Re:Ziti: Programmable network overlay and edge components fo...
by tyingq on Monday September 26, 2022 @02:08PM
(#32986259)
No, they actually block them by actively inserting their own routes at a higher priority and inserting firewall rules. You can fool around with LD_PRELOAD to neuter their functions that do this and get everything working end-to-end. They are blocking things that would otherwise be NATed and work just fine.
There's also workarounds for Windows using Powershell scripts and "Set-NetIPInterface -InterfaceMetric 6000" to lower the priority of the AnyConnect internal routes that break docker, or using wsl-vpnkit (as DockerDesktop does).
Re:Ziti: Programmable network overlay and edge components fo...
by Hikikomori on Tuesday September 27, 2022 @04:29AM
(#32992844)
Only if you configure them to do so. I created our Globalprotect solution and we use docker extensively without issues. It just sets a default route (0/1 and 128/1) and users just need to NAT from the docker network for it to work.
Re:Ziti: Programmable network overlay and edge components fo...
by tyingq on Tuesday September 27, 2022 @08:19PM
(#33002866)
Well, "you" being the entity that controls the head end of the VPN, which controls settings not (always) tweakable by the end user.
Re:Ziti: Programmable network overlay and edge components fo...
by chrisweekly on Monday September 26, 2022 @04:53PM
(#32988209)
Have you written any of this up in more detail, or have relevant links to share?
It’s not that they block them per se, they are just ignorant of them and so they can’t route them. Traditional VPNs rely on routing protocols like OSPF and BGP (with the occasional static route thrown in) to move traffic, and your docker overlays aren’t integrated with the netsec team’s routing infrastructure.