Pierre Barreau

Member of the INET team of BNP CIB, in charge of the infrastructure security devices of the company.

Recruted to work for the automation sub team, composed of 3 members.

Main task is to develop and maintain a website of the team, where we’re exposing through a web UI (streamlit) informations of the infrastructure for the members of team and others. For exemple the backup status, configuration compliance, ARP tables of devices or Virtual Servers data from F5 and AVI. We also propose users to execute playbooks without being aware of that by clicking and then it’s generating the full flow on AAP and getting results.

We also expose a backend fast api for those who are interested in, for dashboards or other stuff.

Ansible is used in CLI but mostly via AAP. For the DB, we have redis and mongo. We use Celery for the queuing of tasks.

I mainly worked on automation of execution of playbooks on AAP, fetching all VIP (40k nearly for EMEA as an exemple) and exposing them to users, automation of password management on devices such as Fortinet, F5, Checkpoint.

For ad-hoc tasks I had to configure FW Fortinet that needed to be déployed in market rooms.

Member of the INET CLOUD team, in charge of the private cloud Load Balancer offer and the public clouds infrastructure of the Group.

I was working mainly on the private cloud, at first, doing support of the users. Nearly 15k VIP where deployed on NSX V and NSX T and we were two for managing that.

I participated during my 1st year in the project of replacement of NSX T by NSX ALB (AVI Network). I participated in the architecture definition, the sizing, the tests of charge. I did the automation of the deployment of infrastructure using Ansible. And I automated the validation of the lifecycle of a subscription using Python. I wrote the Perl code for the Centreon plugin to monitor the infrastructure.

The project was abandonned and AVI was finally replaced by HA PROXY FUSION. This time, as I had gain experience in the team, and because of the availability of the colleague I previously used to backup, I took the lead on the subject, regarding the tests of charge, architecture design and automation design. Of course, it was still being checked by the management and more experienced colleagues.

For the occasion, I worked with 2 guys in Portugal to fully automate the deployment of infrastructure and the subscription process through a new portal of the private Cloud, using Celery but reworked. We had Nautobot as a SSoT and we were able to fully deploy a platform of HA PROXY of 3 managers and there workers HAPEE using forms of few lines in Nautobot because everything had been standardized and templatized. We also had written all the Centreon plugins for managing the infrastructure deployed.

Even the tags in NSX were automaticaly added to the managers and workers so micro segmentation could be applied instantly.

Inside a team of 3 permanent Network engineer, in charge of managing the infrastructure of 1300 sites (1100 of them were 1 guy offices, because of the activity).

There was a high demand for automation but no one was here to fill it. I immediatly took that role in the team and was given the opportunity to work on all the technologies that were deployed, with trust, and have been able to progress a lot and provide automation on many subjects such as :

- bastion Wallix : automation of management of groups, temporary accesses, etc …

- cisco meraki : automation of lifecycle of small sites (only one router to configure), automation of operations that are runned everywhere (add a SSID)

- NSXT : automation of security groups management (add / delete) based on the tags in vCenter

- phpIpam : automation of filling the data, based on the collection of data on all meraki sites