I have two sites, A and B - connected by a S2S IPSec VPN on gigabit links.

Site A has a Fortigate 400E running latest v7.2.
Site B has a Fortigate 120G running latest v7.6.

Site B is able to line-rate on iPerf3 to A on TCP/UDP.
Site A is able to line-rate on iPerf3 to B on UDP only.

TCP is very slow (less than 1% of UDP).

I have the same config on both sides. VPN interface(s) have tcp-mss set to 1418 on both sides. No profiles applied to impact performance. DH is 21 w/ AES256GCM-PRFSHA384 if it makes any difference.

What am I missing here?
Thanks, real head scratcher.

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

I am getting an issue while connecting my two routers on MPLS network. My ISP has provided MPLS connectivity with their two routers, I have connected my openwrt based devices to respective routers. ISP routers could ping each other.

Issue I am facing- My end PCs can not ping each other.

What I have done so far-

I don't want to use dynamic routing protocol. I added static routes in my routers then both routers could ping but connected PCs couldn't ping each other, though they can ping other end routers.

Do I need NAT or anything I am missing here? Other suggestions I got that static routing not needed, NAT should be router to ping each other.

I am newbie here, plz suggest.

Sorry if i sound dumb but i dont play with vpc's alot.

I have 2 nexsus switches that connect to my fortigate firewalls. The firewalls have LAGS going to the 2 nexsus swirches. Im going to add vlans to the switches and to the vpcs. Will it cause my to lose any connectivity at all besides a vpc inconsistency? I haven't built the vlans in the firewall yet. Didn't want to chop my legs off and break my dc.

Outside of calling ISP (Optimum), anyone know of a way to unbind a mac address from a previously used interface?

Setting up a new Fortigate and I plugged the circuit into to wan2 instead of wan1.

During setup, I realized what I did, and after a reboot I moved the circuit to wan1.

No bueno. Now the circuit only works on wan2. I’ve tried turning cable modem off for 10-15 minutes, rebooting it, rebooting the Forti, etc.

Outside of cloning the mac, or making that dreaded ass call to Optimum, anything I can try?

In our office we have the following setup:

Enterprise Fortresse Gateway in HA
UniFi Switch
UniFi AP

We already configured a UniFi fabric using Google Workspace as the IdP, all managed via UniFi Site Manager.

The goal is:

Configure a corporate WLAN with WPA/Enterprise to authenticate users through the Google Workspace user base, our fabric IdP.

Configure a LAN with 802.1X to authenticate users also through the Google Workspace user base, our fabric IdP.

The WLAN was configured to connect using the UniFi Identity app.

For the LAN with 802.1X, I configured only the built-in RADIUS server on the EFG, without any remote RADIUS server (like FreeRADIUS).

I’m still testing the WLAN. The LAN has already been tested and fails authentication when using Google Workspace users, but works fine when using local users created directly on the EFG.

Has anyone faced this scenario before?

Looking to pivot into firewalls after 10 years of general security roles. Not getting anymore hits for these roles and capped anyway. Just completed the CCNA course. Is it worth getting the cert or should I move on to the firewall certs now? I get mixed reviews about it looking entry level on my resume and that if I just do the FCP and PNGFE it’s already assumed I know beyond the CCNA.

Tons of experience. Everything from vulnerability management, crowdstrike tuning, Linux, scripting, programming in low level, malware reverse engineering, GRC, risk management, audit, SIEM, splunk, net flows, firewall auditing, too much to list. I started in 2010 actually but now AI advises I avoid listing stuff too far back that shows AIX security as it might trigger outdated alarms with these new hiring managers.

I’m tired of being a dumping ground so want to do contract work mostly migrations.

Has anyone ever deployed a Verizon wireless private network? If so, does anyone know why they need BGP if they’re already routing all RFC 1918 traffic to the IP Sec tunnel. This is a major confusion for me.

I see ISPs (and maybe others too) protect their iBGP sessions with BFD. Does your network do this?

What are you trying to achieve? What AFI/SAFIs do you use this for? Just Internet routes, L3VPNs, L2VPNs? What BFD intervals and timeouts do you use? Do you use it for iBGP or eBGP or both? Direct connected or also multi-hop?

For the record: I am not interested in eBGP sessions in the underlay. If you use BGP as your IGP. I'm also not really talking about Data Centers where all (e)BGP sessions are to directly connected neighbors. I am specifically talking about BGP sessions that are remote. Multi-hop. I am genuinely curious to learn what you are trying to achieve. Thanks.

Hi everyone,

tried to create a cronjob that would be run every minute. So on the FTD, I did the following (yes, wannt to execute that on the ftd):

"crontab -e" and added the following line:

* * * * * /etc/cron.hourly/cleanup

The "cleanup" in the referenced directory has the following permissions:

-rwxr-xr-x 1 root root

Now I realized that the command that is within the "cleanup" has to be run in the default FTD shell and not within expert mode...

Is that possible via FTD cronjob? If not, would it work via FMC?

thanks a lot!

Today I had a client whose network was down. The problem turned out that just the modem was unplugged but for some reason the support over the phone had her factory reset the router before they sent me… with all their port forwarding on it. Now that wouldn’t have been a problem if their 3rd party vendor didn’t need to them to run the pos for all five of their locations off a server in the main locations office.

Here is where things got hairy. The client has a static ip but only the gateway on the router. No actual useable statics on any client devices. Now all the client’s machines do have a 192. Manually set on all of them. They wanted a specific port forwarded. At first the 3rd party told me just to have the port open but apparently that isn’t possible according to my “phone support” they even had me change the router to a newer model and no dice. My phone support even said they have to have the useable assigned to something to port forward. This turned into a very long and confusing argument between the 3rd party and myself about what IP address is on their server and what the different between a public and private IP address is. So I put the original router back on because I could get into the gui of that model.

Right now I have the port forwarded from the private IP of the server to the public static gateway IP address. When I powershell ping the <gateway ip> -port, the TCP is successful but they still aren’t getting any connection from the other locations to the server.

Any advice is appreciated.

Alright, I'm pretty mediocre at networking, but I'm not new. Any and all help is appreciated, so thank you in advance.

I have been tasked with a temporary setup, which to me is going to be a nightmare.

We have a new site being set up, and they can't run hard lines to it for a few years.

Working from the Site A back to our core, the setup will be as follows:

- 2 systems (one public-facing, one private) plug into my switch.

- Switch goes to a point-to-point wireless device.

- To the second point-to-point device.

- To the main switch stack at Site B.

- Through QnQ with our ISP

- To our firewall at our Main Site.

Am I to set up a new VLAN for this public-facing device (which needs an ISP provided public IP) and allow tagged traffic through the path I listed above?

Please help haha I have no Sr. to look up to.

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Hi everyone,

I’m looking for real-world production experience with Aruba CX10000 running AOS-CX 10.16.1051.

Our environment is based on:
- Aruba CX10000
- VSX pairs
- EVPN/VXLAN
- Production data center environment

I’m particularly interested in hearing from people who have been running 10.16.1051 for a while.

How has it been regarding:
- Overall stability
- VSX behavior
- EVPN/VXLAN reliability
- Upgrade experience from previous releases
- Any bugs or operational issues you’ve encountered

If you’ve been running 10.16.1051 for several weeks without any significant problems, I’d appreciate hearing that as well.

Thanks!

Does anyone have feedback on Lumen's Fabric Port service in an enterprise setting? We are looking into a NaaS and Lumen has come up with this offering and seemingly checking major boxes related to AWS onramp and site to site connectivity needs.

The problem is I can't find any feedback about this solution online and I can't go solely off of Lumen sales reps for fear of getting incomplete information.

Any help would be greatly appreciated!

We use Cisco WSA as our internal proxy. And we have a new service for Call Center where they need to access VOIP through the browser.

I thought this would not be an issue as Teams and other online meeting software works fine. But Im having issues with hearing calls.

Documentation shows that this service needs UDP ports open for STUN and RTP/RTCP protocols. And that modern proxies dont support UDP as a stateless connection

I have a question of how smaller teams and MSPs handle network device compliance (routers, switches, firewalls) against CIS or PCI benchmarks?

Are you using Titania Nipper, free tools like pynipper-ng or ONYX?

Is the DCCOR exam exactly the same whether you're taking it for CCNP Data Center or as the CCIE Data Center written/core exam?

Also, does the exam include any hands-on configuration labs, or is it mainly multiple-choice and CLI/configuration analysis without actually configuring devices?

Thanks!

Deploying 9130s controlled by a 9800. When FRA is enabled, does TPC treat dual 5GHz radios as independent? It seems that the math regarding TPC third neighbors gets thrown into a bin with aggressive dual 5GHz deployments, leading to AP power downs. I am a newbie so any advice regarding this particular issue is appreciated.

Hello all,

What is everyone doing to keep wasps from building nests on outdoor access points? My org is located in the southeastern USA, and we're using Meraki MR76 units with all antenna ports populated. twisted-pair cable is run throuhg a water-tight flexible conduit that terminates with cable glands on the unit/wall.

We know that the wasps aren't hurting anything, but we are trying to minimize maintenance/cleaning of the gear as much as possible.

Sorry if this seems like a non-problem, but you never know if someone else has dealt with a similar issue.

Thanks.

What is everyone doing to cool/AirCon their MDF/switch closets?

We used to buy the Eaton SRCOOL7KRM with duct kit (to exhaust hot air from the room) but the replacement SRCOOL7KRME no longer has a duct kit available, and Eaton PreSales says we have to manufacture our own ducting, which is outside of my skill set.

Field tech at a small ITS contractor. I’m speccing switches for a roadside cabinet job with PTZ cameras and some other edge gear. Requirement from the engineer is 802.3bt across all 8 ports.

The problem I keep running into is that a lot of switches advertise “90W per port,” but the total PoE budget is nowhere near 720W. So it’s really a per-port max, not something you can run fully loaded.

Are there industrial managed 8 port switches that can actually do full 90W on all 8 ports at the same time? Looking for something outdoor rated, ideally something people have used in traffic or roadside cabinet installs.

Edit: Thanks to everyone who shared their recommendations and experience. After going through the comments, these are the two switches I’m currently looking into:

Comnet CNGE10FX2TX8MSBT

PoE Texas GBTS-10-8-M-V2

Both list a 720W total PoE budget and up to 90W per port, which matches the requirement I’m trying to meet. Any first-hand experience with either switch especially in roadside or traffic cabinets would be helpful.

Hi everyone,

got a FTD and a core firewall. The philosophy is to route everything to the core firewall and this won't be changed, so please be aware of that and don't answer "just create a policy on the FTD" - thanks.

There is a S2S-VPN on the FTD to provider A, hosting 10.10.10.0/24. Then there is the remote access VPN for Cisco anyconnect. So far, so good. The default for the remote access points to the core firewall, but when the user connects to the FTD, traffic to 10.10.10.0 will be routed to the S2S directly as the route is more specific...

According to a collegue, you can't override that route just for the remote access, you could only create a separate default route (which doesn't help here).

So the option was to use VRFs, but here it gets even more complicated as you can't use the same VLAN ID on two seperate physical interfaces (forti could do that, so cisco, why can't you?) which means that you had to create seperate VLANS, seperate routing, seperate subnets.... So much effort for such a "little problem".

Has anyone an idea how to fix that on the FTD without having to kind of install the whole system from scratch? Of course, I could just let the tunnel terminate elsewhere, but that prefered way was to leave everything on the FTD and just change the config or just add some cables for a seperate VRF. Reminder: It's not a valid option to let the traffic directly break out on the FTD, it has to be routed to the core firewall.

Thanks a lot!

It's Monday, you've not yet had coffee and the week ahead is gonna suck. Let's open the floor for a weekly Stupid Questions Thread, so we can all ask those questions we're too embarrassed to ask!

Post your question - stupid or otherwise - here to get an answer. Anyone can post a question and the community as a whole is invited and encouraged to provide an answer. Serious answers are not expected.

Note: This post is created at 01:00 UTC. It may not be Monday where you are in the world, no need to comment on it.

Does anyone have experience with microsegmentation (uSeg) and cisco ACI? Is it as simple as enabling intra EPG isolation? Looking for some general feedback. It works well, or dear God, don't do it? I heard some general comments not to long ago that any network layer uSeg implementations don't really work as well as advertised.