experienced this year? What caused them? Were they caused by construction teams accidentally cutting fiber lines? Or power outages? In my experience, this is typically no more than a couple incidents per year.\nNow, despite news and social media coverage, how many significant outages do major cloud providers experience each year? According to AWS and Azure status histories, it\u0026rsquo;s roughly the same amount on a per-region basis. Nearly all US regions have had 1-2 outages this year for both providers.\nThe number of significant outages doesn\u0026rsquo;t seem like it\u0026rsquo;s any more or less than other organizations. The average datacenter seems to experience around 2 major outages per year which is about the same as AWS and Azure.\nOf course, the outages affect way more customers because they\u0026rsquo;re cloud providers. When a cloud provider goes down, everyone knows about it through social media, news, and first-hand experience. When a specific company has an outage on their on-premises infrastructure, only the employees and customers of that specific company will know about it and it\u0026rsquo;s less likely to make headlines.\nIs your infrastructure running workloads that cannot have any downtime? If so, a strong DR and BC plan should account for cloud provider outages. Multi-cloud environments would protect against single points of failure within Azure, AWS, etc.. Not all organizations will have this requirement, though. Some may be able to tolerate cloud outages. Some simply run workloads that can withstand outages. Your organization\u0026rsquo;s DR and BC plans will depend upon its needs, so they all will look a little different.\nLike I mentioned earlier, the cloud isn\u0026rsquo;t the perfect solution for all business needs. Cloud providers offer great options for creating highly available infrastructure if it suits your needs, but it has to be well architected to withstand outages. Anyone who works in IT knows that it\u0026rsquo;s not a matter of \u0026lsquo;if\u0026rsquo; an outage will occur, it\u0026rsquo;s a matter of \u0026lsquo;when\u0026rsquo;. Cloud providers are no exception to this.\nSo, the question isn\u0026rsquo;t will you experience an outage, it\u0026rsquo;s have you planned for it?\nI wanted to share my thoughts after seeing LinkedIn posts demonizing using cloud providers for production workloads and other essential things. Maybe I\u0026rsquo;m just responding to the rage bait articles/posts that only exist for engagement and I\u0026rsquo;m preaching to the choir. Regardless, thanks for reading!\n","date":"2025-12-10T00:00:00Z","image":"https://alexdean.link/p/cloud-outages/cloudcomputing_hu_c140a00363b07bdf.png","permalink":"https://alexdean.link/p/cloud-outages/","title":"Cloud Outages"},{"content":"If you\u0026rsquo;ve Palo Alto NGFWs for a period of time, you may have used the External Dynamic List (EDL) function. This is basically a function that allows the firewalls to retrieve a list of URLs or prefixes from an external feed. In one of my previous jobs, we utilized a text document in an AWS bucket and utilized the file\u0026rsquo;s URL for the Palo Altos to use as a feed source.\nWhile the process looks a little different, the same goal can be accomplished in Cisco\u0026rsquo;s NGFWs. For this example, the Firepower Management Center (FMC) will contain the dynamic object that can be reference by access policies for the managed FTDs.\nFirst, you\u0026rsquo;ll log into your FMC. Go to Integration \u0026gt; Dynamic Attributes Connector.\nNext, go to the Connectors tab. Create a new connector of the Generic Text type.\nIn the \u0026lsquo;Add Generic Text Connector\u0026rsquo; window that appears, give it a name and description. Adjust the Pull Interval to the desired setting. In the URLs field, paste the URL of wherever is hosting the text document with the desired list of URLs/prefixes. This can either be from AWS, Azure, or from any other webserver that\u0026rsquo;s accessible by your FMC. The URL is retrieved by navigating to your text file in your Azure storage container/AWS bucket. There will be an option to copy the URL of the object from there.\nAfter providing the URL, optionally click Test to verify your FMC can successfully connect to that URL. Click Save.\nYou should now see a dynamic object created in Objects \u0026gt; Object Management \u0026gt; External Attributes \u0026gt; Dynamic Object. You can view the mapped IPs from this menu to verify the object contains all of the entries in your text file.\nAt this point, you\u0026rsquo;re ready to create an ACP rule to reference this new dynamic object. To add the dynamic object to a rule, it will not be in the Networks tab of the rule creation window. It\u0026rsquo;ll be in the Dynamic Attributes tab instead.\nThat\u0026rsquo;s it! The process is fairly simple and straightforward but took me some time to research the Cisco FMC equivalent of a PA Panorama EDL. This can be a simple, centralized way to manage blocklists or allowlists.\nUseful Links:\nDynamic Attributes Connector Documentation ","date":"2025-11-05T00:00:00Z","image":"https://alexdean.link/p/paloalto-edl-on-cisco-ftd-using-fmc/blocklist_edl_hu_a5aeb925e7c79e22.jpg","permalink":"https://alexdean.link/p/paloalto-edl-on-cisco-ftd-using-fmc/","title":"Palo Alto EDL Equivalent on Cisco FMC"},{"content":"Finding good documentation on the configurations needed for the CE side of an ExpressRoute setup is difficult. I recently went through an initial setup and ran into several obstacles. This post will focus on the CE config.\nFirst, you need an ExpressRoute circuit established. This is done through a Microsoft partner. I\u0026rsquo;m assuming you\u0026rsquo;re already done with this step and are ready to actually begin configuring things.\nNext, you\u0026rsquo;ll need to decide on two /30 networks to assign for the BGP peerings with Microsoft. Keep in mind, these two /30s must NOT overlap with anything you end up building in Azure. For example, if you choose 10.0.0.0/30 and 10.0.0.4/30, you CANNOT use 10.0.0.0/24 within a vnet later (exception: if the vnet containing the overlapping subnet is not and never will be peered to the vnet with the circuit within it. I\u0026rsquo;d just avoid overlapping altogether).\nOnce that\u0026rsquo;s decided, configure them within Azure. It\u0026rsquo;s very straightforward and there\u0026rsquo;s plenty of documentation out there on this part. See here for Azure-side private peering configuration.\nOn the customer equipment (CE) side, you\u0026rsquo;re going to be configuring the BGP peer on your edge device. In the example below, it\u0026rsquo;ll be configs for a Cisco ASR router.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 ### Azure ExpressRoute CE Router BGP configuration ### ! ip prefix-list AZURE_PREFIX_FILTER seq 10 permit 192.168.1.0/24 ip prefix-list AZURE_PREFIX_FILTER seq 20 permit 192.168.2.0/24 ! router bgp 64512 bgp log-neighbor-changes neighbor 10.0.0.2 remote-as 12076 neighbor 10.0.0.2 ebgp-multihop 255 neighbor 10.0.0.6 remote-as 12076 neighbor 10.0.0.6 ebgp-multihop 255 ! address-family ipv4 network 192.168.1.0/24 network 192.168.2.0/24 neighbor 10.0.0.2 activate neighbor 10.0.0.2 prefix-list AZURE_PREFIX_FILTER out neighbor 10.0.0.6 activate neighbor 10.0.0.6 prefix-list AZURE_PREFIX_FILTER out exit-address-family ! interface GigabitEthernet0/0/0.5 description ExpressRoute Connection encapsulation dot1Q 5 ip address 10.0.0.5 255.255.255.252 secondary ip address 10.0.0.1 255.255.255.252 End A high-level list of things to configure:\nSubinterface on the interface that will connect to ExpressRoute The BGP process, neighbors, and address family Prefix-lists for inbound/outbound advertisements A few key takeaways from this template:\nMake sure you include an outbound prefix list. If you are advertising too many prefixes to Azure, it will not form neighborships properly. Microsoft\u0026rsquo;s ASN will always be 12076 for private peering. Your IP in the two /30 subnets will always be the first usable IP in the subnet. The second usable IPs need to be configured on the Azure side. the \u0026ldquo;ebgp-multihop\u0026rdquo; statement must be configured as your Azure neighbor will not be directly connected. If you\u0026rsquo;re having trouble with the peering, you can verify your route and ARP tables on both your edge device and on the Azure side. Work on getting pings working from your subinterface IPs to your Azure peer IPs and work your way back. It\u0026rsquo;s not shown in the template above, but be sure to add ACLs to your subinterface. Importantly: READ THE BGP DEBUG LOGS. If you see SAFI/AFI errors, you\u0026rsquo;ll need to make sure your address-family configs are correct and compatible with the peer. Keep most BGP settings default as there is not much documentation regarding specific Azure peer BGP settings. If you see logs saying the peer has reached its prefix limit, verify your outbound prefix lists are correct and filtering only what you want to advertise.\nUseful BGP troubleshooting commands:\nShow ip bgp summary \u0026ndash; shows BGP neighbors and if they\u0026rsquo;re exchanging routes Show ip bgp neighbor 10.0.0.2 \u0026ndash; shows detailed info about a BGP neighbor Debug ip bgp \u0026ndash; can specify a neighbor to debug so you don\u0026rsquo;t get irrelevant logs Term mon \u0026ndash; to view BGP debug logs Don\u0026rsquo;t forget: your cloud IP space will need added to ENS software, firewall rules, router ACLs, and any other points in your infrastructure that may be filtering traffic!\nUseful Links:\nExpressRoute Documentation ExpressRoute Router Configuration Sample ","date":"2025-10-20T00:00:00Z","image":"https://alexdean.link/p/expressroute-initial-setup/expressrouteIcon_hu_ac56a2a423c7992f.png","permalink":"https://alexdean.link/p/expressroute-initial-setup/","title":"Azure ExpressRoute Initial Setup"},{"content":"Welcome to my blog!\nMy name is Alex Dean. I\u0026rsquo;m a network engineer with over 10 years of experience. Much of my experience has had heavy cybersecurity duties as well. I\u0026rsquo;m currently attending WGU in the B.S. Cloud Computing (AWS track) program and have active SecurityX (formerly CASP+) and CCNA certifications. I\u0026rsquo;ve worked in both public and private sector positions. I\u0026rsquo;ve also gotten to work with on-prem, hybrid, and fully cloud environments. I\u0026rsquo;m very thankful for the range of experience I\u0026rsquo;ve been able to have so far.\nMy goal with this blog is to share any tasks, struggles, or news that I feel may be possibly be helpful to others or may be useful to come back to in the future.\nThis website is built with Hugo so this will likely be in a \u0026ldquo;in-progress\u0026rdquo; state for some time as a get the hang of using Hugo. I\u0026rsquo;ll do my best to keep this thing as shiny and polished as possible while I learn it!\n","date":"2025-10-05T00:00:00Z","image":"https://alexdean.link/p/hello-world/cover_hu_e95a4276bf860a84.jpg","permalink":"https://alexdean.link/p/hello-world/","title":"Hello, World!"}]