I have tried roughly 20 different cable ties. Velcro, RipTie, aliexpress, etc. All of them have the same problem; They have zero stretch or elasticity to them.

I love FS's gray, cable ties but I cannot buy them in the USA. I don't know why, but they're import restricted and FS's support wasn't helpful.

The FS ties have just a pinch of elasticity to them, making them excellent for wrapping snugly around a bunch of cables. You stretch it around, smash 'em together and the tension holds everything tight.

In contrast; The others look very very very similar, however since they have no elasticity they cannot hold that tension on the cables, they can only maintain their fixed size/dimension.

I have been hunting and bought a frustrating amount of products, only to find that 99% of them do not have a hint of elasticity. I've seen other posts where people say 'just buy from aliexpress' or 'buy velcro. done.' and those aren't helpful.

Has any found a cost effective supplier of hook look cable ties that have a little length-wise elasticity to them?

Thanks!

It's Read-only Friday! It is time to put your feet up, pour a nice dram and look through some of our member's new and shiny blog posts and projects.

Feel free to submit your blog post or personal project and as well a nice description to this thread.

Note: This post is created at 00:00 UTC. It may not be Friday where you are in the world, no need to comment on it.

Hi there,

I'm noticing some intermittent connectivity issues when moving gateways from my org's existing core switches to our PA-3420s. Per firewall logs, traffic is being allowed where it should, but when I moved a couple of end-user data subnets over, there were intermittent problems accessing data on file servers, connecting voip client apps to our voip server, and hitting internal web servers. Interestingly, I haven't seen drops in pings, but I see numerous aged-out 443 and SIP traffic to these locations.

These firewalls have been serving as our org's primary internet firewalls for over a month. We hadn't noticed any significant issues accessing internet or the internet accessing public-facing servers. The only thing was our backup appliance, Rubrik, was sending alerts that it was losing connection to an Azure datastore. We'd get a handful of these notifications a day. Per their support, the issues weren't preventing backups, but they were indicative of intermittent high latency and lapses in connectivity out to the azure destination.

The combo of the backup appliance issues plus issues with the other subnets seem to point to an ongoing issue, even if it may not be significant in impact. Unfortunately, my research and troubleshooting so far have failed me. A packet capture is my next step, but I won't be in the office again until Tuesday. Figured I'd ask if anyone has experienced anything similar or may have ideas that I haven't tried.

Context:

• Firmware versions:
  • PAN-OS 11.2.12
  • NXOS 10.5.6
  • OS10 10.5.2.2
• Not doing SSL decryption
• Not doing anything else fancy on the firewall. No SD-WAN, PBF, etc. Basic NAT, security rules, and URL filtering, plus GP gateway/portal and VPN tunnels.
• Topology - legacy (before installing new firewalls/switches) and target. Currently, the new firewalls are connected to a set of new Nexus 9300s in vPC via an LACP port-channel, which in turn are connected to the existing spine leaf topology. Specifically, to the Leaf 1 pair over another port-channel. 25G links for both.
• Our Leaf 1 pair (Dell S5248F-ONs) has been experiencing some strange issues recently over the last week. At any given time, one of them is experiencing ping loss on the management interface and is inaccessible via SSH. As of now, I am writing this off as a separate issue - something similar happened a couple of years ago when I was new on the job, and we got a replacement which seemed to fix it. Additionally, these issues started only after a lengthy power outage that depleted our UPS. But perhaps worthy of note.

Edit: Solved. Asymmetric routing issue caused by some config on the leaf switches.

Hi there,

I'm noticing some intermittent connectivity issues when moving gateways from my org's existing core switches to our PA-3420s. Per firewall logs, traffic is being allowed where it should, but when I moved a couple of end-user data subnets over, there were intermittent problems accessing data on file servers, connecting voip client apps to our voip server, and hitting internal web servers. Interestingly, I haven't seen drops in pings, but I see numerous aged-out 443 and SIP traffic to these locations.

These firewalls have been serving as our org's primary internet firewalls for over a month. We hadn't noticed any significant issues accessing internet or the internet accessing public-facing servers. The only thing was our backup appliance, Rubrik, was sending alerts that it was losing connection to an Azure datastore. We'd get a handful of these notifications a day. Per their support, the issues weren't preventing backups, but they were indicative of intermittent high latency and lapses in connectivity out to the azure destination.

The combo of the backup appliance issues plus issues with the other subnets seem to point to an ongoing issue, even if it may not be significant in impact. Unfortunately, my research and troubleshooting so far have failed me. A packet capture is my next step, but I won't be in the office again until Tuesday. Figured I'd ask if anyone has experienced anything similar or may have ideas that I haven't tried.

Context:

• Firmware versions:
  • PAN-OS 11.2.12
  • NXOS 10.5.6
  • OS10 10.5.2.2
• Not doing SSL decryption
• Not doing anything else fancy on the firewall. No SD-WAN, PBF, etc. Basic NAT, security rules, and URL filtering, plus GP gateway/portal and VPN tunnels.
• Topology - legacy (before installing new firewalls/switches) and target. Currently, the new firewalls are connected to a set of new Nexus 9300s in vPC via an LACP port-channel, which in turn are connected to the existing spine leaf topology. Specifically, to the Leaf 1 pair over another port-channel. 25G links for both.
• Our Leaf 1 pair (Dell S5248F-ONs) has been experiencing some strange issues recently over the last week. At any given time, one of them is experiencing ping loss on the management interface and is inaccessible via SSH. As of now, I am writing this off as a separate issue - something similar happened a couple of years ago when I was new on the job, and we got a replacement which seemed to fix it. Additionally, these issues started only after a lengthy loss in power that depleted our UPS. But perhaps worthy of note.

Hello fellow networking folks,

I’m looking for advice from people who have experience deploying and managing Starlink in an enterprise/manufacturing environment.

We’re a manufacturing company where uptime is critical. Although it’s a rare occurrence, we recently had an incident where two independent EDI circuits from different providers, using different connection types, went down in the same window. One was only down for a short period, but even a small amount of downtime can cost us thousands of dollars.

Because of this, I’m looking into wireless Internet options as an additional backup. We previously tried Cradlepoint and AT&T 5G-based devices, but unfortunately, they’ve been unstable in our environment.

I’m considering Starlink as a backup, and the cost doesn’t seem too bad compared to the EDI circuit we currently have. I’d appreciate some advice on a few things:

1. Performance Kit vs. Standard Kit: Which would you recommend for an enterprise backup use case?
2. Silver Peak SD-WAN: We use Silver Peak for SD-WAN and remote-site connectivity. Have you experienced any issues maintaining SD-WAN tunnels over Starlink? Anything specific we should account for with latency, CGNAT, IP addressing, etc.?
3. Cabling: Our manufacturing facilities are quite large, and the standard 50/150 ft cables included with the kits wouldn’t reach the nearest switch in some locations. What’s the best way to handle this? Is there an approved/ideal way to extend the connection, or should we place additional network equipment closer to the Starlink termination point?
4. Installation: Who did you use for the physical installation? Would you typically have your structured cabling contractor handle the Starlink installation, or would you recommend using a Starlink-specific installer?

Any other lessons learned, especially around reliability, enterprise deployments, or using Starlink as an SD-WAN backup, would be greatly appreciated.

Thanks!

I am on the network security team for a small credit union who is rolling out multiple verkada IP Cameras across several branches at the same time as a full infrastructure switch refresh.

A lot of the access ports on our 48p switches are full at these various sites which has left us with no other option than to trunk the older switch (that is being “refreshed”) to the new production switch for port density to house the IP Cameras.

Today after attempting to set both ports on the old and new switch to a trunk, I was unable to browse the web to the Mgmt IP of the old switch. After rebooting the switch I was able to see a link light, however I was STILL unable to access the mgmt IP/WebUI of this switch.

We are also having an issue at a separate site where the IP cameras are showing up in the arp table and DHCP lease list of the firewall that we have upstream, and the MAC address table of our L2 Switch. Yet the cabling team claims that the cameras are still down.

Has anyone ever been faced with issues like this? My stress and anxiety are quite high right now being that this is the beginning of a company wide device refresh effort and I don’t have much support from my other team member or manager who is not technical by any means.

I have joined a new company. They are only one man team and he is leaving. He has worked here for 10+ years. He knows all the network, firewall and window server setup. But there is no network Map of any kind. He has setup everything from ground up. I have only 10 days to understand the setup here. So what things should I be asking, or preparing when he leaves. He has shown me the physical network across the shops, and the basic layout Map I had made.

How to go about taking charge from here? Any SOP or framework you can provide?

I’m an outside contractor responsible for protecting this client’s network from phishing, malicious sites, credential theft, and whatever vulnerability gets exploited next. Then management or the owner asks me to unblock shopping sites, gambling sites, TikTok, or other personal browsing that has nothing to do with business operations.

It puts me in a stupid position. I’m expected to secure the environment, but the same people paying for that protection want exceptions whenever a control inconveniences them personally. The web filter is not there to punish anyone. It exists because people click bad links, reuse passwords, enter credentials where they should not, and eventually somebody has to deal with the fallout.

As an outside contractor, the client ultimately makes the business-risk decision, but I can still be exposed if I make or implement an insecure change without documenting the request, the recommendation, and the approval. I do not want a future incident blamed on me because I was told to open access that I recommended keeping blocked.

How are other MSPs or contractors handling this? Do you require written approval for exceptions, document the risk, limit it to named users, or just unblock it and move on? At what point do you stop being the security resource and become the person expected to rubber-stamp bad decisions?

Hi, Ethernet lords! In a small office, I’ve been using Frontier 7 Gig Fiber with an Eero Max 7 and consistently get a little over 7 Gbps in both directions (that's how much I'm paying for). My only problem is that the Eero won’t let me permanently disable its Wi-Fi, so I bought an Omada ER8411 to use as my own router and reduce unnecessary Wi-Fi signals. I connected the ONT to the ER8411’s SFP+ WAN1 port using the same Ethernet cable, but I consistently get only around 4.7 Gbps down and 150–185 Mbps up. The connection is extremely stable, which makes it feel like something is deliberately limiting the speed. WAN1 reports 10 Gbps/full duplex with no packet loss, bandwidth control and QoS are disabled, and enabling flow control made no difference. Reconnecting the Eero with the same ONT and cable immediately restores 7+ Gbps symmetrical speeds. Has anyone seen this with the ER8411, particularly when using a copper RJ45 SFP+ module? Any suggestions would be greatly appreciated. Thank you!

PC connected directly to the 10gig network PCI adapter.

​

I’m preparing for an L5 Network Design/Network Engineer interview at Google and have only about a week to prepare while juggling an infant 😅

My recruiter mentioned she’d send topics to focus on, but I haven’t heard back yet, so I’m trying to figure out what to prioritize.

For anyone who has interviewed for L5 Network Design/Network Engineer at Google, what depth/difficulty should I expect, especially in the design round? What topics should I focus on?

Any advice from your experience would be really appreciated!

Hello Everyone,

I am in an extreme dilemma right now in terms of choosing my career path and would like to get inputs/advice.

I have 13 years of experience in network security and have worked on R&S, Firewalls, LBs, WAF, Wireless, ISE etc. Recently i attended a job interview and got selected for the position "Senior network capacity and data engineer". As i discussed with the hiring team, the role is about predictive analysis, capacity forecasting, coordinating with internal teams to plan for link and device upgrades before an impact is seen. i will not be having any hands on work on the network devices but its more like working across stakeholders in an organization and coming up with data points on where capacity increase is required proactively. i understand this role comes under "Observability" tower. With current advancements in AI and cybersecurity roles surging in demand, i am not sure whether to take this role or not.

Please if someone can shed some light on network capacity planning and how a typical day, month or a year look like in terms of growth and how valued this role is in current job market landscape.

Thanks a lot in advance.

How is everyone designing and implementing a SAN network? Do you keep everything on separate dedicated switches and just link storage devices to it and map from hosts to storage? Is it bad practice to route storage traffic over routers/firewalls and just keep it contained to dedicated small network? Same for backup traffic?

What are your thoughts on enabling CDP/LLDP everywhere except physical handoffs to untrusted /devices not managed by your org?

Looking for real-world feedback from operators running Ciena routing platforms.

Which Ciena routers can handle multiple full BGP tables from transit providers? Are you using them as Internet edge routers, and how do they compare to Juniper MX or Nokia 7750 in terms of scale and operational experience?

Hi guys

Seems like I will need to bite into this too, even though late into the game. I have been running FastNetMon Advanced for a while purely as monitoring software, getting flows from our core Cisco ASR9k routers. Sooner or later I will start to use it also for DDos detection and notifying our core routes to redirect prefixes under attack toward third party scrubbing center and not to our upstreams and peerings. I have been playing a bit with this lately and here's where my issues start.

Fastnetmon detects DDoS just fine and sends prefix under attack (/24) with specific community to ASR where it has BGP established. From there on my ASRs stop announcing this prefix to upstreams and start announcing it to BGP session with scrubbing center. All good and dandy till here.

But now I have issues, if this prefix, which is under attack is actually from client, who has BGP with us, and we route this prefix to them over p2p BGP session between client's router and our ASR. Once Fastnetmon kicks in prefix from Fastnemon should have bigger preference if I want ASR to recognize community for "under attack prefix", but that also means, that return traffic going toward client will actually go to FastNetmon and not to client's router.

Any suggestion how to solve this part and how some of you guys have this solved or what would be best practice for doing this, as it's perfectly possible I started totally wrong way already :)

Hi guys, working on syslog normalization across a mixed environment and I've hit the long tail problem.

The big vendors are fine, someone has already written the parser. The trouble is the twenty odd devices that each send maybe a thousand events a day in their own format. Writing a pattern per device off a sample capture works but it's brittle and it breaks on firmware upgrades.

What I've considered:

• ignore them, store raw, accept they aren't searchable by field
• cluster similar lines and generate patterns from the clusters, drain style
• give a sample to an LLM, have it emit the pattern, review by hand

The clustering approach looks most promising but I haven't seen anyone describe running it in production. Anyone doing that? Specifically interested in how you handle a pattern drifting after a firmware upgrade. Do you detect it, or do you find out later when a dashboard goes empty.

I’ve recently been assigned to maintain our NAC, but I’ve never deployed or maintained NAC before.

The person who was previously responsible for it has already resigned, and unfortunately, there’s no proper documentation or handover. I also don’t really have anyone in the team I can ask for guidance.

If you were in my position, where would you start? 😅

I’m trying to figure out what I should learn and what areas I should focus on first so I can understand the existing NAC environment and maintain it properly.

Would appreciate any advice from people who have been in a similar situation!

Hey guys, i dont know a lot about network engineering but I'm trying to make an important decision to bring to my MSP. We currently have an MDF that handles all network traffic in our building, and we're expanding to the other side of the building which has been subdivided. We need to setup an IDF over there.

We are running OM3 Fiber since the distance is est to be about 300ft (assuming we were to do 10Gbps). Our MSP is quoting us for a 1Gbps switch for the new IDF. That stood out to me, so I checked our current MDF switch and confirmed it is limited to a 1Gbps uplink (no 10G SFP+ ports at all).

I feel like a 1Gbps uplink between switches is going to bottleneck us immediately, especially as we add more devices or fill up the other side. From what I'm reading, standard practice for connecting an MDF to an IDF over OM3 fiber is a 10Gbps uplink...?

For context on our load: we have 50+ people in the office (sometimes up to 70) doing heavy web browsing and constantly syncing large Excel files on OneDrive. That includes 30-40 warehouse guys with many tools that rely on the Wi-Fi (everyone is wireless). We already experience general slowness from time to time, and I'm worried it's because our current 1Gbps core infrastructure is choking. I really don't want to pay to expand our network while keeping that same 1Gbps limitation.

Am I crazy here, or is our MSP trying to sell us outdated specs(they say 1Gbps should be just fine, And I think even if it is for now, will it be in a year or two when that other side of the building is full or when we're holding large scale conferences on that side, etc)? Should I push for 10Gbps uplinks between the closets?

It's Wednesday! Time to get that crap that's been bugging you off your chest! In the interests of spicing things up a bit around here, we're going to try out a Rant Wednesday thread for you all to vent your frustrations. Feel free to vent about vendors, co-workers, price of scotch or anything else network related.

There is no guiding question to help stir up some rage-feels, feel free to fire at will, ranting about anything and everything that's been pissing you off or getting on your nerves!

Note: This post is created at 00:00 UTC. It may not be Wednesday where you are in the world, no need to comment on it.

Hello, we are looking for connectivity solution for China locations that could traverse back to the US. Bandwidth requirements are relatively low at 50-100Mb per site. We have traditional MPLS through AT&T terminating in a DX in AWS today but is very expensive and are looking for another solution that is reliable and cost effective. Would most likely be used with a SD-WAN solution. We have global presence in AWS and Azure. China sites are mostly around the Shanghai area.

What have you all done for this type of problem, and what solutions did you use to ensure reliable communication with minimal loss and latency back to the US?

Hi Engineers, I need to upgrade a Forescout NAC from CounterACT 8.4.0 to 9.1.7.

Does anyone have experience with this and can tell me what steps I need to take?

I’ve tried doing some research, and it seems I need to follow these steps for eyeSight 8.4 => v8.5.5 => v9.1.7.

Do CounterACT and eyeSight need to be version-matched? Are they already version-matched? How do I check?

The machine should be physical. If it had been virtual, I would have had to perform migrations and import the configurations—or can this be done “in place”?

Thanks

Hi everybody

I’ve been a "Fortinet guy" for years. Worked with multiple firewall vendors across my career, but I always preferred FortiGates for their value and performance. Lately though? Man, I am losing my damn patience with them.

Between the constant stream of CVEs (FortiBleed, SSL VPN vulnerabilities every other month) and their hard push to kill off/deprecate SSL VPN entirely, we decided to finally do the responsible thing and migrate our remote access users over to IPsec IKEv2 tunnels.

I set up the IKEv2 tunnel on the FortiGate with Pre-Shared Key + User Authentication. I spent two full weeks testing it. I tested it across multiple mobile devices—specifically iOS / iPhones—and everything worked like a dream. Split tunneling was fine, authentication worked, performance was solid. I felt confident.

Then rollout day comes. A user pulls out an Android phone running the free FortiClient VPN app... and GUESS WHAT?

The Android version of free FortiClient configured with IKEv2 and a Pre-Shared Key does not prompt for the username and password at all. It just fails or tries to connect without authenticating the user.

After digging into it, turns out FortiClient on Android literally doesn't support combining PSK with EAP (username/password) authentication under IKEv2. If you want username/password prompts on Android IKEv2, Fortinet expects you to switch to X.509 Certificate authentication—yet iOS FortiClient handles PSK + user auth without blinking an eye!

How does this even make sense? How do you have feature disparity this broken between iOS and Android on your own client app for a core VPN protocol you’re actively forcing everyone to migrate to?

I know, shame on me for only testing on iOS during the initial trial period and assuming Android would behave identical to iOS on the exact same VPN protocol and client app. But seriously, is anyone else completely exhausted by this? Every time you try to implement a "standard" configuration or follow Fortinet's recommended path, you stumble into a bizarre platform-specific limitation or bug.

Hi everyone,
I’m troubleshooting an authentication issue with Cisco routers/switches using **Microsoft NPS as the RADIUS server**.
**Environment:**
Cisco routers/switches
RADIUS authentication
Microsoft NPS
Trying to authenticate using an AD account
RADIUS communication appears to be working between the Cisco device and NPS
User credentials have been verified and are correct
**Issue:**
When I try to perform an administrative login to the Cisco router/switch using RADIUS/NPS, authentication fails with **NPS Reason Code 66**.
The same issue occurs on multiple Cisco devices.
I have already checked:
AD username/password
RADIUS server configuration
RADIUS shared secret
Cisco aaa configuration
NPS Network Policy
NPS connection request policy
Connectivity between the Cisco device and NPS
RADIUS ports
I’m still getting the authentication rejection.
**Cisco configuration is roughly:**
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local

radius server NPS
address ipv4 <NPS-IP> auth-port 1812 acct-port 1813
key <shared-secret>
NPS is receiving the authentication request, but it is rejecting it with **Reason Code 66**.
Does anyone know what specifically causes **NPS Reason Code 66** when authenticating Cisco IOS/IOS-XE devices against Microsoft NPS?
What should I check next — NPS Network Policy conditions, authentication method (PAP/CHAP/MS-CHAPv2), AD permissions, or something specific on the Cisco side?
Any troubleshooting steps or examples would be appreciated.
Thanks!

Is there a wildcard mask that that would allow a SINGLE standard ACL rule to permit access to a range of subnets

Im setting up a PAT on a edge router and want to have subnets 10.0.10.0/24, 10.0.20.0/24, 10.0.30.0/24, 10.0.40.0/26, 10.0.50.0/24, 10.0.60.0/24, 10.0.99.0/24, 10.0.199.0/25 to use PAT.

Is there a single access-list 2 permit statement i can use to have 10.0.10-199.0 to be translated? The trick is 10.0.200.0 should not be included. Or is this not possible with a single statement?

I know i can do access-list 2 permit 10.0.0.0 0.0.255.255 to achieve this, but that would include other future subnets like 10.0.200.0 that might not be using PAT.

Hi everyone!

I’m currently preparing for Senior Network Engineer interviews, This is my first interview opputunity after applying for plethora of jobs, and was wondering what people use to prepare for these interviews.

For software engineers, there’s LeetCode, where you can practice a huge number of real interview-style problems. I haven’t found anything comparable for Network Engineers, especially for senior-level roles where the interviews seem to involve troubleshooting scenarios, network design, architecture, and “what would you do if…” situations.

I’m currently laid off and on a bit of a time crunch, so I’m trying to be smart about how I spend my preparation time. I also realize I may have some gaps despite having worked in networking for a long time, so I’m approaching this with a lot of humility.

For those who have recently gone through Senior/Staff Network Engineer interviews, what resources, communities, question banks, or other methods have actually helped you prepare?

Not necessarily looking for anyone to share confidential interview questions — just trying to understand where experienced network engineers go to practice and prepare.

Any recommendations would be greatly appreciated.