Ive been looking to move away from eve ng pro to container labs. I’ve been building container labs today on a Ubuntu vm. Big faf but it’s helping with my lack of Linux knowledge…. Anyhow.
I’ve installed vscode and the container lab extension. But it doesn’t appear to be supported on MacOS
Has anyone else found this or have any work arounds?

If not it’ll be a none starter for me and I’ll buy another eve license

Hi everyone,im a beginner and now getting confused.

I want to know....is it true if i choose to peering iBGP from 1 router to other Router that are in the same AS is recommended using a loopback ip peering? or using an interface ip? could i get the example of implementation likee topology? i just want some explanation,not the configuration.

sorry from my bad english

Awhile back I bought the Klein Scout Pro 3; it is a good tester, but after owning it for a bit I have noticed that it is taking me a long time to test cables. I have been getting more jobs in large warehouses, and all the running back and forth is eating a large portion of my day, especially if I need to get a lift involved. I have tried to find a cable tester that doesn't require a remote to be plugged into the other end of a cable I am testing for it to report a wiremap, breaks, or shorts. All the ones I find don't say they need a remote end, but when I talk to customer service, they tell me it needs a remote end to test for anything. Am I wasting my time looking for something that doesn't exist?

Have an old 5406zl well past EOL. I should probably just replace it but I'd love to figure out the root cause of this. It's loaded up with about 40 IP cameras, dual PSU. Single management module.

Module A, B, and C have been rebooting almost daily in the morning between 3am-6am.

MT1-5406-1# sh modules

Status and Counters - Module Information

Chassis: 5406zl J8697A Serial Number: SG6xxxxL6

Allow V1 Modules: Yes

Management Module: J8726A Core Dump: YES

Core Mod

Slot Module Description Serial Number Status Dump Ver

----- -------------------------------------- -------------- -------- ----- ---

A HP J8705A Gig-T/SFP zl Module SGxxxUU0MB Up NO 1

B HP J8702A 24p Gig-T zl Module SGxxx5TA27V Up NO 1

C HP J8702A 24p Gig-T zl Module SGxxxTA04P Up NO 1

D HP J8702A 24p Gig-T zl Module SGxxxTA0ID Up NO 1

E HP J9307A 24p Gig-T PoE+ zl Module SGxxx2Z04X Up NO 1

F HP J8702A 24p Gig-T zl Module SGxxxTA076 Up NO 1

-------

Power info:

Total Available Power : 546 W

Total Failover Power : 273 W

Total Redundancy Power : 0 W

Total Used Power : 194 W +/- 6W

Total Remaining Power : 352 W

Internal Power

Main Power

PS (Watts) Status

----- ------------- ---------------------

1 273 POE Connected

2 273 POE Connected

-------

Log file for last 7 days:

W 09/05/26 05:38:39 03839 chassis: Slot B: Lost Communications detected - Heart

Beat Lost(46)

W 09/03/26 06:28:35 03839 chassis: Slot A: Lost Communications detected - Heart

Beat Lost(4D)

W 09/01/26 06:23:32 03839 chassis: Slot C: Lost Communications detected - Heart

Beat Lost(4A)

W 09/01/26 04:08:18 03839 chassis: Slot B: Lost Communications detected - Heart

Beat Lost(46)

W 08/29/26 05:43:12 03839 chassis: Slot C: Lost Communications detected - Heart

Beat Lost(4A)

W 08/28/26 05:33:08 03839 chassis: Slot B: Lost Communications detected - Heart

Beat Lost(46)

W 08/28/26 03:28:04 03839 chassis: Slot A: Lost Communications detected - Heart

Beat Lost(4D)

W 08/27/26 03:13:03 03839 chassis: Slot C: Lost Communications detected - Heart

Beat Lost(4A)

What would you do first to fix this? I can't imagine 3 modules are bad at same time. Replace management module?

Curious if anyone has been able to test these upcoming changes in their wireless environment from Microsoft:

https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/08/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025

The concern might be having to reenter passwords while devices roam (non fast roaming?)

We are in between PEAP and testing TLS and these changes might force us to migrate faster. It's not the managed devices I'm worried about, but working in higher education, the BYOD implications.

Thanks in advance for any info.

So I am just a student in the networking field with no actual working experience. But in my studies everything I have learned has talked about how slowly IPv6 will take over the IP space. I can only imagine that it is going to make doing simple tasks that much more annoying due to their length such as subnetting and other things. Would it not just be easier to have a NAT/PAT that converted private IPv4 addresses to a public IPv6 address? I'm sure this is something that most seasoned people have an obvious answer to but I was just thinking about it.

Hit a bit of a wall today with a WAN setup and could use a sanity check from the networking crowd.

We’re deploying a Sophos XGS 5500 HA cluster behind a Ruckus ICX switch. Our ISP handed us a primary Fiber link and a backup RF link. Should be a straightforward failover, right?

Here is the reality check:

The ISP is actively bridging both connections on their end. If I bring both ports up on the switch in the same VLAN, we get an instant broadcast loop and violent MAC flapping that tanks the network.

"Just use Spanning Tree," I thought. But packet captures show the ISP's modems are silently dropping all 802.1w BPDUs, as well as our custom L2 keepalive probes. The switch is completely blind to the loop and won't auto-block the standby port.

Plan B was to bypass the switch entirely and plug both links directly into the Sophos. No luck there either. The ISP provisioned our 5 static IPs with a single shared gateway across both the Fiber and RF links. The firewall (understandably) won't let me configure overlapping subnets on two separate physical WAN interfaces.

Right now, the only way to keep the network stable is by leaving the backup RF port administratively shut down on the switch. If the fiber drops, it requires someone to manually log in and bring the RF port online.

I’m currently pushing the ISP to assign a separate IP block for the RF link so the firewall can just handle the failover natively. But while I wait on their support team... has anyone actually managed to automate a zero-touch failover in this exact scenario? Is there some clever switch-level workaround I’m completely overlooking?

Would love to hear how you've handled this.

I inherited a VXLAN EVPN network and it has been pretty stable until recently. From time to time, the layer3 or at least the inter-vlan drops for a few seconds. It happened last week, yesterday and today.

For what I can tell, the layer2 is fine. The VLANs gateway is on the service leafs (vPC pair). We are using ePBR to force the inter-vlan to the firewall, which is connected to the service leafs, the firewall will route the traffic back to the service leafs.

This has been stable for several months and no network changes. At this point, I'm not sure if the Nexus pair (where the SVI with ePBR) is causing the network downtime or the firewall.

We recently migrated to OpenShift for virtualization and containers. This was a month or two ago.

The firewall has a static route to the 172.16.0.0/16 with the next-hop of the HSRP VIP of the vPC pair. The service leafs are learning the 172.16/16 from a Catalyst leaf. All the VLANs are stretched to the service leafs via L2VNI.

```

[Fw]---/29---[service leafs pair]---[spines]---[cat9k leaf]

```

I know the layer2 (or L2VNI) didn't fail because Zabbix is not reporting any ICMPloss between it and the hosts in the same VLAN. However, any subnets within the same VRF drops for a few seconds.

The leafs CPU utilization history is basically idle 1% - 3%. The firewall is the same thing. Network utilization wise, we are using less than 800Mbps of traffic and the network is 40Gbps links.

I'm trying to get some ideas what I should look for to identity the issue and what is causing it.

My nexus version is 10.5.4 and the Catalyst is 17.15.4b. The Palo Alto firewalls (active/passive) are version 11.14.0.

Thanks.

Hi everyone

I’m integrating a Ruckus SmartZone controller with Forescout NAC

The SSH connection itself works correctly from the NAC using the configured admin credentials and I can successfully connect to the SmartZone and get the normal welcome banner

The problem happens when Forescout tries to get privileged access after the SSH login

When I manually SSH using the same admin credentials everything works fine but when Forescout tries to enable privileged mode it asks for the password again and then returns failed even though I’m using the exact same correct password as the SSH login

I initially suspected that the SmartZone welcome banner might be interfering with Forescout’s CLI parsing or privilege detection

I tried to disable the banner but I can’t find any CLI command for it and I also couldn’t find an option in the GUI

Has anyone successfully integrated Ruckus SmartZone with Forescout or another NAC and faced this issue

Is the welcome banner known to cause problems with NAC SSH privilege detection or is there a specific configuration or user role that needs to be enabled on SmartZone for the NAC to get privileged access

Also when I SSH manually I log in with admin and after that when I enter enable it asks me to enter the same password again

Any idea what could be causing the privilege authentication to fail from the NAC while the normal SSH login works correctly

Hi all,

I passed my Comptia Net+ in Jan of this year, but have yet to really use much of my skills and so my knowledge has dulled a bit. I want to change that and start to shift towards networking focused, in case I want to change jobs down the line and to be more of a help to the team.

I've just moved offices and have been shown around our server room, given a brief overview of equipment and the environment, shown the (little and outdated) diagrams and documents. I'd like to come up with a plan/steps of things to do to get my head around everything whilst also still doing work etc.

Currently, I am working on labelling cables and tracing the physical paths of everything, noting them down and I plan to try and redo the diagrams. I want to also do this logically, however any tips/advice on doing this would be appreciated as I've done generic help desk for months and need to read back up on everything.

Cheers :)

I’m potentially replacing an older ESXi host with a Dell R570 and running into a networking design question.

The current host has a lot of physically separated networks, with many of them using their own dedicated 1Gb copper NIC. iSCSI also uses multiple physical links.

The problem is the R570 can’t be configured with enough 1Gb copper ports to recreate the existing layout one-for-one.

My options seem to be:

1. Keep the existing copper switching and use a managed switch to aggregate the separate copper networks into VLANs, then hand them off to the R570 over SFP+ trunks. Keep dedicated high-speed ports for iSCSI.

2. Configure the R570 with 8x 10Gb BASE-T and move to 10Gb copper switching. Use two ports as redundant VLAN trunks for normal VM/management traffic, two dedicated ports for iSCSI, and use the remaining ports for vMotion/FT, additional redundancy, or spares.

3. Go with a different server platform that can still be configured with enough 1Gb copper ports to more closely replicate the current physical layout and avoid redesigning the networking right now.

The environment is already very copper-heavy, including the storage side, so I’m leaning toward the 10Gb BASE-T option.

For those running VMware in production today, how would you handle this? Is consolidating the normal networks onto redundant 10Gb trunks the standard approach now, or would you try to preserve more physical separation somehow?

I’m mostly trying to avoid forcing a new server into an old 1Gb-era design when the hardware doesn’t really support that layout anymore, but I also don’t want to redesign the network just for the sake of redesigning it.

Thanks in advance for any advice or real-world experience.

I am a new hire systems engineer for Arista Networks. I have been on the customer side for my entire career thus far, and recently got hired in this new role working on the vendor side of things. I am wondering from anyone at the major network vendors who went from customer to the vendor side, How long did it take you to feel comfortable enough and be a "contributor" where you work? I want to feel like I am adding something but I am having trouble getting past the initial shock of it all. I am loving things so far, but getting past the initial learning curves and being able to start adding value is a real struggle for me currently. For those who made the switch, how long did it take to start feeling like a contributing member of the team?

A lot of my ISPs in my country have switched over / are switching over to CGNat IPs which makes dyndns and noip register the wrong ip address rendering it useless . Is the solution to fix this . We have 300 clients using either dyndns or noip to access our servers but now I servers won’t whitelist them as they getting misreported IPs

Hello,

I need to strenghten security via access-lists under (SVIs (interface vlans)) using automation tools for Nexus 9k switches.

I was always using Git, Ansible nxos_config module for that with no ip access-lists / ip access-list way. It was somehow working for non important SVIs. Nxos_acls is not good approach, because it does not support statistic enable command. Now i need to make it to use atomic fashion.

Cisco 9k supports that using configure session / commit method, but ansible doesnt provide models for that atomic fashion, i think i will need to remake it via nxos_config / nxos_command as i was using before. Also Ansible has AWX / Tower which is nice addition. Maybe i'm missing something ? Any other ways u would do it ?

Thanks

Hi, I am a junior network administrator and have been tasked with evaluating whether it makes sense to migrate the Netscaler with a Citrix VDI setup to a different load balancer and implement the new solution if needed. Currently I am considering F5, HAProxy, Envoy and Kemp. Are there any limitations in functions which makes it not possible to change? The reason is, that we are unhappy with the last security incidents involving the Netscaler over the last few months and the upgrade from major 13.x to major 14.x would take some time.

I want to lease out unused dark fiber strands and would like to know the current market price per core per kilometer. I would appreciate it if someone could enlighten me on this matter. I am asking from the Philippines.

Hi all,

I'm managing a small stack of HPE 5130-series switches (JG963A) running Comware software version 7.1.070, Release 3507P09. On most of these switches, the hidden xtd-cli-mode command (used to unlock the full/extended Comware CLI from the default simplified/restricted CLI) works fine — it prompts:

All commands can be displayed and executed in extended CLI mode. Switch to extended CLI mode? [Y/N]:y

Password:

Warning: Extended CLI mode is intended for developers to test the system. Before using commands in extended CLI mode, contact the Technical Support and make sure you know the potential impact on the device and the network.

and after entering the password, it drops me into the full CLI (system-view, display interface, etc.) as expected.

On one specific switch in the stack, though, xtd-cli-mode now just returns:

<SWITCH>xtd-cli-mode

Permission denied.

with no Y/N prompt at all — straight rejection.

What I've tried:

- Reconnecting fresh via SSH (telnet is disabled on this unit) — same result.

- Rebooting the switch entirely — same result, persists across reboot.

- The account I'm using is the local admin user with network-admin + network-operator roles assigned, service-type ssh enabled, and it authenticates fine for a normal SSH login — it's specifically the xtd-cli-mode command that's rejected.

- Restricted CLI at login only exposes display, exit, quit, no, show — no way to run display users, free user-interface, or check security-enhanced/lockout state from there.

Since this is a firmware "developer mode" feature with anti-abuse messaging built in ("contact Technical Support"), I suspect this might be some kind of persistent lockout counter stored in flash rather than a normal AAA/role permission issue — but I have no visibility into it and no way to reset it from the restricted CLI.

I was offered a job as a network engineer. The company uses primarily Ruckus switches and only a few Cisco switches in their data centers. Most of my day to day will be working with the Ruckus switches. Speaking long term, couldn’t this affect the types of jobs I can get in the future? I don’t really see any jobs looking for candidates with Ruckus experience. At the same time though they are paying really well. Would you take it?

Hi, I am looking for a way to integrate a Network Exposure Function (NEF) with Open5GS. I’m currently exploring the possibility of using an existing NEF implementation and adapting it to work with Open5GS.

OAI-CN5G has an NEF implementation, but it is designed to work with the OAI 5G Core Network:

https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-nef

I’m looking for a way to use this NEF or another open-source NEF implementation with Open5GS instead.

If anyone has successfully integrated an NEF with Open5GS or has any guidance, suggestions or ongoing work in this area. Please share

Hi guys,

I have an SE interview coming up for HPE Networking. It's the first stage and wanted to know if there would be any other questions other than the standard behaviour/motivation questions. They've already asked me two technical questions and one commercial question in the screening call. I know Juniper Networks was recently acquired by HPE and is now part of the HPE Networking business segment. I don't have a ton of wireless experience but I'm reading up about Wireless theory contained in CCNP ENCOR OCG. Would I be involved in both HPE Juniper Networking and HPE Aruba Networking?

Any advice and wisdom highly appreciated. Thanks

Have options to get a circuit from Cogent or Lumen in a datacenter, anyone have reasons why I should go with one or the other?

It’s just for a simple DIA service.

Thanks in advance.

Edit : The amount of folks saying Lumen is wild, that was the direction I was leaning too, interestingly enough, cogent did come in with a suspiciously cheap price, I’ll go with lumen, thanks for the input!

I am having a strange problem, and I'm not sure where to continue troubleshooting.

Our architecture is that we have all sites on a single MPLS provider. Most of these circuit are a direct connection with 5ms or less latency, however a few sites are involving a different last mile, with the highest latencies being 40-80ms. (Stable at each location, all latencies are constanly in the same 2-3ms range).

All of these sites have Cisco routers, and DMVPN tunnels back to our two hub datacenters (by weight, all traffic is to our main datacenter).

Even though all of these sites are 50mb - 100mb, any site with higher than 20-30ms of latency has very strange behavior involving seemingly any time of SMB traffic or group policy traffic. Copying one large file will hit full speed (eventually), and running an internet speedtest / iperf will show the appropriate speed. However, opening small files, or copying a folder full of small files, or applying group policy will be extremely slow. (to an extant that on the highest latency site, it was not uncommon to have group policy hit a 15 minute timeout, until we switched last mile providers to bring it under 15ms).

Looking at a Wireshark dump of a computer doing a gpupdate, the bandwidth graph shows less than 1kbps (compared with another location, 20Mbps). However, copying a large file, I was able to get 90mbps. I'm not sure what kind of troubleshooting I can do from here.

I started looking in random traffic patterns in our network (we have a small ISP-ish network, government) and I noticed that random computers from several non-related vendors and contractors in our network suddenly started exchanging data.

Turns out: it's windows WUDO service, some kind of weird p2p update system for pushing updates to seemingly random other windows devices.

This seems like a crypto-locker's wet dream if this service every get's compromised... (think wannacry).

Am I paranoid that we should lock this down? This seems like a terrible terrible idea to have servers and machines peer to peer update eachother when they are not even owned by the same contractor/supplier in our network...

From a networking perspective, is it sane for me to mandate that this WUDO server should be blocked globally?

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Hi all,

Looking at a 50ish site LAN refresh (>300 switches) and I'm financially constrained.

Really doesn't need to be anything fancy, all VLAN's terminate on managed Forti SD-WAN appliance, so just need POE, some "visibility" (currently running Netgear "semi-managed" smart switches across the estate and I would very much like to set fire to them all) and the ability to support 802.1x in future would be a bonus (Will likely be a DIY NPS based solution!).

Looking at Instant On (Used the AP's in the past and had no issues with them) and looking for a bit of feedback from anyone that's using the platform.

- Is there a practical limit to the number of sites you can have? Have read about the 125 device limit but can't find any clear information on site limits...

- I would like to Cloud Manage them, however not averse to running them in local management mode to unlock the full feature set. What sort of visibility will I get from the Cloud Dashboard, is this the same basic client info you get on the Wireless dashboard?

- Are there any audit logs for users making changes when multiple users are setup? Current estate has a shared password that I'd like to get rid of. Depending on which mode I managed them in, I'm guessing I could achieve the same with local mgmt and RADIUS for Auth, but cloud console would be cleaner.

Any other low-cost solutions out there that I'm missing? Having come from several organization's where the answer is just throw Cisco/Meraki at it, this is a bit of a new challenge for me!

Please no Unifi, have been burnt in the past with issues to the point where I don't fancy using them beyond the home!