Stepping off the cliff edge...

On January 11 2021, in the middle of a pandemic, I quit my very fulfilling and stable Government job to run my own company. Six months on, how do I feel about this decision. What is it like doing this? 

InfoSect founders: Silvio & Kylie

Background 

At the start of 2021 I was a Technical Director in the Australian Government. I had worked there since 2009. My job was energising and rewarding. I certainly hadn't plateaued and I had been given remit of some really exceptional work.

In 2017, my husband Silvio and I bought a warehouse in Fyshwick and started a hackerspace called InfoSect. We were inspired by groups like the L0pht in the USA. We just wanted a place to hangout with other hackers and do cool research.

April 2017 - purchase of InfoSect warehouse

Silvio worked at University of NSW (UNSW) as the Director of Education, he taught in the Cyber Security Centre as well as reviewing their course content. In October 2019, Silvio decided to teach at InfoSect instead of at UNSW. 

There were a lot of reasons for this but that's his story to tell. I suspect mostly a desire to focus on highly specialised, niche content drove that decision. As his training at InfoSect grew, he began to be approached to perform research as well as train. 

Silvio hired two part-time staff for InfoSect to help him in 2020. At this point, almost all of my evenings and weekends were starting to be spent helping him run the business. 

So I made the huge decision to give my notice and resign my full-time, rewarding career.

Expectations

It was the start of 2021, I was on a new adventure. My expectations revolved mostly around freedom. I was going to be free to set my own hours, choose my own work and of course, present and publish how I wanted.

I bought myself a gym membership for 2021. I am most definitely not a morning person, but in my new job I thought I could go to the gym at 9 or 10am and then catch up hours at night. I was so used to working at night helping with the business at this point, I thought this would be easy.

I wanted to do research. So many projects waiting for me, so many things I wanted to explore.

And of course, I wanted to make a difference. I wanted to build something that filled a gap in cyber security. I wanted to leave a legacy.

Six months already?

Hopefully you're all on the edge of your seat wondering what my first 6 months of this major change was actually like.

We did so much in my first 6 months.

InfoSect was a hackerspace, we'd used it for community events and storing a lot of conference gear (particularly with the COVID19 postponement of BSides Canberra in 2020). We had a small office space downstairs and a classroom upstairs. But we knew we needed to give ourselves more space and make it more professional to work in and meet clients in. 

We kicked off a sizable renovation the day after BSides Canberra 2021 (12th of April) which went for around 2 months. The major part of this rennovation was building an extra floor in the warehouse space at InfoSect, but there were so many additional parts of this fitout that Silvio coined the tongue-in-check phrase "It never ends and then you die".

Part of this journey included multiple trips to the tip, clawing old, deprecated gear out of Silvio's unwilling clutches.

Before & After InfoSect Rennovation

We taught so much. Since I started full-time at InfoSect we have taught 11 weeks of training in 3 different timezones. That's about 46% of our time in courses. 

This business as usual continued during our 8 weeks of renovations, at which point we duplicated our online streaming training setup at home so that courses weren't interrupted by the sound of drilling, hammering and saws.

InfoSect In-Person & Virtual Training 2021

We did hands-on security research every chance we could

IoT & OT Labs Built

Our customers said, 'you're fantastic, but how can we give you work when you're so overloaded already'. So we grew.

We put in more desks. We started with a desk for me downstairs... and then electronics work benches upstairs, and then more desks... and more desks. You get the picture.

In fact, in the last 6 months I have built so many flatpacks I'm starting to think I could start a career out of doing this. I'm going to point out, that although Silvio features in all the photos below, I'd do the bulk of the building and then he'd come along for the final touches or the parts that needed two people and I'd take a quick photo.

As well as desks we assembled a new vistors couch, lectern and buffet for downstairs. We also installed a conferencing system because these are essential in current COVID times.

The new space was shaping up great, but we really needed people. 

In mid-2020, after Silvio had been at InfoSect for almost a year, we sat down and had a chat together on what we wanted from InfoSect. It had morphed from hackerspace to professional training and was doing well. But at this point it was solely Silvio. It was essentially, a glorified sole-trader. And it was a lucrative business with only one person to pay. 

Some professional advice we had received on the business for future and growth was along the lines, 'you are making plenty of money for a single person - this won't scale if you hire more people'. I looked at Silvio and repeated the advice, 'as individuals, we are better financially if its just you at InfoSect'. He looked at me and said, 'but I don't want to work alone. I want a posse of cool people to work with, to do cool things with'.

In the last 6 months we have hired 3 extra people with 1 more person in the pipeline. That brings our little team to 8 people.

We are really fortunate that we have cultivated a team culture that is collaborative, clever and dedicated. We're at the point that we are having our own little InfoSect mini-conferences and enjoying working with each other. I think Silvio is realising his dream of having his posse of smart people to work with. 

InfoSect Staff: Jayden, Josh, Silvio, Kylie, Sam, Josie and Di

This is bringing me close to finalising what has happened over the last 6 months. But there is actually another huge body of work I embarked on.

Our customers said 'you need to provide security diagrams for your work systems' and 'comply with the Essential 8'

This was great actually, I had jumped the fence and had to apply all of the best practice I had been recommending in the past.  So I hardened, and hardened, and hardened some more...

The last 6 months has seen a huge uplift in InfoSect's systems, governance and compliance. This is a journey every small business needs to go on and could be an entire blog post in itself. As well as founder and Manging Director, I am also InfoSect's IT Security Manager (ITSM), IT Security Administrator (ITSA) and many other roles that are keeping me busy.

Reality

I need to wind this up, I could probably add so much more from the last 6 monts - it has been really busy. In reality, building my own business and working for myself is nothing at all what I was expecting when I surrendered my pass and was escorted out of my old office. In fact I haven't had a chance to use my 2021 gym membership at all.

The highlights of running my own business includes:

• I have less time. I actually didn't think that was possible. When something needs doing for a customer, course or deadline - I'm doing it whether its Saturday, Sunday or midnight.

• The range of what I do has increased so much. I guess until we're bigger, we're all going to be pitching in to provide solutions for every component of the business.

• The buck stops with me (oh, and also Silvio I guess). It's always at the back of my mind that until we are bolstered and have gained momentum, the success and failure of InfoSect is heavily based on the commitment and work Silvio and I do in these early days. And luck - I feel like we have so much luck on our side every day.

• Working with Silvio is fantastic. He is so genuine and smart. He literally wants everyone around him to learn more and love what they're doing as much as he does. I was concerned working with my husband would have us spending too much time together, but we've fallen into an easy, fun, workable relationship.

My advice to any one else considering doing something as crazy as me in the near future.

• Do it - it's an amazing experience. Like most experiences in life, until you do it you can't really comprehend what it will be like.

• Prepare for highs and lows. Some days Silvio and I are literally dancing around celebrating a win for InfoSect, other days we are having sleepless nights worrying about something. It's more rollercoaster than any other job I've had, but definitely worth it.

• Pick your business partner well. This person is going to be sharing the best and worst times with you. You are going to be spending a lot of time together. The ability to work together, divide tasks and feel like you are both contributing equally is super important.

• Make sure you're doing something you love. I guess this is obvious. I imagine this is like when you pick your topic for your PhD. You're going to be spending a lot of time doing your business, so make sure you love it.

• Understand that you will need to be flexible in what you do. You may identify as a specialist, but the reality is - you are going to have to use all your knowledge to fill in the gaps that the business has. You will need to learn about business management, customer engagement, contracts, finance and of course, flat pack assembly. If you're open to learning new things, this can be fun.

And here is the big question. If I rewound to 6 months ago, would I do it again? The answer is a big resounding "yes".

Setting up eve-ng on Google Cloud for Virtualised Network testing

I've setup eve-ng on google cloud for the 0xCC training conference. Here are some walkthroughs on how to get started with your own lab for learning/testing networking configurations.

1. Initial Eve-ng Setup

Most of this is documented well in the following guide, there are just a few adjustments to the guide that I recommend when running something in a cloud environment.

Follow steps 1 - 4 in the google cloud install steps. https://www.eve-ng.net/index.php/documentation/installation/google-cloud-install/

After you've done step 4, that is you've created the virtual instance but eve-ng isn't installed yet, lock down access to your instance. Eve-ng installs itself with weak credentials.

Browse to the networking options in google cloud, select VPC network -> Firewall.

The rules that apply, apply just to this project, therefore, I removed the RDP rule and I locked down SSH and HTTP to just my IP address. Do this by clicking on the rule, selecting edit and entering your IP address in "IP ranges field" under "source filters".

From here continue on with the instructions 5 and 6 in the documentation. However, after rebooting the eve-ng install, change the root password.

By default the root password is root/eve - use commands similar to below to change it:

sudo -ipasswd (follow the prompts to change)

When you log into the web interface, also change the weak default password from admin/eve.

2. Setting up Images to deploy

3. To route from the simulation to the Internet

To allow the kali image and the routers to hit the Internet. I routed interface pnet9 through to pnet0 (the management interface). After doing the below - the Internet could be used by connecting to Cloud9 in the simulation.

Setting up pnet9 and the routing:

Make it persistent by:

Edit /etc/sysctl.conf and search for the following lines:

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

apt-get install iptables-persistent

/etc/network/interfaces:

iface pnet9 inet static
        address 192.168.255.1
        netmask 255.255.255.0
       

Configuring a DHCP server:

Running the command systemctl enable isc-dhcp-server will also ensure it starts on reboot.

4. Clone the VM

I created an instance for each student. The easiest way I found to clone a VM in Google Cloud was to first create a snapshot and then create an instance from the snapshot.

1. Create a snapshot from the VM to clone
2. Click on snapshot, select "create instance"

(Women-in-Tech)++

So many times I've been asked how do we increase the number of women in tech roles and for years I've had no idea what the answer was - I had no idea why I was the only female in my teams. However, I've more recently paid attention to the tech teams that are 100% male vs the tech teams that have a good diverse balance, and I think I know what is different.

Technical Female Leadership

So much focus goes into women in management leadership roles, however if your organisation has no senior female technical leads, then you will never be able to tip the balance.

• You can't be what you can't see. This mantra has been repeated so many times it almost hurts to write, yet to be honest - it hasn't stuck for the technical fields. The simple fact is, a female is much more likely to sidestep into a non-technical role if there is no obvious pathway for her in her career. Or worse, not even join your organisation in the first place. And really, who'd blame her?

• Female technical leaders are less likely to have unconscious bias and are more likely to mentor and drive both males and females equally. They will have high expectations of both genders. Therefore, your female techs will be given the same difficult projects and same training opportunities. A female tech isn't there to meet your quota, she wants the same work as the guys and if she's not given the same opportunities - she will leave.

• Female technical leads have a vested interest in improving the gender diversity problem. She wants to tip the scales and see more women in tech. So she will actively grow a diverse team for you.

• A female senior technical lead is likely part of multiple women in tech communities and groups. (I joined my first one in 1995 at ANU before starting engineering and have been in at least a dozen since). She's flying your banner just by being in those groups and showing that your organisation is diverse. She knows technical women and as a leader, she knows she can encourage them to apply for tech roles when they are advertised.

Can a senior male technical lead do a good job of mentoring and growing a diverse technical team? Possibly - though there is less evidence of this.

If you're reading this and already formulating excuses for why you don't have female tech leads, I've heard them all before.  "There is no pipeline, the women leave tech roles before reaching this level" or my (sic) favourite "We'd have to drop the standard to recruit female technical leads"

I want you to stop, pause, think about the attitude and biases you're projecting with these excuses. Consider whether you genuinely want change or you just want to look like you want change. If you seriously want change - then make change.

Segment Routing

Segment Routing (SR) is a proposed solution to replace MPLS in the wireline networks which is picking up a lot of traction.

RFC 8402 is the Segment Routing Architecture standard which was accepted & published in July last year, it had been worked on for around 5 years before becoming an RFC. It is considered a relatively new protocol. There are currently 42 draft IETF standards in progress for various features around the SR architecture. Lots of information can be found on SR at https://www.segment-routing.net/

It works currently by leveraging either MPLS or IPv6 to represent segments in a network.

A segment can be a network link, the link between two router. It can be a node, identifying the router itself, or it can represent a service – which is essentially the customer network.

Each segment in the network is represented by a Segment Identifier or SID. As you can see in the diagram below, Segment routing works together with an IGP. IGP stands for Interior Gateway Protocol, which is an umbrella term for the routing protocols that share routing information within a common routing domain. Segment Routing currently leverages  IGPs to spread information of the SIDs throughout the network. The two IGPs that SR can use at the moment are OSPF and IS-IS. When SR uses OSPF, the SIDs are distributed in the extended prefix Link State Advertisements. When using IS-IS they are distributed using the router capability advertisements

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKRST-2124.pdf

In SR, every node has a unique identifier called the node SID. This identifier is globally unique and would normally be configured on a loopback address on the device.

In IPv4 networks, the SID is encoded as a standard MPLS label, whereas in IPv6 it is encoded as an IPv6 address associated with the segment.

I’m going to work through an example that focuses on SR-MPLS. This has been done in VIRL and I will attach the VIRL file at the end of this blog post.

You can see in this network the SID allocated to each of the routers.

There is a concept of the global block in  segment routing which begins at 16000, in my case I’ve kicked the numbering off at 19000, just because I could. The last digit of the SID corresponds to the router number in this network.

By default in this network, when a router goes into the ingress router it will take the best path through the network as determined by IS-IS. In this case, it is vi R1, R2, R3 and finally through R4.

To demonstrate one of the features of SR, I’m going to force a packet to go via R5.

In the configuration below I’ve set up a tunnel through to R4 which an explicit path titled SIDLIST1.

In the example you can see I’m explicitly stating the pathway to be 19002, 19003 and then 19005 before going to 19004.

  interface tunnel-te1

    ipv4 unnumbered Loopback0

    autoroute destination 100.0.0.4

    destination 100.0.0.4

    path-option 1 explicit name SIDLIST1 segment-routing

  explicit-path name SIDLIST1

    index 10 next-label 19002

    index 20 next-label 19003

    index 30 next-label 19005

    index 40 next-label 19004

The options for defining path are fairly extensive. It can be configured to avoid a router, to always go through a particular router and many other options. But for now we’ll see what happens when we apply this to the lab network.

I have the explicit SID list configured and what I’ve done is tapped each link and opened the traffic in wireshark so we can see exactly what the packet looks like as it goes through a segment routed network.

I have set up a ping from R7 to R8 across the SR network. The packet goes straight into the ingress router. The router will look up the route and then put the appropriate stack of segments within the packet and forward to the next router. This is were I first tap it.

Here (above) between R1 and R2 you can see the stack of MPLS labels indicating the segment route to take.

The active segment is on the top and is the segment that the router inspects when it arrives at R2. In this case R2 will see 19003 and will forward the packet on to R3. Before forward it will remove the top label.

Between R2 and R3 (above) we can see that stack is slightly smaller and the active SID is now 19005. This means R3 will forward the packet to R5, once again removing one of the labels.

Between R3 and R5 (above) we see the active SID is now 19004, meaning that R5 will forward to R4 removing the SID before doing so.

Above we see between R5 and R4 all the SIDs have been removed, there is just a final label which represents the customers vrf, and so R4 knows to forward to R8.

In summary, we can see how segment routing uses the MPLS labels to represent SIDS and how it is possible to configure explicit routes through the providers network.

Click here for the VIRL demo file

0x001A

I completed a Bachelor of Engineering with Honours specialising in Telecommunications and Digital Systems between 1995 - 1999.

I worked as a Design and then Senior Engineer in Network Development and Optimisation for OnAir Networks and then later in Terminal Interworking within Cellular Engineering. I loved it.

After 9 months of maternity leave I tendered my resignation to care for my 3 children that I opted to have within 3.5 years to ensure I wasn't too long out of work.

I completed a Masters in Computer Networking, multiple Cisco certifications and a couple of security certifications.

I've worked as a Network & Security specialist from 2009 until current.

I am currently working as the Director of a highly technical section.

This is my history and here is what I've learnt from spending the last 0x001A years as a minority in my career.

• My view of women in STEM events has evolved throughout my career. I've had times I hated them. Times I thought they achieved nothing and were a waste of time. I still see my former thoughts echo'd back in other tech women that just want to do their jobs. Today - they are not everything, but they raise awareness that there is a lack of women in tech roles and if only one more female is enabled from an event, then they are worth it. 

• When you meet another woman in tech, it can sometimes feel awkward. I'm so used to working with men that when I get to work with a female, I'm not so sure how to act. Some women love having an ally others will see you as competition. And some people will compare the only two women on the team, with comments like "Jenny is more technical than Sally". Don't compete with other women. We have enough to deal with.

• When you start a new role, its harder to get credibility than a male. Not getting good projects, not being given full TACACS access, questioned on new engagements - it happens. As a female, its easier not to move around as much. Because once you've proven yourself and its understood you know your job very well - its easier to stay where you are. But don't. Put yourself out there - believe in yourself. 

• You will be mansplained to - multiple times. It's frustrating when that tech director painfully explains how to use ls on a linux system. This isn't a reflection on you, this is a reflection on them. This is their embarrassment not yours. Don't take this responsibility on, its not yours. Move on and ignore them.

• There is an expectation that because you are female that you have better social skills, higher emotional intelligence and can represent and lead other generations. This is sexist. I had someone tell me that as a female I had a duty to behave better, kinder and nicer than everyone else. I don't. I'm shy, I'm introvert and I don't owe any more to the community than any other person doing their job in tech.

• Take credit for your work. For many years I would allow other people to take credit for my work. When my name was forgotten in the credits, I would dismiss it and say it was okay. It's not okay. Don't be modest and accepting - women have the right to be as proud of their work as men do. If they say, "Sorry we forgot to give you credit", don't say its okay - tell them to correct the situation and do the right thing. Women are adverse to boastfulness. Don't be afraid of being proud of your work.

• Remember why you're doing it. You will have bad days. You will be undermined and minimised. You will be talked over and mansplained. You will be dismissed as attending the "partners program" at tech conferences - the partners program being for wives and girlfriends of attendees. Forget all that and remember why you are here. When this happens, I put on my headphones, I sit at my computer and I lose myself in my tech. Because no matter what people say or think - this is my job, this is what I love doing and this is what I will continue doing.

Now get out there and do your tech jobs ladies!!

OzSecCon 2018

On 2-3rd of June 2018 I attended OzSecCon in Melbourne. I'm not really a locksport enthusiast by any stretch of the imagination, I'm happy to fiddle with a lock and pick during social night - but I don't go out of my way to find the locksport village at a conference. However - the atmosphere at OzSecon was overall amazing. Notwithstanding, it is hosted by Topy - the Australian who has lugged his locksport stores up, down, east and west across Australia, at his own personal expense, hosting the locksport villages at AusCert, Ruxcon, PlatypusCon, BSides Canberra and probably many more I'm forgetting. He is the drive behind growing Locksport in Australia - so if you are remotely into Locksport, OzSecCon is where you should be.

I've done a brief writeup of the talks and workshops I attended below.

DAY ONE

‘Keynote: Red Teaming’, by Jek Hyde

Jek works on Walmart Red team. She made it clear that her position on the red team is to achieve physical access - not work on computers. She referred to herself as a “Professional burglar”. She discussed secure facilities syndrome - in which facilities tend to be very hard to get into but once in, is all soft and squishy on the inside due to wanting to promote a good culture. She did a walkthrough of a pentest she did in Canada. Started with dumpster diving. Found out about meeting, made a fake pass, wore fake pregnant belly, used a Bose cloner to clone a pass and got in.
Installed keyloggers, Dropbox, rubby ducky & listening devices. Heard a lady going out for lunch and used her office to gain access to systems. Key takeaway point was that physical and logical are treated separately when they affect each other so much and should be looked at together.

‘Manipulation aids in opening safe locks’, by Jaakko Fagerlund

 Jaakko is from Finland and is a machinist by trade and loves breaking all things mechanical.
Discussed through the techniques of cracking dial combination safes. The wheels within the dial can be different shapes and graphing (turning the wheel through each number). Right contact point (sloped) is the one that is most useful to measure. Showed graphs on the non-roundness of wheels - 0.5mm deviation at some points. Exploits are based on dialing tolerances, cheap electronics, reading wheels in the order W3, W2, W1.
Advanced exploits use electronics to graph the wheel pack, ultimate way is a manipulation robot (autodialler with a microphone - softdrill)

 

‘Cognitive biases and how to be less wrong’, by Alex Hogue

Alex discussed base rate rejection. He explained that people are more likely to look at the evidence without looking at the base rate. Eg. creaks in a plane == evidence of impeding crash despite base rate of crashes being low
He also discussed confirmation bias. Eg. Verifying your hypothesis only with tests that will result in positive confirmation. This can be beaten by using null hypothesis - proving yourself wrong.
Availability Heuristic - if there are more examples in public media, then people assume it is more common eg. Ransomware. Leads to “after a disaster we prepare more”
Others: scarcity bias, loss aversion, sunk-cost fallacy, the halo effect, outcome bias, inattentional blindless, bias bias, cognitive dissidence creates more bias.
Alex concluded with a very entertaining slight of hand routine done to a volunteer from the audience.

‘Tamper resistance bypasses’, by Connor and Emily Morrison

Covered different types of tamper evident seals with some recorded demos of removing them

 

 

 

 

 

 

 

 

‘How to disappear completely’, by Attacus

Atticus provided an overview of “Senseface” - which is a product that detects faces. She showed an admin interface of a Westfield Info booth that records faces estimating gender and age for advertising purchases. Atticus discussed Detection vs Recognition. Detection is allowed without consent because it doesn’t relate to personal or sensitive information. She spoke about the Identity-matching Services Bill 2018 - the Capability will be provided to Home Affairs for national security, identity safety etc. She noted that the Attorney-General's department is in discussion about selling facial records to private companies.
Second part of talk moved to techniques of avoid facial recognition. Talked about how facial recognition worked and old school mitigation techniques include, wearing a balaclava, wearing sunglasses or pulling weird faces to avoid facial recognition.
cvdazzle.com - Adam Harvey, ahprojects.com provides solutions to avoiding facial recognition.

‘Back in time: Finnish lock industry’, by Thomas Covenant

Thomas covered off the history of locks in Finland, which is a leading region of lock production because of the rockiness of the country.
Karelian locks (a region ceded to the Soviet Union from Finland) date back to medieval Finland.
She talked through wooden locks, development of metal and ornamental locks and the spiritual beliefs around locks keeping people safe.
1920s industrialisation heralded Abloy locks in Finland. Designed by Finnish man who repaired a cash till, and saw the rotating disks. 1918 patent registered, sold in 1919 for 34 euros

DAY TWO

‘The ALC Galaxy Lock: an in-depth look’, by Adam Foster

Adam talked about how he bought and disassembled a galaxy lock, released by the Australian Lock Company (ALC). He discussed how it worked and possible ways to attack it. He stated that he had managed to pick it but he hadn't recorded it and couldn’t replicate.

‘Challenge locks’, by nullwolf

Nullwolf started off explaining reasons why you would build challenge locks - Reddit lock-picking awards profile flair for building challenge locks. He covered off on the rules for building a challenge lock eg. At least 6 modifications, working key
Covered shopping list required.
Using a dremel to do pin sculpting

 

 

Impressioning Workshop

I attempted the impressioning workshop... twice! I was terrible at it. But I learnt a lot about the technique and skill involved to impression a key.

 

 

 

 

 

 

 

 

Milling your own cutaway lock 

This is when I realised the value of OzSecCon being run at Melbourne Polytech. Access to all the machining tools allowed a live demo of creating cut away locks (plus many more machining demos that I missed). @anarchy_won did the demo and was patient and willing to answer any questions we had on mill types, techniques and other hints. It was fantastic seeing his passion and knowledge.















As well as the talks and workshops, OzSecCon had an inclusive and welcoming environment. I was greeted with friendliness and helpfulness the whole conference. I attended the female lunch and the Friday night party - both were really enjoyable. The party was catered with Turkish and a neverending bartab!

Overall, I've heard the locksport community likened to what the computer hacker community was 20 years ago. A little edgy and considered borderline inappropriate. However, like the trailblazers that made computer hacking mainstream, OzSecCon is breaking down barriers and making this important topic visible and accessible to everyone. Well done Topy & the OzSecCon Crew!!

BGP route injection - extending VIRL externally

This simulation a demonstration of route injection in a BGP network with 6 AS' - which I demonstrated at CrikeyCon 2018. However, at that time I hadn't been able to extend outside of the VIRL environment so had to browse via wget commands on the server CLI.

Today I had the time to configure my VIRL instance to extend to outside the environment to external devices (in this case a Windows VM).

In retrospect, this wasn't very difficult. But there is very little clear documentation on how to do this. The steps to achieve this were.

1. Configure the flat network under the VIRL Web GUI. Here we specify the IP address range of the external network and the interface on the VIRL VM/machine that we want to link to the external connection. Note down the flat network address.

3. On the VIRL CLI we now find the bridged interface that has been allocated the flat IP Address 172.16.1.254

 virl@virl:~$ ifconfig
br1       Link encap:Ethernet  HWaddr 00:0c:29:37:1c:0e
          inet addr:172.16.1.254  Bcast:172.16.1.255  Mask:255.255.255.0

4. Then make sure eth1 has been associated to the appropriate bridge

virl@virl:~$ brctl show
bridge name     bridge id               STP enabled     interfaces
br1             8000.000c29371c0e       no              dummy1
                                                        eth1

if this isn't the case use the command brctl addif br1 eth1 and check again

5. Add a flat device to your simulation. If connecting to a linux server and wanting to access the rest of the network, make sure you enable routing (ipv4_forward & iptables rules).

6. Ensure the network is configured to use the flat network that you've just setup

7. When the simulation starts you should be able to attach to eth2 however you intend to, and ping/ssh to every device in your simulation (provided you have setup routing within the simulation to enable this)

I wish someone had walked me through this last Feb when I was fairly time poor - but now it's done. I hope it helps someone. Happy simulating!!