Tommy here from Warrant Systems and let's dive into the topic of talking about different firewall options And this is gonna have a lot of qualifiers around it This is April of 2023 when I'm making this list These are the firewalls on this list at least that I have direct experience or at least some indirect experience to friends with and that's one of the big qualifiers is it's impractical and Hard to try to list all the popular firewalls and that's going to be of the controversial one as I learned on Twitter when I Posted some of these questions of people want me to review their favorite firewall And if it's your favorite firewall keep using it if it's happy if it's secure and it works well for you I don't have any reason to tell you not to use those I wanted to offer some knowledge on the what we use and the qualifying list here comes down to Things we use a lot of course PF sense being that list and things that some of my trusted IT friends that we work closely with Do use as well now a little background on myself here We are an IT services company and a managed services company as in we are outside IT for other businesses We manage about 50 PF senses in different businesses That we also do consulting with those businesses some of those have internal IT teams now expanded from that We also have co-managed IT we do as in they have an internal IT department But farm out some of the work to us and we have a lot of those clients using things like 48 Not that we're managing your 48, but we know they manage your 48 We're usually they're managing let's say their servers or some visualization or some storage So I have interaction with a lot of these firewalls that are on the list here with the exception of a little bit of Maraki, I have less interaction with them and the same thing with The 48 it's less interaction But worth listing on there because I had my friend Jason slaggle go over the list and say yeah We definitely use these we like them You've seen them on the channel before and then I also had Christian lemba and I have a few other IT friends that Really like the Sofo system so I threw it on there but I just don't work with those a lot but I at least for a comparison list have it on there and People who are familiar with my channel know my bias towards PF sense because it's a very popular solution One thing I will say right off the bat here though when it comes to PF sense I listed it as just PF sense, but yes, there's two versions PF sense and PF sense plus PF sense CE I should say which is community edition the open-source version PF sense plus is basically that same version with if you extra add-ons on there and This is a topic that you know people say well aren't you now talking about PF sense But closed-source if you look they're kind of developed in tandem, but they do release the PF sense plus additions first That is just the way they do things PF sense the neck gate people behind it are big at supporting upstream and BSD They write some of the drivers and do a lot of the integrations They have wonderful documentation as well the reasons I've been such a longtime user of PF sense But without you know getting too far into it I will mention open sense is not on the list because I just don't interact with it from a business standpoint I don't have any problem though if you would like to use open sense This is where the Twitter controversies by me not having it on there People seem to assume that I have some dislike for it. I just don't use it. It does have more frequent updates But they're both actively developed projects PF sense the 2.7 CE which is close to final release is based on free BSD 14 I believe open sense is on free BSD 13 But both of those are current and if you go to PF and PF sense plus that it's currently on 14 that's current as well. So there are updates to it They're just less frequently open sense seems to be really popular in the home lab world because it has like more packages And I get that but from a business management standpoint And that's for a lot of my experience comes from is using these in businesses not just testing in a lab So the real world usage I just don't run into the open sense as much and having to manage something that has a lot of updates can be challenging Now it is my understanding lightly and I looked a little bit There is a business version open sense which has a slightly different path with a few extra features But I've never used it and I didn't want to buy a license just to test something because that testing would be still once again in The lab. I don't have time to tear down large infrastructure We have site to site VPNs, etc. And see how open sense performs So if you want to use it keep going if you're happy with it keep using it My preference is for PF sense and let's drive into the details of the list I have over here. We got PF sense Arista untangle. So Arista bought untangle and they've continued on with the product I believe they renamed it Arista edge by still see untangle in a few places I think that branding is still there though if you look for my old videos, they all say untangle Maybe I'll do an update a video on it at some point since it's been bought. They still have been maintaining the project It's still a popular firewall and I have some friends that are gold partners in it We don't have that many clients on it, but we have a few and it seems to work. Well, and it's very trouble-free USG UXG and the UDM pro UDM pro SC a group these together separately as opposed to just calling it unify because these have very different functionalities and even UDM pro and pro SC There's some differences there You can probably throw in the unified dream wall on there to be more like a pro SC The unifies are really popular in the market, but there's definitely some shortcomings. We'll be talking about there 48 Sophos and Maraki. You can't ignore Maraki's presence, especially in the IT services market So I threw them on here as a list. I also can't ignore the controversies around Maraki Not just the pricing but occasionally Maraki going around people I've got links that are in the description if you want to dive into some of that and Contacting customers directly is the going around is and you have to be a reseller to get Maraki And then if they contact your customers directly to catch you out Not the first time I've heard of Maraki doing it, but it recently happened again So I didn't want to ignore or pretend the controversy doesn't happen with them Next is the features here can run on your own hardware with PF sensets. Yes or a suntangle. Yes and No, no here You're only gonna run it on the unify hardware when you're running unified for 48 same thing You don't get to just load it up as a device You're gonna have to use the 48 hardware Sophos. So it's a software-based firewall They do have appliances just like PF sense does so yes You can load it up yourself or virtualize it which is next category and Maraki's a no on both of those The virtualize I've virtualized PF sense mostly for lab use, but you can use it in production I'm partial to using direct hardware, but though it's an option same thing with the Arista I'm partial to using hardware, but yes, it can be virtualized You're tied to the hardware when it comes to the unify line and the 48 I put yes, but a link to how they do virtualization that way you have that information Available to you for the page they have already talked about virtualized ones and Christian lump Has a video on Sophos and virtualizing Sophos Sensual management's a big thing that comes up when you're doing this from a business standpoint Not just a home user And PF sense doesn't have anything natively the offer our solution to this is have our clients PF senses VPN back to us This allows us to get to their web interfaces, but not create any tunnels between them So there's no lateral movement that can happen from a security standpoint This is what scares me is some of the third-party ones out there Where people say let's just put SSH case in so we can have one central place to automatically manage it You're also creating one central place where someone could mass change firewalls without a second level of authentication Depending on how that's done. So something to take in consideration. There's nothing official from neckate on this The one from Arista does work in a way where it just creates a tunnel back Essentially like a proxy where it just brings you to the login page of each device and gives you the status of those devices So there's central management. It's nice Unify if you have the USG UXG via their controller the unified controller acts as the central management for multi sites on there It's a multi-tenant controller. So you can have many clients in there if you want Yes via the UI Site so each one of the dream machines has or even the dream wall they run the unified controller software within it and Then you can tie it to unifies portal, which just brings you to the page on there through central management through the unified system So they do have a way of handling that 48 has their central management system Sophos does and so does Maraki web interfaces. Yes for PF sense and Tangle via the unified controller Even though it's built into the dream machine series It's still the unified controller software running with inside of it So you're not exactly interacting with the firewall natively you do it through the unified software 48 yes has System so does Sophos and Maraki is pretty much via their site. There's very basic things you can do on a Maraki You don't really can do any advanced configurations I think it just has some troubleshooting things you can do when you get to the web interface of a Maraki firewall It's designed really be managed to their site licensing fees PF sense comes in community edition and plus the community edition is free the open source edition the Plus edition can be registered for free for home users and lab use So there's not actually any license fees But you can also buy support packages if you want when you're running it on your own hardware if you're by neck-eat hardware There's no license fee hence a little asterisk there So if you buy any of the neck-eat appliances you get the PF sense plus edition and a limited amount of support And there's no license fees ever. It's perpetual. There's no renewals on this Arista they're a little bit more mixed. That's why I said some features This is a link that takes you to a comparison chart to what you get for free versus what requires Extra licensing paid licensing versus just free registration because you do have to do some registration if you want to use the entangle It's not just download and go. There's I believe a registration page. You have to set up on there No license or registration is tied to the hardware Technically to make any of the firewall functions work 48. Yes, they definitely have licenses Sofos has a free for home edition and Maraki is not just licensed their license And I believe it just stops working when there's no licenses They're they don't have no home or free edition that I'm aware of maybe they do but I didn't see it when I was looking They do have some basic models and you can get some like special reseller extra licenses I think once you are a registered reseller, but I'm not gonna get too off topic on now Operating systems PF sense is gonna be based on free BSD currently free BSD 14 Then we have Linux and I put Linux on all these but technically they're very custom versions of Linux They're not like Linux and then they loaded some piece of software on top to make a firewall But they're at least Linux based at the underlying OS Supports high availability. Yes, and yes on the Arista and on the PF sense No, and no on either model of these. I know it's been in the coming in the future But I don't know when that future is maybe you're watching it when they actually release this But that's not a feature that they offer is a full HA or one firewall can fail over to another Yes on these ones here BGP OSPF there's actually quite a bit of features around this with the PF senses and as one of the packages they have to Control this But this is where sometimes you may have a little bit of nuance. You have this in PF sense. You have this in Arista It's limited what you can do in Maraki. I forget what the limitations are yet to do some digging to Figure out because it may change it from model to model as I was told 48 yes and so forth says yes But this is where you can start to say, okay, but does it do the exact way? I want it to or the full features that was where we'll say yes It has it but the details are going to be dig into it if you have a BGP use case dig into it first SD-WAN there is no SD-WAN option for PF sense Arista on Tangle has an SD-WAN option that integrates into on Tangle Nothing I'm aware of for the unify line 48 has their own integrates with their firewall SD-WAN options So does Sophos and so does Maraki Open VPN PF sense uses normal open VPN. It's interoperable with standard open VPN clients And for the most part untangle is as well a wrist untangle can do open VPN They have I've done videos on this where I've talked about their implementation. I actually liked it Yes They actually have the full version of open VPN that you can use a rolling to TPN versus it's done differently in PF sense So nuance kind of matters to some people of if you're using TOTP authentication With those they implement it differently, but it is at least still open VPN very basic open VPN and it Seems to be that they've included more open VPN I've not done a lot of testing on here and it's only EA if you use the pro This is where unify can be very tricky to do this because the unify themselves do not list nice charts for features Across their firewalls that are easily found and even Cody from Actile Comp Network She does a lot of videos on here and being Cody we're talking and as Cody said You just have to take and read the notes for each version release and see what applies to your firewall And he's not wrong the unified does not do a great job of Nuance to figure out what features are supported and right now It's only on the EA as of April 1st of 2023 when I did my testing on this 48 does not have open VPN in there So post has a their own custom implementation of it and rocky does not either IP sec Yes, that is a paid feature on a Rista. So that's back to the licensing fees. You can only get it with the paid version Yes, they both have IP sec on the unified line 48 all the way across IP sec pretty popular Wireguard yes on pfSense paid on a Rissa Tangle. No, but yes, but yes, but is the way I'd put it on here Their wire guard implantation is a little bit confusing and I think it's also on their normal implementation They have their teleport version of it, which is designed to tie to phones But it's a little confusing and I don't it's not they're getting towards I know at some point when they hit full release here It's supposed to be like a more normal wire guard implementation So make sure it fits your use case if you're looking into one of these and you have a desire to use wire guard 48 does not neither does so post a muraki L2 TP once again paid feature. They do have this on the unifies Please note there are certain limitations with L2 TP is why it's not the most popular VPN But it is I should say not the most popular is a popular VPN But can cause challenges when you have two users behind the same IP address This is something that where you try to get a couple people VP and in you'll go wait There's some conflicts as L2 TP doesn't like when people come from the same IP address That is a problem you run into With home users and especially if they're in the same area provided by CGNAT for example can break things This is one that is a yes only for PF sense and someone may think I'm biased for putting honor But there's no denying tail scales popularity. It is grown Immensely, I know zero-tier is kind of a competing product That's I could have listed on here But it would just be no across the board zero-tier is not in any of these But tail scale with a lot of commercial backers and a really good product has become really popular I love that they integrated into PF sense. That's actually why PF sense chose that I know there's been request centers third-party ways to get zero-tier in PF sense, but Nonetheless, I've done videos on both zero-tier and tail scale. I think they're both great solutions It's just nice and I wanted to throw it out there that yes They are integrated in here intrusion detection intrusion prevention systems with PF sense This is going to be a manual process. You can load seracada to snort You can turn on all the rules you're going to get some false positives You're going to have to do some investigating how that goes for you This is something I've done a video on for tuning seracada But just so you know, it's not like just set and forget it and it just works And it's very automated with everything like the rule updates are automated You can buy pro rules and put them in there But it's still kind of on you to determine the threat investigation They've filtered the rules a little bit differently when you get them from arista on tingle So there's is I would say a little bit smoother because it's part of the feed you're getting from arista But there still can be some false positives depending on rule settings on there It's very basic inside the unify and usg series So they have it, but it's kind of basic Also, some people I'm a little fuzzy on exactly what speed penalties there are for turning it on This is going to be very provided based on the hardware you have With both of these ones here because you're providing your hardware 48 will have as well Meraki specs on turning it on and what the thoroughput would be with those features And sofos once again, if you're running on your own hardware Or if you buy the sofos boxes, you know, you're going to get varied amounts of speed hitting on that So worth noting I put content filtering and this is where people tell me but yes, it does have it I would not use it. We do not plan on using it Or this is why I don't do videos on how to set up squid or anything like that I think it's a headache. I think it's complicated to manage. I don't find it simple It always seems to have lots of bugs in it and requires too much management time So we just don't use it We use end point filtering for those of you wondering a tool called Zeros got a video on my channel for it Z or us Untangle does a pretty good job of it. They can do basic dpi or full ssl inspection But when it gets over here to like the usg, they're just doing dpi no ssl So there's no certificates to install. They do basic dpi inspection and That's about it The 40 gate sofos and muraki all have where they can do More advanced levels of it. They can get deeper into some of the application level filtering, for example PF blocker is probably really popular because you can use things like piehole feeds into it You can still run a piehole with pf sense or any of these firewalls if you want But with pf blocker you can choose the feeds. You can have it all in one device I don't use anything wrong with piehole project, but out of convenience If that's something you want to run having that built in is nice There's some dns level filtering you can do in there. It's really basic what dns filtering you can do in the usg udm pro 48 sofoso have it But I don't think you can put your own custom feeds in any of these models that i'm aware of could be wrong about that I didn't put an asterisk on it, but I know they have a level of dns filtering I just don't know if you can do custom feeds you can do custom lists Like you put things in there, but not the same as putting like a feed an active feed like you can in pf blocker Goip traffic filtering that is also facilitated through pf blocker. It's a feature in there There's a beta feature for this in the unify line Um, then we have 48. Yes. Yes, and sofoso. I'll have goip option Traffic shaping traffic shaping there is a lot of advanced options inside of pf sense for this same thing with the rest on Tangle it's a more of a basic honor off in the unit by line They don't have I don't believe any type of granular control. Maybe in the future I'll have something better on that. I but I would list it as there but basic 48 sofos morocchi. I'll have this Multi-wan support. It's always weird that this is a paid version of a rest on tangle needed for this But hey, if you want to use dual wan and do different load balancer between them That is a paid option for them. Of course in pf sense. I got videos on this It's Hard to put this without just an asterisk It's very basic the control levels you have over the usg and a udm series on this I wouldn't call it wonderful. I would call it usable, but you know They've gotten a little bit better over time with it, but it's still not as granular controlled As you have in like pf sense or even the other firewalls like 48 sofos and morocchi SNMP monitoring yes across the board that can be turned on all of them Active directory integration. Yes radius or ldap paid feature here They actually have a really nice integrator for this and the reason you have active directory integration Is usually going to be because you want to take your vpn authentication and your active directory users and pair those up So you're not managing separate lists of the radius both with the unify line and yes integration over here Policy routing lots of policy routing options very advanced ones within your pf sense. Yes within the entangle Yes within the usg But this is where it gets money in specifically like wire guard last I checked there was still no ability to do wire guard policy routing which is Kind of could be a challenge if you're trying to set up a wire guard site to site And you're like, but I can't do a policy route for that for a site to site So once again, you got to dive into the details of it But for ipsec for example, they do offer the ability to do policy routing with some of the ipsec on there With 40 gate and sofos they have it and I didn't put no wire guard here because well wire guard doesn't support it on the uxg So it's just yes But back over here to firewall rule policies based on active directory This is a fairly advanced feature but enough people asked on twitter that said throw it on there There's no way i'm aware of doing this at all in pf sense So if that's you know, you have ad objects and you have users And you want to apply based on the user based on some level of authentication a firewall rule policy based on that active directory object I don't know of any way to do that in entangle But you can do that in the uh arista no integration with usg But the rest of them do have this feature as well 48 sofas maraki hc proxy I bring this up Not to say that pf sense is cool It has it but also it actually is used very popular Especially not just homelab people but there's sometimes services that you don't want to have to deal with certificates for You can do this with the let's encrypt certificates which are listed below tie to ht proxy use it locally So you're not exposing it to the world, but you can if you want I've done videos on this using this to Have different local services managed without any certificates errors Throughout a internal network ht proxies are really convenient way to do that So I definitely think it's worth having in there Obviously this is no across the board with an interesting exception Thanks christian lempa for pointing this out that there's a web application type firewall So there's extra levels of traffic inspection you can do with their Built-in web location firewall for services coming from the external going through their WAF to come in there Technically I see no one 48 and someone may see but tom 48 sells a product that does that Yeah, it's just not their firewall It will integrate with it. So I almost put no asterisks, but just so you know firewall The firewall does not natively have something built in but yes You can buy another service from maraki and technically maraki is owned by sysco And there's other services you could buy to put in front of it But we're trying to keep this at least somewhat scoped Let's encrypt certificates. No I don't think there's any way I seen to do them in the iris untangle If someone has a document I overlooked let me know But without the proxy and I don't know if that really matters And usg nothing in there And matter of fact, I don't even know why unify has never integrated the Controller software either into let's encrypt seems like it would be really good to do I believe they even sponsor some of the let's encrypt things. Maybe there's a future roadmap or that is well integrated I hope so but today um, that's not in there For you can do this for the firewall I didn't see an ability to do it for anything else and no on the sofos or the maraki For those certificates, but the biggest reason you want to use them is you're going to be for h a proxy So I kind of tied those things next to each other together Captive portal might be another reason to use less encrypt Certificates, but yes, you can do this with pf since you can do the rista the unify controller software does the portal So whether you have that software Running on a udm pro or as a separate service on a cloud key or something self-hosted It's going to the controller. Technically not the firewall. So I made that note in there 48 yes sofos. Yes maraki. Yes traffic monitoring and reporting I really like n-top ng. It's great. It gives you a lot of great details on there. It's not a bad tool It's not going to be as advanced as I think the Arista might have a little bit better But this is also where you can get to uh be splitting hairs for what you really want How granders need to be is it adequate or do you want something That gives you like this user went to this website and summary reports the uh, Arista reports are nice for that Unify and the lack of good time slicing means yes, it gives you information But it's a little bit harder to digest. So I'll put that on there that it has it the graphs look really well presented But the granularity of them not being good makes them a little bit harder to read But the it's checking the box that it has them a 48 sofos and maraki all are yes Now one thing missing from that feature's list was vlan support the answer is yes across the board So I added it to the list. So if you click that chart, you're going to have it on that list Next i'm just here to provide some data points. I'm not here to be your decision point I'm not saying these are the only firewalls you can use or you must use pf sense because I have a lot of videos on it Ultimately, I just wanted to provide some insight to things we've done things We've worked with things some of my friends have worked with and as I said christian lumpa really likes sofo sex g I have a few it Manager friends that really like it and so I included on the list even though I don't directly use it But hey, uh, he's got a video on it so you can dive into it And I know he said he's creating some more videos on it as a topic So depending on the future when you're watching this there may be more videos linked Over to his channel on that Unify is one more to bring up because I think unify is a good moving target for improvement They keep getting better They've somewhat invalidated my video about the weird way unify does vpns because they're getting better proper vpn support And maybe We're watching this video or you're watching this video in the future where unify has made a nice chart So I don't have to chase down like release notes to figure out if they're implementing the vpn in a normal way Or they've tied it to some other service like uid to be able to get it to work As I said, I'm hoping in the future they just do it normal and make a nice chart So we understand what support on which products exist But nonetheless that can make unify a little bit challenging for routing I think they work great like just for basic routing functions But the vpn is awesome where people get hung up hoping it will do something and finding out unify has done it Slightly different. This is always that nuance challenge you have with any of these firewalls is Having support for a feature versus how they implemented and how easy that feature to use can be Varying a bit. Nonetheless, I love hearing from you. Leave your thoughts and comments down below as to which firewalls You like which one's your favorite? I'm always curious. What else is in the market? I try to keep an open mind looking at different things Head over to my forums for a more in-depth discussion on this topic or any way anytime you want to engage with me And thanks


Hello, I'm Art Salazar of U.P. Los Baños, Scholar of Agriculture Institute of Plant Breeding. And my project is on corn. We want to be as a nation, we want to be an economic tiger. But a tiger has to be strong, being a tiger, and yes to it. And that's where our concern is. So we even think of becoming respected and feared nation. We have to have a good foundation in terms of food and nutrition security. Data would show that the incidence of diabetes in the Philippines is alarmingly high. It's higher than the world's average. And also, we are importing a lot of rice. We are one of the biggest, if not the biggest rice importer in the world. And it could not go on this way. Before we think of being really an economic tiger, that's what I said, we have to address these issues. And our project on a simple thing, a scorn, will help towards that. Because in terms of our rice importation, our rice importation is only 10% of annual rice requirement. So it's about 2 million tons. And also, corn incidentally is a low-glycemic index food. It's staple. And so if you eat more of corn than rice, then you'll have less chance of diabetes. And if you are already diabetic, then you could manage your blood sugar. So it's a simple thing. As what I said, it's just corn, but I would say it's a miracle food. And it's here. It need not be imported. It's grown by our Filipino corn farmers. And the amount of foreign exchange that we'll be saving is about 25 billion pesos worth annually. If that amount of money will be circulating among our farmers, that's a lot of money to get by. And it will be the springboard for economic takeoff. And so our work is really investigating and finding out best way how to promote the adoption of corn in the Philippines. And we're looking at the blending of rice and corn. And we found out it's best to consume it taste-wise, 70% rice and 30% corn. And so if all the Filipinos in general will be consuming 70-30, we will be exporting rice the next day. Because we only import 10%. And also we will reduce the rate of diabetes. So our advice to our compatriots in Desayos in Mindanao, go back to corn because the consumption of corn in the south is decreasing. And for our compatriots in Luzon, increase the intake of corn, put more corn into your diet so that we'll have less need for rice. And that way, then we could move on. A person who is hungry and who is diabetic will find it hard to think, will find it hard to create. So it is the foundation for the growth of our nation para sa isang malusog at busog na bayan mais.


Hey there friends, thanks for checking in. This video is sponsored by the Big D Bag, otherwise known as the Dude Bag. It's a monthly subscription from a veteran-owned company for people who love the outdoors, and here's an example of what each D Bag will include. $112 minimum worth of product in each bag. Now if you use TFG in the discount code, you'll get an additional item in your first bag. If you go with the quarterly subscription, you'll get this Delco knife priced at $200. It's solid as can be, and it has a leather sheath. Go to thebigdbag.com. Now let's get to that video. Hey there friends, thanks for checking in, and welcome to another video in my series called One Handgun, One Shotgun, and One Rifle. The handgun that I'm featuring is a Grand Power X caliber. What a fine handgun this is. A full-size race gun with a 5 inch fluted barrel that is very nice. The barrel rotates when firing, making for softer shots. Full ambidextrous thumb safety, slide stop, and magazine release. 15 round magazines, lightning cuts in the slide, fiber optic front sight, adjustable rear sight. It does have an accessory rail right there, and a trigger that measures right around three and a half pounds. It's pretty incredible. I love this handgun. I always have. I love the Grand Power models. This is the main baby in the Grand Power line. This is it, the X caliber. I've had it for about five or six years now, and I love it. So let's go ahead and take a few shots. I've got some cheap reloads in here, so we'll see how they do. And just as I thought, with those cheap reloads, it didn't lock the slide back. A little underpowered, but that's okay. Hopefully you got an idea how fine this handgun is. Excellent trigger pull. I mean, it's amazing. I love it. Grand Power X caliber fine handgun. Now let's get to that shotgun. The shotgun that I'm featuring is a Rock Island Armory All Generations 12 gauge pump action shotgun that was just released. It's a nice shotgun for an MSRP of $2.99. Check out that stock. It does have a cheek riser right there. You can adjust that to your liking. Thick rubber butt pad there. Pump action. Very nice. Has some slots there to offer a strap if you decide kind of mag polish. 18 and a half inch vent rib barrel, bead front sight, serrated rib on top. Five plus one capacity. It will chamber three inch loads. I showed that with my review, my range review that I use turkey loads that were very tough, but a nice shotgun. I'm very much impressed with it. Aluminum receiver. It's called the AG All Generations 12 gauge action release lever right there next just in front of the trigger guard. Let's go ahead and take a few shots with this. New Rock Island 12 gauge. Very nice. I'm impressed. I'm not on even ground if you see me slipping around. I'm on uneven ground, but there it is. Very nice shotgun. Now let's get to that rifle. The rifle that I'm featuring is a Delta Sierra 316L optics ready with a 15 inch M lock handguard. You can see I have a Magpul AFG there, but I changed out the stock to a thrill stock and the grip to a thrill and 30 round magazines made by thrill as well. It's an excellent rifle. I put quite a few rounds through it already. It's been performing great. I'm really happy with it. The optic that I have here is a vortex three times magnifier and a vortex spark that is solar powered. So it does have a battery, but it's also great for a day like this when the sun is coming in. I'm about 70 yards away. Let's take a few shots. I've been super pleased with the setup. It's performed great and I plan to do quite a bit more with it. Thanks for watching another video in my series called One Handgun, One Shotgun, and One Rifle. If you like videos like this, please subscribe and share. I always appreciate thumbs up button. Thanks for watching and you guys be safe.


Well, good morning everyone. Welcome to morning prayer. So good to have those of you who are here live in the room with us. And we also want to welcome those of you who are joining us from home, wherever you're at today. We have an invitation to make this moment a prayer room in and of itself. So if it's in your living room, this is sacred space. And if you're here in the prayer room, this moment is sacred space. And what defines sacred space is not the four walls, but it's our full attention. And so I want to invite you that over the next hour or so, we're just going to give God our full attention and our full span of attention.  Psalm 71 verse three, David's praying this prayer. And he reminds the Lord, he says, Lord, be to me a rock of refuge to which I may continually come. You've given me the command to save me for you are my rock and my fortress. God is our safe place. And the invitation that the Lord gives us is to not just come to him once. But David said, you're a rock that I can continually come back to. This can be the rhythm and needs to be the rhythm of our lives is that in the midst of every season, whether it's storms or victories, mountaintops or valleys that we have a rhythm of coming back and finding our secure and our safe place in his presence. David, one of the things that he did in every season of his life was he worshiped God. David wasn't a man who worshiped. David was a worshiper. Just who he was. It was his identity. That's what we were created to do. We were created to worship the Lord long before we ever minister to anybody else. Our first ministry is kings and priests before God is to minister to his heart. There's something in our God that loves and is blessed by us willingly choosing to give our full attention and our worship to him. So that's how we're going to start this morning. This is why the Bible encourages us to enter in through his gates with thanksgiving and into his courts with praise. Our worship gives us access to his presence and our worship blesses the heart of God. So wherever you're at including this room you're living or might as well encourage us let's lift up holy hands this morning. Jesus with holy hands lifted up without wrath without doubting with our full attention span. We approach your throne of grace today by the blood that Jesus shed for us. Not by our works, not by our own qualification but because you placed the holy ephond upon us and called us priests before you and invited us out of darkness into the marvelous light of your presence and we're here to bless your heart. We say to our own soul, bless the Lord, oh my soul and all that is within me bless his holy name. Today we come to worship the living God. We come to let our breath and our words not be filled with criticism or fear or trepidation or judgments but seasoned with worship directed at the one who's on the throne. We say glory and honor and praise and dominion and might and majesty and all worth belongs to you Father. Beautiful and elevation, glorious, exalted, wonderful Savior. Jesus. All right now just fill your mouth with exaltation with praise, with praise. Event that's taking place in Grand Rapids on Saturday, it's an unprecedented gathering not just in Grand Rapids but really in the region as part of what God is doing across the nation and mobilizing, unifying and mobilizing the church, the body of Christ especially young adults towards the mission field, the great commission to prayer to the presence of God, fueling the great commission and so they're going to be gathering Saturday Grand Rapids at the van and I'll really have an anticipation and expectation that God's going to do something that's going to shift and it's going to change a generation and a region. What you join with me is we pray today Father we pray over the send event that's coming up a focus and a theme that you've marked in this time period in this season Lord across this nation, an hour of urgency and an also an hour of maturity Lord where you're pulling the attention of your church back to you, back to the first love and Lord mobilizing a generation of young adults who would give their all and say here am I send me, send me to the hardest places, send me to the four quarters of the nation, send me to my culture, send me to my college campus, send me to the most difficult cities in America and Lord in a age of intimidation and fear for so many people are for so many reasons are afraid to share the gospel or apotheos set in to our spirits that has kept us from being concerned for those who've never heard the gospel. A heart has become hardened because as long as we've got it that's all that's necessary Lord would you this weekend on Saturday do something significant do it from West Michigan Lord Lord how many prayers have been prayed over West Michigan how many intercessors have walked the streets of Michigan and walk the streets of Kalamazoo and Grand Rapids and even beyond and asked you Lord to spark a movement to spark revival Lord we've seen shadows of it and we've seen tastes of it but Lord we want the whole thing and so Lord as you're gathering people from Toronto and Ohio and Indiana Wisconsin and Michigan in one arena in one place across the spectrum of denominations church backgrounds and even ages Lord we're praying that you would come as the wood is being assembled on the altar and the stones are being put in their proper order Lord none of it matters if fire doesn't fall from heaven on the sacrifice so we're praying as it's all aligned in this arena Lord we don't see this as an arena we see this as an altar and we're praying with thousands of people gathered in this altar at the send on Saturday Lord that you would fall with fire of your presence upon the altar upon the arena Lord and let your presence and the fragrance of Jesus let it be known let it be manifest God Lord that you're gonna come and you're gonna speak with clarity Lord you're gonna give dreams and visions to people that are gathered there that are gonna see for the first time their place in your call Lord I'm praying that you would stir the hearts of pastors that worship songs are gonna flow like waves over your people they're gonna flow like waves up and down every aisle in up in the bleachers and through every seed and through every crevice of that arena and Lord it's going to get on every person that's gathered there and it's gonna be multiplied by a hundred fold because of the people that that are there who impact a hundred or more people outside of that arena that this would be an occasion Lord that marks a generation and marks a region becomes a spark that ignites something significant in this generation in this region Lord we're lifting up Andy Bird and his team right now who are in the final days of preparation that are reaching out to churches with a sense of urgency to get people to gather Lord we don't want to just see numbers there for the sake of numbers but Lord we don't want anyone to miss out it's like the hundred and twenty in the upper room Jesus we don't want anybody to miss out on what you're about to do so Lord I'm praying for Andy for strength and endurance praying for favor and for wisdom over him right now for his team Taylor and for circuit riders worship and all the pastors and the leaders and the speakers Dr. Michael Brown and Brian Barcelona Kerry Job and Cody cards that all the different radiant city worship that's gonna participate Lord we're just praying for unity we're praying for anointing we're praying for strength praying for authority we're praying for clarity we declare Jesus you are Lord of West Michigan but I want you to declare that Jesus you are Lord of West Michigan your Lord of the Great Lakes region Jesus come and have your way tear open the heavens and come down sin fire of your presence God Jesus we just bind every satanic strategy of division you know how the enemy work and that religious spirit that wants to get a hold of a region and tear it apart right now we're asking that even as the enemy may come in you like a flood would raise up a standard against it oh God and that you would pour out a commanded blessing as brothers and sisters gather from multiple denominations we gather together in one place to lift up the name of Jesus and to see one mission fulfilled the Great Commission in that moment that the oil of your unified blessing a commanded blessing that cannot be thwarted would be poured over gathered in one place Lord we're praying that the praises that are gonna come out of that arena even though they're loud to the natural ear we're praying in the spiritual realm that they are piercing to the darkness that long principalities and powers of religion and legalism and arrogance and pride are gonna be broken once and for all and open up a window for heaven and for angelic ministry to be released on the streets of Grand Rapids and Southwest Michigan in a way that they've never been before we're praying that praise is gonna fill the streets Lord you said that if there will be prayer in my house there will be praise in the streets and we're praying that mighty rushing rivers of worship and praise of the anointed one are gonna flow through Monroe and down Division Avenue and 131 and m6 and 96 up and down north and south east and west throughout Michigan and along I80 corridor into Chicago Madison Wisconsin and Milwaukee and Toronto and Detroit and Toledo and Cleveland Lord that there's gonna be an outbreak of passion for Jesus because of the praises of your people come on let's ask for the Lord to release a unified blessing I want us to just put our eyes Jesus you are glorious access before you or that as we worship you draw near to you chose to love us unconditionally or today would you open our hearts even wider to receive more this morning if you have your Bibles I want you to open with me to second Thessalonians we're gonna pray for the next few moments out of this apostolic prayer this prayer that Paul prayed continually for the church specifically the church of Thessalonica verse number three of chapter one second Thessalonians Paul says we ought always to give thanks to God for you brothers as it is right because your faith is growing abundantly and the love of every one of you for one another is increasing therefore we ourselves boast for you and the churches of God for your steadfastness and faith and all your persecutions and any afflictions that you are enduring or today we join our hearts to this prayer this desire that you put in the heart of Paul but more importantly you recorded in the pages of scripture for all times for us the saints of God to be able to see this and know that this is the longing and the desire of your heart for us and so Lord we're praying it back to you today not because you don't know what you've already said but because we're asking you if this is the longing of your heart for us then God would you do it in us but we want this to become a reality we want this to become the moorings of our heart and in the places in the moments and areas of our heart where this is not a reality we just repent before you and invite you like the gardener to come and to break up the fellow ground you said in your word in Hosea you said break up the fellow ground for its time to seek the Lord and we want our heart packed down soil of our heart that has become hardened because of the heat and because of the seasons of life that we walk through Lord we don't want our hearts to remain hard our love to grow in a bound so just as these scriptures say Lord you say that our faith is growing abundantly Lord we're asking that you would grow our faith that Lord you have said in your word that the just shall live by faith that we walk by faith and not by sight today just as the disciples said Lord how how do we grow in our faith you said if you have faith like a mustard seed a seed that's planted a seed that grows a seed that expands or today look at our faith look at our trust that we have in you and Lord would you expand it we want our faith to grow faith comes by hearing and hearing by the word of God Lord would you stir a hunger in us for growth Lord would you provoke us that where we're at is not where you're taking us let Lord that there's more for us we want the mustard seed of wherever our faith is at to we wanted to grow Lord that only happens when you water when you breathe upon it Lord when you stir the hunger and as you said that if we hunger and thirst we will be filled you said if we seek we'll find we'll knock the door will be opened unto us if we ask we'll receive and so we're asking Lord would you take the seed of wherever our faith is at today and a water and by your Holy Spirit and begin to provoke us and challenge us and stir us that our faith might expand that our trust in you might continue to grow so that we can go from faith to faith and from glory to glory and from strength to strength just as the man said to you he said I believe help my unbelief Lord today would you help our unbelief cause our faith to grow abundant with status quo we're asking you father the great gardener to prune every area in our life where there is not fruit so that our faith might continue to grow abundantly more than those areas of our life that are stealing the life from the vine Lord would you prune so that we can bear more fruit Lord we're doubt and unbelief and disappointment and discouragement and vain imaginations have controlled our lives Lord help us to renew our minds then we might believe you that we might grow in faith abundantly if they just live by faith then Lord we want to live more we want more of your life in us we're not content with just making it to heaven Lord we want here on this side of eternity our faith to grow abundantly Lord I'm praying for every student that's going back to school this year Lord elementary school high school and college that the tactics of the enemy to deconstruct their faith would be turned upside down and Lord that there would be a Shadrach Meshach and Abenigo a Daniel calling upon their lives to grow abundantly in their faith even in the most difficult soils even where the enemy has planned to tear down Lord we're asking for your help to build up that Lord you would raise up young people that love you know you and do great exploits Lord for every mom and dad who now have that they could do all kinds of things in the morning Lord we're praying that this would be a moment where they would say God I want to grow abundantly in my faith I want to take a deeper a deeper perspective of the kingdom of God I want to join a group I'm gonna take a class I'm gonna start a small group I'm gonna get into the word Lord stir hunger in us beyond status quo and beyond apathy and just getting by so that we might want to grow abundantly and become spiritually mature that we bear fruit that brings glory and honor to your faith that is in measure would become a greater measure just hear the invitation of the Lord saying how much do you want how far are you willing to go how abandoned are you willing to be to come after me it's like the Lord saying there's an ocean before you how far do you want to swim out there's more than you could ever imagine there's more than you've ever experienced can you can't out pursuing we want more that faith to grow into love for one another you said the love of every one of you for one another is increasing Lord let this be our testimony Lord that our love is expanding as our faith is growing our love of one another not just with the cheap words not just with the outward appearance but Lord that our hearts genuinely faith is growing hope is rising love is being expressed Lord let the love that we have for you grow and let the love that we have for one another increase the God they kind of love the God kind of love the love that overlooks wrongs done the love that sees the weakness and still also believes in the potential the love that loves beyond differences the love that wants the best the love that keeps no record of wrongs done that always believes the best that's patient it's kind Lord we want that kind of love to increase and let it mark us you said in John 17 that Lord that when we're one that the world would see that you really are the Son of God we want the world to look at the church and see faith hope and love that our love for one another it's not like the world Lord where there's competition and comparison and vengeance and pettiness and gossip slander and divisions the Lord would you unite us Lord would you allow our hearts to increase in love for one another today help us to love like you'd love us you would release them back into our lives with power that the door of our prayers would be thrown open in your resources and the greater measure of faith help and love would be released in us and then it mark us as your people Lord that not only is this the longing of our heart it's the longing of yours so Father let it be done in our lives today in Jesus name hey everybody say come on listen we want to thank you for joining us this morning invite you back today at noon and tonight at 6 30 p.m. down here at the Radiant City Center we're from the heart of our city morning noon night praise worship and intercession is rising up so thank you for being a praying and worshiping church we look forward to seeing you later


We're good to go. Hi, everyone. I am Rudra Roke. I'm part of the engineering team at Contrail. And today, I'll be talking about Kubernetes and OpenStack, and in particular, how OpenContrail networking helps solve the container pod bare metal solution in an OpenStack environment. So the environment today, where you have a Kubernetes cluster, as we saw in the keynote today this morning, there was a Kubernetes cluster that was started on an OpenStack environment.  And you have an OpenStack cluster. The Kubernetes cluster has its own network plugin, either through the CNI interface or the KubeLit plugin model. Then you have OpenStack with its own networking model through Neutron plugins and essentially also supporting bare metal in the OpenStack environment. So you have these hybrid networking environments sitting in a single cluster. And they're not really able to talk to each other. They're really isolated in terms of management and overlay and nesting of the network.  And hence, the whole issue of securing these makes it quite complex. To this end, the Contrail solution provides a single network controller for your hybrid workloads. So whether you have OpenStack VMs running or you have a Kubernetes cluster in an OpenStack environment, the pods in that environment, as well as bare metal servers connected to this environment, all of them can talk to each other with a single network controller, which is the OpenContrail controller. Since we are running Kubernetes in VMs, you could potentially have forwarding happening in the kernel module of those VMs. In addition, there's the servers with their own forwarding module through Neutron plugin. In such nested environments, you're really living in an isolated world. And OpenContrail solution solves by bridging these two together through subinterfaces. The other benefit that we get is you can actually create a network which can span across Kubernetes, OpenStack, and bare metal. So we can have a virtual network where you can have a pod, a virtual machine from OpenStack, and a bare metal server all talking to each other as though they belong to one single network domain. Because of this seamless implementation with OpenContrail, you are able to provide better security policies. You're able to control how your apps can talk to each other.  Also helps you provide monitoring and analytics, essentially, to troubleshoot this complex hybrid workload environment. So let me start with just key components of OpenContrail, which most of you must be familiar with. We have the notion of virtual networks. In this example, it's red and green. These are two isolated domains. Any workload you launch in each of these domains cannot talk to each other unless you create a policy and you connect the networks to each other. Once you connect the networks based on a protocol port saying these two networks can only talk on this protocol, this port, you can even insert a service saying green network can talk to red network through a firewall service, which could be provided by a virtual machine or a container-based firewall. So this network policy is an abstraction that allows for connectivity between virtual networks. Contrail also has the notion of interfacing with physical gateways. Unlike the need for instantiating a software gateway, Contrail can directly peer with physical gateways such as MX and connect your overlay or virtual network to the physical world. We also have layer four load balancers, which are ECMP-based load balancers. So you don't really need to terminate your TCP sessions. You can instantiate a load balancer, and it will do a five-touple-based hash and distribute the traffic. In addition, we do full proxy-based HTTP load balancing as well. So if you look at the overall architecture for Contrail, Contrail as an assistant solution can work with many orchestrators and, of course, OpenStack being one. We have homegrown orchestrators with some of our customers. It works with Kubernetes, works with vSphere. The Contrail controller listens to any network object messages and then goes ahead and instantiates those objects either in a physical gateway or in top of the rack environment or to a bunch of server nodes through XMPB connection. So what I'm getting towards the second half is a demo, basically. And this is kind of what the building blocks for the demo are. So we have two networks. We have a green network and we have a red network. There's a bunch of pods that have been spawned on the green network. And the red network has other Kubernetes pods as well as some virtual machines and some bare-medal servers. The green network can talk to the red network only through a service chain in this example. And the service chain could actually have multiple services in the chain. It could have a load balancer. It could have a firewall. And the load balancer members can be pod members, bare-medal members, or virtual machine members. The red network can go out to the internet by peering with an MX gateway. So that way you have internet connectivity as well for the red network. So what is the Kubernetes deployment model typically used in OpenStack?  So in this case, you see the three virtual machines which are launched. And each of them is provided a Kubernetes role. One of them is a Kubernetes master. And the other ones are Kubernetes nodes. And nodes are where the Kubernetes pods get scheduled. And that's where they're on. So pods could equate to one container or multiple containers in one environment. To support a contrail in a Kubernetes environment, we've added a couple of things. There's something called as OpenContrail Cube Network Manager in the master. We listen to all API and scheduling messages from the Kubernetes API server. And based on that, we create all the contrail resources that are required to create a virtual machine, a virtual machine interface, what network should it get plugged into. And then on the node, we have added our plug-in. In the past, if you went to Kubernetes 1.1, we used a Cubelet plug-in model. But now with 1.4 Kubernetes, we are moving to the standard-based CNI plug-in model. So on each of the nodes, contrail plug-in will get launched whenever a pod gets scheduled on that particular node. I'll come back to this later, but this is essentially talking about how a bare-metal server gets connected to the whole overlay model through an EVPN mechanism. So as part of the demo, we can see that there's L2 MAC address-based routes which are pushed to the QFX, which is atop of the rack. And we have a VXLAN endpoint from our V router going into the QFX. This is kind of our demo setup. And we have two compute nodes. So these are two OpenStack compute nodes. We have one control node. What you see in blue is a Kubernetes cluster. So we've launched three VMs, which form the Kubernetes cluster. There's a master, and then there are two nodes. The contrail Vrouter kernel module, which is responsible for all the forwarding, it's running in the Kubernetes node VMs, as well as it's running underneath on the OpenStack servers. So if you notice the two compute nodes, you'll see that two levels of V routers are there. Although you look at it, and it seems like it's a nested model, but we are plugging in subinterfaces directly from the upper level Vrouter to the Vrouter on the server and actually eliminating and just bridging the traffic through. And the forwarding and all the route information is sitting only on the lower kernel module. Coming back, just to give an example here, we have two green pods, two red pods, which are all on the Kubernetes cluster. We have a green VM, which is actually in, it's an OpenStack VM. And then we have a bare metal server, which is sitting in your data center, but it's pulled in into the red network. So you have two pods in the red network and a bare metal server. We have two green pods in the Kubernetes environment. And we have a network policy to make sure that the green network and the red network can talk to each other. So the end of the demo, hopefully, I mean, we have a recorded demo. We'll see that everybody is able to talk to each other, whether it's bare metal server, a pod running in a Kubernetes cluster, or a VM in OpenStack environment. So I'm going to switch to the video. Is there any? Yeah, is it switching? You can't switch the video. Looks like we're not able to switch to the video here. Is there any way? All right, that's good. OK. So here we have a Kubernetes cluster, which has been created. So we've launched three VMs. And they are running on the two compute nodes that we have, compute node one and compute node two. There's a master and two minions. They have been launched on a base network, 190 to 168.1 subnet. So we have these three VMs that are running and creating a Kubernetes cluster. Now, on the control side of things, we can see that we have two compute nodes which are represented by virtual routers. And we have roles such as analytics, database, config, and control to manage, act as the controller for control. Looking at compute node two, we can see one of the minion VMs is scheduled there. And the other compute node will have the Kubernetes master and the second minion scheduled there. We have three VMs which are running our Kubernetes cluster. Now, if you go into the master, we can actually see that the minions are ready and good to use. Just to ensure, we will check the port connectivity between the master and the Kubernetes nodes. So Kubernetes master listens on port 8080 for connections from the minions. And the two minions are connected to 190 to 168.1.3, which is the master. In this case, now we're going to launch a pod in the green network. So we have, as I mentioned earlier, we have two networks, green and red network. Sorry, we are launching the pod in red network. And what happens at this point is it gets an IP address from the red subnet, which is available even for your OpenStack VM networking. So 10.10.1 is our red subnet, and 10.10.2 is our green subnet. And we can see that when you launch the pod, we have a networking interface which has been created in Contrail, which is 10.114 is the IP address of the pod. Now, the important thing to notice here is it's also been plumbed into the lower vRouter. So as I was talking about nesting of vRouters, the plumbing has also happened on the lower vRouter through a VLAN subinterface. Now, the next step is to look at the Docker containers. It's all running. Now, we'll go ahead and launch another pod in the green network. So the red pod is running in the red network. So now, these two pods are essentially in two isolated networks. So they should not be able to talk to each other. One has a subnet 10.10.1 slash 24. The other one is 10.10.2. They are completely isolated pods within the Kubernetes VM. We can see here that both these pods are connected and the MAC addresses have been plugged into the MAC VLAN driver of the Kubernetes VM. Now, we're going to try to ping from the green network to the red network. And it makes sense, since these two networks are fully isolated domains, they shouldn't be able to talk to each other. Contrail network policy is the fundamental construct to allow traffic between networks. So we're going to create a policy saying, any traffic going from red to green network on any of the pods, we are allowing bi-directional traffic. Now, once we create this policy, we need to attach this policy to both the green and the red networks. And as soon as we attach the policy, we can notice that the traffic will actually start flowing between the two pods on the Kubernetes cluster. So this is something that's just working on the Kubernetes VMs. Now, to bring it down one level, the next phase is to essentially try whether these pods can actually talk to Kubernetes to an OpenStack VM. Now, this is all our UI where you can see how the policy connects different virtual networks. We have red and green connected through the red, green allow policy here. The packet in and out count, we have all the analytics. As I had mentioned earlier, there's a concept of subinterfaces to eliminate the nesting of V routers. And you can see that here. The next example is, how do you connect these Kubernetes pods to a VM in OpenStack? To go through that, we'll go ahead as step one, find if there are any NOVA VMs running. We go ahead and launch a NOVA VM in the green network. So essentially, because we have already created a policy to connect red and green networks, any pod, whether it's in the red network or the green network, should be able to reach this virtual machine. So we got an IP address from the 10.10.2 subnet in this case. And we'll connect to that VM through the link local interface. And it has the IP address, as I said, from the green network, which now we want to try to launch a pod in the red network and try to see if the pod is able to talk to the virtual machine. So here we're going to launch another pod. We already have two pods which are talking to each other. But for talking to the VM, we'll go ahead and launch one more pod. So in this nested environment, the traffic is going through the subinterface. So this is a red pod, which is going to be able to talk to your green VM. So a 10.10.1 network is actually talking to 10.10.2 OpenStack VM. You can see that this is the OpenStack VM. And then we had all the pods which are running inside these VMs, whether they were red or green pods. And then we have actually a VM in the green network on the OpenStack cluster directly. But they are all sitting in the same network and or they're connected through policy and they're able to talk to each other seamlessly with a single SDN controller, single SDN networking notion. So again, we have a few analytics pieces of information that you can look into. You can look into stats and other things. But let me quickly jump to, we have only about a minute left. The last example that I wanted to show was how these pods can also talk to a bare-medal server sitting somewhere in your data center. The bare-medal server is connected to, so this is a bare-medal server VM that we have pod that we're going to try to talk to. The bare-medal server is sitting in a network which has pushed a MAC address to our QFX. And then the QFX also has another arm into the open-contrail networks through the VX LAN tunnel. So essentially, we have extended the whole network into the bare-medal as well. And now what we are trying to do here is trying to ping from the bare-medal into one of the pods, which is 10.10.26, which is a green pod in the Kubernetes cluster. This is essentially trying to show the MAC address information that is being shared in terms of the next hop. I would like to end the demo with, since we are a little short on time, essentially we have the Kubernetes minion with one of the pods here. We have a virtual machine in green network, and we have a bare-medal in the red network. And we are pinging from the pod the bare-medal server, from the bare-medal server, one of the pods, and from the green VM, another pod. So you have complete hybrid workloads running in OpenStack VMs, bare-medals, as well as Kubernetes pods. And all of them are able to talk to each other just by the creation of two networks in contrail. And the overlay is connecting everything in our case. So with that, I would like to thank everyone. OK. Yeah, east-west, yes. Sorry, we can, right? I mean, you can create more networks to do microsegmentation of any kind. So you could do, in Kubernetes, we could deploy an app-level segmentation, and that would actually essentially isolate everything based on services within a Kubernetes app, as well, yes. We can do layer 3 connectivity with a VPN connection that can be achieved, yes, across data centers. I don't believe we need to do that, but VXLan, in our case, is used only for bare-medal reachability. Outside of that, we use other mechanisms, mostly layer 3. So in our network policy, you can have two networks, and you can insert any service in between, be it security, a VM which gives you security. You can have a VM which gives you load balancer services. We can service chain, yes.