Re: NTT

[(ABHK), Nick Cheng]

Hi Bora,

Thanks. We change the DNS to FR that one and it is OK now but it is so strange as HK and China are using same DNS but China cannot resolve this address and available to ping the IP. Anyway, we will trying to figure it out now. Thanks for your help.

Nick Cheng
IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

On Mon, 14 Oct 2019 at 18:39, Bora Supica <bora....@agnesb.fr> wrote:

Hi Nick, like Christophe said, you will add one entry on your DNS server visuals.agnesb.fr 172.1.1.25.

 

Or you can redirect all to our server DNS like I made for all off your sites.  The important is to have always the same ip off DNS server on all our sites.

 

 

 

 

Best regards

 

 

Bora Supica

CMC Agnesb

17 rue Dieu

75010 Paris

Tél : 01 40 03 58 95

Mob : 06 98 73 71 97

 

De : Christophe Coursin [mailto:ccou...@agnesb.fr]
Envoyé : lundi 14 octobre 2019 12:14
À : (ABHK), Nick Cheng <nick...@agnesb.com.hk>
Cc : Bora Supica <bora....@agnesb.fr>; Kazumi Amisaki <k.am...@agnesb.co.jp>; Jean-Claude Fratissier <j...@agnesb.fr>; Walter Antoine <walter....@agnesb.fr>; Terrance Lee <terr...@agnesb.com.hk>; Hiroshi Kurosawa <hiroshi....@agnesb.co.jp>; Aymeric Besset <aymeric...@agnesb.fr>; Dave Wang (TW) <dave...@agnesb.com.tw>; Alex Hsieh (TW) <Al...@agnesb.com.tw>
Objet : Re: NTT

 

and can can you solve the name  ?

 

http://visuals.agnesb.fr/winbook/    

 

 

From: (ABHK), Nick Cheng

Sent: Monday, October 14, 2019 12:07 PM

To: Christophe Coursin

Cc: Bora Supica ; Kazumi Amisaki ; Jean-Claude Fratissier ; Walter Antoine ; Terrance Lee ; Hiroshi Kurosawa ; Aymeric Besset ; Dave Wang (TW) ; Alex Hsieh (TW)

Subject: Re: NTT

 

Dear all,

 

We just do the testing in China office router and it can ping this IP.

Nick Cheng
IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

 

 

On Mon, 14 Oct 2019 at 17:55, Christophe Coursin <ccou...@agnesb.fr> wrote:

Hi

 

I think the image are coming from this address 172.1.1.25  in french network, I think you need to reach the french network 172.1.1.0 or at least 172.1.1.25

 

 

regards

 

cc

 

From: (ABHK), Nick Cheng

Sent: Monday, October 14, 2019 11:50 AM

To: Bora Supica ; Christophe Coursin

Cc: Kazumi Amisaki ; Jean-Claude Fratissier ; Walter Antoine ; Terrance Lee ; Hiroshi Kurosawa ; Aymeric Besset ; Dave Wang (TW) ; Alex Hsieh (TW)

Subject: Re: NTT

 

Hi Bora,

 

We find something strange after changed China network to IPSEC. When China office users want to access ASWEB, all China office user PCs cannot see the product image as below. Do you think is it related to network access list issue or others? For easily troubleshooting, do u know what is the address for these images? Thanks.

 

Nick Cheng
IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

 

 

On Wed, 9 Oct 2019 at 11:29, (ABHK), Nick Cheng <nick...@agnesb.com.hk> wrote:

Hi Bora,

 

Thanks for your info and we will reply you ASAP.

 

For now, we already change the network between HK and China to IPSEC. We are monitoring the performance now. Thanks.

Nick Cheng
IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

 

 

On Tue, 8 Oct 2019 at 19:06, Bora Supica <bora....@agnesb.fr> wrote:

Hi Nick, thank you for all off your documents.

 

On our side everything is ready to make the test.

You will need to make tunnel VPN-IPSEC to our public IP 87.89.34.65, what I have done already to you public IP 113.28.88.33. Our fire-wall is Fortigate.

 

I will send you the password trough Google hangouts.

Let me know if it is ok for you.

Regards

 

Bora Supica

CMC Agnesb

17 rue Dieu

75010 Paris

Tél : 01 40 03 58 95

Mob : 06 98 73 71 97

 

De : (ABHK), Nick Cheng [mailto:nickche...@agnesb.com.hk]
Envoyé : jeudi 3 octobre 2019 05:20
À : Bora Supica <bora....@agnesb.fr>
Cc : Kazumi Amisaki <k.am...@agnesb.co.jp>; Fabrice Guiraud <fabrice...@agnesb.fr>; Jean-Claude Fratissier <j...@agnesb.fr>; Walter Antoine <walter....@agnesb.fr>; Christophe Coursin <ccou...@agnesb.fr>; Terrance Lee <terr...@agnesb.com.hk>; Hiroshi Kurosawa <hiroshi....@agnesb.co.jp>
Objet : Re: NTT

 

Hi Bora,

 

Please refer to attached pdf file is existing network diagram for HK,TW and CN environment.

 

And for the testing for IPSEC, it is good if we compare the performance between MPLS and IPSEC.  But CN office is holiday now and I think we can do this before end of next week and I will update you if have any news.

 

But for the testing method, our network consultant and us think that we prefer to do this in our other testing VLAN which is 172.100.3.x. As we need to setup in production equipment, it has risk if we test in production VLAN also. It is better to do this in other VLAN.

Nick Cheng
IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

 

 

On Wed, 2 Oct 2019 at 00:04, Bora Supica <bora....@agnesb.fr> wrote:

Hello to everybody.

                I would like that we try to connect one site (HK TW …) does not matter which one to test if it will be working and how will be the speed using internet and VPN between 2 sites.

 

I would like that we try to connect one site (HK TW …) does not matter, to test, if it will be working and how will be the speed using internet and VPN between 2 sites.

 

For that I suggest just to use one PC, on both sides and connect them and exchange the files, use Remote desktop or something else.

To do that, on our side, I can change the route on our network just for one PC which will use VPN. I hope that it is possible for you too.

You will find in attachment, the current network path.

Document: “NTT_20120112_Schéma_AgnesB_NW_v5.2.pdf”, and “ntt-mpls-to-VPN.jpg”.

Can you send me, a similar document, which describe your network?

 

We have on my PC

 

 

As you can see everything go to the router (gateway) trough 172.1.1.1

If we build a tunnel VPN, I will add the path (for HK) like this

 

 

I hope that you can make the same on your network and, that we can test if the connection from 172.1.1.18 and 172.100.1.29 goes through the tunnel VPN-IPSEC.     

 

I prepared sommes files for downloadinq to compare the network speed using MPLS NTT or Internet with VPN-IPSEC.

 

You can download the files from http://fileserver.agnesb.fr/test/test10mb.zip the file off 10 Mb and

http://fileserver.agnesb.fr/test/test100mb.zip the file off 100 mb. Her you will use internet and future VPN-IPSEC link.

 

And the same files here

 

http://172.1.1.18/test/test10mb.zip  and 

http://172.1.1.18/test/test100mb.zip

 

where you will use the NTT mpls connexion, and you can compar the speed, and the time you need to download the files.

 

Also if you can check the response on ping from you to our AS400 here in Paris

 

For me it is like this, the time (temps) is 205 ms and it should be less then 20 ms.

 

 

 

 

1.       Check on your side if it is possible to change the path to the LAN Paris (172.1.1.0/24) just on one PC.

 

IF YES

 

2.       Change / add route on your PC

 

3.      Mount tunnel VPN from Paris to Hong Kong (or another site who would like to be the first to make the test)

 

4.      Check if traffic between the 2 PC (172.1.1.18 and 172.100.1.29) is enough good, fast and stable.

 

Make the new mesure off download from your PC to 172.1.1.18

           

            If all is good you can change the routing table for all the PCs on your side and I will do here in Paris

 

Best regards

 

Bora Supica

CMC Agnesb

17 rue Dieu

75010 Paris

Tél : 01 40 03 58 95

Mob : 06 98 73 71 97

 

De : Kazumi Amisaki [mailto:k.am...@agnesb.co.jp]
Envoyé : vendredi 20 septembre 2019 06:06
À : (ABHK), Nick Cheng <nick...@agnesb.com.hk>; Guiraud, Fabrice <fabrice...@agnesb.fr>; Bora Supica <bora....@agnesb.fr>; Jean-Claude Fratissier <j...@agnesb.fr>; Walter Antoine <walter....@agnesb.fr>; Christophe Coursin <ccou...@agnesb.fr>; Terrance Lee (ABHK) <terr...@agnesb.com.hk>
Cc : Kurosawa, Hiroshi <hiroshi....@agnesb.co.jp>
Objet : Re: NTT

 

Hi,

 

In Japan, ASA-5515 is used as an Internet gateway.

 

-------------------------------------------------------------------------------------------------------------------
Hardware:   ASA5515, 8192 MB RAM, CPU Clarkdale 3058 MHz, 1 CPU (4 cores)
            ASA: 4096 MB RAM, 1 CPU (1 core)
Internal ATA Compact Flash, 8192MB
BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)
                             Boot microcode        : CNPx-MC-BOOT-2.00
                             SSL/IKE microcode     : CNPx-MC-SSL-PLUS-T020
                             IPSec microcode       : CNPx-MC-IPSEC-MAIN-0026
                             Number of accelerators: 1
Baseboard Management Controller (revision 0x1) Firmware Version: 2.4

------------------------------------------------------------------------------------------------------------------- 

 

Thks,

 

Kazumi Amisaki

IT Dept.

agnès b. Japan Inc.

mobile:080-5057-5801

k.am...@agnesb.co.jp

 

 

2019年9月20日(金) 12:26 (ABHK), Nick Cheng <nick...@agnesb.com.hk>:

Hi Fabrice,

 

We are working with our network consultant about the change. At this moment, we build a testing environment and prepare the settings command for router and ASA. After that, we will  create a new vlan for testing first to avoid any impact for the production. If there are no problems, then we can copy those command settings to production environment. Are you ok for that?

 

Following are the 3 IPs for our office production network and as we also need to build the route to JP also, can JP also provide the info to us?

 

	CMC Agnesb Paris	HK	JP	China	Taiwan
TCP/IP public	87.89.34.65	113.28.88.33		140.207.51.214	210.61.199.236
TCP/IP LAN	172.1.1.0/24	172.100.1.0/24
TCP IP PC for TEST	172.1.1.18	172.100.1.29

 

The routes that we will need to build are:

 

HK>FR	TW>HK	CN>HK	HK>JP
HK>TW	TW>FR	CN>FR	TW>JP
HK>CN			CN>JP

 

Also, we want to know what equipment and model used in CMC and JP for build IP Sec VPN, router or ASA? HK will use Cisco ASA 5515, TW is ASA5510 and China is CISCO1841C/K9.

 

Thanks.

 

Nick Cheng

IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

 

 

On Thu, 19 Sep 2019 at 19:07, Guiraud, Fabrice <fabrice...@agnesb.fr> wrote:

Dear Nick,

 

Is this clear enough for you ?

 

Any chance that you can share your 3 IPs (see Bora's mail below) with us today or tomorrow ?

 

Please feel free to come back to us in case of any doubt.

 

Thank you very much

 

Kind Regards,

--

Fabrice Guiraud

responsable informatique

17 rue Dieu  75010 Paris

+33 6 64 71 49 19

 

 

Le jeu. 12 sept. 2019 à 15:51, Bora Supica <bora....@agnesb.fr> a écrit :

HI Nick, it is OK for me to start with HK.

We shall need to know somme informations on your and my side.

 

CMC Agnesb Paris		Your site
TCP/IP public	87.89.34.65
TCP/IP LAN	172.1.1.0/24
TCP IP PC for TEST	172.1.1.18

               

TCP IP PC for TEST will be the only one PC whitch will use VPN to connect to your site, like that we can make the tests and can validate that everything is ok. After that we can change the route on the router for everybody.

I hope that you can make the same.

If you need more information, I will try to reply.

 

Best regards                                    

 

Bora Supica

CMC Agnesb

17 rue Dieu

75010 Paris

Tél : 01 40 03 58 95

Mob : 06 98 73 71 97

 

De : (ABHK), Nick Cheng [mailto:nick...@agnesb.com.hk]
Envoyé : lundi 9 septembre 2019 12:00
À : Guiraud, Fabrice <fabrice...@agnesb.fr>
Cc : Kurosawa, Hiroshi <hiroshi....@agnesb.co.jp>; (TW), Dave Wang <dave...@agnesb.com.tw>; Kazumi Amisaki <k.am...@agnesb.co.jp>; Fratissier, Jean-Claude <jean-claude...@agnesb.fr>; Bora Supica <bora....@agnesb.fr>; Walter Antoine <walter....@agnesb.fr>; Terrance Lee <terr...@agnesb.com.hk>
Objet : Re: NTT

 

Hi Fabrice,

 

Please refer to below our answer and our status. Thanks.

1. Decide with you which of you we start with (Dave, maybe TW ?) 

         We suggest to start with China office first as the impact is not much if have.

 

       2.Plan a technical workshop between Bora and you to establish the vpn link (are you each comfortable with this technical act ?)

         

         Yes, we can. Maybe we can build the IP SEC VPN line ready first and find a time to bring it up and deactivate the MPLS to test.

 

      3.Switch to this new vpn link and desactivate the ntt link to check if all access are still up

 

          Please refer to above and can you give us some details about the ASA from CMC?  As we need to build the VPN from HK, CN and TW to CMC. 

 

      4.Wait for some days (1 week ?) to ensure there's no issue.

 

         Yes, it make sense.

 

       5.Loop this action plan with the following subsidiary

 

        6. We still conclude the route that we need to build and will send to all review after completed.

 

 

Nick

 

On Sat, 7 Sep 2019 at 09:34, Terrance Lee <terr...@agnesb.com.hk> wrote:

Dear Fabrice,

I put Nick in the loop of this discussion. He will discuss with our Network consultant and see which area should start to change over first according to the technical point of view. Will get back to you later. Thanks

 

Dear Nick,

Please check with Andrew and see how to rollout the the new vpn plan. Thanks

 

 

Regards,

 

Terrance Lee

Senior I.T. Manager

Agnès b. HK Limited

Suite 1701, 17/F., Cityplaza One, Taikoo Shing, H.K.

Tel.: (852) 2894-2625

Mobile: (852) 9655-7456

 

 

 

On Fri, 6 Sep 2019 at 20:30, Guiraud, Fabrice <fabrice...@agnesb.fr> wrote:

Dear all,

 

Thank you very much for your reply.

 

In order to go further on this matter, Bora's going to contact each of you on next week to plan technical set up to establish the vpn connection.

 

If you agree, I would suggest to :

1. Decide with you which of you we start with (Dave, maybe TW ?)
2. Plan a technical workshop between Bora and you to establish the vpn link (are you each comfortable with this technical act ?)
3. Switch to this new vpn link and desactivate the ntt link to check if all access are still up
4. Wait for some days (1 week ?) to ensure there's no issue.
5. Loop this action plan with the following subsidiary

Does it make sense to you ?

 

Thank you all

 

--

Fabrice Guiraud

responsable informatique

17 rue Dieu  75010 Paris

+33 6 64 71 49 19

 

 

Le mer. 21 août 2019 à 03:38, Kurosawa, Hiroshi <hiroshi....@agnesb.co.jp> a écrit :

Dear Fratissier-san, Fabrice-san

 

I had a meeting with Amisakai-san regading the Network line change.

 

We will correspond depends on your decision. 

We accept by using the VPN connection to CMC and each branch.

When we arrange the 100Mb guaranteed/bandwise reservation line,

it needs 120,000～150,000 yen monthly cost.

And need to lead time almost 2 months. We will arrange it working with domestic network carriers.

 

As you know, we will move the core network equipment to Data Center next year. (BCP project)

We will provide the BCP plan/schedule after complete the client PC replacement project (Nov - Dec)

Much appreciated consider our BCP project.

 

Best Regards,

Hiroshi Kurosawa

 

 

2019年8月14日(水) 19:22 (TW), Dave Wang <dave...@agnesb.com.tw>:

Dear all,

ABTW office encountered a strange internet issue in late January 2019, we were not able to download zip files from "wetransfer.com" shard by CMC Creative, the download always failed and local ISP had no way to help, so we tried to upgrade ABTW office internet broadband from 50M/20M ADSL to 100M/100M FTTB (repair service 5x8) in March, with only a little additional monthly cost, luckily the problem was solved and our internet performance gets better.

 

I think ABTW is ok to add new IPSEC VPN tunnels to other countries to replace NTT($$$), as long as our existing router (Cisco ASA5510) is still capable to handle new VPN tunnels. Regarding SLA, from my experience, I think ABTW office users are tolerant and patient if not able to access external resources🤔 . If we really run into some situations (local FTTB down) and specific users need to access external resources with time constraints, maybe the cheap way, we can consider to share personal 4G mobile connections to user PC (or even a 4G router) and setup temporary VPN connections (e.g. Cisco VPN client or L2TP...) to other country's VPN server, without spending more money to build up load-balancing or fault-tolerance network to keep high availability as NTT.

 

Below is the test speed (fast.com) from ABTW office for your reference. Thank you!

 

 

Best Regards,

 

Dave Wang

Assistant IT Manager

AB Taiwan Limited Taiwan Branch

9F.,No.36,Songren Rd.,Xinyi Dist.,Taipei,Taiwan

Tel: (886)-2-21765118#720

 

 

 

Fratissier, Jean-Claude <jean-claude...@agnesb.fr> 於 2019年8月14日 週三 下午4:18寫道：

Dear All

 

We discuss since 8 month (very long) with NTT to update the international network.

The purpose was to decrease significantly the monthly charge and to have a more

flexible solution when moving offices (it's the case in Asia these last 3 years).

We also have seen other providers such as China télécom.

 

As a reminder, we set up the NTT architecture to have a privileged link for finance (JDE),

for video polycom (almost not used: google meet is the video tools) and for the

interconnection of AB sites.

 

The last proposal received is not totally in line with what we expect.
In synthesis, the technical architecture proposed is:

• CMC Paris office: IPSEC link (as today)
• JDE data center: IPSEC Link (as Today)
• Subsidiaries: CBIPSec Gateway. This last solution implies for subsidiaries to use
  your local access provider to join the NTT Gateway. The price is more attractive
  and more flexible in case of office moving. The negative point: No SLA

After discussion with Fabrice (CMC IT manager) we would like to try another solution.

We want to create a VPN link between AB offices.

This kind of configuration already exist with Finance Data Center (VPN IPSEC)

We also already use that for USA and GB.

In addition, in this case, the SLA depends on your local provider (HK telecom, NTT?

and so on)

 

 

The level of public internet service is much better and more reliable than 10 years ago.
The budget allocated to NTT represents a significant amount that we could spend on

other projects.

Thank you for seriously consider this option, and come back to Fabrice next week, 

in order to prepare the implementation plan.

We have to check the reliability of this option during a significant period.

 

Regards

 

Jean-Claude Fratissier

DSI / CIO

17 rue Dieu, 75010 Paris

+33 1 40 03 58 90

 

--

Nick Cheng
IT Operation Supervisor

Agnès b. HK Limited
Suite 1701, 17/F, Cityplaza One
1111 King's Road, Taikoo Shing, Hong Kong.

tel. (852) 2894 2622

[(ABHK), Nick Cheng]

De : (ABHK), Nick Cheng [mailto:nickch...@agnesb.com.hk]

fabrice...@agnesb.fr>
Cc : Kurosawa, Hiroshi <hiroshi....@agnesb.co.jp>; (TW), Dave Wang <dave...@agnesb.com.tw>; Kazumi Amisaki <k.am...@agnesb.co.jp>; Fratissier, Jean-Claude <jean-claude...@agnesb.fr>; Bora Supica <bora....@agnesb.fr>; Walter Antoine <walter....@agnesb.fr>; Terrance Lee <terr...@agnesb.com.hk>
Objet : Re: NTT

[Christophe Coursin]

[(ABHK), Nick Cheng]

[Christophe Coursin]

and can can you solve the name  ?

 

http://visuals.agnesb.fr/winbook/    

 

From: (ABHK), Nick Cheng

Sent: Monday, October 14, 2019 12:07 PM

To: Christophe Coursin

[Bora Supica]

Hi Nick, like Christophe said, you will add one entry on your DNS server visuals.agnesb.fr 172.1.1.25.

 

Or you can redirect all to our server DNS like I made for all off your sites.  The important is to have always the same ip off DNS server on all our sites.

 

 

 

 

Best regards

 

 

Bora Supica

CMC Agnesb

17 rue Dieu

75010 Paris

Tél : 01 40 03 58 95

Mob : 06 98 73 71 97

 

De : Christophe Coursin [mailto:ccou...@agnesb.fr]

Envoyé : lundi 14 octobre 2019 12:14

À : (ABHK), Nick Cheng <nick...@agnesb.com.hk>

Cc : Bora Supica <bora....@agnesb.fr>; Kazumi Amisaki <k.am...@agnesb.co.jp>; Jean-Claude Fratissier <j...@agnesb.fr>; Walter Antoine <walter....@agnesb.fr>; Terrance Lee <terr...@agnesb.com.hk>; Hiroshi Kurosawa <hiroshi....@agnesb.co.jp>; Aymeric Besset <aymeric...@agnesb.fr>; Dave Wang (TW) <dave...@agnesb.com.tw>; Alex Hsieh (TW) <Al...@agnesb.com.tw>
Objet : Re: NTT

 

and can can you solve the name  ?

De : (ABHK), Nick Cheng [mailto:nick...@agnesb.com.hk]