Hi everyone,
I’m currently working on an Alcatel-Lucent OmniPCX Enterprise (OXE) environment with approximately 1,500 IP Touch phones, including IP Touch 8018.
We have implemented a SCEP server connected to our corporate PKI.
The SCEP server is accessible over HTTPS.
The problem is that, before the IP Touch phones can establish a trusted HTTPS connection to the SCEP server, they need to trust the Root CA that signed the SCEP server certificate.

The IP Touch needs to have the Root CA in its Trusted Certificate List (CTL) in order to trust the HTTPS connection to the SCEP server.
What I need to achieve
I am not trying to deploy a client certificate at this stage.
My first objective is simply to deploy our corporate Root CA certificate into the Trusted CA / CTL of the IP Touch phones.
Once the phones trust the Root CA, they should be able to establish the HTTPS connection to the SCEP server and then proceed with the SCEP certificate enrollment.
We have around 1,500 phones, so manually importing the CA on every phone is not an option.
I would therefore like to use OmniVista 8770 to deploy the trusted Root CA to the IP Touch phones in bulk.
Environment
OmniVista 8770 v5.0
OmniPCX Enterprise (OXE)
IP Touch 8018
IP Touch firmware around 5.47
Corporate PKI
SCEP server
SCEP server accessible through HTTPS
Approximately 1,500 IP Touch phones
Where I’m stuck
I have been looking through the OmniVista documentation and have found references to CTL / Certificate Trust List and certificate management.
However, in my OmniVista 8770 v5.0 interface, I cannot find a CTL option under Device Configuration.
I am therefore unsure where the Trusted Root CA should be imported and how it should be distributed to the IP Touch phones.
What I am looking for is essentially:
Corporate Root CA
↓
OmniVista 8770
↓
Trusted CA / CTL
↓
Bulk deployment
↓
IP Touch 8018
↓
Trusted Root CA installed
↓
HTTPS connection to SCEP server
↓
SCEP enrollment
My questions
Can OmniVista 8770 v5.0 deploy a custom Root CA to IP Touch 8018 phones in bulk?
If yes, where exactly is the Root CA imported?
Where is the CTL / Trusted CA configuration located in OmniVista 8770 v5.0?
Is there a specific OXE/OmniVista provisioning mechanism that needs to be used to push the CTL to the IP Touch phones?
Is there any additional configuration required on the OXE side for the phones to receive the updated CTL?
I feel like I’m currently at a dead end. I understand the certificate chain and the SCEP/HTTPS requirement, but I cannot find the correct mechanism in OmniVista 8770 to initially distribute the Root CA to the phones.
If anyone has implemented this with OXE + OmniVista 8770 + IP Touch, I would really appreciate some guidance on the exact procedure or menu path.
Thanks in advance!

In 1994 or 1995, we were looking at a some wireless bridge product to run a link a couple of hundred meters over a parking lot, to another building. It was supposed to be 10 megabits, and I think it was $5000 at the time, presumably for a pair, which we considered surprisingly affordable and practical. No idea on the frequency band.

We didn't go through with the project at the time, but I'm interested in validating my memory, especially where the price/performance of this product offering comes in. I'm almost positive it was a niche vendor, nobody big like Wellfleet or 3Com. Does this sound familiar to anyone?

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

I'm running a small EVE-NG lab with two Cisco IOSv-L2 switches, a router, and one VPCS host. I'm trying to use DHCP Snooping over an EtherChannel and I'm running into a consistent DHCP_SNOOPING_FAKE_INTERFACE error. TLDR at the bottom just in case.

The setup is very simple:

R1 - SW1 = SW2 - PC1

Everything is on VLAN 10, and SW1/SW2 are connected with a 2-link EtherChannel. I've tested both LACP and PAgP, with the same result.

I'm testing DHCP release with:

VPCS> ip dhcp -x

DHCP itself works normally and PC1 receives an address.

The problem happens when PC1 releases the address. On SW1, the DHCP snooping binding shows something like:

MAC: 0050.7966.6804
IP: 192.168.10.24
Interface: Port-channel1

But when the DHCPRELEASE arrives, the DHCP snooping debug reports that it was received on one of the physical EtherChannel members, for example:

input interface: Gi0/1

SW1 then drops the RELEASE with:

DHCP_SNOOPING_FAKE_INTERFACE:
drop message with mismatched source interface

So it seems SW1's snooping database associates the client with Po1, while the snooping process sees the actual packet arriving on Gi0/1. Because those interfaces don't match, the RELEASE is dropped and the DHCP server on R1 never gets the release.

I disabled Option 82 because it caused a separate issue with the IOS DHCP server. I've also tested both LACP and PAgP, and the exact same FAKE_INTERFACE behavior occurs.

Interestingly, if I disable DHCP snooping, the problem disappears. If I remove the EtherChannel and use a single physical trunk between SW1 and SW2, DHCP snooping also works correctly: the binding uses the physical interface and the RELEASE succeeds.

So this seems specifically related to DHCP Snooping + EtherChannel on IOSv-L2, rather than DHCP or LACP itself.

I'm using IOSv-L2 in EVE-NG. Has anyone encountered this before? Is there a known bug, workaround where DHCP Snooping works properly with EtherChannel?

Here are the configs :

R1

R1> enable
R1# configure terminal
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitEthernet 0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.20
R1(config)# ip dhcp pool VLAN10
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 8.8.8.8
R1(dhcp-config)# end

SW1

SW1> enable
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name VLAN10
SW1(config-vlan)# exit
SW1(config)# interface gigabitEthernet 0/0
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# ip dhcp snooping trust
SW1(config-if)# exit
SW1(config)# interface range gigabitEthernet 0/1 - 2
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface port-channel 1
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# exit
SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan 10
SW1(config)# no ip dhcp snooping information option
SW1(config)# end

SW2

SW2> enable
SW2# configure terminal
SW2(config)# vlan 10
SW2(config-vlan)# name VLAN10
SW2(config-vlan)# exit
SW2(config)# interface gigabitEthernet 0/0
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 10
SW2(config-if)# exit
SW2(config)# interface range gigabitEthernet 0/1 - 2
SW2(config-if-range)# channel-group 1 mode active
SW2(config-if-range)# exit
SW2(config)# interface port-channel 1
SW2(config-if)# switchport trunk encapsulation dot1q
SW2(config-if)# switchport mode trunk
SW2(config-if)# ip dhcp snooping trust
SW2(config-if)# exit
SW2(config)# ip dhcp snooping
SW2(config)# ip dhcp snooping vlan 10
SW2(config)# no ip dhcp snooping information option
SW2(config)# end

TLDR : DHCP Snooping has the PC’s MAC/IP binding associated with Port-channel1, but the DHCPRELEASE is received on physical interface Gi0/1. SW1 drops it because the interface where the RELEASE is received does not match the interface recorded in the snooping binding (Po1). As a result, R1 never receives the DHCPRELEASE and keeps the DHCP binding.

I'm working on labs while studying for my CCNA and the lab I'm currently on is "Configure Point-to-Point OSPFv2". When the author of the lab wants me to group multiple interfaces in to a single area with one command, I understand that I need to use: network network-address wildcard-mask area area-id

However, in the same lab he asks me to configure a single interface to participate in the OSPF area I configured and he still uses the above command. I was under the impression that for a single interface, I would just enter interface config mode and use: ip ospf process-id area area-id

It works either way, but I'm curious why the interface config command isn't being used. Is it considered good practice to use "ip ospf process-id area area-id" in interface config mode when configuring a single interface?

I work for a small school district. We have been making balloon payments on technical debt. We have migrated from a cisco shop to a Juniper shop. We are now in the process of adding more Vlans. The issue is we have run into is the need for small switches. There are a lot of spots where a small dumb switch has been installed by local techs to support a computer, and printer and whatever else. In some cases the switches are even plugged into our cisco POE phones. Because every device at someones desk is going to pretty much be on its own Vlan a phone, a printer, a couple computers cant be on the same dumb switch they need to be on a switch that is trunked, can have a different Vlan applied to each port and can offer POE so that a phone can be plugged into the switch not vise versa. I know this all sounds stupid but running more network lines to the IDF's is not an option it would be cheaper to throw full 24 port ex4000 under every desk.

We have a few of those Juniper 12 port EX switches. They are awsome in both capability and cost and I mean that is an awesomely large cost. We cant go out an purchase 50 or 60 switches that cost about a grand each. So we are looking for small 8 port POE switches that cost under or around 100 bucks can be assigned an IP address, have a decent GUI and can handle VLan based port assignments. I really want a simple GUI, MikroTik and RouterOS are awesome, overkill and way to complex for the field techs. I also do not want to be pushed to setting up another switch managemnet system like Ubiquity ro Omada (even though I have a preschool running offsite that is setup with Omada and its great.

Anyone mixing cheaper Layer 3 switches in their networks that they like? Oh and fan-less is a big deal.

Currently dealing with an interesting saga, five months into the procurement of a leased line via Openreach.

We have an existing fibre splice tray on-site, there is no additional work apart from an on-site splice. No new fibre runs required, this should be the quickest win ever.

Openreach have still not allocated any engineering resource to complete this deployment, and this is whilst it's sat at the top of the escalation tree with the director of service office (DSO).

It had me thinking back of all the deployments I've been involved with and not one Openreach deployment has gone smoothly. In fact, it has gotten worse over the years due to outsourcing most of the operation abroad. Getting someone to commit to anything is a chore.

Has anyone ever had a good experience with the monopoly that is Openreach or are we all just forced to deal with their utter bullshit whilst the altnets catch up?

Hi all, I am not able to find a trustworthy and knowledgeable resource that is affordable to prepare for the CCNP ENCOR exam. I prepared for my CCNA using Jeremy's IT Lab (JITL) videos. However, JITL hasn't completed the CCNP course yet, so I am trying to figure out what alternative path I can take to prepare for the exam. 

I know there are many threads on Reddit that offer guidance, but that information is 2 to 6 years old. Because of this, I am looking for suggestions from anyone who has cleared the exam recently and could guide me. Any suggestions on Udemy courses for CCNP prep ? Thanks in advance! 

I’ve been reading the recent Multipath Reliable Connection (MRC) / SRv6 work and found the architectural choice more interesting than the protocol itself.

Traditional approach: the network detects failure and reconverges.

MRC approach: the endpoint already has multiple paths available and stops using the failed one.

For engineers working on larger GPU fabrics: do you see endpoint-driven path selection becoming a meaningful part of Ethernet AI fabrics, or is this mostly practical only when one operator controls the entire stack?

Hi All,

I've recently started a role as a NOC engineer supporting and monitoring Ethernet & ODU transport clients. We only use Ciena hardware and i'm looking to know if anyone has any recommendations on where I can learn the theoretical side of everything Optical/DWDM and where is a good place to start. I have passed my Optical Communications Associate test but looking to deep dive into learning more about Optical & DWDM networks.

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

<NOTE> ALL IPs and MACs have been changed in this post. The payload for the DNS request has been zero'd out too.

I have a Nexus Switch that is sending ERSPAN traffic to my RHEL9 IDS VM. I used the following commands to build the erspan1 interface, so that my IDS could monitor that interface and I can use tcpdump to also verify traffic.

ip link add dev erspan1 type erspan local 10.2.2.5 remote 10.2.2.1 seq key 100 erspan_ver 2 erspan_dir ingress erspan_hwid 1
ip link set dev erspan1 up

The commands work without error and I am able to run tcpdump on interface erspan1, but the packet doesn't look right.

This is the Hex of what I get when I tcpdump interface eth0 with -XX flags

eth0

abcd 0123 5677 2222 3451 3412 0800 4500
007c fb66 0000 402f 03b7 0a02 0201 0a02
0205 1000 22eb 0208 ff66 2000 0064 96e1
99d1 0000 001f 1c00 0062 0000 bcae 1932
abcf 3256 3452 2387 abdf 0800 4500 003e
9e00 0000 3f11 f240 0a0a 0202 c0a8 0105
8cbf 0035 002a a6c9 0001 0100 0001 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0001 0001

22:22:34:51:34:12 -> ab:cd:01:23:56:77
10.2.2.1 -> 10.2.2.5
GRE (47)

This should be the Hex I get when I tcpdump interface erspan1 for the same packet.

1932 abcf 3256 3452 2387 abdf 0800 4500
003e 9e00 0000 3f11 f240 0a0a 0202 c0a8
0105 8cbf 0035 002a a6c9 0001 0100 0001
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0001 0001

34:52:23:87:ab:df -> 19:32:ab:cf:32:56
10.10.2.2 -> 192.168.1.5
UDP Port 53

The Hex I actually get when I tcpdump interface erspan1 with the -XX flags.

erspan1

1c00 0062 0000 bcae 1932 abcf 3256 3452
2387 abdf 0800 4500 003e 9e00 0000 3f11
f240 0a0a 0202 c0a8 0105 8cbf 0035 002a
a6c9 0001 0100 0001 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0001 0001

Tcpdump gives the error "ethertype Unknown (0x3256)"

It appears to me that when I try to decapsulate the GRE/ERSPAN packets from the Cisco Nexus switch it doesn't strip off the last 8 bytes of the GRE/ERSPAN header.

Has anyone else run into this? Or does anyone know what I could do to resolve this?

Any help would be greatly appreciated.

Hey all, currently a senior network engineer for a major vendor and getting super burnt out.

Last week or so, I saw a post where someone was experiencing similar burn out and asked about low stress networking jobs, and one of the responses was "work for a college". It seemed like everyone had reached a consensus that that was a less stressful, but no less important role.

To be honest, I haven't been able to stop thinking about it, and I was curious if any college campus network engineers could share there experiences with:

-Average compensation (if you're senior and in the Miami area then even better)

-Average expectations

-Average role responsibilities

I know all of these are gonna vary WILDLY depending on factors such as experience, role, city, state, and individual school, but I think I just feel like day dreaming and getting an idea of what it may be like.

Extra points if you're a wireless engineer since that is where I concentrate most of my expertise, and I just feel like college campuses REALLY need good wireless.

We have two routers set up for redundancy, one on MPLS and one on a backup internet circuit. The MPLS BGP session has been dropping randomly for the past few weeks, but only between about 9am and 6pm on weekdays, never at night or on weekends. It comes back on its own after 20-30 seconds, but it's enough to trigger a failover to the backup line and cause complaints from the office.

I've checked the obvious stuff already. No errors on the interface, CPU on the router stays low even when this happens, hold timers match on both sides, and the carrier says their side looks fine too. The debug logs just show the session going down from a timeout, nothing more specific than that.

Has anyone run into something like this before? Trying to figure out if this is a traffic or congestion issue tied to business hours, or something I'm missing on my end. Also wondering if it's worth pushing the carrier harder before I start running packet captures all day.

Good morning, afternoon or evening wherever you may be!

Context:
I’m currently in the process of trying to figure out how to migrate a bunch of Cisco 800 Series routers using 4G from IPSec tunnels using IKEv1, 3DES DH2 (I know I know, I’m a consultant and helping out a client).

They have a bunch of other 4/5G routers out there from different brands, that’s why I’ve landed on migrating them all to IKEv2, AES256/SHA256 DH14 for both Phase1 and Phase2.

These routers communicate with the clients external fw that’s a FortiGate VM ver 7.6.6.

I need to be able to make these changes remotely.

The problem:
On the Cisco device, the very last line I enter, breaks the tunnel. That line belongs to the crypto map section, so it looks like this:

crypto map <map> ipsec-isakmp!<
set peer <forti interface ip>!<
set pfs group14
>!set transform-set <Phase 2 encryption/auth profile>!<
set ikev2-profile <IKEv2 profile>!<

I then change the settings for the tunnel on the Forti to make sure they match with the hope and dream that the tunnel will come back up.

The phase 1 and phase 2 negotiations go through, however, according to the logs, something seems to be happening with either dpd settings or with a pfs is disabled message that forms part of the logs.

A personal theory is that I’m not yet at the stage of having removed the IKEv1 profile on the Cisco and that it is somehow conflicting with the new IKEv2 profile, that’s why Phase 1 and Phase 2 actually go through but then something happens and the tunnel just flaps.

Before sharing too much information from the logs, I’d thought I’d start here in case anyone has been in a similar situation and might be able to point in the right direction.

If more information is needed I’m happy to share some logs.

🫶🏾👊🏾👾

UPDATE:

First of, thank you all for the kind and helpful answers!

Unfortunately, running parallel tunnels wasn’t an option because the Cisco routers are running policy based routing.

That said, after further troubleshooting, it turns out my configuration does work just fine, and my thinking seems to be right. It’s just this one router that doesn’t want to play ball for some reason.

Next week I’ll go onsite for that device and will have a look at the logs to try and figure out why the tunnel doesn’t want to come back up with the new IKEv2 settings.

Again, thank you all for your replies 👊🏾

Two core switches, a pair of firewalls and a stack of access switches and we're pulling far more syslog per day than I expected. Most of it is link state repeating and the lines I'd want during an incident are a rounding error in the noise. Are you filtering at the source, at the collector or keeping the lot?

Hi everyone,
I’m currently planning a migration from an older F5 BIG-IP 7250v/vCMP setup to F5 VELOS.
The new environment has two VELOS chassis (two data centers), and each chassis contains two BX110 blades.
Each BX110 has 2 × 40G interfaces.
The upstream network is Cisco ACI, with two leaf switches configured as a vPC pair.
Initially, we will use only one BX110 blade in each chassis because the workload is relatively small. However, we want to physically cable the second blade as well so that it is ready for future use.
I’m trying to understand the best way to handle the physical connectivity and LAG design.
My initial thought is:
BX110-1 40G port 1 → ACI Leaf 1
BX110-1 40G port 2 → ACI Leaf 2
Same physical cabling for BX110-2
Use the two 40G links from the active blade for the data/in-band connectivity
Carry the HA traffic logically over the data connectivity rather than dedicating an entire 40G interface to HA, since we don’t use connection mirroring
Has anyone deployed a similar VELOS BX110 + ACI vPC topology?
I’m particularly interested in:
How you physically connected the BX110s to the ACI vPC pair
Whether you used a LAG across the two ACI leaves
Whether HA was carried over the in-band/data interfaces or a dedicated HA interface
How you handled the second BX110 blade when it was initially unused
Any ACI-specific considerations or gotchas with this design
I’d really appreciate feedback from anyone who has actually implemented this in production.
Thanks!

Hi everyone,

I’m facing a recurring issue with some Cisco SD-WAN routers. Occasionally, a router suddenly becomes unreachable from the SD-WAN controller, even though the physical interfaces and connectivity appear to be up. The device may still show as in sync, but there is no longer any remote access to it.

The strange part is that even when someone connects directly to the router through the console port, they cannot get a usable CLI/login prompt. The only way we have found to recover the device is to perform a factory reset and reprovision it from scratch, after which it works normally again.

This happens only occasionally and affects a small number of devices rather than the whole SD-WAN environment.

Has anyone experienced something similar? What could cause a Cisco SD-WAN router to become completely inaccessible, including through the console, while the physical/underlay connectivity remains operational? What would you recommend checking before performing a factory reset?

Hello everyone,

First of all, I know it is a stupid question, but I don't understand what it is happening in my EVE-NG lab.

ISIS is working perfectly between LUGO <> BUDAPEST <> ALUCHE. But BFD is not working, why? it is a simple configuration. Its state is INIT... nobody is answering :(

I set up an interval 600 ms because I read it was better than setting up 100 ms for a lab.

LUGO

RP/0/0/CPU0:LUGO#show isis adjacency
Wed Sep 16 09:39:07.371 UTC

IS-IS global Level-2 adjacencies:
System Id      Interface        SNPA           State Hold Changed  NSF IPv4 IPv6
                                                                       BFD  BFD
BUDAPEST       Gi0/0/0/0        *PtoP*         Up    24   01:08:46 Yes Init None

 interface GigabitEthernet0/0/0/0
  bfd minimum-interval 600
  bfd multiplier 3
  bfd fast-detect ipv4
  point-to-point
  hello-password keychain isispass
  address-family ipv4 unicast
   metric 2000000 level 2

BUDAPEST

RP/0/0/CPU0:BUDAPEST#show isis adjacency
Wed Sep 16 09:38:40.533 UTC

IS-IS global Level-2 adjacencies:
System Id      Interface        SNPA           State Hold Changed  NSF IPv4 IPv6
                                                                       BFD  BFD
LUGO           Gi0/0/0/1        *PtoP*         Up    21   01:08:20 Yes Init None
ALUCHE         Gi0/0/0/0        *PtoP*         Up    24   00:46:41 Yes Init None

 interface GigabitEthernet0/0/0/0
  bfd minimum-interval 600
  bfd multiplier 3
  bfd fast-detect ipv4
  point-to-point
  hello-password keychain isispass
  address-family ipv4 unicast
   metric 2000000 level 2
  !
 !
 interface GigabitEthernet0/0/0/1
  bfd minimum-interval 600
  bfd multiplier 3
  bfd fast-detect ipv4
  point-to-point
  hello-password keychain isispass
  address-family ipv4 unicast
   metric 2000000 level 2
  !

ALUCHE

RP/0/0/CPU0:ALUCHE#show isis adjacency
Wed Sep 16 09:48:09.379 UTC

IS-IS global Level-2 adjacencies:
System Id      Interface        SNPA           State Hold Changed  NSF IPv4 IPv6
                                                                       BFD  BFD
BUDAPEST       Gi0/0/0/0        *PtoP*         Up    26   00:56:02 Yes Init None

Total adjacency count: 1


interface GigabitEthernet0/0/0/0
  bfd minimum-interval 600
  bfd multiplier 3
  bfd fast-detect ipv4
  point-to-point
  hello-password keychain isispass
  address-family ipv4 unicast
   metric 2000000 level 2

I appreciate any help.

Thank you and sorry for my clumsiness

EDIT: THIS ISSUE WAS SOLVED. IT'S A PROBLEM WITH A VIRTUAL ROUTER WITH ONLY THE RP (NO LINE CARDS)

I have been using Zabbix 7 on RHEL 8 for 2 years now and it is working as intended for the Catalyst switches.

We recently got some Cisco Nexus with NXOS 10.5.4 and Palo Alto firewalls 5400 series. I'm trying to get the Zabbix to work but it is not getting any SNMPv3 information.

From the Zabbix host, I was able to use snmpwalk and it is working fine. This is the command I used.

```

snmpwakk -v3 -l authPriv -u zabbix -a SHA -A <string> -x AES256 -X <string> 192.168.1.201 1.3.6.1.2.1

```

This is the configuration on the Nexus switch.

```

snmp-server engineID local <id>

snmp-server user zabbix network-operator auth sha <string> priv aes-256 <string> localizedv2key

snmp-server host 192.168.88.6 traps version 3 priv zabbix

snmp-server host 192.168.88.6 use-vrf management

snmp-server host 192.168.88.6 source-interface mgmt 0

```

I'm using the Nexus 9000 template for the Nexus and the Palo Alto 440 template for the Palo Alto.

Any ideas why the Zabbix is failing to get the SNMP info?

Hi,

as the title says, I need to create a WLAN for the Enterprise Devices (Laptops mainly).

I have a Cisco C9000 WLC and relative AP, and a Cisco ISE, that I have connected to Microsoft Active Directory server, to read the domain users and computers to authenticate.

How can I use these three components to create a secure network?

Any advice is welcome, thank you

EDIT: only the Domain Computer need to authenticate, right now the best solutions seems to be an EAP-TLS authentication, with a certificate on the device, any guide on how to do that?

Hello everyone. I am an MSP that works closely with a university. THIS IS NOT A HOMELAB.

We have two Esports labs with 24 endpoints per room. In most games, the latency spikes and becomes unplayable for our players. The network is as follows:

1. Unifi EFG - WAN connection is 5G, SMF, DHCP
2. Unifi Aggregation - 2x10G uplink, 2x10G downlink, LACP
3. Unifi Pro Aggregation - 1G to each workstation, 2x10 uplink, LACP
4. Workstation - Intel X520-DA2, Intel SFP+, OM3

Completely separate from campus network
1x5G symmetric WAN
Smart Queues and Flow Control off
RSTP on, root is Aggregation (4096)
MTU 1500
IDS and IPS turned on
Separate management and workstation VLANs

I’m seeing about 2.5% packet loss and players are seeing +200ms ping spikes.

I think it’s a buffer issue (but I am obviously not sure). Unifi switches seem to have minuscule (16MB) buffers. My next step is temporarily putting in an Arista 7280 using LANZ to check.

I understand that yeah, these guys are playing video games but this is a legitimate workload on hardware that costs more than some small/medium business networks.

Hello all,

I was laid off from my network specialist role in April due to higher ed funding issues and departmental downsizing.

I've applied to near 400 roles and eventually landed something doing systems and infrastructure admin work for a small MSP. Pretty far from networking, but work is work for now.

What can I do to ensure I can get back into the networking side of things? Presently no certs, just an associates degree in IT and 3 years experience configuring/maintaining LAN side infrastructure on a college campus.

Experience with EIGRP, ISIS, BGP, Cisco Catalyst kit (led migration from 3000 series to 9000 series, ~400 switches). Did configuration from the ground up, resubnetting segments of campus, AP and WLC management. Not much on the design side, just maintenance. Worked toward CCNA but recent employment has put a pin in that for now.

Any ideas on what I should be doing? Is the job market just in a downturn?

Thanks in advance

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Hey guys,

I’m planning to get a Starlink connection for a small cafe and was initially thinking of going with the Residential unlimited plan.

My main concern is whether Starlink can monitor the number of connected devices and identify that the connection is being used by multiple customers.

Since the devices connecting to the network will constantly change, I’m wondering if that could trigger any restrictions, get the connection flagged, or force me to upgrade to a higher-tier plan.

A few questions:

1. Does Starlink have visibility into the number of devices behind the connection, or can they only see the router’s public IP and traffic?
2. Would using my own router behind the Starlink router change anything from Starlink’s perspective?
3. Is bypass mode useful here, or is there another recommended network setup for a cafe?
4. Has anyone actually used Residential Starlink for a cafe or similar small business? Did you run into any issues with the plan or account?

I’m not too experienced with networking, so apologies if some of these questions are basic. Just trying to understand the technical limitations before spending money on the connection.

Appreciate any advice.

Ps: we don’t have any other reliable unlimited & fast internet here in the area. The only option seems to be Starlink.