Tagged: VeloCloud
16 posts · browse all tags
-
Certificate Required, Credentials Not: CVE-2026-93952 and the Second VeloCloud Orchestrator 10.0 of the Summer
Arista's SA 0183 discloses CVE-2026-93952, an actively exploited CVSS 10.0 flaw in on-prem VeloCloud Orchestrator that only bites when Edges authenticate with certificates. Fixes exist for 5.2 and 6.4, not yet 6.1 or 7.0, and July's patched builds are still exposed.
-
Arista VeloCloud Edge HA Part 1: How Failover Actually Works, and CVE-2026-86106
On 9 September 2026 Arista disclosed four VeloCloud Edge and Gateway CVEs in one batch. This one, CVE-2026-86106, lives entirely inside the HA peer channel between two Edges, so Part 1 goes deep on how that channel actually works before explaining the bug in it.
-
Arista VeloCloud Edge HA Part 2: CVE-2026-86107, CVE-2026-86108, CVE-2026-86109, and the Fix
The other three VeloCloud Edge and Gateway CVEs from Arista's 9 September 2026 batch: a VCMP tunnel crash, an OS command injection in the management workflow, and a signature-validation gap in the update mechanism. All three share their fixed releases with Part 1's HA bypass.
-
SDWAN Control Plane Showdown: Three Philosophies for Solving the Same Problem
Fortinet collapses control onto the data-plane device. Arista/VeloCloud collocates it on a multi-tenant Gateway. Cisco/Viptela decouples it fully into vSmart and OMP. Three architectures covered on this site, lined up side by side, right before the Cisco series picks up the third one.
-
A Brief History of SDWAN Controllers: Viptela, VeloCloud, CloudGenix, and Why Cisco Runs Two SDWAN Stacks
Three startups solved SDWAN's control-plane problem within a year of each other. Two got bought by exactly the company you'd expect; one brand didn't survive. The acquisition history of Viptela, VeloCloud, and CloudGenix — and why Cisco still runs two unrelated SDWAN stacks today.
-
From DSCP to Deep Packet Inspection: Why SDWAN Application-Aware Routing Killed Traditional QoS
A deep technical comparison of legacy QoS (DSCP/CoS, static priority queues, box-by-box CLI) against SDWAN Application-Aware Routing — plus a vendor-by-vendor breakdown of how Cisco Catalyst SDWAN, Fortinet, Juniper Mist (128T), and VeloCloud actually identify and steer application traffic.
-
Advanced tcpdump Recipes for the Enterprise Engineer: The Packet Never Lies
Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.
-
VeloCloud SDWAN and Partner Gateways Part 1: MPLS-Only Site Architecture
A deep dive into how VeloCloud SDWAN connects MPLS-only branch sites via Partner Gateways — covering the NNI, underlay BGP peering, and why MPLS-only edges present a unique onboarding challenge.
-
VeloCloud SDWAN and Partner Gateways Part 2: Onboarding an MPLS-Only Edge
A step-by-step walkthrough of how an MPLS-only VeloCloud Edge activates using a temporary internet path injected into the MPLS VRF, what changes once the VCMP tunnels are up, and how the production routing state differs from the onboarding state.
-
VeloCloud SDWAN and Partner Gateways Part 3: Taming the Default Route at the NNI
Why a 0/0 leaking from the MPLS underlay into a VeloCloud Partner Gateway is dangerous, how to filter it at the NNI, and the VeloCloud best practice approach to default route handling — with BGP policy examples.
-
Arista (VMware) SDWAN Deep Dive — Part 1: Components, Gateways, and the Three Planes
First post in a five-part deep dive on Arista (VMware) SDWAN. We start with the components — Edges, Cloud Gateways, Partner Gateways, Orchestrator, Controller — and the three planes that bind them. Sets up a UK ISP scenario that the rest of the series will pick apart.
-
Arista (VMware) SDWAN Deep Dive — Part 2: Routing — Overlay, Underlay, BGP, and the Gateway as Route Reflector
Part 2 of five. How prefixes get into the overlay, how the Gateway redistributes them, the three Cloud VPN modes, BGP at the Edge and the Partner Gateway, and the route-selection logic that decides which underlay a flow ends up on.
-
Arista (VMware) SDWAN Deep Dive — Part 3: The Data Plane — VCMP, DMPO, and Per-Flow Steering
Part 3 of five. Wire-level look at VCMP encapsulation, the DMPO measurement loop, Business Policy and per-flow steering, and the on-path remediation (FEC, duplication, jitter buffer) that lets the overlay tolerate underlays that misbehave.
-
Arista (VMware) SDWAN Deep Dive — Part 4: Topology Walkthroughs — MPLS-only meets Internet-only Across Continents
Part 4 of five. The GlobalCo packet-flow walkthroughs — Newcastle to HQ, Bristol to HQ, Chicago to a UK Cloud Gateway (why it fails), and the headline: MPLS-only Chicago talking to Internet-only Shanghai via a Partner Gateway, hop by hop.
-
Arista (VMware) SDWAN Deep Dive — Part 5: Best Practice, Failure Modes, and a Design Checklist
Part 5 of five. Gateway design rules, Partner Gateway sizing, segmentation, security service insertion, MTU, the failure modes that catch teams the first time, and a one-page design checklist for an Arista (VMware) SDWAN rollout.
-
Designing an Arista SDWAN Spoke with Enhanced HA, Dual DIA, and OSPF
Building a resilient Arista (formerly VeloCloud) SDWAN spoke: two Edges in Enhanced HA, two DIA circuits wired the optimal way, a multi-VLAN LAN, OSPF for route exchange, and the caveats that bite in practice.