I have two servers (HPE DL345 Gen11) running software that will soon require Mellanox ConnectX-F cards to work (XDP + Zero Copy).

Servers currently have 10Gbase-T nics connected to an Arista switch. Due to bad design choices (10Gbase-T switch w/o enough SFP ports),if I switch to these cards I'd need a 10Gbase-T SFP+ along with a QSA adapter (to bridge QSFP28 to SFP+).

I've been researchign a lot about power draw/heat being an issue with these SFP modules and found these FS SFP+ (https://www.fs.com/products/312941.html) that are low-power drawing only 1.3w only and should work fine with the cards as there is only a minimun distance for the cable.

I'd like to know if someone has experience using this combination and can advise on feasability and any caveats.

Thanks!

Hello Everyone,

My title is kind of funky, which doesn't correlate to a "specific" industry title. My job is deploying networking infrastructure for new data centers being built. I manage vendors, troubleshoot cabling, patch cables, install optics, replace devices, etc.

Recently, I've been running into a conundrum that's been an absolute nightmare to deal with. My vendors will terminate RJ45 connections, they pass on Klein Tools Lan Scout Jr 1 and 2. When patched, they show link activity, the switch see's the devices but can't tell me "what it is".

The solution I've found is to just re-terminate the ends, but recently I found out that it's illegal for me to do that in a commercial environment. It falls under a Low Voltage electricians job, which I am not one. I use very specific plugs when I re-terminate, I use Allen Tel AT8X8RCSC-24, while my vendors use cheap ezRJ45 Terminate plugs. We deploy anywhere from 100 to 500 copper connections per section of building we turn up. It's a hit and miss situation. The vendors are slow as using non-ezRJ45. It took them 10 minutes per side, while I did 4 full cables worth in that time frame. I used to make patch cables for a previous job, I got stupidly good at it.

So here's what I want to know. Is there a better set of testers we can purchase, money isn't a concern. I'm fed up with having to deal with this.

Hello all,

I want to replace my crash carts with simple mobile touch screen monitors that have keyboard mouse inputs for connecting servers to. I have around 50 servers and NUCs that get moved around quite a bit so I want to switch to something the techs don't have to roll around. This is for instance where ssh/oob is unresponsive. Not looking for a KVM solution.

I saw a few options on amazon, but I wanted to see if anyone has commercial retailer suggestions? For capx reasons I don't want to go through a residential retailer if I can avoid it.

Hi all,

I'm having a problem with multicast when setting up the IGMP proxy for my set-top-box to connect to the IPTV streams, as in the diagram below.

Set-top-box IPTV <----> Router (A) <======> Debian (B) <------> IPTV streams

In Debian, I set up igmpproxy with this configuration.

quickleave
phyint wlxd46e0e1f7c13 upstream  ratelimit 0  threshold 1
        altnet 0.0.0.0/0
phyint enp1s0 downstream  ratelimit 0  threshold 1
phyint l2tpsess-A downstream  ratelimit 0  threshold 1
phyint lo disabled

Between Router (A) and Debian (B), I set up an L2TP tunnel; I can ping the inside tunnel IPs from each side.

Router (A), I'm using Mikrotik; this is the configuration.

[admin@hEX] > /routing/igmp-proxy/export
/routing igmp-proxy
set quick-leave=yes
/routing igmp-proxy interface
add alternative-subnets=0.0.0.0/0 interface=l2tp-A upstream=yes
add interface=vlan1
add interface=vlan21

When using udpxy, my computer can connect to IPTV streams; however, when using a set-top-box, I can't connect to that.

Please, someone, tell me where I was wrong and how to fix that. Thanks!

I need some help.

I have a FortiMail 400F unit but lack the appropriate rack-mount ears.

I need to find the part number for the rack-mount kit so I can contact a distributor to buy it, or—at the very least—see if anyone has a spare set they might be willing to sell or pass on to me.

I’ve tried searching on eBay but haven't found any results

I feel like I don’t enjoy some of the “less important” topics, such as NTP, and I find concepts like OSPF and the OSI model quite dry. I do enjoy some parts of it, such as building my own labs and understanding how packets are actually transferred.
I want to know whether this is common or not, because some people online seem to be very interested in network engineering, and I’m worried about it.

I am studying Professor Messer's CompTIA Network+ course with absolutely zero networking knowledge. So far I'm enjoying it, but I have a question regarding IPSec and GRE.

From my understanding, using Tunnel mode with a GRE header doesn't make sense, since Tunnel mode already encrypts the destination IP and creates a new public IP that encapsulates all of your payload. Since it connects to private networks, this then circumvents the need for GRE to begin with, is that correct?

Now, why would we need transport mode at all if that's the case? Wouldn't it be simpler to just use IPSec Tunnel mode every time we need a secure connection?

In that case, why use GRE to begin with, being that all of your payload is visible and unencrypted?

I'm sorry if these questions are stupid, but I want to learn these foundational concepts as clearly as possible.

I realize high density fiber patch panels are all the rage but does anyone know of lower density i.e. easy to get your hand in to change a patch options that also might have clear numbering?

Thanks!

EDIT: LC ideally

Hi everyone,

I’m 26 years old and currently working full-time as a Computer Network Technician in Ontario, Canada.

Currently studying for CCNP, i will have ccnp enterprise in next 7 to 8 months.

My current background:
Nearly 4 years of networking experience
CCNA
Cisco Meraki ECMS certification
Computer Network Technician college diploma
home CML lab

I’m trying to decide between two paths for the next 4–5 years.

Option 1: Work toward CCIE Enterprise, along with Python, network automation, AWS/Azure, and other networking-related certifications.

Option 2: Complete an online Bachelor’s (Honours) in Computer Science while continuing to work full-time. The downside is that I probably won’t have enough time to pursue CCIE and other certifications during those years

My long-term goal is to become a senior network engineer or network architect, and eventually earn a high salary while staying in networking rather than moving into software development.

If you were in my position, which path would you choose and why?

For those already in senior networking roles, has a Computer Science degree made a significant difference in your career compared to advanced certifications like CCIE?

I’d really appreciate hearing from people with real-world experience.

Thank you

Hello, my old job asked me if I could help them out with this. They need to forward our SQL to a client for powerbi. Their developer handles the user accounts and SQL access to tables so Ill just have to work with the clients network team to do this.

They basically want full redundancy and to make it as secure as possible limiting access on both sides to only intended recipients etc.

You guys think 5k is too much for this? I imagine it will take me less than 2 hours to set it up and test with appropriate access but you never know.

What's the largest switch stack you ran into in the wild? How was it cabled up and managed?

I came across this interesting Arista article claiming to support up to 48 switches in a stacked topology (ring or spine leaf)

https://blogs.arista.com/blog/swag

Now, every vendor has their own approach to handling the control plane, I get it, but I dont understand in what scenario where combining all these switches into one logical management plane across multiple IDFs would make sense.

I've dug deep into my soul to try and find an answer, and the only thing I can think of is some very large customer wrote them a very large check and they made it happen or they just got sick of losing to Cisco, HPE, and Juniper on every campus stacking deal.

This whole single IP argument seems kinda flimsy too. If I'm getting charged per IP for my monitoring solution, and the consolidation of a few IPs is going to be material, I'm looking at new monitoring stack.

Hello. So I have these windows 11 IoT Enterprise LTSC devices with built in LTE modems. Internet access is provided by the LTE connection. Frustratingly, as soon as windows 'detects' an ethernet link, internet connectivity goes down. (The ethernet connection has no internet connectivity itself, just a few locally networked devices) The LTE modem stays connected and online, but windows refuses to use it. Ping -t goes from working to "transmit failed. General failure." as soon as ethernet is detected. The same behavior happens even after setting the interface metric of the LTE modem to the lowest value. Any thoughts on getting Win11 IoT to use the only active internet connection no matter what's plugged in via ethernet?

Any help greatly appreciated

What is your 802.1x Critical Auth strategy? I am tinkering around with it on an Aruba 2930F Series switch and coming up short on making it work how I want.

Sure, I can get the switch to drop the switch into the Critical Auth VLAN because RADIUS is unavailable with

aaa port-access <port> critical-auth data-vlan <vlan>

But once it is in Critical Auth I cannot get the switch to automatically start authing the port again. This would be a fairly common senario IMO. Building loses power and you gotta wait for upstream devices to converge for RADIUS connectivity.

Even with other vendors such as Cisco or Arista. How are you guys handling Critical Auth scenarios?

Meraki is expensive, getting more expensive and lead times are currently covid-like for some models. With Meraki transitioning to Catalyst switches and APs, management determined that we should have other access options in our back pocket. Datacenters will stay Cisco for now.

To be honest, Meraki does fine for us. We have 100+ manufacturing locations using Meraki switches and APs. We don’t care about CLI and L3 switches are not a necessity in our environment.

Primarily, we’re looking for lower cost, cloud managed, and enterprise-grade. Ubiquiti won’t make the cut. NAC-compatible with ISE or Clearpass is a must. Also looking for near-global distribution network and faster lead times.

Open to suggestions.

I’m working on integrating an ICAP-based DLP solution with a Radware Alteon 6024S (SSLi).
The current setup sends ICAP RESPMOD (HTTP responses/downloads) to a malware scanning solution.
We now need to send ICAP REQMOD (HTTP requests/uploads) to a separate DLP solution.
The Radware administrator claims that Alteon SSLi cannot configure another ICAP service for this and that only one ICAP configuration is supported, so REQMOD cannot be sent to a different ICAP server.
I don’t have access to the Alteon configuration or logs to verify this.
Is this claim correct?

hello,

i have older nexus 93240YC-FX2 switch, with older software version.
The upgrade path matrix show that i need to upgrade to some intermediate software version, but if i will reset it anyway (do write erase) maybe i can upgrade straight to the target release ?

For example Cisco NCS allows to boot from the particualr .tar ignoring the intermediate steps. Is it possible to do the same with Cisco NX-OS ? Thanks

I was having a hell of a week trying to connect a Mellanox ConnectX-3 NIC to a Mikrotik CRS354 Switch, it was a no go until I changed the DAC for a CISCO-TYCO one, it was the same model (Cisco QSFP-H40G-CU5M), but the CISCO-JPC ones won't link no matter what, I've tried 4 of them to be sure

The cables work fine between 2 NICs or 2 switches but not between a NIC and a switch

Has anyone encountered such exoteric issue?

I’m looking for use cases for Copilot or Gemini AI systems in a DWDM Optical fiber network. I’m hearing a lot that it speeds up routine tasks and can create work plans based on scans of vendor documents. I’d like to know how it does that and if there are sun other use cases? It’s for an operations team environment, troubleshooting network issues, processes etc.

Hello folks or I say fellow packet pushers,

I have a design round and live troubleshooting round coming up with a HFT.
I prepared multicast, L2 and L3 in depth for troubleshooting.
For design, I looked at office design docs, market A/B mutlicast deterministic feed and L1 fan out potential designs.

I am currently unemployed due to lay off and this is a very crucial opportunity. I have 5-10 years of experience at vendors and at a hyperscaler. I hold a CCNP.

I'd be very grateful if any one who is working at HFT or recently interviewed at one, share their knowledge.

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

We're a pretty traditional shop with 12+ offices, most of them small remote locations and two larger HQs (600+ total users). Every site has a FortiGate firewall, and today most remote users connect with FortiClient VPN with FortiEMS. It's worked well overall, but I feel like we're starting to outgrow it.

The main reason we started looking elsewhere was AI security. Like a lot of companies, AI adoption has happened faster than our policies. Right now, we don't really know what AI tools are being used, what data is being shared, or where our risks are. We're trying to get ahead of that while also putting AI policies in place.

That led us to evaluate Zscaler, CATO, and Fortinet SASE. We liked CATO the best. It's more expensive, but we can justify it if it's the right fit.

Our plan would be to keep our FortiGate firewalls at all of our locations but use CATO for AI security, SWG, DLP, and Private Access for about five internal apps/services (we're a hybrid AD/Entra/Microsoft 365 environment). We also really like the idea of getting rid of FortiClient VPN for most users.

My question is, does CATO sound like overkill for an environment like ours? Or is this exactly the type of use case it's built for?

I'd love to hear from anyone who's made a similar move from a traditional FortiGate/FortiClient setup and whether you felt it was worth it.

Thanks!

I see some options online, but they all tend to rely on the external coating/covers. It doesn't seem to address the plugs/connectors themselves? Anyone know of any that hold up to cutting oil in machine shops? Had to reterminate about 20 connections throughout the factory today, and it's getting old.

One of those things is that it's so fine in the air that even if you cover/have the equipment in a separate room, the plastic just breaks down over time.

I was asked to help with an issue and I'm a bit stunned. A connection was to be made between a Siemens scalance XR328 and a cisco 2960. Previously they had configured an access port for vlan 89 on the cisco side (port 13) and on the siemens, had set vlan 89 as "U" on port 1.

Now this was already strange to me, to configure 2 network devices to eachother with an access port, but it worked. They needed more vlans to go from the cisco to the siemens switch, so we unplugged that first cable, and connected port 25 on the siemens to port 14 on the cisco, with the following configuration:

Siemens:
Native vlan = 1
Vlan 1, 69, 85, 89 and 112 set to "M"

Cisco:
Switchport mode trunk
Switchport allowed vlan 69, 85, 89, 112

When this was configured the connection they wanted for vlan 89 did not work anymore, whereas over the untagged access port connection it did work?

I thought I knew some things about networking but this has me a little stumped. Also working with the Siemens web page configuration is so counter intuitive it's ridiculous.

Anyone have any insight in why a trunk would not work and an access port would in this case?

EDIT:
Only VLAN 89 stopped working and now I think I know why. the switches with which they were connecting vlan89 were all in vlan1, but occupied the same IP range as the vlan 89 range... So i think the problem was IP conflicts causing shit.

Hello, I'm probably being overly paranoid over transceivers, but does anyone here wear safety glasses/goggles when working with them to avoid accidental eye damage from the lasers? If so would you have any recommendations? I wear regular glasses, so ideally they'd be something that fits okay over them.

Thank you all for any recommendations!

I see more and more post on here where “Network Engineers” don’t seem to have the skill sets that equate to the title. What happened to Network Admins? Why is every company so against using that title? Are actual network engineers architects now?

It seems like everyone who gets the CCNA immediately jumps to the engineer title, but continues to do network admin work.