Welcome back to the Wheel of Hutt. Yo, what's going on? Leaf finish and sleeper back again and welcome back to the channel. Today, we're here with episode three of Wheel of Hutt and we moved the board before we had open 10 packs up here. So I twisted it around. Maybe just maybe we'll have some luck to get some 10 packs today. We have some amazing content out, which I can't wait to show you. But before I show you the content, we are going to spin the wheel for the first time to see what we have to do before we hop into our first game of the episode. All right, so we ended off on one pack last time. Let's hope for some more. All right, here we go. Spinnin' the wheel. What are we going to get? And it's back on open one pack. OK, we'll take that. Now, the reason I'm OK with one pack is because there are some crazy packs out in the store. But let me show you the content that is out. There is a new event out called Prototypes. You got these 86 overall cards. You got Marner. You got Brady Kachuk. You got Heesher, Goudas, and I believe that's Devon Taze. Then you also have these prototypes as well. Caroline Harvey, Rick Nash, Jay Bollmeister, Chris Draper. OK, and then in fantasy, we've got the fantasy cards. So plus one overall for every goal scored forward, plus one overall for every goalie winner shutout, plus two overall for every goal scored as a defenseman and only regular season game counts. We have a bunch of fantasy hockey cards as well. As you can see here as well and a crazy team of the week. Eighty seven, Austin Matthews, eighty six. I'm getting milk and eighty five Patterson, eighty five Hughes, crazy content. So now in terms of the packs, let me show you what I was saying in terms of the crazy pack. So I think I would know what I want to open. And it's going to be this prototypes greater chance choice pack. You have a total of 15 players over five rounds. So it's a choice pack with a greater chance of pulling an eighty six overall. So you have an eight point eight percent chance of pulling an eighty overall. Here you got a one point seven here. I mean X one times greater. I don't know. You have one goal player with a greater chance of pulling a hockey fantasy card. OK, that's pretty cool. So with that being said, I think our best pack to open is this prototypes greater chance choice pack. We get one of these. Let's see what we can get in this pack here. We're hoping for something juicy, man. Our first purple, maybe. Who knows? Payton Krebs, Brian Dumalin, nothing to help the team. Jamie Lee Rat Ray actually might help the team. She's actually fast as hell. So that's actually a pretty good pull. And Freddie Anderson, so you know, we'll take the gold tenders and then we'll take Payton Krebs because he's going to be a young star in this league for a long time. All right, Kevin Lankinen, Connor Ingram. Oh, OK, not a great round. I mean, I guess we'll go. It doesn't really matter, man. We'll just go highest overalls kind of thing. Second round didn't treat us that nice. It's OK. Third round, Darnell Nurse, which actually will help out the defense, so I'm probably going to take him. Chandler Stevenson, OK, Dmitri Orlov and Ryan Johansson. So I think we're going to go nurse Stevenson and Ryan Johansson. I think a couple of guys will make the team. Fourth round, Renetta Fast, OK, good defenseman there. Adam Lowry and Alina Mills and Nick Bonino. OK, so we'll go with those. I don't know if any of those guys will make the team. Last round, give me an 86 plus here, baby. Cam Talbot, Sunquist. Oh, no. Oh, this pack was brutal. Oh, what a bad. I got to go back and look at these odds real quick.  What were our chances of getting an 84 plus because we didn't even get one of those, man. That is crazy. That that's not great. That honestly, not a lot of that's going to help out the team. I'm going to be honest with you guys. That's not a good look. What were the odds? 83 plus was an 86 percent.  So we're going to end up losing Jake Muzzin with Darnell Nurse coming in. He played one game with us and he's already out the door. And then Kevin Shadenkirk is going to get the boot for Renita Fass. I'm going to keep her on the third pair. She's five, six, one, forty three. Like she's probably going to get bounced off a lot. We'll try her out. It's an 83 overall. I kind of want to keep the big boys at the at the front. So we'll put her in there for sure. And then Harvey Pinar is going to be coming out for Jamie Lee Ratray. Crazy name. Carl looks pretty good. We do lose playmaking forward, though. So that's going to be interesting. I got to find a way to get that going. She does look pretty good, actually. OK, let me see what I can do to get playmaking forward activated here. Hold on, boys. OK. Ryan Yohansen is going to be coming in for Daniel Sprong. This actually works out better overall. He's going to get playmaking forward activated. The team's looking all around a little bit better here. Not too bad. So I believe we are in div three rivals. If I'm not mistaken, we are. So I think we're going to go up against some good teams here, boys. I'm a little nervous. Also, as you can see, I forgot to mention the coin totals up. Why is it up? I've been opening up daily reward packs, the daily packs. So I've been getting coins out of those. That's why we're up to 10.9 K. All right. What are we going up against first game? John Belivow at an 87. Braden Point and Artemy Panarin. Looks like he's got a pretty good squad. That Belivow is going to be interesting to go up against. Oh, my God, this guy's 74, 47 and eight.  We're 40 and one. So that's interesting. We'll see how this goes here. So far, Nurse is looking good. He's controlling a lot of the play in his first shift. We like that. Oh, no, we're going to burn to here and we're going to get stuck. Nurse is going to cover the pass that gets through. I don't know how Nurse doesn't get like a foot on that or anything. He's got X Factor, Yosi and Point. Jack Hughes makes it one to nothing. We're down one, nothing early, not a great start. I don't know. We got to clear our way through. This guy's played a lot of virtual hockey. Oh, my God. Let's go, Gino. No one's knocking you off the puck, bud. Take the shot.  I think that might have trickled off the post, too, if I'm not mistaken. Good effort there. Belivow, Shandirzi. Good defensive play. Let's go over to Z. Here we are. Low shot rebound. Oh, it's a good deflection from his goal tender. That might have actually been a goal. Let's go. Connect me. You're good. You're good. You're good. Oh, that's not even connected. Z Gris, what a save. I have too many of the same numbers on this team, man. I swear to God. We're getting worked around right now. Good poke. Goal tender. And my goal tender, I don't know what goes on in this game. I want to watch the replay so we can watch this together. I don't know what happens in this game sometimes. I really don't. Jonathan Huberto makes it two to nothing. What happened here? Nice, Gustafson. Nice. Feels like that's a puck you should be able to cover. I don't know. I'm going to have a very fun time in this game. Three, two, Jamie Lee. All right, good shot in the period. That wasn't even her. I really need to get acquainted with this team. I don't know who's who on the ice sometimes. I mean, looking at the stats, man, like it's an even game. He's just got in those two goals. First one was a good goal. We'll give it to him. Second goal was not. But I mean, hey, that's the name of the game. I mean, at the end of the day, they don't ask you how. They ask you how many. So this guy has many more. Dude, I feel like my poke checks this year. I poke the guy and the pokes aren't strong enough. Like his guy. Man, this game is just, it's something else this year, man. This game is just something else, man. Can we watch this goal again, too? What is with the puck just trickling in? I'm trying not to rage. I swear, like it's not worth it.  I think it's time to switch goaltenders. What is Phillip Gustafson doing here? Put your pad down, man. Okay, three-nothin'. Lovely game. Good block. Are we gonna get this puck over him? We did for the first time. Go skate. Two seconds. Police for the love of God and we score with a second left. Cut the lead back into two. Trevor Moore assisted from Nurse in his debut. Okay, good stuff, boys. We're just gonna throw in the first lines for now because the period's over. We're in this game. We are in this game. We're down by two with 20 minutes left. It's not bad. The score clocks showing zero right now. That's crazy. Interesting. End of two. He definitely had a better period that period. His two goals out of the three have been ones that trickled in, so that's fun. Low shot rebound. Bro, this goaltender's not giving up any rounds. Is that Igor Shosturkin? I think it is. It's a ranger's goal. It has to be him. He's been robbing us, man. He's very good at the redirections, man. I'm trying for these rebound shots and he's redirecting them out of the way every time. It's crazy. So it looks like we're gonna lose our second game of the episode. This is gonna be our first loss of regulation, actually. Kinda sucks, man. He had two tricklers in. This could have been a tied game if it wasn't for those crappy goals that he ended up scoring. It's the name of the game, though. Again, they don't ask you how. They ask you how many. And we're gonna take our first regulation loss of the series. Guy deserved it.  Again, the goals that he scored weren't the greatest, but at the end of the day, it doesn't really matter. Looking at the stats here, I mean, yeah, he had way more shots than me. Four or five minutes more time on attack than me. So, you know what? Well-deserved GG's, buddy. We take our first regulation loss. Okay, so after that game, we were at 11,266 coins. We have a chance to get bankrupt on this. We don't want that. 11.2K can get us a pretty good player, so we're hoping for a good spin. With that being said, let's spin the wheel here and see what the wheel is going to bless us with. And what is it going to be? It's going for a while here. And it's open five packs. We went from bankrupt to up. We get to open up five packs. We take that, dude. I thought I was like, oh my God, we actually went bankrupt. Five packs, it is. Let's go. We have five packs. I'm going to open up a variety. That first pack did not treat us well. Let's be honest with each other, but we're going to open it again. Okay, so we're just going to start off with one of these again. Screw it, okay? First one wasn't good. Maybe the second one's going to be better, okay? So let's see. First round, Olexiak, okay. Ooh, 84 overall. Caroline Harvey, okay. And Owen Power. All right, our defense is getting better and we desperately need good defensemen. So we take that. We definitely take that, okay? Oh my God. And we pull our first purple. Legit my first purple all year. Not only in the series all year, 86 overall, Kail McCarr. Our defense is looking spicy now. 93 speed, 93 excel. Decent, like good shot, not decent shot, good shot. Good hand stack, good checking stats. If we had offensive defensemen, he gets an even better shot. Even better passing. So hey, first purple, 86 overall, Kail McCarr. We will definitely take that. Boon Jenner and Trevor Zegris again. I know we have a dupe with Trevor Zegris, but there's no point in taking a 78. So we're going to go Kail McCarr, we're going to go Boon Jenner, we're going to go Trevor Zegris. What a pack. And we still have three more rounds. I doubt we pull anything else, but Kail McCarr is going to be huge. And the good thing is, is we still have four packs after this. You know what I mean? So I don't know, man. I don't know. It's looking pretty good, okay? So we're going to take Vinny Trocheck. We're going to take Esa Lindell. And we're going to take James Reimer, just because it's James Reimer. We love James Reimer here, okay? Fourth round out of five. Sure. Ruzika, okay. Alex Lyon and Jonathan Martiasol, who actually might make the team. He has the synergy we're looking for too. Not bad. We'll take Martiasol. We'll take the 280 overalls. Fifth round. Del, we get another purple.  We are getting some good pulls. Air-neck bladder, defense is looking good. Anti-Ranta and Evan Bouchard. So we're going to go Bouchard, Eckblatt and Coughfield.  Okay, the first one didn't treat us nice. The second one though. The second one though, 84, 86. We'll take that. Let's go with a Mega Players pack next. We have 580 overalls. Second pack out of five. What will this one give us here? Give us something good, baby. Here we are. Tanner Pearson. Okay, Nick Aprucesi. Okay. Where are our 80 plus overalls? We're getting a bunch of 70s that we don't really need. We get a team of the week. Sure, not one of the good team of the weeks, but we get a team of the week. Michael Backlin, okay. Could possibly make the team. Spencer Knight. Okay, okay. Don't know if we're going to change our goalies. Maybe Gusson just had a bad game. Speaking of goalies, we're pulling more. Okay, man, I think the choice pack is the way. Robert Thomas, not too bad, 82 overall. Yes, Barry Cook and Yemi. All right. Justin Falk. Okay, UPL, Corey Cross. Jordan Kyrie. Okay, we are pulling some good cards, man. Packs are low key, a little juiced right now. And that's going to be it for this pack, all right? Okay, not too bad. Not too bad at all. You know what? We have two more of these. We're going to open up one more. One more, one more. I don't want to go too OP with this because then our team's going to be too stacked. You know what I mean? Okay, so, Shul, we got that guy. Spencer Knight and Rebecca Johnston. Sure, we'll just take the highest overalls. Kind of thing at the end of the day. Okay, second round. Okay, 85 overall, Kendall Coyne Showfield. Used her last year in the Monopoly Hut series. Her X factor, she was actually pretty good. She's going to get used for sure. So that's pretty nice. And that's going to be it for that round, all right? So we'll take Showfield and just those two guys over there as well. We have two more rounds, I believe. This is the fourth round. This is the third round. We have three more rounds. Okay, Shane Gossesbier, Jordan Stahl. Jose Copetar and Nick Schmaltz. Okay, so we'll take those. Oh my God, our team's going to look a little too stacked now. I kind of feel bad that it's going to be this good already, but whatever. Logan Couture, Victor Rass, still playing hockey, Sean Durzi and Scott Wedgwood. Again, whatever we'll take the dupes. Couture, good card. Don't know if we'll make the team. Last round here. What will it give us? Mikey Anderson, Charles Lindgren. Mark Stone could make the team as well. And Tori Krug. Okay, not a bad choice pack. Okay, we will take that.  I'm not going to open up another one of these because our team's going to look mighty fine after these. Okay, two more to go. And I'm leaning, like, I'm going to try it out. I'm going to try it out. If we can pull a fantasy hockey card in one of these, hey, why not? All right, so let's see. We get one player out of this. Great chance of pulling one. And we pull a duplicate Kevin Shaddenkirk. That was a waste of a pack. And I'm sorry that you guys had to watch that. And just for the lulls, because I think we've had too many packs, too many good packs, we're going to open up a premium pack, okay? We're going to skip it, too. And it was a waste of a pack. I'm not going to lie, it was a waste. But what I'm going to do here, to get some coins up, I'm not going to do any sets. I'm going to just quick sell the players. We're not going to use, not goal players, because we could use those for sets. We'll take an easy one K coins from that set. And we are now up to just over 12 K. So not too bad. Again, worried with the bankrupt thing, but it's not bad. Let's throw the cards onto the team now. So honestly, our defense is going to be, like, totally different. We could probably say goodbye to Sean Dursey and Eric Chernak. Let's be real, they're probably departing our team after pulling kill McCarr, after getting an air neck blad, they're definitely done. Trevor Moore will be departing for the newly acquired Mark Stone. Ryan Johansson played his first game with the team, and he is now departing for the newly acquired Cole Caulfield. Showfield will be taking over Jamie Benz spots. So we're getting some more speed on the team, which I really did want. And a rat ray might have to depart just for synergy reasons. Actually, we're too short on playmaking forward now. I was going to throw in Jonathan Marsh assault, but if we're losing playmaking forward, which it looks to be the case, we might just keep it the same. If that's the case, if we have a better center than Morgan Frost, we're going to throw them in. Anze Copetar looks to be our best option. So Anze Copetar is going to get fourth line minutes there. So after all is said and done, this is what the team is looking like. We have Travis Connectney. The first line stays the same, Connectney Malcolm to Bertuzzi. Second line is looking pretty different, aside from Elias Lindholm. Mark Stone will be playing on the wing with him, and so will Cohen Schofield. Third line will be Nugent Hopkins, Trevor Zeegers and Cole Cawfield. The fourth line will be Joe Pavelski, Anze Copetar and Jamie Lee Rat Ray. And then on D, we got Kail McCart, paired up with Darnell Nurse. We got Aaron Eckblad with Owen Power, and we have Renata Fass, playing with Caroline Harvey and goal timing stays the same. So we did lose playmaking forward, but we also activated two more synergies. We got two way forward activated for Connectney Schofield, Pavelski, Stone and Bertuzzi, Copetar and Ryan Nugent Hopkins. We got offensive defenseman activated for Kail McCart, Fass and Harvey, and then two-way defenseman is activated for Power, Nurse and Eckblad. So the team is ready to go. We're ready to head into the second game of the episode with the team looking pretty dang spicy. All right, can we win our next game of the episode? We hope so. Luke Robothigh, Joe Neuendike and Brooks Orpik. Okay, he's got a good team. The good news is we do have our first 86 overall on the team being Kail McCart. He's making his debut. Let's see what the team can do. This guy's 68-50 in 10 in the games he's played. He's a Hutt Grinder as well. We were playing some good people with some good teams this episode, man.   We have Kepp Philip-Gussison in that as well. I think I told you guys that already. Kail McCart. Oh my God, that didn't miss by much. That would have been nice. What a hip check there. Take the shot, Kail. Okay, Kail. Oh, I wanted the lacrosse. He didn't do it. And across to Elias Lindholm in his debut. Kail McCart with his first point. We're up one to nothing. What a start for Kail McCart and Elias Lindholm on the team. I want to start from us. One-nothing, let's go, boys. Low shot rebound. Ooh, that almost worked. Good cover from his goal-tender. Just take the shot there. His goal-tender is tired, man. We almost have full pressure as well. Dodges the hit, dodges again. Take the shot, what a save, man. I don't know how that wasn't a goal. I see ya. Bang. Take it to the net.  Overcross, bang. Oh, my god. He picked it up at the side of the net there. Not ideal. Overcross, Kail McCart, man. He's opening up. He already has a point in this game. He was looking for a goal in that shift there. Let's go, Kail. Low shot rebound. It's there, and it's a goal for Trevor Zegris. McCart in his debut with two assists. He's going to quickly climb up the point lead on this team, man. He is playing good in his debut. Darnell Nurse also getting an assist. Two nothing, boys. We love to see that. We absolutely love to see that. Zegris wants more. Rebound. Oh, my god, it's on the line. Oh, my god. How did that not go in for our third goal of the game, man? That's insane. And I mean, looking at the stats here, 13 shots to three. We're LTO-ing him. We're feeling good with this team, boys. All of those packs were nice. Over puck. Owen Power. That's not Owen Power. Bang, Bertuzzi. What a save. Oh, my god, Bertuzzi is actually snakebitten on this team right now.  Oh, my god. Now to kind of stop playing for a sec. Konekni and Konekni. What are they calling it off for? No, no, no, no. What are we calling this off for? If anything, I'm pushing the goalie towards in that and helping him save the puck here. That's not going to count. Oh, that's tough scenes, boys. We got a strip of a goal. Could have been 3-0 in there. Wow. They gave me the wrong player. What a save from Philip Gustafson. He's having a bounce back game after the last one, boys. He needed that. Here we are. Good pass.  Bang on the backhand.  OK, that's OK. Here we are. Konekni. Nice move to the inside. Travis Konekni. Oh, Bertuzzi, what was that dive? Not needed. And we're looking at the end of two here, and, I mean, we're playing well. That's all I'm going to say. We are playing very well. Awesome. Oh, nice. Dodgers a hit. Low shot rebound. Bertuzzi. No, Konekni is going to get his own rebound. Oh, my god, this X-factor Konekni is something else. Makar with his third point of the night, three assists. And Philip Gustafson got an assist on that play, too. Oh, my god, the boys are just jowling together, man. We love to see that. This Kill Makar card is actually insane, boys. I'm such a huge fan of this. He's actually so much better than everyone else. And you can feel the difference. It's amazing, boys. We're going to do it with Caulfield. Bang.  We actually could have hit that. That was an amazing save from the goaltender. Take a hit, make a play, though. Aaron Eckblad over at Owen Power. Oh, he misses the net. Oh, it was right there. Oh, good poke. Good poke.  Oh, that's a weak goal from Philip Gustafson. Other than that, he's had a good game. But that is a weak shot to let in. Three to one, it's OK. There's only a couple seconds left.  And that will be game. We go one-on-one this episode. We took our first regulation loss, but we come back big with a huge win. We absolutely love to see that. We're getting close to bronze ranking. Do we get bronze ranking? We do. That's a dub. And we're close. Not close. We're getting to silver, all right? Looking at rival summary, we are getting some more points. Getting closer to div too. Don't know how I feel about that. Coin summary, we're going to gain some coins for doing what we do. And then looking at the stats here, man, it was a well-deserved win. After that game, we also completed an objective. So hopefully, that's some coins. And it is 500 coins to add on to the 13K we already have. So we're ending off the episode with 13,665 coins, hoping that the next spins in the next episode isn't bankrupt and hopefully buy any player. Because like I said, with this chunk of change, we can buy a pretty decent player for the team that we have. Anyways, guys, that's going to be it for today's Wheel of Hut episode. If you guys did enjoy, be sure to drop a like on it. If you guys are new around here, make sure to subscribe button down below for some more Wheel of Hut, some more NHL24 content, all of the above. So be sure to subscribe if you haven't. But yeah, like I said, that is it for today. Thank you very much for watching. And I'll talk to you later. Peace.


Now remember the associative law, we can associate certain parts of an expression For that to be executed first the same happens in computer languages like Julia And I've just shown you here the order of operations now These are all little symbols that you'll be unfamiliar with some of them. We would be there's our fraction and At least there's the little carrot sign there for What to do with powers if I double-click on that you can see how that was constructed What we're interested in is just a say say for instance we say 2 minus 4 Times 3 of course, it's going to do 4 times 3 multiplication comes before Subtraction so that's going to be 12 and so that's 2 Minus 12 and indeed we get our answer the negative 10 But we can force the issue by just simply putting our little parentheses around what we want to execute it first Times 3 so 2 minus 4 is negative 2 times 3 is going to be negative 6 So just forcing the associative law just associating things so that we can force the order in which these operations are executed so similar to normal pen and paper mathematics


Okay, let's go ahead and get started. So, well, thank you everyone for coming in early on a rainy morning for this exciting session. So, this topic is breaching virtualization and security with OpenStack and Contrail. And I will be, so the format is, I will be talking for about 15 to 20 minutes. And then I'm actually going to give a quick demo of some security services that we can dynamically spin up on top of our OpenSDNController, OpenContrail, and OpenStack. And then my colleagues, Shui and Aniket, will be leading the hands-on session and walk you through exactly how you do service chaining for security services. So we welcome you to interact with us. So you're welcome to tweet and join our LinkedIn group and visit our opencontrail.org website. So basically, our SDNController is integrated with OpenStack and it's completely open sourced. So we welcome developers to participate in the development. So in Chinese, the word crisis has two characters. The first character, Wei, means a time of danger. And the second character, Ji, means opportunity. So the Chinese understands that changes are inevitable. And when change happens, it brings both danger and opportunities. And you're either energized or demoralized, depending on whether you see the opportunities or you just see the danger. So what's my point here? So we are in the forefront of a revolution towards cloud and virtualization. And that actually brings a lot of complexities and challenges to the way we deploy security. And if you were in some of the previous sessions in this summit, you've heard a lot about what kind of challenges cloud and virtualization has brought to the security architecture. So I'll just list some of them here. So first of all, cloud and virtualization was driven by dynamic applications. And they, in turn, enabled applications to be more dynamic. So when I say dynamic, what I mean is actually it's twofold. The first dimension of dynamic application is the applications can really shrink and grow in a momentary notice. So to give you an example, back in 2012, this is Linga. So Alec Baldwin was on the plane, and he refused to turn off his smartphone or tablet because he wants to play the Linga game, Words with Friends. And then once the news broke out, there was record traffic on Linga website trying to play the game. So the application can really grow very fast unexpectedly. And the second dimension is actually the rate of innovation that's happening in the software development space. So with agile development, you're very familiar with the DevOps. So the DevOps team need to spin up dynamic environment to test and release the software several times a day. And these application environments may have different security implications and security requirements. So for security that's very static, it's not going to catch up with the new requirement posed by the dynamic applications. So security must change along with the applications. And the second challenge is workload mobility. So even within one data center, due to high availability requirements and the need to meet SLA requirements, and also for disaster recovery, workloads may move around within the same data center or even across different data centers. So the traditional way of doing security. So security must be always on in the new era. And also it must be in lockstep with your mobile workload. And last but not least, so in a virtualized cloud data center, we are seeing an increasing amount of East-West traffic, which is traffic between your virtual machines, intro data center. So according to statistics, more than 80% of the data center traffic is actually intro data center between your virtual machines versus less than 20% is actually going in and out of your data centers. So, oh, sorry. So what that means, the security, the data center security must be more granular. So now if you only have a parameter-based security, you have a firewall at the edge of your data center. That would not work because either you have to divert all your traffic, like intro data center, to the parameter and back, which caused huge inefficiency. Or these communications, these traffic, just evade your security protection. They won't go through any firewall and protection anymore. So those are the challenges that virtualization and cloud are posing on the security architecture. But we are arguing that at the same time, they are actually bringing huge opportunities for security to do a better job. So in order to show you where the opportunities are, I want to go back a little bit and talk about the key things that enable security to do its job. For security to be efficient, we need both contact and security. So by contact, I mean application contact. The environment the applications are running in, for example, the information about the application, whether it's Oracle database and whether it's your web server, the vendor information, what operating system and the file system, and also how much storage I need and what's my CPU usage. And with these, it's kind of like you have a better knowledge of what the applications require from the architecture. So you can do better security and protection. And the other thing that's really contributing to good security is isolation. So basically, by isolation, I mean the security function itself ideally should be isolated from the entities that it is protecting. So for example, you don't want a host-based security. And when the host is infiltrated, the security can be easily disabled. If your antivirus software can be easily disabled, then it doesn't achieve your purpose of doing good protection. And traditionally, security has been struggling to achieve both. Because for host-based security, it has very good contacts. It understands what applications are running in this environment. And it understands what applications and the file system and everything. But it doesn't have good isolation, just like what I said, an attacker can easily, relatively easily disable the antivirus software if you're already to control of the host. Likewise, traditionally, network-based security has very good isolation because it doesn't run on the same host. It doesn't run on the same entity as the applications they're protecting. They're in the network. So they're isolated from the applications. But it has been challenging for network-based security to get the contacts information. But they do need the application contacts to be more efficient. To give you an example, if you have some UTM system or a firewall, it might need to go through tens of thousands of signatures wasting a lot of CPU cycles to be able to find out which signature this attacker actually matches. But if it actually knows that, oh, I'm running Oracle server, then it can actually narrow down the number of signatures that it needs to match and maybe reduce it down to hundreds instead of tens of thousands. So knowing the application contact can make security much more efficient. So we argue that in the era of virtualization and cloud, we actually have all the conditions that we can actually do security much better. So we can actually have security that knows both the contact and also have very good isolation. So what do I mean by that? So at the host level, right now with server virtualization, so you have a hypervisor layer that's separated from your application environment, which is running in your virtual machines. So if you're protecting your applications, then the hypervisor layer, the security that's implemented in the hypervisor layer, has very good isolation. And because they are on the host, they already have very good application contact. Now with security, they actually gain more isolation. So it's harder for the attackers to get to the hypervisor level to actually disable the security. So similarly, for network-based security, traditionally, we are challenged with getting the application contact. But with software-defined networking, so we actually have a logically centralized SDN controller that actually has your information of all your virtual networks. So it actually provides, along with OpenStack, it provides much better programmability. And the users can actually easily convey its security requirements through a policy-driven framework that's enabled by SDN and network virtualization. So in the next few slides, I'm going to use Contrail and OpenStack to give you an example of how we make this happen. So first, a quick introduction of Contrail. So basically, Contrail, I use interchangeably with OpenContrail because it's an open-source project. It's an open-source SDN controller and cloud networking virtualization, orchestration, and automation software that's led by Juniper. But now, we have seen pretty rapid adoption in the open-source community. Until now, we have contributed more than 750,000 lines of code into the open-source community. And so we have seen huge adoptions among service providers and enterprises alike. And we have about 130 proof of concept and deployment. And among them, 90% of all top service providers in the world actually have done proof of concept with Contrail for their SDN and cloud and NFV projects. So architectural-wise, at the bottom of the stack, we have a network virtualization. So basically, this is your plumbing. And traditionally, this has been done with VLAN and where you need to deal with broadcast storms and restrictions on the number of VLAN IDs and a lot of scaling issues. And so Juniper, along with some other leading vendors in SDN, we adopt a software-overlay approach that removed the restrictions that VLAN has. So you can actually dynamically spin up virtual networks. So these virtual networks can also represent the different security requirements that your applications have. So if a group of your applications or a certain part of your multi-tier application, they have specific security requirements, you can put them in the same virtual machine group or endpoint group so that they can be protected with a set of individual policies. And the next layer up, we actually have a set of virtualized network services. So Juniper has traditionally been pretty strong. And we have a suite of virtualized security services that we can run on our SDN platform that includes our Firefly parameter, which is a firewall product and also an anti-DDoS product called DDoS Secure. And we also have web application security and also SSL VPN that we can run. And we actually have a demo of running them over a country platform. And because the country is open source and open standard, a very open platform, we can actually easily enable third party security and network services to be running on top of control. So if you're interested in developing such a service, if we have time at the end, we'll show you how to pull the source trace rule depth stack. And on top of that, we have the SDN control layer and configuration layer. And so this layer is composed of a centralized, logically centralized SDN controller that talks to distributed forwarding elements that's embedded in your compute node, which are normally your physical servers. So we have a similar to the open virtual switch. We have a V router that's running in the hypervisor level. So we support a suite of hypervisors like KBM and Zen and ESXi and Hyper-V in the future. And so what the controller does is it actually accepts user configuration. So through OpenStack, you can have a self-service portal where you can configure virtual networks. And through another control API, you can actually do some additional, more network focused activities like you can configure a service template and do dynamic service chaining. So ContraSDN controller takes all this information and then pass that down, do its processing, and pass that down to the distributed forwarding element. And then on top of that, we can integrate with cloud management platforms like OpenStack and CloudStack. But also in a service provider environment, we can also integrate with their OSS, BSS. And one thing that stands out for Contra is we have very good statistics and analytics information about the infrastructure. So the good thing that it can do with the service provisioning is with this rich set of information, you can actually figure out what additional things you need to do with the service. And you can actually provision the service better. For example, if you provision one virtual machine running a firewall, and suddenly your application footprint increased, and you need to increase your firewall footprint, you can actually detect that through your CPU utilization or your throughput. And that can be fed back to your cloud management system and your SDN controller.  So this is just an architecture diagram of the components in Contra. So I already mentioned some of this. So at the compute level, so over here, let me see, how do I? I actually don't know how I get that little red dot. But these two are my compute nodes, so I can have multiple virtual machines running on top of that. That's my workload that I need to protect. And I have a vRouter that's running at the hypervisor level. And at the vRouter level, because one of the differentiation of Contra is, for vRouter, it's a layer 3 entity versus OpenVirtualSwitch, which is a layer 2 entity. So as a layer 3 entity, we can actually have much richer functionalities. We can actually do load balancing and even some firewall functionalities and security functionalities and some NAT functionalities at the hypervisor level without introducing another virtual machine for your routing and other security functions so that the performance is much better when you need communication between different virtual networks. And so these are the vRouter is the distributed forwarding element. And on top of that, we have the SDN controller. So as I mentioned in the beginning, we use an overlay approach to realize the virtual networks and your tenants and multi-tenancy. So we actually are physical network agnostic. So we don't really care what switch fabric you use. It can be Juniper's Q fabric. It can be Cisco's UCS and can be Brocade. Or it can be a mixed environment. And because we establish overlay tunnels on top of that, you don't need to replace your existing data center infrastructure to enjoy the benefit that we can bring. And we tightly integrate with OpenStack for cloud orchestration. So this is a list of some of the key features that we support. I already mentioned some of this. So at the forwarding element level, we already support load balancing and security. So security is actually built in to our design because the virtual networks are inherently secure. So the virtual machines within the same virtual network can talk to each other. But without any additional work done, virtual machines in different networks, they are very separated from each other. And they don't share any information unless you establish a policy to connect them through a security service. So also service chaining. So we actually made service chaining really easy. So I'm going to show you a quick demo in a moment. So the last slide I'm going to have just talks about how we actually map the logical infrastructure to your physical infrastructure. So the physical infrastructure, you can have multiple compute nodes with multiple virtual machines on running on top of them. So the infrastructure I want to build, the logical infrastructure I want to build is on the top. So I want to build, for example, three virtual networks, the green, the blue, and the yellow. And then I want to be able to connect them with certain security features. I want to connect these two with a firewall and those with a deep packet inspection. So how are they done? So these virtual machines can be anywhere in your data center. It's not restricted by the VLAN cluster or anything in our implementation. So what we do is we establish overlay. It can be MPOs over GRE MPOs over UDP or VXLAN tunnels to connect these virtual machines together and then change the firewall service in between. So the advantage of this approach is we can deal with workload movement. So this can be movement of the firewall instance itself. It's a virtual machine itself. Or it can be the workload that you're protecting. They can move around. And the control SDN controller can actually dynamically update the tunnel based on the movement because it understands, along with OpenStack, it understands where the workload has moved to. And it can dynamically adjust tunnel to make sure that the security service is always on and in lockstep with your workload. And the other advantage is it's about auto scaling. So basically, with the rich analytics we can bring, we can actually detect whether there is a need to scale up or scale down your firewall services. And we can automatically get that done. And because at the vRouter level, we can actually do load balancing at the hypervisor level. So if we scale up your firewall services from one to four, we can automatically load balance among these four instances, so giving you much higher capacity. So I think that's the talking part. And so with virtualization and the cloud management, we can actually easily make security very dynamic, very scalable, and very pervasive in your data center. And with that, I'm going to show you a quick demo of our DDoS secure over a country and how that can help you mitigate DDoS attacks. So let me see if I can make this window a little bigger. So this is your usual open stack interface. And we also have a country UI. So basically, they use the same set of underlying information. But with the country UI, you can have some more advanced networking functionalities. So what I do is I'm going to spin up two virtual networks. So one, I can use these two interchangeably. So I'm going to spin up two networks. One is the attacker network, DDoS attacker net. I give it an IP address. So this is how easy I can create a virtual network. And so I'm going to create another one called DDoS target network. So this is where my web server or the entities I want to protect, this is where they're going to reside. Actually, I accidentally, so I'm going to change that later. And so while I'm at open stack, I'm going to spin up a virtual machine in each of my virtual networks. So one is going to be the attacker. And the other one is going to be the target. I'm going to attack. So I put it in my attacker network. And then I'm going to launch another instance to be my target. So now I'm actually going to switch to my country UI so that I can do my dynamic service chaining. So here I'm going to configure a service template. So it's going to be a transparent service, meaning it's a layer two service. So I choose my service image. And then I'm going to have three interfaces. The left interface connect to my attacker. And right interface connect to my target. And I have a management interface where I can see the statistics about my DDoS attack. So with that service template, I can actually spin up multiple service instances. So I'm going to do one now, DDoS service instance. So I'm going to pick the template I just picked. And I'm going to put my management in the public network so I can access through a browser. And I leave the left and right as auto-configured. So this will actually take a minute or two. So basically what this is doing is OpenStack is spinning up a virtual machine to run my anti-DDoS software image. And after that, I'll set up a policy to. So oh, it's actually fast. It's active now. So then I'm going to set up a security policy to direct the traffic from attacker network to the target network to go through my DDoS secure service instance. So this is doing the service training. DDoS policy. So from source network would be my attacker network. And destination network would be my target network. So I can apply a service. That's a service instance I just created. And then once a policy is created, I'm going to apply it to both my attacker and my target network. So I can select my DDoS policy that I just created and save. So I removed because I accidentally added this. So I applied the DDoS policy here. So now I go back to my attacker virtual machine. So I need to log on to the console and see if I can access my target so that I can issue some attacks. So I have config. So for my attacker, I have an IP address of 192.168.123. And my target has an IP address of 101.253. So I'm going to do a quick ping to make sure that I can access my target. So now the ping can go through. So now I'm going to launch my attacks. So some of you who are very familiar with security, I think nowadays, DDoS attacks are getting more and more sophisticated. So traditionally, we see a lot of TCP sync attacks, those like flooding attacks. But recently, there are more and more slow lorries types of attacks that actually really exploit the application defects. So basically, for example, they're opening up TCP sockets, but they don't close it. So your web server can quickly run out of resources. So I'm actually going to launch two types of attacks. So I'm going to use H-Ping3 to launch TCP sync like flooding attack. So dash s means it's a TCP sync attack. So I launch it on port 80, which is my web server. Do a flood. And the IP address. So I put that in the background. And then I'm going to launch a slow lorries attack. So this is just a porous script. Porous, slow, lorries.pl, DNS, I hope my connection is OK. I think the network connection is somewhat slow. So if I can't complete this demo, I can always blame on the network. I blame on the wireless network. OK, now I see some life. Attack or VM. I'm going to go back. So DNS is 192.168.253. Port is 80. So as you can see, it's building sockets on the web server, my target. And then if we go back to the instances, you can see this is my DDoS service instance. And because I put the management interface in the public network, so I can actually log on to this to see the attack. Let me see the address again. <IP_ADDRESS>. <IP_ADDRESS>. Yeah, so I'll be done in a minute or two. So once we see the attacks. <IP_ADDRESS>. So this is our DDoS secure device manager. So it has a dashboard to show you, to let you configure DDoS secure. And also it can show you some live attacks that we detected. So from the dashboard, as you can see, we're already seeing traffic spikes at the DDoS secure device. So this one actually shows the CPU usage. So the CPU usage also spiked up. And this is the attack level. So we already detected the attack. And you can also see that through live incidents. Oh, actually, let me see. Worst offenders? No, sorry. Live incidents. So as you can see, the top one has a very high traffic rate. So this is your TCP sync attack. And this one over here, the second one, in the traffic rate is very slow. So this is your slow lowest attack. So the DDoS secure service actually detected both. And from here, you can see we're in logging mode. So we're not really mitigating the attack. So we're basically just logging the attacks. And what I can do is I can configure my DDoS secure to do mitigation. So I put it in defending mode. Then you see that actually all the traffic, all the attack traffic will be dropped. So now I have changed to defending mode. And you can see the amount of traffic coming into the DDoS secure, it's still quite huge. But the outgoing traffic is going to be zero pretty soon. Because the DDoS secure service dropped out the attack traffic. And so now your target, your web server, or whatever application will be protected. So that ends my demo. And I'm going to invite my coworkers Shree and Aniket to lead you through a hands-on session where you can do some of these things yourself. Thanks, Chloe. So we'll get into the hands-on part of the session. Each of you should have received two hand-outs, one which goes over the lab exercises that we are going to go through today. And the other one is a sandbox information. If you haven't received one, please raise your hands, we'll come and help you. So you need this. We do these hands-on exercises in a lab. And the lab is behind a VPN. So the handout contains the URL that you point your browser to, to connect to that VPN and then log in using the login information. And then there is a little client that you'll have to download. It's a Java applet that you'll have to download. Once you log into the VPN, there's a start button. When you click on the start button, you'll either download a Juno's Pulse or a network connect applet. And once you download, that's when you actually get connected to the VPN. And once you are connected to the VPN, you can point your browser to the 10, 10, 11, 11, or 10, 10, 11, 16 URLs. Those are the URLs to the open stack and the contrail instance that is running in the lab. So we also have a raffle draw towards the end of the session. Folks who will complete the exercise will be, we'll do a raffle drawing for them. And there's an iPad giveaway at the end of the session. So good luck. So I'll spend three or four minutes waiting for everyone to get connected to the VPN. If you have any issues connecting to the VPN, you may raise your hands and we can help you get connected. Once we are connected, we'll do a very quick overview of the architecture and then get on to the hands on as soon as possible. Same password. Be the same password. It's not, why is it not taking? So let me do the same thing on my screen here to quickly show you how it should look like. So this is exactly what I did. I pointed my browser to the OpenLab URL, <IP_ADDRESS>. I logged in using, Chloe has her own credentials to the OpenLab, so she logged in using her credentials and then you hit start and that downloads the Java applet and then that's how you get connected to the VPN. And this should be running to tell you that you are connected to the VPN. All right? So let me spend a few minutes talking about doing a quick recap of the Contrail architecture. And the goal is not to deep dive into the architecture itself. It's only to set context for the exercise. So you can see it's nicely organized into four layers. The four layers that you saw earlier in Chloe's slides, this maps to the same four layers. At the top, you have the cloud orchestration and we are all familiar with OpenStack. So the topmost layer is the OpenStack layer with which you will interface with the system. The next layer, there are two components that Contrail provides. There are two pieces of software that Contrail provides, the controller and the V-Router software. So the controller software is the next layer and the V-Router is a kernel loadable module that instantiates into the hypervisor of each of the compute node where your VMs are going to hang off of. So that's the next layer you can see, the V-Router and the controller software. The controller itself is comprised of three different software modules, the control piece, the config piece and the analytics piece. So the config piece is responsible for translation of the high level abstract definition of your overlay picture and translates that into the lower level data model and hands over that data model to the control. And the control then speaks XMPP to the V-Routers and programs the V-Router to instantiate that picture in the overlay. You describe the picture of the overlay you want to see in the, using the orchestrator software. And then each piece, each component of this system sends a bunch of analytics information and all that analytics information is dumped into highly available databases. And we will see in the Contrail UI how you can retrieve those analytics information about the flow and records and also about the log messages. Underneath the overlay, underneath the overlay is the physical underlay. So the physical underlay provides any to any IP connectivity within your data center. So remember your virtual machines are hanging off of these x86 compute nodes, x86 servers. And the underlay provides any to any IP reachability between these servers. And the only thing Contrail expects from the underlay is this IP reachability. And it does not, there's no other expectation from the physical underlay. So that's the beauty of, that's the beauty of the Contrail solution. So fundamental to network virtualization. So Contrail is a network virtualization platform and fundamental to network virtualization is this idea of being able to give the tenants of the cloud the illusion of having a logically isolated network from isolated from rest of the tenants. And in a private cloud, a tenant is a department, in a public cloud, a tenant is a customer of the cloud. So fundamental to network virtualization is this idea of being able to give the illusion of isolation from rest of the tenants of the cloud. So that's the fundamental, and this network isolation, the building block of this network isolation is the concept of a virtual network. And for Contrail, we build these virtual networks using overlays as opposed to some other solutions where you could have used VLANs, but there are several issues in using VLANs and we will not go over the issues in using VLANs because the focus of this session is to do the hands-on. So remember that virtual networks are implemented in the Contrail world using overlays. And so the tunnels that you see in the picture, these tunnels between the V routers and from the V router to the physical gateway, these tunnels are what are used to implement the overlays. And the gateway could be a physical router or it could be a software router that is used to exit the data center, go from the virtual to the physical world or to go from the data center out to the internet. So that's the role of the gateway. And that's all we need to do, that's all we need to know for, to set the context for the demo and the hands-on exercises.  And in terms of how that logical picture actually gets instantiated in the physical world, that's the bottom diagram that's shown. So what we have in the top diagram, there are three different virtual networks. There are some virtual machines hanging off of these virtual networks. And then there are two services. There's one service, there's a firewall service between the green and the blue network. And there is a DPI service between the blue and the yellow network. And these services themselves are also instantiated inside of virtual machines. So these are virtualized services, also called network function virtualization. So these are virtualized services themselves deployed inside virtual machines. So you can see all of these virtual machines. There are two compute nodes in this diagram. So all of these virtual machines are spawned on these two compute nodes. And if there's traffic being sent, so virtual machines belonging to the same network, the green one and the green three, you can see are sitting on two different compute nodes. And the tunnel is established to extend the network from the left host to the right host. So the tunnels are used to extend the network to create the concept of the virtual network. So that's the essential idea you need to take away from this slide. So we saw that demo. And now for the hands-on, this is sort of the agenda, what we'll be going over in the hands-on exercises. So the fundamental building block is the virtual network. So the first thing that we will see in the hands-on is how do you create a virtual network? And then you spawn virtual machines and then put the VNX of these virtual machines in the virtual network that you spawn. So that's the next step we will see. We will spawn virtual machines inside these virtual networks. So these virtual machines will hang off of those virtual networks. And then the other fundamental building block of network virtualization is the idea of isolation. So you will see that in a virtual network, the virtual machines can talk among themselves, but traffic cannot exit the virtual network or traffic from other virtual networks cannot enter that virtual network. So in order to allow traffic to exit and enter the virtual network, you have to actually apply policy. So we will see the application of policy and then attachment of that policy. Now this policy can be a stateless ACL-like policy, and therefore we also have richer and more stateful policies that can be applied. And that is what is called a service insertion. So we will see one example of service insertion. We saw one example of service insertion in Chloe's demo. We saw the DDoS secure being inserted as a service. In our hands-on exercise, we will see a NAT gateway being inserted. So Juniper has this virtualized service instance called the Junos vFirefly, and we've already pre-programmed this Firefly to perform the NAT function. And that image has been added to the Glance repository and is available in your OpenStack instances. That's running in the OpenLab lab. And so we will take this NAT instance and we will instantiate it between two networks. So we will see that. We will see the concept of floating IP and how that gets used. The third exercise, we can do the DDoS secure ourselves. We saw Chloe doing the demonstration and you can do it for yourself. You can do the exact same demo. We have the instructions in your handout. And the fourth exercise finally is the rich amount of debug and analytics information. How do you get access to that? How do you attach packet analyzers?  How do you do that? So that's an instructions for all these exercises that are available in your handouts. So the first demo where we will insert the NAT gateway, essentially, let's say there is an enterprise network. So when you create a virtual network, you will assign some private IP block to it. And then clearly, it won't have routes to reach the external internet. But there is another network. There's a public network which we have pre-created, which has routes to reach the internet. And therefore, for this private block of IP addresses that the enterprise network has, in order for the VMs spawned in the enterprise network to be able to reach the internet, you have to apply the NAT service because routes to the internet are available for the public network. So if you apply the NAT service in between the enterprise and the public network, then the VMs in the enterprise network will be able to reach the internet. So that's essentially the demo we will do. The public network already exists. We've already created. It has routes to the external internet. The enterprise network is what we will create. We will spawn one virtual machine inside the enterprise network. We will then apply policy, and then we will insert the Firefly NAT service between these two virtual networks. So all traffic going from the enterprise network will be forced through the NAT service. The NAT service will be applied. And then by virtue of that NAT service, access to the internet will be enabled. So that's the demo we are going to do. That's the hands-on we are going to do. So as I said, the public network already exists. And the first step is to create the enterprise network. So in order to create the enterprise network, you can use either the OpenStack Horizon UI or the Contrail Web UI. So let me introduce you to the two UIs first. So in Chloe's demo, we also saw both the UIs, but mostly we will, for the purpose of this demo, everything that's to do with spawning of virtual machines, we will do from the OpenStack Horizon UI, and everything that's got to do with networking, whether it's creation of networks or application of policy or spawning of service instances, we will do from the Contrail UI. So there are three data centers in the lab that we've created for the purpose of this exercise. So I'm connected to one of them, 10, 10, 11, 11, and that's my Horizon dashboard. And then on the same IP address at the port 8080, you can connect to the Contrail UI. Now everybody is familiar with the OpenStack UI, so let me spend half a minute introducing the Contrail UI. So there are four tabs in the Contrail UI. There is a monitor tab. The operational aspect of a Contrail controller can be seen from the monitor tab. The interesting thing to note here is that there are five servers. And among these five servers, there are two V routers. When I say there are two V routers, it means there are two compute nodes. And within these compute nodes, two V routers have been instantiated. And so on these two compute nodes, all the virtual machines are going to be spawned. And then you saw the Contrail controller comprises of three different nodes, the config control and analytics. So that's my controller running on the remaining three servers. The three remaining three servers. So once again, I have five servers in this data center. Two of them are designated as compute nodes, where V routers are instantiated. And the remaining three, I've distributed my control config and analytics nodes to run my controller. So the idea is that the controller is logically centralized and physically distributed. And for scale and redundancy and high availability, you can instantiate each component, whether it's the controller or config, on as many nodes as you want, for the purposes of high availability and redundancy. So here I have instantiated two control nodes for the purpose of redundancy. And then each of these components, I can, you can drill down and then it shows you some information about the CPU consumption and the memory. And each of these nodes, I can drill down. And then the color and the size of the bubble has its obvious meaning. If it's green, it means it's all good. If it's pink or red, it has something fuzzy going on. So that's the monitor dashboard. And similarly, you can look at the networks that you've already spawned. So it lists all the networks and then it can, so Chloe just created this DDoS attacker net. So look at this nice web 2.0 UI, which shows you exactly what Chloe did. She created a DDoS attacker network and she created a DDoS target network and then she launched or inserted the DDoS secure service instance. And so it shows you a nice pictorial. This is a simple topology, but you can have more complex topology and then you can easily visualize them in this monitor UI. Similarly, you have the debug. You can attach packet analyzers from here to your virtual networks. And then you can inspect the traffic that's traversing your virtual networks. So that's the monitor tab. Similarly, you have the configure tab. So this is the equivalent of, if you are familiar with the Juno's router, there is a config mode and there is an operational mode. So the monitor corresponds to the operational mode. This is the config mode of a typical router. So most of the work we will be doing today will be underneath the networking and the services sub tabs. So you can look at the networks and you can spawn your network over here. So let's everyone browse to this tab, to this sub tab, the network sub tab under networking in the configure tab of the control UI. And then you can create the enterprise network and give it some suffix, maybe give it your sandbox number as a suffix so that you can easily identify your enterprise network. So I'm going to call it enterprise demo. For now we leave the policy blank. So when we are spawning the virtual network, we leave the policy blank and give it some private IP block. It populates the gateway address. Add that IP block and that's it. Hit save. So as you can see, my enterprise demo virtual network was created. So let us all, I'll give a couple of minutes for everyone to spawn your enterprise networks.  It's the password, that's the problem. There's an administrator, I'll ask him to increase the number of sessions. So here's what you do. You go to the configure tab. Under configure, you browse to networking. Under networking, there's networks. And then on the right-hand side, on the top right-hand side, there's a create button. And for now when you create the virtual network, leave the policies blank. Give it some IP block like 19216811.0 slash 24. Yes. I know some of you are having problems connecting to the lab or I've already communicated with the administrator to increase the number of sessions for those who are having problems with the number of sessions. But in the interest of time, we'll have to make progress. For those people who are already connected, we'll make some progress. Exactly, so what we've done is because there are multiple sandboxes, in each of the DCs there are about 20 sandboxes. And so what we've done is the public block of IP addresses instead of a slash 24, we've split that slash 24 into slash 29s so that each sandbox has their own public. It's the same thing, instead of a public, it's called sandbox dash public. So the next step we do is we go to the horizon UI and spawn a U1 to virtual machine inside your enterprise network. So we created the enterprise network and now we're gonna spawn the U1 to virtual machine inside this virtual network. So we go to the horizon UI, make sure you're logged into the same sandbox. So the sandbox in contrail maps to a project or a tenant in the OpenStack UI. So I'm logged into the demo and I'll launch an instance from an image. We've pre-populated glance with an U1 to image. I'll call it enterprise U1 to demo. Now for the flavor, I suggest not using tiny and using at least a small, but keep it to a small. And then you have to select a network to put the first VNIC of the virtual machine inside and so select the enterprise network that you just created. What that does is it puts the first NIC inside the enterprise demo virtual network and then simply launch the VM. So let's all do that second step. Launch a U1 to virtual machine from the horizon UI and you select the enterprise virtual network you just created to put the first VNIC inside. So that login information is here. So for spawning the U1 to virtual machine, let's use the U1 to image and then once you create the virtual machine, you can log into the console. So the login for that is just U1 to U1 to. If you're using a different image, then the login information is mentioned on your handout. No, use a small and then you can do an IF config and you will see that the ETH0 interface will have an IP address from the virtual network, the subnet block that you allocated for the virtual network. And we will try to ping Google's public DNS server and clearly it will not have access. We will not be able to ping 8888. So the next step we are going to do, so now we have two separate isolated virtual networks. There is a public network and there is an enterprise network. The enterprise network has one virtual machine and the next step we need to do is to apply policy in order to connect these virtual networks. So the next step is to create a policy. Just delete the VM and try spawning another one. So some users do have access to the lab and are not having problems and are moving ahead. So in the interest of time, let me also show what the next steps are on the screen. So the next step you are going to do is because these two networks are isolated, you have to create a policy and then apply that policy to the two networks. So that's what I'm going to do. So as you can see in the diagram, you first create the policy and then the next step you do is attach the policy to the two networks. So I'm going to do these two steps in the Contrail UI, create the policy and then attach it. So I go to my Contrail UI, go to the Configure tab again and under the Networking there is now a Policies sub tab. So I'm going to save Enterprise Internet Policy and then I save from the source network Enterprise demo. Destination network is demo public. So this simply creates the policy and you can see there is a second column called Associated Networks. So that Associated Networks is right now blank. So you might wonder why there is a two-step process. First you create the policy and then you attach the policy. This is because the policies may be created by one set of security personnel and then the application of the policy may be by other set of administrators. So that's why there is a clean separation of who creates the policies and then who uses those policies and applies those policies to the networks. So we've created this policy and right now it's not associated with any networks. You can see the second column blank. So you go to the networks and remember when we created the network we left the policy field blank. So we go back to the network.  Similarly you go to the demo public. We had applied the firewall policy. I'll now take out the firewall policy and simply apply the enterprise internet policy that I just created. So I've now applied the policy on both the networks and thus I have connected the enterprise network to the public network. But this still is not going to apply NAT for all traffic going from the enterprise towards if my pink packets are sent directed to 8888. This policy is not going to apply NAT yet. So I have to spawn the NAT service instance and then insert that service instance into this policy. So before I do that, let me give a few minutes for everyone to create the policy and then attach the policy to the two virtual networks to connect the two virtual networks. I can see the network that I have created in the complex. Really? Yeah. In OpenStand? Are you on the sandbox one? I created the network in complex and I created the policy in complex but I cannot see it there. I only see it in OpenStand. Which is weird. Maybe something. No, it might be some of the daemons might need to be restarted on the server. I was able to access the changes and now I'm on the server. The weird thing is I'm not seeing any of the problems. Okay. So the thing is both are working off of the same database so you should be able to see from both UIs. So there was a question asking me whether there was a map of the topology I've just created. So you just saw what I did was I created the enterprise virtual network and then applied a policy to connect the enterprise to the public network. So let's see how that shows up. So how that is pictorially represented. So because that's like a monitoring kind of functionality I have to go to the monitor tab and under the monitor tab I'll go to the networking. I'll go to the list of networks and I'll search for my enterprise network which I created in the demo sandbox. Enterprise demo is what I created and you can see enterprise demo is connected to demo public simply by a direct policy. Right now there is no service instance inside or between the two virtual networks. So this is the map that there was a question for. You go to the monitor UI, under networking go to the list of networks, select the network within the sandbox that you are using and then you will see that you'll also see the traffic statistics at the bottom. So I'll go back to my slides and go back to the next step. Creating the policy. The dropdown will list the networks from all the sandboxes but the networks in your sandbox will not be a fully qualified name it will just be the name of the virtual network. For all other sandboxes it has a fully qualified name so it will have the prefix of the sandbox and then the virtual network. So the networks in your sandbox will not have a prefix of the sandbox itself. Yeah, because our enterprise demo there is no enterprise demo. I found it in my sandbox. Yeah, I found it in my sandbox. So the next step is actually inserting the NAT service but in order to insert the NAT service I have to first spawn the NAT service. I have to first spawn a virtual machine and inside the virtual machine run the NAT service and then I can insert it into this policy and so all traffic going from the enterprise network will be subjected to the NAT. So in order to do that there's a two or three step process. The first thing you have to do is you have to create a template of the service that you are going to spawn and when I say a template of the service it simply identifies what image is going to be used to spawn the service and some other parameters like what mode the service is in is it an L2 service is in an L3 service and then what interfaces the service is going to have. So you create a service template before spawning an instance off of that template. So after you create the service template you instantiate an instance from that service template. So the next step is to create a service instance from that template. So the next step is to create a service instance in order to create the service instance you use the service template and then you specify which networks the left and right interfaces are going to be connected to and if you want the service to be also managed you will also put the management interface into some network. And then finally you will edit the policy and then insert the service inside the policy. So that's what you will do for the service insertion workflow. So I'm going to do these two steps create the service template create a service instance and then include it inside a policy I'll show it in my browser. So I go back to the configure UI I go to the networking I go to the services section this time I create service template so for my NAT service a template is already created in any case I'll just create a new one I'll call it a NAT demo template. Now the NAT service is actually going to modify packets it's actually going to do the source NAT functionality and therefore it's actually an in-network NAT kind of service so that's the service mode you will select and for the image you'll simply use the NAT-service image the NAT-service and then there are going to be three interfaces the service is going to be connected to two networks to the enterprise network and the public network so it needs two interfaces a left and a right and then if the service itself needs to be managed then you will also need a management interface so let's have three interfaces in the template and then you save the template so I just created the NAT demo template and then once you create the template you create an instance from that template so you create an instance called NAT instance or I could give it a different name I could call it an internet access instance I use the NAT demo template that I just created now in this case the NAT service is already pre-configured and there is zero configuration or zero management I'm going to have to do to this NAT service and so I leave the management interface auto-configured I'll put the left interface in my enterprise network which is my enterprise demo network and then the right interface I'll put it on my public network so I need my demo public and then I save it when I save it what's going to happen is a virtual machine is going to be spawned with the NAT service image and then it's going to have two interfaces and the right in the two networks so while the VM is spawning I know few folks are ahead of the session so if you're done doing exercise one please do raise your hands I'll come and pick up your business card or name for the Apple iPad drawing and we are kind of running out of time so we'll wrap it up in five minutes we are almost done with the demo so as soon as the instance is spawned merely spawning the instance and putting it in the two virtual networks does not route traffic through that service instance you have to actually include that service instance inside a policy the policy that we just created we will go back to the policy we will edit the policy and then include the application of the NAT service inside that policy so I'll go to 10, 10, 11, 11 I go to the policies I created this enterprise internet policy edit the policy and say apply service so it shows me the list of services that are available to be included and so you include the internet access service that you just created save it in the policy the policy is already applied to the two networks so now if you go back to your UBAN 2 virtual machine and try to ping 8888 the ping packets will be subjected to the NAT service source NAT will be applied and that is how access to the internet will be enabled I think that's pretty much all we wanted to cover in the hands-on so we will come around and take your business cards for Apple iPad drawing I know some of you had connectivity issues I just wanted to let you know that the lab is available for the next 10 days so save the sandbox information you can go back home and try the rest of the exercises leisurely yes oh absolutely so here's what I did there are three things I did I created a service template and then I instantiated using the service template instance and then embed the service instance inside a policy so to do that I went back to my policies tab I edited the policy and I said apply service there's an apply service checkbox and then there is a drop down that allows me to select the services I want to apply so one more minute we will if anyone else wants to enter into the Apple iPad drawing please raise your hand this is 314 what we'll do is people who have written their names on white paper we'll put it on one of our business cards and put a number behind them so that when you draw it there is no partiality can you give me a few business cards so we're going to fully randomize fully randomize here try to be as fair as we can one last thing is you'll find folks from Juniper Contrail in the summit so if you have further questions about the product or about any of the features please feel free to contact any of us you saw our team members in the room so please feel free to contact any of us so while the draw is being done let me take this opportunity to also flash a few slides about dev stack okay I got the signal to cut off but I'll quickly flash the slide about dev stack and you can take a look at it you can browse to that URL download the dev stack which includes Open Contrail and you can run it on your you know inside a Ubuntu VM or on your laptop and we'll be making these slides available so there's there's this page we've created on Etherpad it's called Contrail-DevStack who wants to volunteer? oh just a second oh it's from Cisco Julie Ann Connery we're pretty generous