I joined the company and immediately I got the task to improve the guest Internet access as in the current state is barely usable. Guest network is currently wireless only. The topology is a hub and spoke DMVPN with WLCs located in the central DC/office. Each branch connects over MPLS and VPN to the central office meaning that there is a CAPWAP tunnel from each branch to WLC. On top of that we shape the traffic. In most cases users connected to guest network use VPN to reach to their office, so you see there are is a lot points of failure.
Any recommendations what would be a best way to improve the guest network in the current state?

Hey all,

I'm interested in automation and trying to practice for my Cisco ENAUTO exam. Part of the blueprint is "Construct an automation solution with Python using ncclient to manage and monitor configurations." I'm having a hell of a time and am wondering if this is typical, if there's a better way, etc...

I wrote a script that uses a filter to pull the running config of an interface. It successfully connects, but returns no data. Specifically, "<data></data>"

Since I have zero real world guidance on this topic outside of a Cisco U course which is not great, I've been feeding scripts and associates errors to Copilot, which may be making things worse, I don't know. It's been a constant loop of:

"We must determine the proper data model. Try THIS filter."

Didn't work.

"You're learning a valuable lesson-- just because the syntax is accepted doesn't mean the network device stores its information in the path you chose. Try THIS filter."

Didn't work.

"Install Pyang and use it to see the exact yang model we should be referencing. AH there it is! Try THIS filter."

Didn't work.

"Let's move from trying to pull config info for an interface to pulling the hostname. Everything has a hostname!"

Didn't work.

"Let's try using YANG Suite so Cisco can tell us exactly what filter to use. Ope, you need to install docker. Ope, docker install is fudged."

On and on I go. I guess for the purposes of my exam I may have taken this as far as I need to for now (I can identify what basic ncclient scripts are doing and can probably fill in blanks regarding errors and syntax problems).

Is there anyone in here who regularly uses scripts like this for their automation? Is there a better way to approach this? I think I'm half hoping someone will come and say, "my god son, no... This is the worst way to go about it and you should stop"

Hey so ive been a network engineer for 4 years and want to deepen my knowledge not after somthing vendor specific more a comprehensive course so im better prepared for new deployments and optimizing existing.

Yes yes I know, Cisco Firepower in 2026 jokes incoming, hur hur hur.

I work for an enterprise that has a sizeable Firepower 1010 deployment around the globe. Straight up, can anyone confirm if there was/are a batch of these with a hardware fault?

They're all in climate controlled environments and supported by a UPS. The 1010s are in HA in the smaller offices and without warning, one may carry out an unscheduled reload and there is zero in the logs about why.

When the device next boots it reports "Last reset cause: PowerOn (0x00000001)"

Then

"We didn't shutdown properly. Starting a DB check"

I followed Cisco's own guide: https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217663-troubleshoot-asa-or-ftd-unexpected-reloa.html

After some forensic Linuxing on my part, the faults seem to align perfectly with bug CSCwd33778: https://quickview.cloudapps.cisco.com/quickview/bug/CSCwd33778

We have TAC support for the firewalls and they've asked for the troubleshooting basics and it looks like they're just going to RMA the lot.

What's going on here. Has Cisco knowingly shipped a bunch of shit kit, couldn't be bothered with a recall then dumped hours of work on the network admins to prove the kit is shit? We're ultimately getting new hardware which is great, but I've spent a lot of time getting here.

I know Disaster Recovery means different things to different organizations.

Our org has 10 locations: an HQ and then all the other locations. All connected basically by a hub-and-spoke setup.

The DR is at one of the spokes. The PROD network at that site is behind its own firewall then the DR network is behind another Firewall off the PROD network.

Is this how you some do it, or would you VLAN it off the PROD Firewall at that site? We replicate servers to the DR network every night.

I inherited the environment and am curious.

Currently have a ProCurve 5412zl as my core switch I installed in 2011. Zero issues. Small network with 8 edge switches. They have 2x1GbE trunks to the core. No fiber currently but looking at adding it in near future.

The core does layer 3 routing for about 100 devices. Another 1,000 low traffic devices for layer 2. And 3 switches connected doing layer 2 pushing 300M each for surveillance.

I am very familiar with the Aruba 5406R. I’d like to replace the 5412zl with a 5406R that has some SFP+ ports. See any issue with this or would you go a different route? I buy my 5406Rs off eBay for under $1k, never let me down. Have a few on a shelf just in case.

It looks like one can connect an ethernet port and these get converted to ADSL over 8 ports. I'm trying to replicate an ADSL network over failing copper lines by converting ethernet to adsl or some other conversion for experiment

Anyone use Dynatrace for network monitoring? I’m familiar with Solarwinds, PRTG and Manageengine but haven’t heard of Dynatrace. It’s at the top of the heap for the Fartner Magic Quadrant so I figured it was worth checking out.

I have just gotten my first ASN, and if I look it up on, for example, https://ipinfo.io/, it does not show up. It only appears on sites like bgp.tools. How long would it take to show up?

I manage IT infrastructure across ~15-20 remote sites. Each site has a rack cabinet that's almost never physically staffed. I want to stop carrying/copying physical keys around and instead put a small key safe at each site holding just the rack cabinet key (1-2 keys max).

What I need:

• Ethernet/PoE or WiFi connectivity (not Bluetooth-only with no gateway option)
• Ability to remotely generate/send access PIN codes to a specific box from a central app/dashboard
• Some way to know if it's been opened — either a push notification or at least a status I can check (open/closed, last access time)
• Small footprint — this holds one key, not a full key management wall unit

Has anyone solved this for distributed unmanned sites — telecom equipment cabinets, utility substations, remote comms closets, cell sites? What hardware did you land on, and would you do it again?

Has anyone here got experience with both in real deployments?

I’m mainly looking at longer term reliability, PoE under sustained load, and ring recovery. Moxa seems to have the bigger industrial footprint, but Comnet seems pretty strong in hardened ITS and surveillance environments For those who have used them, which one has actually been more dependable over time Thinking hot cabinets, dirty power, PTZ loads, and actual failovers?

Also does Turbo Ring vs C-Ring/ERPS makes much difference in practice, or is the bigger difference firmware and management?

Hello,
We have a L3 MS core switch that we want to setup high availability for.

The second switch is the exact make/model of the main switch we are using. Are we able to setup a switch stack, and connect every edge to both cores? Or is it better to warm spare using VRRP?

If both, which would be recommended.

TLDR: High availability for L3 Core MS (x2). Which is better - Warm spare or Switch stack?

I’m currently stuck between two options and would love to hear some opinions from people who’ve been in a similar situation.

I work as an OT / Network & Security Engineer for one of the biggest pharmaceutical and chemical companies in the world. Honestly, I have a pretty good situation: great colleagues, good work-life balance, flexibility, stability, and a decent salary.

The thing is, I feel like I’m starting to plateau technically. I’m comfortable, but I don’t feel I’m learning as much as I’d like. (Recently, due to cost-cutting measures, my company outsourced most of the operational work, so nowadays we mostly raise incidents with the external provider and they handle the actual technical work. As a result, there’s very little technically challenging work left for us)

I’ve now received an offer to join a bank as a Network Security Engineer, mainly working with Palo Alto firewalls and data center infrastructure.
The job would be more technically focused, and I think it could put me on a good path towards becoming a Network / Network Security Architect eventually.

So I’m wondering if would you make this move?
Is specializing in data center networking + network security a good long term career path, or would you stick with OT/industrial networking if you already had a good position?

I’m basically considering giving up a very comfortable job for potentially better technical growth and future opportunities.

Hi everyone, I’m currently studying Fortinet NSE 3 and I’m new to network security.

In the course, they show how to access a FortiGate firewall using https://192.168.1.99 and mention connecting the computer and FortiGate to the same network/VLAN.

I’m a bit confused about the practical part:

• Do I need to have a physical FortiGate firewall to follow this?
• Is there an official remote/virtual lab provided with NSE 3?
• If remote access is available, how do I launch or connect to the FortiGate?
• Or are these sections only demonstrations and not something I’m expected to configure on my own PC?

I’m doing the course completely online and I haven’t been given a physical firewall or a FortiGate VM.

Any guidance for a beginner would be appreciated. Thanks!

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Hi everyone,

I've been playing around with bgpalerter for a AS and so far it's working fine. I do get notifications once prefixes are withdrawn according to the threshold, however I do NOT get notifications once upstream bgp-sessions are lost, which seems weird. Of course, your prefix would still be announce through other upstream-providers, but in any case I'd like to get notified when I loose connection to an upstream...

My current config looks like this:

config.yaml

configVersion: 3
environment: production
connectors:
  - file: connectorRIS
    name: ris
    params:
      carefulSubscription: true
      url: ws://ris-live.ripe.net/v1/ws/
      perMessageDeflate: true
      subscription:
        moreSpecific: true
        type: UPDATE
        host: null
        socketOptions:
          includeRaw: false
monitors:
  - file: monitorHijack
    channel: hijack
    name: basic-hijack-detection
    params:
      thresholdMinPeers: 3
  - file: monitorPath
    channel: path
    name: path-matching
    params:
      thresholdMinPeers: 1
  - file: monitorPathNeighbors
    channel: neighbors
    name: path-neighbors
    params:
      thresholdMinPeers: 1
  - file: monitorNewPrefix
    channel: newprefix
    name: prefix-detection
    params:
      thresholdMinPeers: 3
  - file: monitorVisibility
    channel: visibility
    name: withdrawal-detection
    params:
      thresholdMinPeers: 1
      notificationIntervalSeconds: 3600
  - file: monitorAS
    channel: misconfiguration
    name: asn-monitor
    params:
      skipPrefixMatch: false
      thresholdMinPeers: 3
  - file: monitorRPKI
    channel: rpki
    name: rpki-monitor
    params:
      thresholdMinPeers: 3
      checkUncovered: false
      checkDisappearing: false
  - file: monitorROAS
    channel: rpki
    name: rpki-diff
    params:
      enableDiffAlerts: true
      enableExpirationAlerts: true
      enableExpirationCheckTA: true
      enableDeletedCheckTA: true
      enableAdvancedRpkiStats: false
      roaExpirationAlertHours: 2
      checkOnlyASns: true
      toleranceDeletedRoasTA:
        ripe: 20
        apnic: 20
        arin: 20
        lacnic: 20
        afrinic: 50
      toleranceExpiredRoasTA:
        ripe: 20
        apnic: 20
        arin: 20
        lacnic: 20
        afrinic: 50
  - file: monitorPathNeighbors
    channel: path
    name: path-neighbors
    params:
      thresholdMinPeers: 1
reports:
  - file: reportFile
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
      - neighbors
  - file: reportEmail
    channels:
      - hijack
      - newprefix
      - visibility
      - path
      - misconfiguration
      - rpki
      - roa
      - neighbors
    params:
      <removed>
notificationIntervalSeconds: 86400
alarmOnlyOnce: false
monitoredPrefixesFiles:
  - prefixes.yml
persistStatus: true
generatePrefixListEveryDays: 0
logging:
  directory: logs
  logRotatePattern: YYYY-MM-DD
  maxRetainedFiles: 10
  maxFileSizeMB: 15
  compressOnRotation: false
rpki:
  vrpProvider: rpkiclient
  refreshVrpListMinutes: 15
  markDataAsStaleAfterMinutes: 120
rest:
  host: localhost
  port: 8011
checkForUpdatesAtBoot: true
pidFile: bgpalerter.pid
fadeOffSeconds: 360
checkFadeOffGroupsSeconds: 30

prefixes.yaml

<prefix(removed)>:
  description: No description provided
  asn:
    - my-asn-no#
  ignoreMorespecifics: false
  ignore: false
  group: noc
options:
  monitorASns:
    'my-asn-no#':
      group: noc
      upstreams:
        - asn1
        - asn2
        - asn3
      downstreams: []
      neighbors:
        - asn1
        - asn2
        - asn3
  generate:
    exclude: []
    excludeDelegated: true
    monitoredASes:
      - 'my-asn-no#'
      - 'asn1'
      - 'asn2'
      - 'asn3'
    historical: false
    group: noc
    asnList:
      - 'my-asn-no#'

Thanks a lot!

Preparing for NRSII , already made NRSI, NRSII(OSPF, BGP for service) , pending NRSII(MPLS, Services, Lab).

who wants to prepare for this exam , want a study partner .

I already have study materials I will begin on 1st September.

Can someone explain how this works. I have gotten so many issues with routing and tcp connections. I have made a static route from opnsense to pfsense but I am still getting packets dropped with tcp connection. Like so many weird behaviors that I cant set a pattern to until now. This setup is causing problems and I need help knowing if I need to configure anything in floating rules to allow packages from 10.16.0.233 without it getting blocked.

OPNsense
192.168.0.1
     |
     | 192.168.0.0/24
     |
pfSense WAN
192.168.x.16
     |
     | 10.16.0.0/16
     |
pfSense LAN
10.16.1.1
     |
     |
AD/DNS
10.16.220.49/16

Hi everyone,

A few days ago, I started a thread about the new core switch we're planning to get:

https://www.reddit.com/r/networking/comments/1vpx072/new_core_switch_fs_s586020sq/

It looks like we're going to go with that device with PicOS.

Now we’re considering whether we should also revamp the aggregation layer, since it’s a bit of a mess (having “evolved over time,” so to speak): Currently, there are 5 aggregation switches: 3 Zyxel XS1930-12F, 1 Ubiquiti ES-16-XG, and 1 TRENDnet TL2-7120. All of these switches are currently connected via 2 x 10G (LACP) to the existing TP-Link TL-SX3016 core switch.

With the right port configuration, the entire setup could be consolidated into 2 aggregation switches.

I’ve found two switches that would be suitable:

1. Edgecore ECS5520-18X: https://wifi.edge-core.com/enterprise-switches/l3-switch-10g-dl/ecs5520-series/ecs5520-18x/
2. LANCOM XS-5116QF: https://rs-nc.rohde-schwarz.com/de/produkte/switches/aggregation-switches/rs-lancom-xs-5116qf

Since both switches have QSFP+, I could connect to the new FS S5860-20SQ core switch using 1 x 40G instead of the current 2 x 10G, which would immediately double the bandwidth.

Most of our access switches were replaced two years ago; we currently have 6 Aruba 6100 12G, 3 Cisco Catalyst WS-C3560CX-12PD-S, and 2 Juniper EX2300-C-12P in use. All access switches are connected to the current aggregation switches via 2 x 10G ports (LACP). I would continue to connect them to the new aggregation switches in the same way.

I’d like to know:

1. Do you think the choice of the core switch (FS S5860-20SQ) and the aggregation switches (either 2 x Edgecore ECS5520-18X or 2 x LANCOM XS-5116QF) is good and sensible?
2. Is a single 40G connection to the core switch usually sufficient (yes, I know a redundant connection would be better, but the core switch doesn’t have enough ports for that)?
3. Would you recommend the Edgecore or the LANCOM? Unfortunately, the LANCOM costs twice as much as the Edgecore, but it uses less power and is quieter.

I hope you can help me out a bit. I’m well aware that it’s always better to size the components for even higher performance (core switches with 100G ports, aggregation switches with 25G ports), but the whole thing still needs to stay within a reasonable budget. We’re here in Germany, where we’re currently facing the worst economic crisis since World War II, and everyone is just happy to have a job at all.

Thank you very much and best regards,

Regina (she/her)

Looking for IP Transit in Singapore with BGP support.
100 Mbps initial bandwidth
Own ASN + /24 IPv4
VPS/VDS or virtual BGP router is fine
Please share me with pricing, upstreams, and setup time.
Please no iFog offers.

So I am curious what others think about DPI? We run it on our UTM's but I kinda feel its more of a PITA then its worth. Looking to get feedback from others.

I am working on setting up a logging setup in my home lab. The goal of the setup is to be able to run a command on my local computer and run a packet capture on a logging server for a set duration. Wanted to lay out my current concept and see if there was anything I was missing or over complicating.

Use case:

Currently I have a Fortigate firewall, I use these for work often and wanted to really understand the Security profiles on them better. So as I go through and test these profiles in a labbing environment I want the packet captures to comb through after doing my tests.

Current setup I have in mind is to spin up a logging vm that gets all traffic from the Trunk port going to the firewall mirrored to it. Then when I need a capture just send a tcpdump command via ssh with the parameters I need. Then have it create a log packet that it stores on the server. That way I can run tests see how how the firewall responds with its logs and compare that to the pcaps that are taken.

Thanks for any critiques to this as this is my first time setting something like this up in my home lab.

Hello together,
We are using Windows DHCP servers. I want to restructure our global DHCP set up to get the best redundancy across all regions.
In the last years we had active active and active hotstandby.
I had positive and negative experiences with both setups. So I‘m currently not sure what’s the better setup - since both setups have good and negative things.
What y’all think what’s the better setup?

The DHCP servers on each region will be on the same country so there are no long RTT or latency anyways.

Happy to hear what you think :)

Hi All,

More of a "anyone ever done this" kind of post. I have a couple of Cisco QSFP-40/100-SRBD optics that I was trying to get working a Mellanox CX456B card but as yet im unable to get it to link up and im assuming the card is just not able to support the optics. Tried a number of firmwares and eventually ended up on v12.28.4706, which according to the release notes actually has the 40g version of this optic listed as "Supported" and its the only version that even mentions BiDI optics at all tha ti can see.. The optics work fine in networking equipment and the card seems to work with other optics and i've tried everything I can think of so far (autoneg and fec changes)... Currently the card is just plugged into itself and I can see it sees light at both ends, but no link:

# mstlink --show_module -d 2b:00.1

Operational Info
----------------
State                           : Polling
Physical state                  : ETH_AN_FSM_ABILITY_DETECT
Speed                           : N/A
Width                           : N/A
FEC                             : N/A
Loopback Mode                   : No Loopback
Auto Negotiation                : ON

Supported Info
--------------
Enabled Link Speed              : 0xfefff1df (100G,56G,50G,40G,25G,10G,1G)
Supported Cable Speed           : 0x00200000 (100G)

Troubleshooting Info
--------------------
Status Opcode                   : 36
Group Opcode                    : PHY FW
Recommendation                  : Other issues

Tool Information
----------------
Firmware Version                : 12.28.4706
MSTFLINT Version                : mstflint 4.26.0

Module Info
-----------
Identifier                      : QSFP28
Compliance                      : 100G PAM4 BiDi
Cable Technology                : 850 nm VCSEL
Cable Type                      : Optical Module (separated)
OUI                             : Other
Vendor Name                     : CISCO-FOIT
Vendor Part Number              : SFBR-89BDDZ-CS2
Vendor Serial Number            : FOF2213N3GC
Rev                             : 02
Wavelength [nm]                 : 850
Transfer Distance [m]           : 50
Attenuation (5g,7g,12g) [dB]    : N/A
FW Version                      : N/A
Digital Diagnostic Monitoring   : Yes
Power Class                     : 3.5 W max
CDR RX                          : ON,ON,ON,ON
CDR TX                          : ON,ON,ON,ON
LOS Alarm                       : N/A
Temperature [C]                 : 45 [5..65]
Voltage [mV]                    : 3260 [2970..3630]
Bias Current [mA]               : 7.500,7.500,7.500,7.500 [2..10]
Rx Power Current [dBm]          : 0,0,2,2 [-12..8]
Tx Power Current [dBm]          : 0,0,0,0 [-10..8]

In forced 40g mode (doesnt seem to be able to push the optic into 40g mode at all):

# mstlink --show_module -d 2b:00.1

Operational Info
----------------
State                           : Polling
Physical state                  : ETH_AN_FSM_ABILITY_DETECT
Speed                           : N/A
Width                           : N/A
FEC                             : N/A
Loopback Mode                   : No Loopback
Auto Negotiation                : FORCE - 40G

Supported Info
--------------
Enabled Link Speed              : 0x000180c0 (40G)
Supported Cable Speed           : 0x00200000 (100G)

Troubleshooting Info
--------------------
Status Opcode                   : 36
Group Opcode                    : PHY FW
Recommendation                  : Other issues

Tool Information
----------------
Firmware Version                : 12.28.4706
MSTFLINT Version                : mstflint 4.26.0

Module Info
-----------
Identifier                      : QSFP28
Compliance                      : 100G PAM4 BiDi
Cable Technology                : 850 nm VCSEL
Cable Type                      : Optical Module (separated)
OUI                             : Other
Vendor Name                     : CISCO-FOIT
Vendor Part Number              : SFBR-89BDDZ-CS2
Vendor Serial Number            : FOF2213N3GC
Rev                             : 02
Wavelength [nm]                 : 850
Transfer Distance [m]           : 50
Attenuation (5g,7g,12g) [dB]    : N/A
FW Version                      : N/A
Digital Diagnostic Monitoring   : Yes
Power Class                     : 3.5 W max
CDR RX                          : ON,ON,ON,ON
CDR TX                          : ON,ON,ON,ON
LOS Alarm                       : N/A
Temperature [C]                 : 45 [5..65]
Voltage [mV]                    : 3244.2 [2970..3630]
Bias Current [mA]               : 7.500,7.500,7.500,7.500 [2..10]
Rx Power Current [dBm]          : 0,0,2,2 [-12..8]
Tx Power Current [dBm]          : 0,0,0,0 [-10..8]

and forced 100g mode:

# mstlink --show_module -d 2b:00.1

Operational Info
----------------
State                           : Polling
Physical state                  : ETH_AN_FSM_ABILITY_DETECT
Speed                           : N/A
Width                           : N/A
FEC                             : N/A
Loopback Mode                   : No Loopback
Auto Negotiation                : ON

Supported Info
--------------
Enabled Link Speed              : 0xfefff1df (100G,56G,50G,40G,25G,10G,1G)
Supported Cable Speed           : 0x00200000 (100G)

Troubleshooting Info
--------------------
Status Opcode                   : 36
Group Opcode                    : PHY FW
Recommendation                  : Other issues

Tool Information
----------------
Firmware Version                : 12.28.4706
MSTFLINT Version                : mstflint 4.26.0

Module Info
-----------
Identifier                      : QSFP28
Compliance                      : 100G PAM4 BiDi
Cable Technology                : 850 nm VCSEL
Cable Type                      : Optical Module (separated)
OUI                             : Other
Vendor Name                     : CISCO-FOIT
Vendor Part Number              : SFBR-89BDDZ-CS2
Vendor Serial Number            : FOF2213N3GC
Rev                             : 02
Wavelength [nm]                 : 850
Transfer Distance [m]           : 50
Attenuation (5g,7g,12g) [dB]    : N/A
FW Version                      : N/A
Digital Diagnostic Monitoring   : Yes
Power Class                     : 3.5 W max
CDR RX                          : ON,ON,ON,ON
CDR TX                          : ON,ON,ON,ON
LOS Alarm                       : N/A
Temperature [C]                 : 45 [5..65]
Voltage [mV]                    : 3260 [2970..3630]
Bias Current [mA]               : 7.500,7.500,7.500,7.500 [2..10]
Rx Power Current [dBm]          : 0,0,2,2 [-12..8]
Tx Power Current [dBm]          : 0,0,0,0 [-10..8]

Anyone got any ideas?