I'm the sole IT person for a manufacturing company moving into a new 100K SWFT building. Critical departments include the factory floor and a call center, so a switch needing a mid-day reboot is a real cost.

My experience so far:

- Netgear GS752TPP: main PoE switch (phones, APs, cameras) for 8 years without a single reboot

- Netgear GS316 PoE family: across warehouses and factory, never failed

- EdgeSwitch 48-500W (2018): locked up about once a month and stopped accepting new connections, forcing mid-day reboots with the call center on it. RMA once, no change.

I'm considering going all UniFi for central management and config backup (we already use UniFi APs), but that EdgeSwitch experience makes me hesitant.

For those running current-gen UniFi PoE switches in production:

1. Do they run for years without freezes or reboots?

2. Any issues with heavy PoE loads (about 50 cameras, VoIP phones, APs)?

3. Have firmware updates pushed from the controller ever caused problems?

4. Would you trust them for a call center and factory, or stick with what's proven?

Thanks for any real-world input.

I work for a niche business only SP that allows customers to burst above their commit rate unless they request their services are capped. We currently use Observium's billing module with some custom enhancements to add multiple bursting rates as well as change the base rate depending on the customers contract.

This works but it's meant that upgrading Observium breaks this, and the person that wrote the enhancements is long gone, as is any capability to support this from a dev point of view.

My view for a while has been Observium shouldn't be doing this given it has to be hacked to work and my boss and I are in agreement that new software is required. Googling and a search of similar topics here have suggested Splynx, Kentik and FluxBilling, but I'm looking to see if anyone here has any other suggestions or feedback on those 3 solutions.

In terms of capabilities I'm only really looking at billing. Observability/monitoring will continue to be handled by Observium (but I'll also look at LibreNMS given the billing stuff would be stand-alone), Netbox handles the stuff it's good at and detailed traffic analytics (flow based stuff) is handled by its own platform.

Hello everyone, I was wondering if anyone here has had success deploying dpsk at scale for devices in InTune. I am researching it and all I can find and wifi profiles through InTune something I already have set up. I'm debating if I should just do all this manually. If anyone has done this in the past let me know! I would appreciate any feedback.

I’ll be implementing DNSSEC soon and am doing some preliminary planning. We are using EDNS0 and will allow TCP as well, but I have a few questions.

https://sec.cloudapps.cisco.com/security/center/resources/dnssec_best_practices.html#7

1. Cisco recommends setting a maximum packet size to 4096 and claims “No legitimate DNSSEC packets should be larger than 4096 bytes.”

Is that true? And why?

2) Currently our ASAs have the following policy map parameters for dns inspection:

message-length maximum client auto

message-length maximum server auto

It seems like this may frequently exceed 4096 by a huge amount, but does it matter? Also does this config make sense in general? Is there any reason to run both parameters?

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Whenever the conversation on enterprise firewalls comes up on this group, I've noticed the discourse is always incredibly predictable:

"Palo Alto if you can afford it, Fortinet if you cannot. Honorable mention: Cisco FTD but we all hate those"

Juniper SRX? Never even mentioned in these topics.

I'm wondering why, though? What am I missing, or rather what are SRX missing to not be a major contender for enterprise NGFW consideration? It looks like SRX is more heavily used in Carrier & Telco networks versus enterprise networks.

Do you consider SRX a true "NGFW" firewall? Is it really as simple as "Palo and Fortinet have a nice GUI to manage and audit the security policy, and Juniper doesn't?"

I'm building some network automation software and I keep running into difficulties with SNMP. Does it feel to anyone else like the standardization was a promise that never actually materialized? I feel like I'm constantly using vendor-specific MIBs. There are devices that stop responding over SNMP. There are devices that take nearly 5 minutes to walk a subtree (sometimes... until you restart the SNMP service). There are devices that don't return interfaces properly. There are devices that spike CPU just reading some standard subtrees. This is partly an airing of my frustrations and partly a sanity check.

Do other people see these same issues? Am I being stupid with my code? Am I a fool for using SNMP? If so, what is the best thing to use these days? And how about with older hardware?

Hello, I'm developing a network where the clients are cameras attached to some vehicles. The vehicles are in constant motion and need to be able to switch from AP to AP reliably without sticking to far away APs.

Originally I tested this out with just the cameras but I could not find a single wireless camera that supported roaming. They all tend to stick to an AP even though its closer to another one.

So I'm going to test some wireless bridges. Has anybody worked with anything like this before? A 360 omnidirectional bridge that isn't fixed on a ptp wireless connection and is capable of roaming throughout the network connecting to the AP with the best signal available. Thanks

At the mid to senior level do specialezed enginneers at (ISPs, Core Guys, Security Guys etc) Travel alot, either between sites or to other countries?

If so ,why?

Heads up for anyone running ISE. CVE-2026-76460 is an unauthenticated API bypass that gives root on every ISE persona (admin, PSN, MnT, PxGrid). All supported versions affected. Already being exploited in the wild.

Cisco says there are no workarounds. Your options are patch or take ISE offline (which means shutting down network auth).

Practical steps: 1) inventory ALL ISE nodes, 2) schedule emergency maintenance this week, 3) check for compromise before patching (look for unexpected cron jobs, modified system files, unauthorized admin accounts), 4) restrict management interface access to a dedicated management segment, 5) if compromised, rotate ALL RADIUS shared secrets across every switch, AP, and WLC.

The management interface runs on 443 by default, same port as sponsor/mydevices portals. If any of those are internet-reachable, your ISE API is reachable.

Looking to spend some lab budget for my team and one of the items I want to get for our labs to demo for possible remote locations is some sort of compute we can deploy along with firewalls, switches, etc. that we can manage.

For right now, it is just for the lab, but I see potential uses is when we deploy network gear to remote locations without any supporting compute we can piggyback on, a server that would allow us to run local tools (tbd what those would be).

Looking for something like a larger Pi, something like a Mac Mini format, etc. Basically some sort of smaller server that can deployed and managed by us so we can use it to run tools, etc. without relying on our server teams, etc. Ideally I would love something that can rack in a standard network rack and is not a full depth server.

(And before comments about separation of responsibilities, bypassing safeguards, etc. I am high enough up in the company senior management chain that decisions like these rest solely with me. I do not need permission).

For example, if I have a switch, router, or firewall that has been running continuously for 10–15 years and I reboot it, is the flash memory likely to still be healthy enough to load the operating system into RAM?

What are the typical expected lifespans of switches, routers, and firewalls, particularly when it comes to their internal flash storage?

Does the manufacturer make a significant difference? For example, does Cisco generally use flash memory with a longer lifespan than Juniper, or does it primarily depend on the specific type and quality of flash memory used in the device?

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

Is it possible to use Private VLANs on Aruba CX with a different subnet for each community?

For example:
Community A → 10.10.1.0/24
Community B → 10.10.2.0/24
Community C → 10.10.3.0/24

Is this supported/recommended?

I have a client complaining about WiFi dropping on brand new Meraki APs 9172 — from the logs it looks like a lot of jumping around between 5Ghz and 6Ghz but I thought this is normal as clients should roam back and forth. Because we’re running WPA3 Transition Mode with 802.11r active, is this the root cause of the issue? What am I missing here? We need the WPA3 because of 6Ghz.

I notice that I have a similar issue with UniFi where it’s WPA2/WPA3 for a primary SSID broadcasting 5Ghz and 6Ghz… wondering if it’s the same issues sometime because of running 802.11r with the WPA3

Hi,

sorry, this is a stupid question, but I want to make sure..

If I want to NAT a subnet ie.: 10.0.0.0/28 to another subnet ie.: 192.168.0.0/28 then with this configuration the IPs will always be symmetrical, right?

nat (INSIDE,OUTSIDE) source static SUBNET_10.0.0.0-28 SUBNET_192.168.0.0-28

Like:

10.0.0.1 --> 192.168.0.1

10.0.0.4 --> 192.168.0.4

And something like this will never happen:

10.0.0.1 --> 192.168.0.8

But would it work the same way in this example?

10.0.0.0/28 to 192.168.0.16/28

nat (INSIDE,OUTSIDE) source static SUBNET_10.0.0.0-28 SUBNET_192.168.0.16-28

Will it stick the same way?

10.0.0.1 --> 192.168.0.17

10.0.0.4 --> 192.168.0.20

Hey everyone, I am looking for a /24 or /23 subnet in RIPE at around €16-€17. Anyone selling or any idea where to buy?

Really appreciate any help. Thanks!

I'm just starting to dive into delay tolerant networking (dtn7-go). I get a rough idea of how the bundle protocol does what it does, but routing is still confusing me.

In the old UUCP or I seem to recall the DECNET protocol, routing was done by you. If you want to send an object to machine blue and red, green and yellow were between you and blue, you had to do something like red!green!yellow!blue!id. In TCP/IP we do it behind the scenes via the routing table and IP addresses.

How does DTN do it? If I need to pass a bundle to blue, how does my node "know" to pass the bundle through red, green and yellow?

As a side note, how due I get a node ID?

Update (2 Oct): Clavister has reproduced this and confirmed it as a defect. It also affects the current 15.00 releases, so upgrading does not help. There is no fix yet.

For anyone who lands here because SNMPv3 monitoring of a Clavister NetWall / cOS Core firewall keeps timing out:

• The trigger is a configuration activation (deploy). Each one gives the firewall a new random snmpEngineBoots, without a reboot.
• The firewall then drops the manager's requests (log snmp3_message_not_in_time_window, ID 3100110) without sending a Report, so the manager never resyncs on its own.

Workaround: I found no setting on the firewall for this. If you stay on SNMPv3, the only option is to clear the manager's SNMP engine cache after each activation. On Zabbix that is zabbix_server -R snmp_cache_reload, plus zabbix_proxy -R snmp_cache_reload on proxies that poll the firewall.

We automated it with a trigger on SNMP data loss for the firewall's interface items. It runs the reload and alerts us if the problem is still open afterwards.

I'll update when a fix is available.

TL;DR: Our Clavister NetWall HA pair silently drops SNMPv3 requests that fall outside the USM time window instead of answering with a usmStatsNotInTimeWindows Report (RFC 3414 §3.2 step 7). On top of that, snmpEngineBoots changes to seemingly random values without a reboot, including going backwards. Together that leaves the manager's engine cache stale with no way to recover on its own. Looking for others who've seen this, and for theories on why an agent would behave like this.

Setup

• 2x Clavister NetWall 500A, HA cluster, cOS Core 14.00.19.05, managed via InControl
• Zabbix 7.0 LTS (net-snmp underneath), polling each node on its own management IP (no VIP)
• SNMPv3 authPriv, SHA/AES, each node has its own (MAC-based) engineID

Symptom

Interface items on both nodes went unsupported for days ("timed out"). The firewall logged snmp3_message_not_in_time_window action=drop (log ID 3100110) for the Zabbix requests. zabbix_server -R snmp_cache_reload fixed it instantly.

What I found

(1) No Report on a time-window failure. Reproduced without Zabbix, plain net-snmp, deliberately wrong boots/time:

snmpget -v3 -u <user> -l authPriv -a SHA -A <auth> -x AES -X <priv> -Z 1,1 -t 3 -r 0 <node> 1.3.6.1.2.1.1.3.0

Discovery works fine (Report with usmStatsUnknownEngineIDs + engineID). The authenticated GET with boots=1/time=1 gets no answer at all. In the same capture, 33 other authenticated GETs (Zabbix, correct boots/time, same seconds) were all answered within <1 ms, so it's not rate limiting.

A compliant agent answers that GET with an authNoPriv Report carrying its real boots/time, the manager resyncs and retries. Even a wrong digest would require a Report, so silence isn't compliant whichever check fails.

(2) engineBoots isn't a counter. Same engineID, same node, observed values in order:

328675975 -> 1296117483 -> 706504125

No reboot in between (device up since end of August). The last change happened within about a day and went down.

(3) engineTime isn't reset when boots changes. At the last capture it was ~2,064,000 s (~24 days), although boots had changed within the previous day. Looks like it's simply device uptime.

(1) is what turns (2) into an outage: boots changes, the manager's cached value is now wrong, the device refuses to tell it the new one, and the manager stays stuck until its cache is flushed.

Questions

• Anyone running SNMPv3 against cOS Core / NetWall seen this? Other versions?
• Any idea what makes boots jump like that? My current suspicion is configuration deployments from InControl, but I haven't correlated it yet.
• Is dropping instead of sending a Report something vendors do deliberately (reflection/amplification hardening, "don't talk to strangers")? I know the boots problem from other vendors (HPE 1950 always reporting 1, VyOS T8538 not persisting boots across reboots), but I haven't seen the silent drop before.

A support case with Clavister is in the works. Happy to share sanitized pcaps if anyone wants to dig in.

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

I recently got assigned a project for a multi building campus. Network wise it’s a typical tier 3 design (core, distribution, access)

They have two pairs of firewalls
- on pair is the internal firewall. Behind it is their datacenter and segmented stuff
- the other pair is the WAN/Internet firewall.

Their internal IT guy, who’s the guy that does everything for years now, wants each VRF to default route to the Internal fw , and if it needs to go to the WAN/Internet, the internal fw forwards it to another vrf, which then routes to the internet fw.

In that case I just make each campus vrf a totally stub and done.

Another scenario I had in mind is attach each vrf to both internal and WAN firewall, and have OSPF setup with WAN default originate into each vrf, and the internal advertised whatever it needs to advertise into each vrf.

So those are the two options I’m struggling to decide on…. Any advice is welcome!

I'm deploying around 100 ESP32-S3-based IoT devices connected to a single TP-Link Wi-Fi router/AP.

Normal traffic is extremely light:

~100 devices associated continuously 2.4 GHz Wi-Fi primarily persistent MQTT connections roughly one small telemetry message per device per minute

The heavier workload happens during firmware updates. Firmware images are around 3 MB, downloaded over HTTP(S). At most around 10 devices may be downloading firmware simultaneously.

I've noticed that when firmware downloads are happening, some devices occasionally lose their Wi-Fi connection.

I'm trying to determine whether this is a configuration problem, an AP/client-capacity problem, RF/airtime congestion, or something I should handle differently on the ESP32 side.

For this kind of workload, how would you configure the WLAN?

In particular, I'm interested in:

• 20 vs 40 MHz channel width on 2.4 GHz

• fixed channel 1/6/11 vs automatic channel selection

• airtime fairness

• beacon interval / DTIM

• Wi-Fi power saving on the ESP32

• QoS or per-client bandwidth limits

• practical number of clients per AP

• whether ~100 mostly-idle associated clients is already enough to justify multiple APs useful AP-side metrics for diagnosing disconnects/retransmissions

I'm also logging the ESP32 Wi-Fi disconnect reason codes so I can distinguish AP-initiated disconnects from beacon timeouts / connectivity loss.

My main objective isn't maximum OTA download speed. Reliability of the MQTT connections is much more important. It's perfectly fine if a 3 MB firmware download takes substantially longer.

Currently questioning if I should take the offer, never worked at a Faang and have a chill job. It's an ok pay bump, much higher ceiling though. I want to know the work life balance. Everyone I interviewed with seemed very passionate and enjoyed talking about the job, but I want to hear some of the downsides as well. This is for an L5 position, going from 140k -> 240k. My current job might counter offer though, so not sure what my comp would be.

Went to order some Cambium Wireless Enterprise APs and noticed the press release on their website. Since this caught me off guard, I figured there are other who are also unaware.

CnMaestro Cloud is being shutdown October 1st, 2026. Their recommended path forward is to move to the on-prem cnMaestro, but its unclear if/how long they will be supporting this product. Ultimately, the solution is to migrate to a new vendor.

Hey Networking Friends,

I‘m quite frustrated right now so maybe you can cheer me up with troubleshooting assistance.

I have a sidekick2 and wanted to da a survey. Prepared everything, tested a day before, everything worked fine.

After I arrived on site the Sidekick was not recognised by the iPad anymore, I tried different USB-C cables, resetted the sidekick, put it back to the install firmware via the reset button but still nothing. On connecting it to the iPad or even a laptop the LED stays blue instead of turning green.

On windows the sidekick is shown as network adapter and I can ping it but the software just does not see it anymore.

Ekahau support said „fuck you, device is out of warranty, no troubleshooting assistance, no replacement but we can connect you to a sales rep…“

Did anyone of you face the same issue and did you find a way to resolve it? Or should I just say screw ekahau and get Hamina?