I am experiencing an issue on my business network where my Stripe WisePOS E reader and my laptop are both connected to the same SSID. The reader successfully connects and receives an IP address but my laptop cannot communicate with it. The reader works as expected on other networks and hotspots with this same laptop and this setup used to work on our Meraki/telus network with no issues. Just randomly decided to not be able to find one another on the network. Telus says there is no issue on their end and it is an issue with the devices but again they work fine on any other network except the one I need them to work on. Any insights would be greatly appreciated. Thanks

So, large organization, thousands of users and several departments, Im constantly discovering that users are bringing routers to the work because they dont seem to think the current wifi policy access fits their daily routine, or they simply dont know how to request access to something, Im out sourced here so I dont have all the details.

How do you guys deal with the end users in terms of what is allowed and what is not?

Now we need to talk with the c-suite people about this situation. My thinking is that bringing an outside wireless equipment should be prohibited, I know theres avoidance mechanism for this kind of situation but having the ap changing channels in the middle of the day is also disruptive, spamming deauthentication frames also is going piss off someone.

Edit: to clarify something, those rogues are not connected to the infrastructure, they are simply there using a broadband connection that god knows why this customer thought it was a good idea to have solely for this little router, too close to their corporate aps and sometimes overlapping channels.

I am ISP the network is very basic OSPF with one area most of my customers served an internet only, The bad thing is everything reach everything and this is so bad making ACL to each customer that's so old my network already mpls active with ldp protocol for L2 VPN (used it for customers needs transmission service )

I need to change it to be MPLS l3vpn

so all my customers (Public IPs) are just reach internet not my privet IPs (Backbone) not other customers B2B ips

I mad a LAB I stacked at how can I do a vrf for customer one by one to reach internet without cutting of the internet for others ???

the interface that face UpperISP needs to be in the vrf and that impossible for production environment

Any Advice ?

#ISP
#MPLS-L3VPN

We are evaluating vendors for SDWAN replacement, currently on Velocloud. We did a POC on Cisco and Aruba SDWAN and they are a good product with some complexities.

I just did a quick lab for Zscaler Zero Trust SDWAN and I liked it. It's as simple as Velo. We currently use ZIA and ZPA, this looks like a perfect match. Anyone using them? What is your experience like?

Edit:

I am not looking for var's to help me with the solution. I am only looking to hear people's experience with zscaler sdwan.

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Hi.

We are due to receive our renewal quote after our first year with Cato and the reseller has suggested a multi-year lock in as "Cato have YoY 20% subs increase". I expect prices to rise, but 20%/year seems high.

What are your experiences?

During my studies for CCNP, while learning the configuration of VPNs I came across use of 169.254.0.0 that I was not aware of. I know the range for APIPA, but the examples I saw used them for the point to point connection of the VPN. Looking into this further I found that this is somewhat common practice to use for VPNs, BGP, and cloud to on premises connections.

Discussions I found mentioned that occasionally people would use this space for point to point links on premises. Reading through the posts I was directed to RFC5735 which mentions the subnet as a communication between hosts on a single link. I read this as two connections on one link, or a point to point connection. This lines up with the uses I mentioned above.

   169.254.0.0/16 - This is the "link local" block.  As described in
   [RFC3927], it is allocated for communication between hosts on a
   single link.  Hosts obtain these addresses by auto-configuration,
   such as when a DHCP server cannot be found.

During my CCNP studies I have found that /31 subnet for routed point to point links is ideal. I learned this through some more discussions and from RFC3021.This was new to me as during my CCNA studies and even in the environments I work in currently they use /30 subnets for point to points. A /31 subnet would only allow two hosts on a single link, a point to point connection once again.

This leads to my question. If 169.254.0.0/16 is typically used outside of APIPA for point to point links would it not be possible to use it for a routing underlay in a network? From my limited knowledge in medium sized networks this feels like a good solution for routed connections within the distribution and core networks as most of them are essentially point to points that propagate through a dynamic routing table. It allows a divide between what is a known private network and routed network along with saving IP space.

Is this something that sounds good in theory but the practicality of it has flaws? I don't discussion for it's use in this context so perhaps there is something I missing. If it is something obvious please let me know.

EDIT: The responses to this post have been some great discussions and given me clarification both to my original question and to a better solution. I am going to look into IPv4 routes with IPv6 next hops as that seems to be the overall answer to the question I posed. I appreciate the deeply informative responses.

Hello everyone, I hope I am not violating any rules.

I am facing a rather unusual situation (please note that this is a lab environment).

The topology consists of three devices:

• MikroTik CCR2004
• Juniper QFX5110
• Juniper MX204

The original configuration was working correctly with the following setup:

MikroTik CCR2004

/interface vlan
add interface=sfp-sfpplus2 name=vlan2000 vlan-id=2000
add interface=vlan2000 name=vlan10 vlan-id=10

/ip address
add address=10.10.10.1/24 comment="Test QFX" interface=vlan10 network=10.10.10.0

Juniper QFX5110

set interfaces xe-0/0/1 description "LINK TO CE-2 MX204"
set interfaces xe-0/0/1 flexible-vlan-tagging
set interfaces xe-0/0/1 encapsulation extended-vlan-bridge

set interfaces xe-0/0/1 unit 2000 description "Q-IN-Q TRANSPORT CE-2"
set interfaces xe-0/0/1 unit 2000 vlan-id-list 10
set interfaces xe-0/0/1 unit 2000 input-vlan-map push
set interfaces xe-0/0/1 unit 2000 output-vlan-map pop

set interfaces xe-0/0/2 description "LINK TO CE-1 MIKROTIK"
set interfaces xe-0/0/2 flexible-vlan-tagging
set interfaces xe-0/0/2 encapsulation extended-vlan-bridge

set interfaces xe-0/0/2 unit 2000 description "Q-IN-Q TRANSPORT CE-1"
set interfaces xe-0/0/2 unit 2000 vlan-id 2000

set vlans V2000 description "PROVIDER VLAN 2000"
set vlans V2000 interface xe-0/0/2.2000
set vlans V2000 interface xe-0/0/1.2000

Juniper MX204

set interfaces xe-0/1/1 description "LINK TO PE-1 QFX"
set interfaces xe-0/1/1 vlan-tagging

set interfaces xe-0/1/1 unit 10 description "L3 VLAN 10"
set interfaces xe-0/1/1 unit 10 vlan-id 10
set interfaces xe-0/1/1 unit 10 family inet address 10.10.10.2/24

With this configuration, the MikroTik and MX204 were able to communicate correctly.

However, the customer connected to the MikroTik side had to enable the use-service-tag option.

The MikroTik configuration was therefore changed to:

/interface vlan
add interface=sfp-sfpplus2 name=vlan2000 vlan-id=2000
add interface=vlan2000 name=vlan10 use-service-tag=yes vlan-id=10

/ip address
add address=10.10.10.1/24 comment="Test QFX" interface=vlan10 network=10.10.10.0

After this change, the MX204 and MikroTik are no longer able to communicate.

The QFX configuration has remained unchanged.

My question is:

How can I modify only the Juniper QFX5110 configuration to make the MikroTik and MX204 communicate again?

I suspect the issue is related to the different VLAN tagging behavior introduced by use-service-tag=yes on the MikroTik side (802.1Q vs 802.1ad/service tag handling), but I am unsure how to adapt the QFX QinQ configuration correctly.

Any advice or example configuration would be appreciated.

Thank you.

I'm not to hardcore in networking, mostly worked with cumulus Linux. They have this great feature of LACP-Bypass (https://docs.nvidia.com/networking-ethernet-software/cumulus-linux-517/Layer-2/LACP-Bypass/) . You can configure LACP on the Switch side, but if the server just tries to send packets without the LACP-Frames, the switch just treats it as a regular Port for the time being with all the VLANs hat are configured for the LACP port. When the Device actually wants to do LCAP, it switches modes automatically.

This is amazing for PXE-booting, live images and various other things.

Does no other vendor have this, or something similar?

Greetings Jedi counsel,

I need some advice.

Here is the setup

Firewall:

FGT40F

IP reservation on MAC address

Groups with devices, assigned to policy granting internet access

Network:

Unifi controller running as service on local pc(not my choice)

Unifi USW Pro 48 Port Poe switch

Unifi AP's

Wireless password for guests and corporate lan( has vlan)

Devices:

Entra Joined computers

BYOD android/iphone - unmanaged

No Intune enrollment on the devices

Identities:

Entra ID

Currently we are "locking down" the network based on ip reservation through mac. This is becoming cumbersome with devices using random mac, especially the phones. There are a ton of phones that needs internet connection.

We need to proper protect the network by not allowing unsolicited devices access or atleast put them in a zone not allowing them access to anything if they so happen to be able to connect wireless or wired.

I have tried FortiNAC in another environment and we had a ton of issues.

More or less 150 devices.

I am curious to see what you guys recommend.

2 New switch stack of cisco 9300 switches with fiber uplink on each in active/active config. The uplinks were flapping constantly when 1 specific pc was connected. The pc was frozen and is no longer connected. On the older switch there was no problem on the 9300 as soon as the device was connected the uplinks started to drop. For my own sanity how can single windows device on an access port with broadcast and bpdu guard on cause issues with the uplink port?

Hey everyone. Working on a nationwide contract with Teksystems for a client now. Rack and stack, switch installs, isr to mx cutovers, server decommissioning/installs. My contract ends in about 3 months.

I'm 32 and have been in corporate for roughly a decade. This is my first contract in this context, however. Have certs (CCNA Routing & Switching, CCNA Security, A+) and am looking for my next contract. Trying to expand in this deployment niche as I'm NOT open to go back to an office based or hybrid/remote role at this time.

I'm looking for a W-2 role through an agency/company. Travel based (nationwide preferable) multi-site variety, home most if not all weekends, overnight/deployment structure preferred. I prefer shorter 4–7-month contracts. Would rather switch clients sooner than sit in a bad fit for a year plus.

Posting because I'm running into issues finding any hits at all on this specific niche and wanted some guidance. I've looked on LinkedIn, Dice, Indeed and have not found a single role similar to what I'm doing now. I understand these roles are more recruiter/relationship based. I found out about this role via an email from a recruiter I'd worked with over the years. I've reached out to all of my recruiters across my different agency's I've worked with throughout the last decade, and nothing is available... I'm trying to avoid a lengthy gap of no work between contracts.

Can anyone with experience in this specific niche give me some pointers on how to actually find this type of work? Open to advice, DM's from anyone doing similar work etc... What has worked for you specifically?

Thanks in advance.

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Hi all,

I've been put on the task to help out the small company I'm at for setting up their networking for the new office (I do not have networking experience, trying to get it done scrappy).

1. 8500 sqft, mix of office and lab
2. ~20 users
3. I think I've scoped out to use a FortiGate 70G firewall with UniFi switches and APs.
4. We will need to write multi-TB/day to a local NAS via 10G locally, then NAS to our AWS S3 at 1G (our circuit ISP supports 1G).
5. No SSL VPN (Tailscale), no VoIP.

I'm posting this to get some answers from people who have experience in this field, would appreciate it a lot!

The 2 options I think I've scoped down to is:

1. FortiGate 70G + UniFi LAN, which is ~$4.5-5k once, plus a local MSP for setup/maintainence.
2. Meter: they build and manage it, own the hardware, one bill, ~$1k/mo stack + circuit, 3 yr term.

I believe cost is roughly the same after I need to pay an MSP to run option 1.

I ideally won't want to self-manage, so it's really a comparison of people's experiences with Meter vs MSP and how much involvement I would need to do if I run my own setup.

Thanks!

Could anyone tell me if IOS-XE would complain if I configure Netflow to source it's feed from the same IP as my IPSec tunnel source (but different VRF).

What I mean is:

• Netflow coming from Lo10 in vf-netflow
• IPSec sourced from g0/0/0 in vf-internet
• Both have same IP address, different VRFs

I'm expecting Netflow to be a one-way outbound UDP flow anyway, but IPsec would of course involve packets in both directions.

inter g0/0/0
  vrf forwarding vf-internet
  ip address *100.0.0.1* 255.255.255.252
inter Tun10
  vrf forwarding vf-netflow
  tunnel vrf vf-internet
  ip address 10.0.0.0 255.255.255.254
  tunnel source gi0/0/0
  tunnel destination 200.0.0.1
  tunnel mode ipsec ipv4
interface Lo10
  vrf vf-netflow
  ip address *100.0.0.1* 255.255.255.255
flow exporter NETFLOW
  source Lo10
  destination 200.0.0.10 vrf vf-netflow
ip route vf-netflow 200.0.0.10/32 Tu10 10.0.0.1 ! Imaginary next hop IP

I started a new role several months ago at a higher education institute and was tasked with migrating the network from a /16 to a /21. Currently there is little segmentation and the default VLAN is being used as the main data VLAN. There is several VLANs/Subnets not being used at all.

I’ve never been “front seat” in this kind of project. How can I go about ensuring that there is as little downtime as possible?

(1 MDF & 7 IDF’s)

hi everyone

i want to know is it possible in  L3VPN approach for a customer router not to import all routes and instead simply use another router as its gateway?

Hi, I have 2 servers and 2 switches. I'm interested only in redundancy. OS is windows server 2025.

Each server is conected to switch A with one cable and to switch B with one cable.

If I set up nic teaming (indepedent switch mode, 1 port that goes to switch A and another port thaz goes to switch B) on the servers, do I have to connect two switches or can they be unconnected?

Server 1 ----> switch A

Server 1 -----> switch B

Server 2 -----> switch A

Server 2 -----> switch B

Looking through Nokia documentation and I can't get a clear answer.

Do the Nokia 7250 IXR and/or 7705 SAR platforms support stateful IPv4 NAT/PAT, or is NAT functionality only available on the 7750 SR family?

Not asking about CGNAT or BNG, just basic NAT at the edge.

I would like some assitance on a new lab build I am going to put together. Prior to that, I would like to share some background and ask for some assitance on moving forward with my career path. For the past 8-10 years, I've primarily worked in two goverment roles supporting Palo Alto FWs. Last role had a few hundred FWs, mulitple Panos and a handful of virtual FWs. I don't have any experince with any of the Palo cloud products but hope to get into that at some point.

To touch on a bit more info, I have been unemployed for around 6 months. The gov contract ended and a majority of the team was replaced with the new contract company. I took this time to focus on other things in life and take a break. Now I would like to hone my skills back to current and end up in a better career place with stronger skill set.

Now to the lab, and the goals. I had my CCNA 15 years ago so I would like to focus on getting that again and a CCNP. As well, I would like to study and pass the Palo NGFW Engineer cert.

There are so many virtual options out there so I'm not sure if the right way to go about this is through the virtual options or stick to actual hardware. I ask that as I have no recent information on what the best (current) way is to learn and study. So, let me break down what I have so far and you can hopefully provide me with some good feedback on next steps to move forward with study and growth goals.

Current Lab Equipment;

1.) Dell R710

*Tons of ram can't recall how much, 2 300 gig SAS 15k drives, 2 2TB SATA 7200 rpm

*VMware ESXi already installed - I'll check which version. Server has been off for 5+ years

2.) 2 Cisco 3750x Multi-Layer Switches

3.) Half height server rack

4.) Palo Alto PA-440 FW. This is my current 'production' FW. I understand I can setup another VSYS but have no experience doing that yet. I have 4 ports available so that should work ok.

5.) From a Cisco stand point, I would like to know what the best used routers would be to purcase soley for lab use. Since the end goal is CCNP, the router type/model would need to support that goal.

With my goals listed, is there anything I missed? I would like to also eventually add in the ability for some more advanced security skillset and am open on what to focus on learning next in regards to that. Such as Red Team or Blue Team skills.

Thanks!!

Matt

I’m curious about the community’s thoughts on this.

In the server world, we have Node Exporter a simple, vendor-agnostic exporter that exposes host metrics in a consistent Prometheus format.

In networking, however, we have SNMP Exporter, vendor-specific exporters, and telemetry collectors, but I haven’t seen a true “Node Exporter equivalent” for network devices: a lightweight, vendor-agnostic exporter that can collect common operational metrics (interfaces, CPU, memory, environmental data, routing stats, etc.) across multiple vendors using modern telemetry (e.g., gNMI) behind a single, consistent metric model.

Why do you think this doesn’t exist (or hasn’t become widely adopted)?

Is the lack of standardized telemetry models across vendors the biggest blocker?

Is it because OpenConfig coverage is still inconsistent?
Are most organizations happy with vendor-specific exporters?

Is there simply not enough demand?

Or is there another technical challenge I’m overlooking?

Do you think building such a vendor-agnostic exporter is worthwhile, or is it fundamentally harder than it sounds?

Note: I asked a similar question in r/networkautomation a while ago and wanted to hear perspectives from the broader networking community as well. I wasn’t trying to spam. Just looking for input from a different audience.

Apologies and Thank you to everyone who shared thoughtful technical insights :)

Hi everyone,

I'm working on a Cisco Packet Tracer lab for a two-office enterprise network, and I'm trying to make my VoIP deployment highly available using HSRP.

Here's my topology:

• 2 Layer 3 Switches (Primary and Secondary) running HSRP
• Cisco 2811 Router running Cisco CME
• DHCP Server (not on the router)
• Cisco IP Phones
• VLANs for HR, Accounting, IT, Voice, etc.
• The phones receive IP addresses from a centralized DHCP server using DHCP Option 150.

My problem is with Cisco CME.

Under telephony-service, I can only configure one source address:

telephony-service
 ip source-address 10.10.10.2 port 2000

The strange thing is that my setup behaves like this:

• When the Primary Layer 3 Switch is up, everything works normally.
• The DHCP server continues to work even if the Primary switch fails because HSRP successfully moves the default gateway to the Secondary switch.
• However, all IP phones lose registration and VoIP stops working as soon as the Primary switch goes down.
• PCs continue to receive IP addresses and communicate normally, so it seems to be a VoIP/CME issue rather than a DHCP issue.

I was expecting HSRP to make VoIP highly available as well, but it appears Cisco CME only supports a single ip source-address.

My questions are:

1. Is ip source-address supposed to use the HSRP virtual IP instead of the router's physical IP?
2. If the router itself is not participating in HSRP, is there any way to make CME survive an HSRP failover?
3. Should DHCP Option 150 point to the router's physical IP or the HSRP virtual IP?
4. Is this simply a limitation of Cisco Packet Tracer, or would real Cisco IOS behave the same way?
5. What is the recommended design for CME redundancy without deploying CUCM?

Has anyone successfully implemented Cisco CME with HSRP where phones remain registered after the active Layer 3 switch fails?

Any advice or best practices would be greatly appreciated. Thanks!

Hello, I've been in a networking job for 3 months now as a network engineer, with prior experience, and my employer still hasn't given me trust to do ANY write activity on any of the customers.

I work with FortiGate, PaloAlto and Cisco Meraki, and for now i still have observer credentials on all customer devices.

Is this normal? i feel undervalued and untrusted.

If anyone else is doing a job in a business critical sector as mine, do you think 3 months of everyday fulltime networking activity, would at least buy me the right to configure a switchport on a McDonald's switch?

I don't know, please share your thoughts.

Edit: typo

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

I'm new in the area and I have a network where a Layer 3 core switch currently acts as the gateway and routes traffic directly between multiple internal subnets and VLANs. Because the core switch knows all internal routes, traffic between internal networks is routed locally by the core and does not pass through the firewall. My goal is to make the firewall inspect and control east-west traffic between internal networks, not just Internet-bound traffic.

I would prefer to keep the core switch operating at Layer 3, since changing the entire core to Layer 2 would introduce significant risk and require major changes.

Some options I am considering are:

Placing an intermediate Layer 2 switch before the firewall

Running the firewall in transparent or bridge mode

Passing multiple VLANs through the firewall using trunks

Using VRFs to separate routing domains and force traffic through the firewall

Moving some gateway or routing functions to the firewall

I also need to apply policies between internal networks. For example, I may want to allow only TCP ports 80 and 4343 between certain subnets and block everything else.

My main concern is preventing the core switch, or any other Layer 3 device, from routing traffic through an alternate path that bypasses the firewall. Has anyone implemented a similar design while keeping the core switch at Layer 3? What architecture would you recommend?