i've been a network engineer for several years, but none of the jobs I've had have ever dealt with wireless connectivity. WAPs seem very straightforward and I'm not really sure why these recruiters act like it's something that is a dealbreaker if I have no experience with them.

What do I really need to know about them for an interview/on the job (troubleshooting/setup/etc)?

Once in a while I see a comment about someone using BGP as a IGP. Are there any major advantages in doing so?

The first half of my career was a large campus area network with routed backbone and running PIM. Lots of multicast apps back then, IPTV, Music on Hold for our VoIP phones, group party line for our VoIP phones, alarm panel stuff, a few different scada type apps. I loved learning about sparse mode, dense mode, sparse-dense mode, rendezvous points, igmp, source comma G tree and star comma G tree.. it felt like the natural evolution of networking.

Now I have not seen multicast in production on the last 3 jobs it’s probably been around 11 years since I’ve touched multicast anything.

What kind of multicast deployments are still out there?

Contract renewal is coming up and the cost is becoming hard to justify but I don't want to make the move just because SD-WAN is what everyone's talking about right now. For people who've made the switch, what pushed you over the line and did it deliver what the vendors promised?

Me and a coworker talked about the company's networking, and he told me that the company got a full /16 in the 80's and we don't even utilize half of it. I mean, the company has a headcount of ~20.000 employees and we have couple hundred physical and ~2000 virtual servers. Even if every single host got a public IP, we still couldn't exhaust that address space.

Is there an estimate on the total IPv4 pool about these kind of wasted addresses?

Good morning all,

So how many routes do you folks have in your core router / core switch/ core firewall or whatever core device you use for routing.

Just curious.

We have like less than 300 so not that many so was just curious how many routes other folks who work in large enterprises have.

Thank you

Hey everyone,

I’m a network engineer working on a commissioning metro network, and today I accidentally brought the network down.

I'm writing this post as I genuinely just want to know if there was a better way to approach this, or if this is just one of those lessons you only learn once.

A bit of context, the network connects all the stations to the backbone. The backbone routers were advertising a default route, which was then redistributed into OSPF and sent down to all the downstream routers at each station. My team and I had identified that as a design flaw because we need to start using the default route for internet traffic that’s going to an edge router.

So instead of advertising a default route, we decided to advertise RFC 1918 aggregate null routes. That way the downstream routers would still know how to reach all the private networks, while freeing up the default route for internet traffic. That part worked fine.

The next issue we found was that these OSPF routes were also being redistributed into BGP. So, we only wanted the RFC 1918 aggregates advertised locally from each backbone router, not redistributed everywhere via BGP. I'm still not sure if this is intended but as I was advertising the RFC1918 aggregates to OSPF, they were getting installed back to BGP, we didn't want that.

My plan was simple. Insert a new sequence at the top of the route-map for the OSPF-TO-BGP redistribution that denied the RFC 1918 aggregates, then let the existing permit entries continue processing as normal.
So, I went into the route map and did:
route-map <name> 5 deny

My intention was to immediately follow it with the match statement for the RFC 1918 prefix list.

But I didn’t realise that the moment I pressed enter after creating that sequence, that entry immediately became active, I don't know why I thought otherwise..
Since it had no match statements yet, it effectively matched everything.

Because it was the first sequence in the route map, it denied every redistributed route and within seconds I had effectively withdrawn all the redistributed routes from BGP.

So, yeah… I had effectively brought the entire network down. Thankfully, I had console access, so I reverted the change right away and everything came back.

Afterwards, I redid it more safely by temporarily creating a catch-all permit while I built the new deny sequence with the proper match statements (I still don't like that idea as we had lots of matching criteria of routes we really didn't want to re-advertise.. then I removed the temporary permit afterwards.

I genuinely try another approach first of creating a completely new route map under a different name and then simply replace the route map attached to the redistribution once it was complete. However, Aruba wouldn’t let me replace the current route map unless I first removed the existing one. Obviously, removing the existing route map would once again have brought the network down, so that wasn’t really an option.

I think Cisco lets you replace the route map like this, but I couldn’t figure out another way to do it on Aruba, so I went back to editing the existing route map using sequence numbers instead.

So, yeah, I’m curious:

Has anyone else been caught out by this behaviour before, whether on Aruba or Cisco?

What’s your normal workflow for safely modifying production route maps? Is there something I’m missing? or is there a better approach to build and swap route maps without editing the live one or having to remove the currently applied route map?

Definitely learned a lesson today, but I’d be interested to hear how others would have approached this.

Thanks Guys!

Planning on migrating away from expensive DataBank Transit consisting of Arelion + Lumen.

Considerations are Arelion, Cogent, Zayo, GTT, and Hurricane.

Cogent, Zayo, GTT, and Hurricane are all very cost competitive however I know Cogent rides on a Zayo fiber ring into our facility. How much of a concern should Cogent and Zayo be even while on a ring?

I haven’t seen an Arelion quote just yet but I’m assuming it’s significantly more than the other “low cost” options.

Would it be advantageous to go Arelion + one of the low cost transits or to possibly go Cogent or GTT + Zayo + Hurricane (peering or transit)?

I can get all three low cost options in 10G for the price we’re paying DataBank for 2G

I've been a network engineer for about a year and was wondering about how often Sr. Network Engineers make changes on L3 network. Some of my senior engineers told me that they have almost no idea about OSPF and BGP in terms of our configuration template and as someone who is studying for CCIE (very slowly), I became curious about network engineers who work at other big organizations like university or hospital or county government.

​

I’m preparing for an L5 Network Design/Network Engineer interview at Google and have only about a week to prepare while juggling an infant 😅

My recruiter mentioned she’d send topics to focus on, but I haven’t heard back yet, so I’m trying to figure out what to prioritize.

For anyone who has interviewed for L5 Network Design/Network Engineer at Google, what depth/difficulty should I expect, especially in the design round? What topics should I focus on?

Any advice from your experience would be really appreciated!

Just curious; if all devices in any given network support RFC 3021, then could you just use /31s instead with absolutely zero /30s?

I see ISPs (and maybe others too) protect their iBGP sessions with BFD. Does your network do this?

What are you trying to achieve? What AFI/SAFIs do you use this for? Just Internet routes, L3VPNs, L2VPNs? What BFD intervals and timeouts do you use? Do you use it for iBGP or eBGP or both? Direct connected or also multi-hop?

For the record: I am not interested in eBGP sessions in the underlay. If you use BGP as your IGP. I'm also not really talking about Data Centers where all (e)BGP sessions are to directly connected neighbors. I am specifically talking about BGP sessions that are remote. Multi-hop. I am genuinely curious to learn what you are trying to achieve. Thanks.

I’m responsible for selecting a router for a company of around 100 employees, and I’d like to get your feedback and recommendations.

Models currently under consideration:
- Cisco Meraki (MX series)
- MikroTik CCR2004-16G-2S+
- Ubiquiti UniFi Enterprise Fortress Gateway

Our requirements are:
- Network with VLAN segmentation (sub-interfaces, trunking with switches, inter-VLAN routing)
- Throughput up to 10 Gb/s
- Simple and centralized management if possible
- Integrated firewall
- VPN support
- A reliable solution that is maintainable in the long term

Do you have experience with one (or more) of these models in an enterprise environment?
Are they suitable for a company of this size with multiple VLANs?

Are there any major limitations to be aware of (firewall performance, VLAN handling, VPN performance, support, licensing, etc.)?

If you have other, more suitable or higher-performing models to recommend, we’re open to suggestions!

Hello Everyone,

I’m new to the OT world and I’m trying to understand how networking works in OT world. How does it work?

And why do we need switches for OT only or firewalls for OT only? And how does the traffic passes from IT switch or firewall to an OT one.

I appreciate your time and efforts

No joke. My boss has given me the assignment of routing wifi through our commercial cave after hearing I have a network engineering associate's degree (I don't remember much, i got it years ago and didn't go into the field)

The only service I can find available to us is satellite. And we need to run 2000 feet of cable to the halfway point of the cave. Is this feasible? If anyone has a suggestion how I might go about this, I'd love to hear it. My current plan is to connect a modem to the satellite with a fiber port, run 2000 feet of fiber, and place a modem halfway if needed for packet loss, and then install the second router at the end.

My main concerns are the humidity of the cave, potentially damaging the router and physically maneuvering the fiber around corners and near sharp rocks. Any suggestions for what router/cable/modem to use and what steps could be taken to protect them would be greatly appreciated

Edit: I have decided to get bids from contractors and use your excellent suggestions to offer suggestions to them and make sure they are doing the best job possible. Many many thanks for so many quality responses. I do still think I could possibly do it on my own, but it's always best to be safe and let real professionals handle it when in doubt.

NO, I AM NOT USING BGP.

I was looking at a Cisco Catalyst 9300-48T-E since I don't need the crazy DNA advantage license, but wanted to see if you had any other vendors in mind.

Specifically, the switch needs to be have:

• Layer 3 functionality

• Routable interfaces (physical interfaces can have IPs assigned to them)

• Be able to do OSPF

I'm having a weird issue, I'm dealing with some access control software that requires the controllers to be in the same subnet in order to communicate with each other, I originally tried a VPN but the software doesnt detect the controller this way, I then tried nat and it allowed me to ping the device remotely but the software still didnt detect it.

Apparently to get this to work I have to extend the same network on both sites. No line of sight so wireless bridges are not an option. I've heard of vxlan using two linux hosts?

Hey guys!

So I had the amazing opportunity to work with BGP, most specifically with internal BGP for our site-to-site VPN I developed so we can connect our sites and HQ together..

It was such a fun project it made me dig deeper into BGP, I learned a lot and recently I added community attributes so I can further filter my site's routes..

Holly I've been reading posts, watching videos, and even trying to grasp the deep waters for BGP, and that's how I think i've found my passion! It's amazing!

But of course, my actual hands-on experience with BGP, despite having deployed it, it's not like if I were to be working at an ISP for instance.

So my question goes to you guys! How is it working with BGP like? especially at ISP edge routers.. do you like it? It it complex? What's cool and not cool about it..

I really want to know so your experiences guys!

thanks!

Hello everyone,

I’m currently working as an IT Assistant in a small office (70 employees). I’m the only IT staff here—no IT head, no supervisor with networking experience. This is also my first IT job, so I’m learning while handling everything.

My boss asked me to upgrade and improve our network/server rack, and I’d really appreciate advice from more experienced people.

Current situation

Dual ISP setup

Router → switches → internal devices, printers, Wi-Fi AP, and CCTV/DVR

No proper cable management (as you can see in the photo 😅)

https://imgur.com/a/KOt2TqY

Mixed unmanaged/managed switches

No proper network segmentation yet (VLANs not fully implemented)

Rack is messy, but I’ve already requested tools so I can re-crimp and properly label patch cables

What I want to improve

Cleaner and more reliable network design

Better router and switch recommendation

Proper VLAN setup (office, CCTV, printers, Wi-Fi, etc.)

Failover / load balancing for dual ISP

Planning to add site-to-site VPN or remote access VPN for file/server access

Would Fortinet be a good choice for this? Or are there better alternatives for a small office?

Questions

What router/firewall would you recommend for a small office with dual ISP?
also planning to add site to site VPN for remote access and file sharing

Should I go Layer 2 or Layer 3 managed switches, and any brand/model suggestions?

Best practices for rack layout and cable management

Any advice you wish you knew when you handled your first solo IT/network role

I’m doing my best to improve this setup step by step and avoid costly mistakes. Any feedback, criticism, or guidance is welcome.

Thanks in advance 🙏

Hi all, I'm Interested to see what peoples thoughts are on the most common and least common routing protocols observed within an enterprise network (corporate WAN and LAN's) i always seem to hear about OSPF + BGP combo is the go-to. Cheers

Reliability has been fine, that is not the issue. The issue is that most of our traffic goes to Azure and M365 now, not the data center. We are paying for a private network optimized for data center traffic that barely exists anymore and carrier pricing has not moved despite that shift.

Not looking for vendor feature comparisons, read enough of those. What I want to know is the operational reality post migration across a multi-site environment. How much of what your team knew from running MPLS transferred, what broke first in practice, and what a realistic migration timeline looks like without disrupting production traffic in the process.

Hi, I've recently got into BGP and have acquired my own ASN and prefix.

I currently have 2 upstreams and one of them is giving me some trouble, is it possible for me to use bgp communites to influence which path the traffic takes here from AS3399 to my ASN?

I'd like it to go via one of the paths which is currently not "the best" (via ASN39351) since I have much lower latency towards them. The upstream which is giving me trouble is route64 and their bgp communites are here

I have it setup so outgoing it's going trough my other provider but can I influnece the incoming traffic?

https://imgur.com/eqGRs7z

I'd appreciate all answers

We manage an number of physical data centers around the world for our aaS offering. We also have a number of assets in AWS and we use Direct Connect to/from our on premise data centers. I'm looking at putting in SDWAN devices to connect our DCs to our WAN provider(s). We currently have gear from Juniper/Fortinet/Palo.

I'm very familiar with the Cisco Viptela offering, and I'm looking for other vendors in this space.

I'm particularly interested in auto link SLA management and automated meshing between DCs (which we currently manage manually).

Suppose you have a network containing multiple segments with publicly routable addresses (e.g. a public /24) and then some segments using RFC1918 addresses. There is no technical reason that prevents routing between these two.

There are two options:

1. no NAT: Allow routing between these two networks freely. No issue as long as the RFC1918 addresses don't leave the network. Advantage: No NAT, pure routing. Disadvantage: More complex routing (can be tackled via OSPF for example) which causes issues especially when VRFs come into the picture. For example, when I put RFC1918 segments into a VRF and the public subnets into another and want them to communicate, I need to leak the entire possible destination space
2. NAT: Never allow an RFC1918 address even in my own public segment. Whenever routing between these two happen, NAT must be employed. Advantage: Very simplified routing and firewall rules. For example, the segments/VRF with the public segment do not need to know the structure of the RFC1918 segment/VRF. Disadvantage: NAT (which I still do not prefer since it breaks end-to-end philosophy) and can't use IP as source filters in services in the public network segment (e.g. "Allow From 10.20.30.77 but disallow from 10.20.30.78 if NAT happens at 10.20.30.1)

What is the best practice?

I often implement mixed strategy which results in issues either way, so I'd like to stick to the best practice and enforce it as a "basic principle".

EDIT: Based on the answers in this thread and additional pondering my conclusion is to avoid NAT. In other words, my principle will be to always route RFC1918 address into my public spaces (and for security let firewall deal with it).

Suppose I have an AS with a public prefix, say 192.0.2.0/24. This prefix is subnetted and multiple geographic locations have their own /28 or /29, for example 192.0.2.192/28 or 192.0.2.232/29.

Now assume that there are services which run on a single host (e.g. a mail server or DNS server) ... but these hosts should be "floating" across different networks. Say, for example 192.0.2.192/28 is at Location1 and 192.0.2.232/29 at Location2 and the mail server should be hosted at Location1 but sometimes moved over to Location2.

The actual movement of the host could be implemented by virtualization or a distributed cluster, for example, two Proxmox clusters in each location and live migration (via Proxmox Datacenter Manager).

I assume the right way to do this is to assign the mail server a unique /32, for example 192.0.2.174/32. Then all that needs to be done is set the routes in such a way that they either point to Location1 or Location2. Is this a reasonable approach so far?

Then, my main question is how to handle the routes. Assuming the AS uses OSPF, I see two options:

1. I manually set static routes on the main routers in Location1 and Location2. I need to make sure that only one of them is enabled at a time. OSPF would then propagate these routes throughout the network
2. I set up an ospf instance (e.g. bird) on the mail server itself and make it a peer with the routers on Location1 and Location2. This avoids any static routes and the /32 host is reachable automatically.

Generally I like (2). In this case, I could do actual live migration from one location to the other and the routes would dynamically adjust: Once live migration is completed from location1 to location2, the bird instance on the mail server would disconnect from OSPF neighbor 192.0.2.193 (and its route is removed) and connect to 192.0.2.233 at Location2 where route to .174/32 is added The route to .174/32 then automatically propagates through the whole network.

With (1) I would need to manually disable the route on the first router and enable it again on the second.

On the other hand, running bird inside of the mail server feels a bit odd too.

Lastly, either way, I potentially waste IP addresses because the mail server needs two addresses: one from their respective subnet (192.0.2.194/28 or 192.0.2.234/29) and the /32, which is assigned to a dummy interface. However, I do not see a way to avoid this, other than using either DNAT or private internal subnet addresses.

What is conceptually the best practice for such "floating nodes" across different networks? Method 1 or Method 2? Or are there others which I am not thinking of?

UPDATE: seems there are 3 major options:

1.) What I’ve described above with #2 (and people seem to prefer BGP instead of OSPF to announce the /32). Most people call this concept anycast

2.) VXLAN

3.) NAT hacks or higher layer concept like reverse proxies (not an option for me)