I didn’t realize that I had two of my machines attached to openvpn from the same l2 segment. It caused a network outage for about 24 hours. Sorry for the downtime folks.<\/p>\n
I believe that if I turn on stp for all nodes which have two legs in to the same l2, I can avoid this type of problem in the future. But I don’t think the broadcast network overhead for managing the spanning tree is worth it. Especially for vlans which span counties.<\/p>\n
Wait, I think LD1<\/a> is in the same county as the vlan hub. How about “vlans which span legislative districts.”<\/p>\n http:\/\/wa-demchairs.org\/kcdems\/districts.php<\/a><\/p>\n Hello from LD40, Orcas3! Reporting from F5 HQ\/LD36 in Seattle.<\/p>\n I use the following tools to manage my vlans and bridges:<\/p>\n vlan<\/a>, bridge-utils<\/a> and openvpn<\/a><\/p>\n I verify my tls certs with perl.<\/p>\n\r\n#!\/usr\/bin\/perl -wT\r\n\r\nuse strict;\r\n\r\nuse Log::Log4perl;\r\n\r\nLog::Log4perl->init('\/etc\/openvpn\/log4perl.conf') or die \"couldn't init logger: $!\";\r\n\r\nmy $logger = Log::Log4perl->get_logger('tls-verify');\r\n\r\n$logger->debug(\"verifying tls cert for config [$ENV{config}]\");\r\n\r\nmy($network) = ($ENV{config} =~ m:^\/etc\/openvpn\/(.*?).conf$:);\r\n\r\nmy($certificate_depth) = ($ARGV[0] =~ \/^(\\d+)$\/);\r\n\r\nmy($locality,$organization,$org_unit,$common_name) =\r\n ($ARGV[1] =~ m{\/C=US\/ST=Washington\/L=(.*?)\/O=(.*?)\/(?:OU=(.*?)\/)?CN=(.*)$});\r\n\r\n$logger->debug(\"X509_NAME_oneline: [$ARGV[1]\");\r\n\r\nmy %network_cn =\r\n (\r\n vl3 => [ 'vl3.colliertech.org',\r\n 'Collier_Technologies_Server_CA',\r\n 'Collier_Technologies_Root_CA',\r\n ],\r\n vl12 => [ 'vl12.colliertech.org',\r\n 'Collier_Technologies_Server_CA',\r\n 'Collier_Technologies_Root_CA',\r\n ],\r\n vl245 => [ 'vl245.colliertech.org',\r\n 'Collier_Technologies_Server_CA',\r\n 'Collier_Technologies_Root_CA',\r\n ],\r\n );\r\n\r\nif( exists $network_cn{$network} ){\r\n exit 0 if $network_cn{$network}->[$certificate_depth] eq $common_name;\r\n $logger->error(\"common name: [$common_name], network: [$network], depth: [$certificate_depth]\");\r\n}else{\r\n $logger->error(\"network: [$network]\");\r\n}\r\n\r\nexit 1;\r\n<\/pre>\n\n