Nepean Networks's Last Mile SD-WAN introduces a game-changing troubleshooting tool called Secure Connect, designed to provide advanced diagnostic capabilities for network administrators. This tool is a reverse proxy deployed on the SD-WAN edge, offering high bandwidth capabilities and secure access to various network devices and services, including on-prem servers, routers, switches, VoIP phones, printers, and IoT devices. One of the standout features of Secure Connect is its ability to perform remote packet capture using Wireshark, allowing network engineers to delve deep into network traffic and pinpoint issues efficiently.
Deployment of Secure Connect
The first step in utilizing Secure Connect is to set up an Secure Connect server, which acts as a Bastion server for secure access. The Secure Connect client is then installed on the Nepean Network’s SD-WAN edge device, ensuring secure communication via cryptographic keys. This setup enables network administrators to access any IP or port associated with Nepean Networks edge devices and other network endpoints.
Remote Packet Capture with Wireshark
Secure Connect's standout capability lies in its support for remote packet capture using Wireshark. This method allows network engineers to leverage Wireshark directly from their laptops and capture traffic directly from the Nepean Networks Edge at high bit rates. Unlike traditional methods like tcpdump, remote packet capture with Wireshark offers significantly faster capture speeds and can handle bandwidth-intensive tasks effectively. Filters can be implemented to reduce bandwidth usage and focus on specific traffic patterns. Instead of using tcpdump on the Nepean Networks edge, DumpCAP from tshark which is installed on the edge device is utilized.
Value and Benefits
Comprehensive Troubleshooting: With Secure Connect and Wireshark integration, network administrators gain a powerful troubleshooting tool that can identify a wide range of network issues. Whether it's misconfigurations, cyber attacks, or performance bottlenecks, Wireshark's detailed analysis capabilities provide insights into network behavior.
Cybersecurity Insights: Secure Connect's ability to perform remote packet capture is invaluable in cybersecurity scenarios. It can detect lateral movement in cyber attacks, identify misconfigured networks, and help in uncovering potential compromises. For example, detecting abnormal traffic patterns indicative of malware activity or unauthorized access attempts.
Proactive Network Monitoring: By leveraging Wireshark remotely, businesses can proactively monitor their network for anomalies and potential threats. Early detection of suspicious activities can lead to swift action and mitigation, preventing potential compromises and data breaches.
Cost Savings: The ability to remotely diagnose network issues and security threats using Secure Connect and Wireshark can result in significant cost savings. It reduces downtime, prevents costly cyber incidents, and enhances overall network performance and reliability.
Jumping the Shark
Leveraging Wireshark and DumpCAP
Troubleshooting Session Example | Proving Email Blacklisting with Wireshark
Scenario: During a recent troubleshooting session, a client reported that their email service was not accessible, and all attempts to access emails were met with errors. The client suspected a network issue, as they were able to access emails using a personal hotspot from a mobile phone.
Initial Assessment: Upon receiving the report, the support engineer conducted initial checks on the network infrastructure, including the Nepean Networks SD-WAN setup. No obvious issues were found, and the network appeared to be functioning normally.
Client's Assertion: The client insisted that there must be a network fault, as emails were accessible via a personal hotspot using his laptop and phone but not through the corporate network. They believed that the network configuration was causing the email access problem.
Utilizing Netpean Network’s SD-WAN Troubleshooting Tool: To delve deeper into the issue and pinpoint the root cause, the support engineer decided to leverage Nepean Network’s SD-WAN advanced troubleshooting tool, Secure Connect, which integrates with Wireshark for remote packet capture and analysis.
Steps Taken:
Setting up Wireshark Capture: The support engineer remotely accessed the Nepean Network’s SD-WAN edge device and initiated a Wireshark capture using the Secure Connect tool. This allowed real-time monitoring of network traffic passing through the Nepean Network’s SD-WAN device.
Analyzing Email Traffic: With the Wireshark capture in progress, the engineer focused on analyzing the email traffic to and from the client's email server. This included examining SMTP (Simple Mail Transfer Protocol) communication, DNS queries related to email servers, and any unusual network behavior.
Identifying Blacklisting Issue: Upon thorough analysis, the network administrator discovered that the client's network NAT IP address was being blocked by the cloud-based email server. This blockage was due to repeated failed login attempts caused by a user with an incorrectly configured email password.
Understanding Network Impact: The blockage of the network's NAT IP address by the email service resulted in all email traffic from the client's network being blocked, hence the inability to access emails.
The troubleshooting session using Nepean Network's Last Mile SD-WAN's secure connect with Wireshark integration successfully identified the root cause of the email access issue. It was not a network fault as initially suspected but rather a blacklisting issue caused by incorrect email credentials and subsequent blocking by a security service.
Wrap
Wrapping up, Nepean Network's Last Mile SD-WAN Secure Connect with integrated Wireshark capabilities revolutionizes network troubleshooting and cybersecurity practices. It empowers network and cybersecurity engineers to delve deep into network traffic, identify issues proactively, and ensure a robust and secure network infrastructure. With Secure Connect, businesses can achieve zero downtime, enhance network stability, and mitigate cybersecurity risks effectively, making it a must-have tool in the arsenal of modern network management.
This Swiss Army knife from Nepean Networks has the potential ability to save a business billions and it enables the functionality to detect lateral movement, which is something that all the fancy pants systems from Silicon Valley are failing in delivering!
Ronald Bartels ensures that Internet inhabiting things are connected reliably online at Nepean Networks - the leading specialized Last Mile SD-WAN provider in South Africa. 👉 Contact Nepean
